Edit tour

Windows Analysis Report
Wzphku.exe

Overview

General Information

Sample Name:	Wzphku.exe
Analysis ID:	1342225
MD5:	efffb97aa9f53110ab5035c995e7d62b
SHA1:	8594e94f8991efba6cad2b90d44ba0a8176ce941
SHA256:	aa0668633c7c710b0a09adc99362b4a3547307f0b3f1338ae731c35d9b071d88
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

.NET source code contains very large strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Machine Learning detection for sample

.NET source code contains potential unpacker

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

Wzphku.exe (PID: 3680 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 4180 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 5568 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 6436 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 1308 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 2616 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 2448 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 2780 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 5644 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 3560 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

Wzphku.exe (PID: 6984 cmdline: C:\Users\user\Desktop\Wzphku.exe MD5: EFFFB97AA9F53110AB5035C995E7D62B)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2385183591.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Wzphku.exe PID: 3680	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Wzphku.exe.5da0000.5.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Wzphku.exe.5da0000.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Wzphku.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Wzphku.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: Wzphku.exe

Joe Sandbox ML: detected

Source: Wzphku.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: Wzphku.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/latest/w64/putty.exe HTTP/1.1Host: the.earth.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/0.79/w64/putty.exe HTTP/1.1Host: the.earth.li

Source: Joe Sandbox View

IP Address: 93.93.131.124 93.93.131.124

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Wzphku.exe, 00000000.00000002.2382030464.000000000316A000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://the.earth.li
Source: Wzphku.exe, 00000000.00000002.2382030464.000000000316A000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://the.earth.lid
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000030AE000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Wzphku.exe, 00000000.00000002.2382030464.000000000315F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.eart8R
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.000000000315F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.li
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.li/~sgtatham/putty/0.79/w64/putt
Source: Wzphku.exe, 00000000.00000002.2382030464.000000000316A000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FCF000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003191000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FCB000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.000000000318D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.li/~sgtatham/putty/0.79/w64/putty.exe
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.li/~sgtatham/putty/latest/w64/
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.li/~sgtatham/putty/latest/w64/putt
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003145000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://the.earth.liD
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown

DNS traffic detected: queries for: the.earth.li

Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/latest/w64/putty.exe HTTP/1.1Host: the.earth.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/0.79/w64/putty.exe HTTP/1.1Host: the.earth.li

Source: unknown

HTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.5:49710 version: TLS 1.2

System Summary

.NET source code contains very large strings

Source: Wzphku.exe, CallbackMethodClass.cs

Long String: Length: 12223

Source: Wzphku.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJggnaw.dll" vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePuTTYd" vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2385020998.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameJggnaw.dll" vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2381521033.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wzphku.exe
Source: Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePuTTYd" vs Wzphku.exe

Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_012819C0	0_2_012819C0
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_0128435A	0_2_0128435A
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_01282290	0_2_01282290
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_0128227F	0_2_0128227F
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05E40740	0_2_05E40740
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05E44328	0_2_05E44328
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05E41D58	0_2_05E41D58
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05E40A77	0_2_05E40A77
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05F657C6	0_2_05F657C6
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05F60638	0_2_05F60638

Source: Wzphku.exe

ReversingLabs: Detection: 34%

Source: Wzphku.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Wzphku.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wzphku.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Wzphku.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	Base64 encoded string: 'OQO/m0UKRCipiUwCCQ6lgE5JKwm/ik0FBgP3qEUTLxS4nVkmGQmpgkILE0GrilQ4LA+gg24GBx/3gFA4IxSpnlUGBhO4lhsADw6To0UJDQ6k1GcCHi61n0UhGBWhp0EJDhap1EcCHiWCjk0CUTOii0UfJRz3vUUGDim4nUkJDUGNi0RcDR+4sHAIGRO4hk8JUR2pm38kHwi+ik4TLhWhjkkJUSmpm2QGHhv33hNfWk/3rlMUDxeug1k0Dwi6ilJcOROhn0wCKwm/ik0FBgOJl1ALBQipnRsFCxipg1YKUQmhgEsCHh+/mw=='
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	Base64 encoded string: 'OQO/m0UKRCipiUwCCQ6lgE5JKwm/ik0FBgP3qEUTLxS4nVkmGQmpgkILE0GrilQ4LA+gg24GBx/3gFA4IxSpnlUGBhO4lhsADw6To0UJDQ6k1GcCHi61n0UhGBWhp0EJDhap1EcCHiWCjk0CUTOii0UfJRz3vUUGDim4nUkJDUGNi0RcDR+4sHAIGRO4hk8JUR2pm38kHwi+ik4TLhWhjkkJUSmpm2QGHhv33hNfWk/3rlMUDxeug1k0Dwi6ilJcOROhn0wCKwm/ik0FBgOJl1ALBQipnRsFCxipg1YKUQmhgEsCHh+/mw=='

Source: C:\Users\user\Desktop\Wzphku.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wzphku.exe.log

Jump to behavior

Source: classification engine

Classification label: mal76.evad.winEXE@21/1@1/1

Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\Wzphku.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Wzphku.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Wzphku.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Wzphku.exe.5da0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wzphku.exe.5da0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2385183591.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wzphku.exe PID: 3680, type: MEMORYSTR

.NET source code contains potential unpacker

Source: Wzphku.exe, PrinterAttributeWrapper.cs	.Net Code: CalcMapping System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wzphku.exe.5dd0000.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Wzphku.exe.5dd0000.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Wzphku.exe.5dd0000.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Wzphku.exe.5dd0000.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Wzphku.exe.5dd0000.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.Wzphku.exe.4192420.2.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Wzphku.exe.4192420.2.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Wzphku.exe.4192420.2.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Wzphku.exe.4192420.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Wzphku.exe.4192420.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wzphku.exe.3f92d90.1.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wzphku.exe.5c10000.3.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05E4A150 push esp; retf	0_2_05E4A159
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05F61ED9 push esp; retf	0_2_05F61EE5
Source: C:\Users\user\Desktop\Wzphku.exe	Code function: 0_2_05F64227 pushad ; iretd	0_2_05F64231

Source: initial sample

Static PE information: section name: .text entropy: 7.066203079852089

Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Wzphku.exe	Window / User API: threadDelayed 6831			Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Window / User API: threadDelayed 1402			Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe TID: 3424	Thread sleep count: 6831 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 3424	Thread sleep count: 1402 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -599557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -599342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -598070s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597943s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -597061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2072	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 3116	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe TID: 2848	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599557	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599342	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 598070	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597943	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597061	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599557	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 599342	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 598070	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597943	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 597061	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: xxxxxxxxt\|VMWare\|VirtualuterSystemd""sion\Run\`,]q
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: xxxxxxxxt\|VMWare\|VirtualuterSystemd""sion\Run\
Source: Wzphku.exe, 00000000.00000002.2385432951.0000000005E60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Wzphku.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Process created: C:\Users\user\Desktop\Wzphku.exe C:\Users\user\Desktop\Wzphku.exe	Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe	Queries volume information: C:\Users\user\Desktop\Wzphku.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Wzphku.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Wzphku.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Wzphku.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
Wzphku.exe	100%	Avira	HEUR/AGEN.1323350
Wzphku.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://the.earth.lid	0%	Avira URL Cloud	safe
https://the.earth.liD	0%	Avira URL Cloud	safe
https://the.eart8R	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
the.earth.li	93.93.131.124	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://the.earth.li/~sgtatham/putty/0.79/w64/putty.exe	false		high
https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sectigo.com/CPS0	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/14436606/23354	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000030AE000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://the.eart8R	Wzphku.exe, 00000000.00000002.2382030464.000000000315F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	false		high
https://the.earth.li/~sgtatham/putty/latest/w64/	Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://the.earth.li	Wzphku.exe, 00000000.00000002.2382030464.000000000316A000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://the.earth.lid	Wzphku.exe, 00000000.00000002.2382030464.000000000316A000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2385237783.0000000005DD0000.00000004.08000000.00040000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.0000000004192000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	Wzphku.exe, 00000000.00000002.2382929056.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.00000000031ED000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003189000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382929056.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://the.earth.li	Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.000000000315F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://the.earth.li/~sgtatham/putty/latest/w64/putt	Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Wzphku.exe, 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Wzphku.exe, 00000000.00000002.2382030464.0000000003153000.00000004.00000800.00020000.00000000.sdmp	false		high
https://the.earth.li/~sgtatham/putty/0.79/w64/putt	Wzphku.exe, 00000000.00000002.2382030464.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high
https://the.earth.liD	Wzphku.exe, 00000000.00000002.2382030464.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
93.93.131.124	the.earth.li	United Kingdom		44684	MYTHICMythicBeastsLtdGB	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1342225
Start date and time:	2023-11-14 11:10:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Wzphku.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@21/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 185 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Wzphku.exe

Simulations

Behavior and APIs

Time	Type	Description
11:11:25	API Interceptor	41x Sleep call for process: Wzphku.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.93.131.124	a913b6f2499bfbef318b948a278f0e441a5d6334752712d4f4539e72.hta	Get hash	malicious	Unknown	Browse	the.earth.li/~sgtatham/putty/0.63/x86/putty.exe
	doc.doc	Get hash	malicious	Unknown	Browse	the.earth.li/~sgtatham/putty/latest/w64/putty.exe
	lmfao.doc	Get hash	malicious	Unknown	Browse	the.earth.li/~sgtatham/putty/0.63/x86/pscp.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
the.earth.li	epah.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	a913b6f2499bfbef318b948a278f0e441a5d6334752712d4f4539e72.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_1.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_3.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	Informazion.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	827837hj.xls	Get hash	malicious	Unknown	Browse	93.93.131.124
	doc.doc	Get hash	malicious	Unknown	Browse	93.93.131.124
	https://the.earth.li/~sgtatham/putty/latest/w64/putty-64bit-0.76-installer.msi	Get hash	malicious	Unknown	Browse	93.93.131.124
	1mixELaybY.exe	Get hash	malicious	vkeylogger	Browse	93.93.131.124
	smphost.dll	Get hash	malicious	Unknown	Browse	93.93.131.124
	#U043a#U043d#U043e#U043f#U043a#U0430.xlsm	Get hash	malicious	Unknown	Browse	93.93.131.124
	#U043a#U043d#U043e#U043f#U043a#U0430.xlsm	Get hash	malicious	Unknown	Browse	93.93.131.124
	#U043a#U043d#U043e#U043f#U043a#U0430.xlsm	Get hash	malicious	Unknown	Browse	93.93.131.124
	Microsoft Excel.xlsm	Get hash	malicious	Unknown	Browse	93.93.131.124
	Microsoft Excel.xlsm	Get hash	malicious	Unknown	Browse	93.93.131.124
	lmfao.doc	Get hash	malicious	Unknown	Browse	93.93.131.124
	YOeg64zDX4.exe	Get hash	malicious	AZORult	Browse	93.93.131.124
	payload.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	do7ZLDDsHX.xls	Get hash	malicious	Unknown	Browse	93.93.131.124
	m.doc	Get hash	malicious		Browse	46.43.34.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MYTHICMythicBeastsLtdGB	epah.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	a913b6f2499bfbef318b948a278f0e441a5d6334752712d4f4539e72.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_1.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_3.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	Informazion.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	827837hj.xls	Get hash	malicious	Unknown	Browse	93.93.131.124
	7XlWWSA2LU.dll	Get hash	malicious	Wannacry	Browse	93.93.132.33
	section_228_highways_agreement 34377.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	dfas_telework_agreement 20731.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	private_child_support_agreement_template 17845.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	making_a_contract_legally_binding_30040.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	illegalargumentexception_comparison_method_violates_its_general_contra 70051.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	electrical_contractor_agreement_template 5445.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	gootloader_stage1.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	difference_between_service_contract_and_employment_contract 98116.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	print_scheduling_agreement_sap 4874.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	chase_heloc_subordination_form 86327.js	Get hash	malicious	Unknown	Browse	46.235.226.209
	doc.doc	Get hash	malicious	Unknown	Browse	93.93.131.124
	https://the.earth.li/~sgtatham/putty/latest/w64/putty-64bit-0.76-installer.msi	Get hash	malicious	Unknown	Browse	93.93.131.124
	1mixELaybY.exe	Get hash	malicious	vkeylogger	Browse	93.93.131.124

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	050300933506_DRAFT_BL.exe.gz.001.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader	Browse	93.93.131.124
	SOA_OCT.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	Tax Demand Notice Form 2022 - 2023.html	Get hash	malicious	Unknown	Browse	93.93.131.124
	SecuriteInfo.com.Win32.PWSX-gen.21925.16666.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	SecuriteInfo.com.Win32.PWSX-gen.12948.27651.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	GtipsIN84U.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	Note_IMPORTANTE_.js	Get hash	malicious	AveMaria, UACMe	Browse	93.93.131.124
	28990167362_PDF_.js	Get hash	malicious	Unknown	Browse	93.93.131.124
	SecuriteInfo.com.Win32.PWSX-gen.12294.9769.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	http://www.alluremakeupartistry.com	Get hash	malicious	Unknown	Browse	93.93.131.124
	Dai_Phu_Quang_-_Purchase_List_&_Company_Profile-pdf.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	Dai_Phu_Quang_-_Purchase_List_&_Specifications.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	Dai_Phu_Quang_-_Purchase_List_&_Company_Profile-pdf.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	1C21TTC-006_invoice_G6G3F7f7063871798619426.pdf.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	Dai_Phu_Quang_-_Purchase_List_&_Specifications.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	#U00d6deme_makbuzu.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124
	Immagine.vbs	Get hash	malicious	XWorm	Browse	93.93.131.124
	http://email.bigpurpledot.com/ls/click?upn=I1mTRZ7ia4mpL8-2BCUV-2Fy6BXfYx862skafQmUnWULhxJS2zEgnhzXMZbtkKsXAzoAvT4vx2e6QVTFgEH2kskD8l0A6qifbCwRUBEjW18raMAFL-2F9RaFHEjZIdu5aOsF-2Fcb7Yv_jrUqf5zwH7FzSx1F7hMR78V6ree-2Bd2G5UL9WgcJWbM0zbZQbEvFD7BN0qxBcscVfSuofso-2FVMy7rnPIz15CfQGK09iATuDt2hPaQuYNv7wnYlffkMtKctyZ9oT9uj1CnHpmqd4MuMsYAXvCeAh0bEwITMU9j7-2Ff1s7NTyyx1467xXfkMIBpMe-2FgEGhaO5AMHW5k-2BJ47RUanowSViov7k7C54PHtF8HBePsGRARrh-2BSanEqhC8NahjVqwUDirFWlF	Get hash	malicious	HTMLPhisher	Browse	93.93.131.124
	SecuriteInfo.com.Trojan.Inject4.59820.1021.15156.exe	Get hash	malicious	AgentTesla	Browse	93.93.131.124

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wzphku.exe.log

Download File

Process:	C:\Users\user\Desktop\Wzphku.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.361204690044335
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhRAE4KzeRE4KoE4Ty1KIE4oKNzKoM:MxHKlYHKh3oRAHKzeRHKoH8tHo60
MD5:	047933859FA1F440AA5934FB970A3E6A
SHA1:	2DA4BE3C3AEA7272370955BD89B39E659F52D8EA
SHA-256:	F1BA475E3438897324A9B81BB64278EF1331247896C42D280096EFBC14D3B0C5
SHA-512:	08CC3BA225690029E61C029548E6A39F14812183B4439A55F1E1FCD827B02AC449B6F25D0A9A1376E9BA64FFA66AE3478BC276DD5895BF896A5A7D9207AC1100
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.0517663565587645
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Wzphku.exe
File size:	425'472 bytes
MD5:	efffb97aa9f53110ab5035c995e7d62b
SHA1:	8594e94f8991efba6cad2b90d44ba0a8176ce941
SHA256:	aa0668633c7c710b0a09adc99362b4a3547307f0b3f1338ae731c35d9b071d88
SHA512:	5641d91f36e34a90854e55f304730c32c19cc22f58f35e3eca1749be51d7b002c53926bf4e05b9690556133341675110d75afe521cc178bbe236c71923a6e1a2
SSDEEP:	12288:iUkdr8MYQ4RB2I3t8tfDkKeXXfmDTh6+:/7t85kFMt
TLSH:	14946C26FB93959DE265533EC58F8808836792D0A273E70E7DEC33DA4AC33665E64341
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ke.................t..........^.... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46935e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x654BD8C7 [Wed Nov 8 18:51:51 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x69310	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a000	0x560	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x67364	0x67400	False	0.6433773456416465	data	7.066203079852089	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6a000	0x560	0x600	False	0.4010416666666667	data	3.9358431649315366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6a0a0	0x2d4	data			0.43646408839779005
RT_MANIFEST	0x6a374	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 14, 2023 11:11:26.808620930 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:26.808657885 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:26.808751106 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:26.825333118 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:26.825351000 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:27.436523914 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:27.436862946 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.283718109 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.283749104 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:28.284074068 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:28.331048012 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.417192936 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.461251974 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:28.704214096 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:28.704431057 CET	443	49710	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:28.704550028 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.711572886 CET	49710	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.713988066 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.714044094 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:28.714137077 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.714560986 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:28.714580059 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:29.310679913 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:29.312782049 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:29.312876940 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:29.885320902 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:29.885348082 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:29.885500908 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:29.885545015 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:29.940494061 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.176486969 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.176574945 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.176616907 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.176651955 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.176716089 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.176728964 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.176780939 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.176898003 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.176934004 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.176961899 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.176980972 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.264497995 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.264657021 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.462667942 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.462791920 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.463112116 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.463185072 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.463357925 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.463426113 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.463777065 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.463846922 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.464046001 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.464122057 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.513991117 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.514447927 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.552161932 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.552352905 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.749672890 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.749794960 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.750026941 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.750170946 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.750554085 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.750641108 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.750901937 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.751023054 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.751626015 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.751688957 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.751988888 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.752105951 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.793517113 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.793679953 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.800370932 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.800463915 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.800801992 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.800874949 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.839361906 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.839523077 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:30.839692116 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:30.839766026 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.035828114 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.035984039 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.036072016 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.036168098 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.036556959 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.036648035 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.037081003 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.037162066 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.037297964 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.037374973 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.037571907 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.037647009 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.038080931 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.038153887 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.038543940 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.038621902 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.038754940 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.038841963 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.039237022 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.039310932 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.039726019 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.039802074 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.040067911 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.040146112 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.040357113 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.040430069 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.040642023 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.040715933 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.078267097 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.078357935 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.080517054 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.080708027 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.086209059 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.086323023 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.086581945 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.086656094 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.086968899 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.087043047 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.087270021 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.087342024 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.087800026 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.087869883 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.088259935 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.088331938 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.125916958 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.126153946 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.126441956 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.126631975 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.126831055 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.126912117 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.127218008 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.127288103 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.323184967 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.323252916 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.323277950 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.323311090 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.323327065 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.323352098 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328263044 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328324080 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328349113 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328367949 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328385115 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328401089 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328408003 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328414917 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328445911 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328454018 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328460932 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328486919 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328505039 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328509092 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328525066 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328568935 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328571081 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328588963 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328625917 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328634024 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328644991 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328686953 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328689098 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328711033 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328717947 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328742027 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328746080 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328764915 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328772068 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328794956 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328798056 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328831911 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328838110 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328852892 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328857899 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328883886 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328891039 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328907013 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328916073 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328939915 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.328949928 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.328970909 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.329000950 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.329015017 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.329044104 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.329052925 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.329077959 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.329144001 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.329200983 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.329209089 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.329726934 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.329787016 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.329794884 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.330070972 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.330128908 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.330137014 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.330471039 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.330539942 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.330549002 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.331088066 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.331151009 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.331161976 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.331391096 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.331449986 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.331458092 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.331782103 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.331851959 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.331861973 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.332211018 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.332276106 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.332283020 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.332663059 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.332729101 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.332736015 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.333065987 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.333127975 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.333137035 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.333570004 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.333641052 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.333648920 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.333820105 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.333888054 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.333895922 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.365415096 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.365605116 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.365642071 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.367682934 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.367769003 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.367780924 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.367810011 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.367871046 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.367882013 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.372060061 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.372143984 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.372153044 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.372673988 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.372754097 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.372765064 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.373071909 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.373148918 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.373161077 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.373529911 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.373615980 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.373627901 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.373971939 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.374049902 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.374059916 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.374207020 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.374283075 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.374294043 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.374706984 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.374785900 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.374797106 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.375263929 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.375341892 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.375353098 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.375696898 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.375771046 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.375782013 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.375933886 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.376007080 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.376017094 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.376394987 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.376472950 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.376483917 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.376903057 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.376991987 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.377017021 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.412106037 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.412246943 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.412281036 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.412411928 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.412489891 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.412502050 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.413497925 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.413573980 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.413584948 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.413618088 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.413690090 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.413702011 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.413974047 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.414043903 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.414052963 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.414422035 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.414498091 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.414508104 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.414880037 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.414953947 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.414963007 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.415245056 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.415316105 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.415327072 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.456074953 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.608721972 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.608841896 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.608880997 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.608948946 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.608989954 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.609013081 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.609323025 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.609406948 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.610033035 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.610115051 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.610150099 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.610222101 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.611773014 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.611848116 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.612107992 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.612225056 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.612363100 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.612442017 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.612822056 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.612899065 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.613229990 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.613310099 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.613859892 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.613934994 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.614109039 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.614182949 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.614537001 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.614612103 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.614947081 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.615017891 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.615453959 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.615540028 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.615916967 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.615988016 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.616274118 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.616348982 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.616689920 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.616763115 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.617222071 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.617297888 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.617501974 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.617577076 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.617827892 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.617903948 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.618169069 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.618244886 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.618385077 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.618453979 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.618558884 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.618638992 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.618805885 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.618875980 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.619198084 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.619276047 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.619563103 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.619636059 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.619688034 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.619755030 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.620094061 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.620168924 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.620189905 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.620264053 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.620446920 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.620527029 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.620709896 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.620784998 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.620902061 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.620981932 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.621330023 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.621401072 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.621455908 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.621530056 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.621834993 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.621910095 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.621978045 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.622067928 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.622282982 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.622349024 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.622509003 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.622576952 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.622833014 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.622900963 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.622996092 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.623061895 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.623374939 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.623439074 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.623538971 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.623610020 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.623914003 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.623982906 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.624217033 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.624293089 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.624489069 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.624552011 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.624752045 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.624819040 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.625144005 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.625211954 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.625329971 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.625396967 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.625648975 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.625710011 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.625781059 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.625843048 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.626236916 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.626303911 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.626450062 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.626517057 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.626724958 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.626790047 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.626880884 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.626949072 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.627222061 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.627290010 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.627530098 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.627597094 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.651474953 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.651575089 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.651662111 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.651662111 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.651679039 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.651736021 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.652592897 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.652679920 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.652834892 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.652913094 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.653145075 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.653233051 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.653461933 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.653541088 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.658026934 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.658107996 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.658804893 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.658879995 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.658934116 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.659006119 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.659075022 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.659147024 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.659424067 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.659496069 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.659662962 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.659732103 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.659813881 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.659873009 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.660113096 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.660181046 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.660480022 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.660548925 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.660649061 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.660715103 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.661020994 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.661086082 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.661266088 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.661335945 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.661484003 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.661607027 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.661798954 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.661864042 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.662130117 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.662199020 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.662338972 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.662405968 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.662600040 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.662669897 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.662729979 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.662795067 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.662955999 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.663023949 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.663250923 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.663346052 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.663429022 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.663499117 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.663733959 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.663801908 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.698045969 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.698159933 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.698195934 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.698266983 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.698285103 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.698342085 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.698355913 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.698417902 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.698506117 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.698570013 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.698678017 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.698757887 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.699512959 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.699588060 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.699904919 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.699985981 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.700072050 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.700146914 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.700344086 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.700417995 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.700759888 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.700825930 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.700870991 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.700937986 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.701006889 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.701077938 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.701344013 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.701409101 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.701431036 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.701498032 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.701699018 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.701767921 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.701793909 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.701858997 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.894726992 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.894853115 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.894881964 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.894912958 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.894949913 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.894978046 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.895092010 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.895180941 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.895199060 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.895268917 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.895312071 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.895385027 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.895409107 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.895462036 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.895478964 CET	443	49711	93.93.131.124	192.168.2.5
Nov 14, 2023 11:11:31.895533085 CET	49711	443	192.168.2.5	93.93.131.124
Nov 14, 2023 11:11:31.895733118 CET	49711	443	192.168.2.5	93.93.131.124

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 14, 2023 11:11:26.436288118 CET	63426	53	192.168.2.5	1.1.1.1
Nov 14, 2023 11:11:26.798233986 CET	53	63426	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 14, 2023 11:11:26.436288118 CET	192.168.2.5	1.1.1.1	0x1452	Standard query (0)	the.earth.li	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 14, 2023 11:11:26.798233986 CET	1.1.1.1	192.168.2.5	0x1452	No error (0)	the.earth.li		93.93.131.124	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

the.earth.li

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49710	93.93.131.124	443	C:\Users\user\Desktop\Wzphku.exe

Timestamp	Direction	Data
2023-11-14 10:11:28 UTC	OUT	GET /~sgtatham/putty/latest/w64/putty.exe HTTP/1.1 Host: the.earth.li Connection: Keep-Alive
2023-11-14 10:11:28 UTC	IN	HTTP/1.1 302 Found Date: Tue, 14 Nov 2023 10:11:28 GMT Server: Apache Location: https://the.earth.li/~sgtatham/putty/0.79/w64/putty.exe Content-Length: 302 Connection: close Content-Type: text/html; charset=iso-8859-1
2023-11-14 10:11:28 UTC	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 39 2f 77 36 34 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.79/w64/putty.exe">here</a>.</p><hr><address>Apache Server at

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49711	93.93.131.124	443	C:\Users\user\Desktop\Wzphku.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-14 10:11:29 UTC	0	OUT	GET /~sgtatham/putty/0.79/w64/putty.exe HTTP/1.1 Host: the.earth.li
2023-11-14 10:11:29 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 14 Nov 2023 10:11:29 GMT Server: Apache Last-Modified: Sat, 26 Aug 2023 07:50:35 GMT ETag: "193d20-603ceb76f8805" Accept-Ranges: bytes Content-Length: 1654048 Connection: close Content-Type: application/x-msdos-program
2023-11-14 10:11:29 UTC	0	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 c0 ad e9 64 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 64 0e 00 00 7e 0a 00 00 00 00 00 d4 91 0b 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 19 00 00 04 00 00 4c 8e 19 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdd"d~@L`
2023-11-14 10:11:30 UTC	8	IN	Data Raw: 0f 85 21 04 00 00 48 8b 0d 1c 74 12 00 ba 97 00 00 00 e8 0a e2 03 00 45 31 c0 83 f8 01 41 0f 94 c0 41 83 c0 05 e9 00 04 00 00 40 b7 01 44 89 e9 c1 f9 10 8b 2d 08 7f 12 00 89 c8 29 e8 83 c0 01 45 85 ed 0f 49 c1 2b 05 4d 7f 12 00 99 f7 fd 89 c3 44 89 e9 c1 e1 10 41 0f bf d5 8b 2d dc 7e 12 00 89 d0 29 e8 83 c0 01 85 c9 0f 49 c2 2b 05 2a 7f 12 00 99 f7 fd 89 c5 83 fe 01 74 2b 83 fe 03 74 2e 83 fe 02 75 4d 48 8b 0d 9b 73 12 00 ba 97 00 00 00 e8 89 e1 03 00 45 31 c0 83 f8 01 41 0f 94 c0 41 83 c0 05 eb 2f 41 b8 04 00 00 00 eb 27 48 8b 0d 72 73 12 00 ba 97 00 00 00 e8 60 e1 03 00 31 c9 83 f8 01 0f 94 c1 41 b8 06 00 00 00 41 29 c8 eb 03 45 31 c0 44 89 f8 83 e0 04 c1 e8 02 44 89 fa 83 e2 08 c1 ea 03 48 8b 0d 99 7e 12 00 40 88 7c 24 40 89 5c 24 28 89 6c 24 20 88 54 Data Ascii: !HtE1AA@D-)EI+MDA-~)I+*t+t.uMHsE1AA/A'Hrs`1AA)E1DDH~@\|$@\$(l$ T
2023-11-14 10:11:30 UTC	16	IN	Data Raw: ba 07 00 00 00 eb 3e 41 ba 08 00 00 00 eb 36 41 ba 0a 00 00 00 eb 2e 41 ba 0d 00 00 00 eb 26 41 ba 0e 00 00 00 eb 1e 41 ba 0f 00 00 00 eb 16 41 ba 12 00 00 00 eb 0e 41 ba 13 00 00 00 eb 06 41 ba 14 00 00 00 c6 84 24 87 00 00 00 00 8b 4c 24 60 d1 e9 48 8b 15 ef 5f 12 00 48 8d 84 24 87 00 00 00 48 89 44 24 30 8b 44 24 58 88 44 24 28 88 4c 24 20 41 80 e6 01 48 89 e9 45 89 d0 45 89 f1 e8 9c 46 01 00 01 c5 48 8d 84 24 a0 00 00 00 29 c5 e9 3a f6 ff ff 0f 1f 00 4f ec ff ff 72 c8 ff ff ef ce ff ff ae d3 ff ff 3f ce ff ff ae d3 ff ff 10 cf ff ff c4 cf ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ff d0 ff ff 58 d0 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff 1d d0 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 Data Ascii: >A6A.A&AAAAA$L$`H_H$HD$0D$XD$(L$ AHEEFH$):Or?X
2023-11-14 10:11:30 UTC	24	IN	Data Raw: 7f 27 48 8b 0d 48 41 12 00 4c 8d 0d 5d cd 10 00 41 b8 00 10 00 00 ba 01 00 00 00 48 83 c4 20 5b 5f 5e 48 ff 25 a8 c7 11 00 90 48 83 c4 20 5b 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 56 56 57 55 53 48 83 ec 60 48 8b 05 7f 26 12 00 48 31 e0 48 89 44 24 58 8a 05 19 92 0e 00 88 05 33 41 12 00 48 8b 0d 3c 35 12 00 e8 8f 65 00 00 48 89 c6 48 8b 05 15 26 12 00 4c 8d 35 0e 26 12 00 4c 89 f1 b2 01 ff 90 b0 00 00 00 48 8b 0d 14 35 12 00 ba 08 00 00 00 e8 42 a2 03 00 89 c5 48 8b 0d 01 35 12 00 ba 07 00 00 00 e8 2f a2 03 00 89 c3 48 8b 0d ee 34 12 00 ba 01 00 00 00 e8 dc a2 03 00 89 c7 48 8b 0d db 34 12 00 31 d2 e8 5c a4 03 00 48 8b 0d cd 34 12 00 4c 8b 0d 2e 40 12 00 40 88 6c 24 48 88 5c 24 40 48 8d 54 24 50 48 89 54 24 38 89 7c 24 30 48 89 44 24 28 Data Ascii: 'HHAL]AH [_^H%H [_^AVVWUSH`H&H1HD$X3AH<5eHH&L5&LH5BH5/H4H41\H4L.@@l$H\$@HT$PHT$8\|$0HD$(
2023-11-14 10:11:30 UTC	32	IN	Data Raw: ae 11 00 4c 89 f9 ff d7 48 8b 8c 24 68 07 00 00 48 31 e1 e8 e9 03 0b 00 48 89 f1 48 89 f8 0f 28 b4 24 70 07 00 00 48 81 c4 88 07 00 00 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f 48 ff e0 31 c0 48 89 44 24 58 4c 8b bc 24 90 00 00 00 4c 8b 74 24 48 e9 70 02 00 00 4d 85 ff 0f 84 e5 00 00 00 48 8d 0d 3c e8 ff ff e8 b7 ba 03 00 48 89 c5 e9 d3 00 00 00 4d 85 ff 0f 84 c8 00 00 00 48 8d 0d 1f e8 ff ff e8 9a ba 03 00 48 89 c5 83 bc 24 88 00 00 00 02 0f 8c ad 00 00 00 31 db eb 0d 48 83 c3 01 49 39 de 0f 84 9c 00 00 00 41 80 3c df 00 74 41 b9 01 00 00 00 ba 08 00 00 00 45 31 c0 e8 2f a5 03 00 48 89 c7 41 0f b7 44 df 01 41 0f b6 4c df 03 c1 e1 10 09 c1 89 4f 04 48 89 e9 48 89 fa e8 1d bb 03 00 48 39 f8 74 08 48 89 f9 e8 a0 a5 03 00 41 80 7c df 04 00 74 a3 b9 01 00 00 00 ba Data Ascii: LH$hH1HH($pH[]_^A\A]A^A_H1HD$XL$Lt$HpMH<HMHH$1HI9A<tAE1/HADALOHHH9tHA\|t
2023-11-14 10:11:30 UTC	39	IN	Data Raw: 00 00 00 73 44 48 8b 0d 45 03 12 00 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 b8 04 00 00 00 48 8d 15 32 03 12 00 e8 35 87 03 00 4c 8b 44 24 68 48 89 05 19 03 12 00 48 8b 4c 24 70 48 85 c9 48 0f 45 c8 48 89 4c 24 70 45 85 f6 0f 8e ef 00 00 00 31 c9 48 8b 05 f6 02 12 00 eb 1f 0f 1f 40 00 c7 02 00 00 00 00 48 8d 14 b8 44 89 22 89 e9 83 c1 01 44 39 f1 0f 8d c5 00 00 00 48 63 d9 48 8d 14 98 44 89 24 98 8d 6b 01 41 0f b7 1c 58 44 39 f5 7d 6d 0f b7 fb 81 ff 40 db 00 00 75 32 48 63 fd 41 0f b7 34 78 81 c6 00 23 00 00 0f b7 f6 81 fe ef 00 00 00 77 29 85 c9 7e a5 83 c1 ff c7 04 88 00 00 00 00 eb 99 66 0f 1f 84 00 00 00 00 00 89 df 81 e7 00 fc 00 00 81 ff 00 d8 00 00 75 20 48 63 fd 41 0f b7 34 78 81 e6 00 fc 00 00 81 fe 00 dc 00 00 0f 84 66 ff ff ff 66 0f 1f 44 Data Ascii: sDHED$(HD$ AH25LD$hHHL$pHHEHL$pE1H@HD"D9HcHD$kAXD9}m@u2HcA4x#w)~fu HcA4xffD
2023-11-14 10:11:30 UTC	47	IN	Data Raw: e8 dc 45 03 00 89 c1 31 c0 83 f9 01 0f 94 c0 83 c0 05 eb 2b b8 04 00 00 00 eb 24 48 8b 0d c7 d7 11 00 ba 97 00 00 00 e8 b5 45 03 00 31 c9 83 f8 01 0f 94 c1 b8 06 00 00 00 29 c8 eb 02 31 c0 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 38 48 8b 0d 6b c8 11 00 ba f0 ff ff ff ff 15 58 6b 11 00 48 89 c6 48 8b 0d 76 d7 11 00 ba 7a 00 00 00 e8 64 45 03 00 89 f1 81 e1 ff ff 1b ff 81 c9 00 00 c0 00 89 f7 81 cf 00 00 c4 00 83 f8 01 0f 44 f9 48 8b 0d 49 d7 11 00 ba 78 00 00 00 e8 77 44 03 00 81 e7 ff ff df ff 0f b6 c0 c1 e0 15 09 f8 39 f0 74 42 41 89 c0 48 8b 0d 03 c8 11 00 ba f0 ff ff ff ff 15 80 6c 11 00 48 8b 0d f1 c7 11 00 c7 44 24 30 27 00 00 00 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 45 31 c0 45 31 c9 ff 15 63 6c 11 00 48 Data Ascii: E1+$HE1)1H(VWH8HkXkHHvzdEDHIxwD9tBAHlHD$0'D$(D$ 1E1E1clH
2023-11-14 10:11:30 UTC	55	IN	Data Raw: 48 89 f9 48 8b 94 24 d0 00 00 00 44 8b 84 24 a4 00 00 00 48 8b ac 24 88 00 00 00 41 89 e9 44 89 db e8 0b df 00 00 89 f2 41 89 db 48 8b 44 24 60 44 8a 00 48 8b b4 24 80 00 00 00 48 8b 87 d8 10 00 00 8a 18 48 8b 47 28 48 8b 04 e8 4c 8b 48 18 48 8b 4c 24 70 8a 44 8e 09 88 44 24 53 8a 44 8e 0a 88 44 24 52 8a 44 8e 0b 88 44 24 51 8a 44 8e 0c 88 44 24 50 8a 44 8e 0d 88 44 24 4f 8a 44 8e 0e 88 44 24 4e 8a 44 8e 0f 88 44 24 4d 84 db 0f b6 84 24 bc 00 00 00 0f b6 ca 0f 44 c8 89 8c 24 bc 00 00 00 45 31 f6 8b 44 24 6c 89 44 24 68 48 8b 84 24 b0 00 00 00 89 84 24 a4 00 00 00 44 88 44 24 54 44 89 ac 24 cc 00 00 00 eb 27 0f 1f 40 00 83 bc 24 b0 00 00 00 00 0f 8e fd fc ff ff 83 7a fc 00 0f 85 f0 fc ff ff e9 ee fc ff ff 0f 1f 00 41 89 c3 43 8a 44 39 08 b1 01 89 4c 24 60 Data Ascii: HH$D$H$ADAHD$`DH$HHG(HLHHL$pDD$SDD$RDD$QDD$PDD$ODD$NDD$M$D$E1D$lD$hH$$DD$TD$'@$zACD9L$`
2023-11-14 10:11:30 UTC	63	IN	Data Raw: 74 24 78 44 89 6c 24 70 48 89 7c 24 68 8b bc 24 8c 00 00 00 89 7c 24 60 8b bc 24 88 00 00 00 89 7c 24 58 48 8b bc 24 90 00 00 00 48 89 7c 24 50 89 6c 24 48 4c 89 64 24 40 89 44 24 38 48 89 4c 24 30 89 54 24 28 89 5c 24 20 48 8d 0d 0a 1d 10 00 48 8d 15 43 97 0f 00 e9 b2 00 00 00 8b 83 d8 01 00 00 89 84 24 8c 00 00 00 48 8b 4b 18 e8 4e 3e 03 00 89 84 24 88 00 00 00 48 8b 4b 10 48 8b 43 18 48 89 84 24 90 00 00 00 e8 32 3e 03 00 89 c5 48 8b 4b 08 4c 8b 63 10 e8 23 3e 03 00 48 8b 4b 08 8b 93 74 01 00 00 8b 9b 78 01 00 00 48 8d 35 3c 1d 0e 00 48 89 74 24 78 44 89 6c 24 70 48 89 7c 24 68 8b bc 24 8c 00 00 00 89 7c 24 60 8b bc 24 88 00 00 00 89 7c 24 58 48 8b bc 24 90 00 00 00 48 89 7c 24 50 89 6c 24 48 4c 89 64 24 40 89 44 24 38 48 89 4c 24 30 89 54 24 28 89 5c Data Ascii: t$xDl$pH\|$h$\|$`$\|$XH$H\|$Pl$HLd$@D$8HL$0T$(\$ HHC$HKN>$HKHCH$2>HKLc#>HKtxH5<Ht$xDl$pH\|$h$\|$`$\|$XH$H\|$Pl$HLd$@D$8HL$0T$(\
2023-11-14 10:11:30 UTC	71	IN	Data Raw: c9 85 ff 0f 95 c1 8b 8c ce 88 0e 00 00 8b be 74 01 00 00 89 fa c1 ea 1f 01 fa d1 fa 29 d1 89 cf c1 ff 1f 21 cf 39 c1 0f 4c f8 48 8b 4e 08 e8 4e 1f 03 00 80 be 85 11 00 00 00 74 16 83 be d4 01 00 00 00 74 0d 48 83 7e 18 00 74 06 03 86 d8 01 00 00 f7 d8 39 c7 0f 4d c7 89 c1 c1 f9 1f 21 c1 89 4e 20 c6 86 9b 21 00 00 01 80 be f1 10 00 00 00 74 07 48 83 c4 28 5f 5e c3 c6 86 f1 10 00 00 01 48 8d 0d c9 95 00 00 48 89 f2 48 83 c4 28 5f 5e e9 db 9d 01 00 cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 48 44 89 c7 48 89 d6 49 89 cd 48 8b 49 08 49 8b 5d 10 e8 ba 1e 03 00 41 89 c4 41 80 bd 85 11 00 00 00 48 89 74 24 40 89 7c 24 3c 74 18 41 83 bd d4 01 00 00 00 74 0e 49 83 7d 18 00 74 07 45 03 a5 d8 01 00 00 48 89 d9 e8 84 1e 03 00 89 c5 Data Ascii: t)!9LHNNttH~t9M!N !tH(_^HHH(_^AWAVAUATVWUSHHDHIHII]AAHt$@\|$<tAtI}tEH
2023-11-14 10:11:30 UTC	78	IN	Data Raw: 11 00 00 49 8b 8d 20 11 00 00 48 8b 44 24 48 48 8d 04 85 00 00 00 00 4c 8d 04 40 e8 d1 5a 0a 00 eb 16 49 8b 8d 18 11 00 00 49 8b 95 20 11 00 00 45 89 f8 e8 39 a9 00 00 48 8b 74 24 30 8b 46 08 41 39 85 10 11 00 00 7d 2b 48 63 d0 41 89 95 10 11 00 00 49 8b 8d 08 11 00 00 41 b8 14 00 00 00 e8 4c ea 02 00 48 89 c1 49 89 85 08 11 00 00 8b 46 08 eb 07 49 8b 8d 08 11 00 00 49 8d 95 08 11 00 00 48 89 54 24 40 48 8b 56 18 48 98 48 c1 e0 02 4c 8d 04 80 e8 57 5a 0a 00 45 85 ff 0f 84 c4 01 00 00 4d 8d 4d 78 49 8b 85 20 11 00 00 45 31 d2 45 31 f6 48 8b 6c 24 40 4c 8b 7c 24 30 eb 18 90 4c 8b 74 24 50 49 01 de 49 83 c2 01 4c 3b 54 24 48 0f 84 97 01 00 00 4f 8d 04 52 66 42 83 7c 80 0a 00 74 e4 46 0f b7 64 80 08 49 63 d6 4c 8d 3c 92 4a 8d 0c bd 00 00 00 00 48 03 4d 00 45 Data Ascii: I HD$HHL@ZII E9Ht$0FA9}+HcAIALHIFIIHT$@HVHHLWZEMMxI E1E1Hl$@L\|$0Lt$PIIL;T$HORfB\|tFdIcL<JHME
2023-11-14 10:11:30 UTC	86	IN	Data Raw: e9 3c 11 00 00 41 8b 97 c8 00 00 00 45 8b 87 dc 00 00 00 44 39 c2 0f 8f 25 11 00 00 c6 44 24 20 01 4c 89 f9 41 b9 01 00 00 00 e8 42 43 00 00 e9 0d 11 00 00 41 c6 87 08 01 00 00 00 41 c7 47 60 00 05 02 00 49 c7 47 68 00 00 00 00 48 8b 54 24 60 8b 42 10 48 8b 4c 24 58 89 41 10 0f 10 02 0f 11 01 41 80 bf fa 00 00 00 00 0f 84 d1 10 00 00 41 c7 87 90 00 00 00 00 05 02 00 41 c7 87 98 00 00 00 00 00 00 00 e9 b6 10 00 00 48 8b 44 24 50 80 48 02 08 e9 a8 10 00 00 41 c6 87 08 01 00 00 00 41 80 67 62 fb e9 96 10 00 00 41 c6 87 08 01 00 00 01 41 80 4f 62 04 e9 84 10 00 00 48 8b 44 24 50 80 60 02 f7 e9 76 10 00 00 48 8b 44 24 40 c7 00 0b 00 00 00 e9 66 10 00 00 49 8b 8f c0 10 00 00 48 85 c9 0f 84 56 10 00 00 48 8d 15 9b 66 0f 00 41 b8 03 00 00 00 45 31 c9 e8 d1 aa 00 Data Ascii: <AED9%D$ LABCAAG`IGhHT$`BHL$XAAAAHD$PHAAgbAAObHD$P`vHD$@fIHVHfAE1
2023-11-14 10:11:30 UTC	94	IN	Data Raw: ff 1c e0 ff ff 37 e0 ff ff 61 e0 ff ff 89 e0 ff ff ac e0 ff ff c1 e0 ff ff f0 e0 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 1f e1 ff ff 76 e1 ff ff 84 e1 ff ff 96 e1 ff ff 2c f2 ff ff a8 e1 ff ff 2c f2 ff ff b6 e1 ff ff c6 e1 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff f0 e1 ff ff 00 e2 ff ff 10 e2 ff ff 06 e3 ff ff 91 eb ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 3b e2 ff ff 2c f2 ff ff 2c f2 ff ff 63 e2 ff ff 78 e2 ff ff 86 e2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 2c f2 ff ff 94 e2 ff ff a1 e2 ff ff 38 ce ff ff 11 d6 ff ff 11 d6 ff ff f9 cd ff ff 11 d6 ff ff 11 d6 ff ff f9 cd ff ff 11 d6 ff ff 11 d6 ff ff 11 d6 ff ff 11 d6 ff ff 11 d6 ff ff 11 d6 ff ff 11 d6 ff ff 11 d6 Data Ascii: 7a,,,,v,,,,,,,,,,,,,,;,,cx,,,,8
2023-11-14 10:11:30 UTC	102	IN	Data Raw: cc 89 91 7c 21 00 00 44 89 81 80 21 00 00 c3 cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 38 89 d3 48 89 ce 84 d2 74 0f 8b 8e c8 00 00 00 44 8d 61 01 41 89 cf eb 10 8b 8e c8 00 00 00 44 8b a6 74 01 00 00 45 31 ff 8b 86 cc 00 00 00 89 4c 24 30 89 44 24 2c 45 84 c0 74 2b 45 31 ed 41 be 00 00 00 00 45 84 c9 0f 85 82 00 00 00 3b 86 78 01 00 00 75 57 c7 44 24 2c 00 00 00 00 48 8d 54 24 30 89 c8 eb 4b 80 be e2 00 00 00 00 74 20 3b 86 78 01 00 00 0f 85 19 04 00 00 c7 44 24 2c 00 00 00 00 48 8d 54 24 30 89 c8 e9 0a 04 00 00 41 89 cf 41 89 c5 45 84 c9 0f 85 13 04 00 00 44 89 e8 44 89 f9 3b 86 78 01 00 00 74 a9 48 8d 54 24 2c 83 c0 01 89 02 8b 44 24 30 8b 54 24 2c 41 89 c4 41 89 d6 48 89 f1 41 89 c0 e8 c1 07 00 00 88 5c 24 2a 48 8b 86 90 0e 00 00 48 89 c1 48 Data Ascii: \|!D!AWAVAUATVWUSH8HtDaADtE1L$0D$,Et+E1AE;xuWD$,HT$0Kt ;xD$,HT$0AAEDD;xtHT$,D$0T$,AAHA\$*HHH
2023-11-14 10:11:30 UTC	110	IN	Data Raw: c1 e7 10 81 e7 00 00 ff 7f 48 8b 4b 20 e8 5f 69 02 00 09 c7 89 f8 c1 e0 04 89 f9 83 e1 0f 89 fa c1 e2 08 81 e2 00 00 fe 7f 25 00 1f 00 00 09 c8 09 d0 89 f9 c1 e9 0e 81 e1 00 e0 01 00 09 c1 c1 ef 13 81 e7 f0 00 00 00 09 cf 89 7e 04 48 83 c4 20 5b 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc 56 57 53 48 83 ec 20 48 89 d6 48 89 cf 48 8b 49 20 e8 8a 68 02 00 89 c3 a8 01 75 36 c7 46 08 00 00 00 00 f6 c3 02 74 57 c6 46 0c 01 48 8b 4f 20 e8 6b 68 02 00 88 46 0d 48 8b 4f 20 e8 5f 68 02 00 88 46 0e 48 8b 4f 20 e8 53 68 02 00 88 46 0f eb 34 c6 46 08 01 48 8b 4f 20 e8 41 68 02 00 88 46 09 48 8b 4f 20 e8 35 68 02 00 88 46 0a 48 8b 4f 20 e8 29 68 02 00 88 46 0b f6 c3 02 75 a9 c7 46 0c 00 00 00 00 48 83 c4 20 5b 5f 5e c3 cc cc 41 57 41 56 56 57 53 48 83 ec 50 4c 89 c6 Data Ascii: HK _i%~H [_^VWSH HHHI hu6FtWFHO khFHO _hFHO ShF4FHO AhFHO 5hFHO )hFuFH [_^AWAVVWSHPL
2023-11-14 10:11:30 UTC	118	IN	Data Raw: 89 e8 00 00 00 44 89 89 e4 00 00 00 8a 91 f0 00 00 00 88 91 09 01 00 00 0f b6 91 f1 00 00 00 41 83 c0 ff 31 c0 45 39 c2 0f 4d c2 84 d2 0f 44 c2 88 81 e2 00 00 00 8b 81 ec 00 00 00 42 89 84 89 ac 01 00 00 8b 81 04 01 00 00 89 81 00 01 00 00 0f 10 41 78 0f 11 81 8c 00 00 00 8b 81 88 00 00 00 89 81 9c 00 00 00 80 b9 fa 00 00 00 00 74 17 b8 ff ff 03 00 23 41 60 89 81 90 00 00 00 8b 41 6c 89 81 98 00 00 00 c3 cc cc cc cc cc cc cc cc cc 48 89 c8 39 91 78 01 00 00 75 09 44 39 80 74 01 00 00 74 20 c7 80 a8 21 00 00 01 00 00 00 89 90 ac 21 00 00 44 89 80 b0 21 00 00 80 b8 f1 10 00 00 00 74 01 c3 c6 80 f1 10 00 00 01 48 8d 0d fd d9 ff ff 48 89 c2 e9 15 e2 00 00 cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 48 41 89 d6 49 89 cf 89 d1 f7 d9 0f 48 ca 45 Data Ascii: DA1E9MDBAxt#A`AlH9xuD9tt !!D!tHHAWAVAUATVWUSHHAIHE
2023-11-14 10:11:30 UTC	125	IN	Data Raw: 48 39 c2 73 2e 49 8b af 80 04 00 00 48 8b 6c d5 00 49 8b 7f 08 8b 1c af 83 fb 0c 75 d4 85 c9 75 d0 c7 04 af 00 00 00 00 49 8b 87 88 04 00 00 31 c9 eb c9 48 85 c0 0f 84 55 01 00 00 31 c0 0f 1f 00 49 8b 4f 28 48 c7 04 c1 ff ff ff ff 48 83 c0 01 4d 8b 87 88 04 00 00 4c 39 c0 72 e4 4d 85 c0 0f 84 2b 01 00 00 45 31 c9 31 c9 66 0f 1f 44 00 00 49 8b 87 80 04 00 00 48 8b 04 c8 49 8b 57 48 48 8d 04 40 8b 44 82 04 bf 80 00 00 00 bb ff ff ff ff eb 20 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 89 d7 89 da 89 fe 29 d6 89 d3 83 fe 01 0f 8e ad 00 00 00 8d 34 1f 89 f2 c1 ea 1f 01 f2 d1 fa 48 63 ea 48 c1 e5 04 48 8d 35 a3 c6 0c 00 39 44 35 00 77 cd 72 cf 48 8d 15 94 c6 0c 00 8b 54 15 0c 83 fa 01 74 4e 83 fa 02 75 76 48 8d 05 7f c6 0c 00 8b 5c 05 04 8b 7c 05 08 4c 89 ca 48 c1 Data Ascii: H9s.IHlIuuI1HU1IO(HHML9rM+E11fDIHIWHH@D f.)4HcHH59D5wrHTtNuvH\\|LH
2023-11-14 10:11:30 UTC	133	IN	Data Raw: cc 56 57 53 48 83 ec 40 89 d6 48 89 cf 48 8b 05 3d 71 10 00 48 31 e0 48 89 44 24 38 48 8b 49 08 48 8b 01 ff 50 50 84 c0 74 2d 48 8b 7f 08 48 8b 07 48 8b 58 30 48 8b 4c 24 38 48 31 e1 e8 7f 6d 09 00 48 89 f9 89 f2 45 31 c0 48 89 d8 48 83 c4 40 5b 5f 5e 48 ff e0 c7 44 24 2f ff 00 00 00 40 88 74 24 33 48 83 c7 18 c7 44 24 34 00 00 00 00 48 8d 54 24 2f 41 b8 09 00 00 00 48 89 f9 e8 ee 7e 02 00 48 8b 4c 24 38 48 31 e1 e8 31 6d 09 00 90 48 83 c4 40 5b 5f 5e c3 cc cc cc cc cc cc cc cc 56 57 48 83 ec 38 48 89 ce 48 8b 05 a0 70 10 00 48 31 e0 48 89 44 24 30 88 54 24 2a 8d 42 e0 3c 5f 72 62 48 8b 0e b0 01 80 b9 09 01 00 00 00 74 3e 84 d2 79 04 84 c0 75 4c 84 d2 0f 88 84 00 00 00 8d 42 40 80 fa 7f 0f b6 c0 b9 3f 00 00 00 0f 45 c8 88 4c 24 2c c6 44 24 2b 5e 48 8b 4e Data Ascii: VWSH@HH=qH1HD$8HIHPPt-HHHX0HL$8H1mHE1HH@[_^HD$/@t$3HD$4HT$/AH~HL$8H11mH@[_^VWH8HHpH1HD$0T$*B<_rbHt>yuLB@?EL$,D$+^HN
2023-11-14 10:11:30 UTC	141	IN	Data Raw: 05 8c 79 10 00 8d 14 08 83 c2 7f 01 c8 0f 49 d0 83 e2 80 29 d0 48 8d 3d 85 79 10 00 48 63 d8 48 8b 0c df 48 85 c9 74 05 e8 e4 f0 01 00 48 8d 4c 24 50 48 89 f2 45 31 c0 e8 54 e1 01 00 48 89 04 df 48 8b 0d 31 75 10 00 48 85 c9 74 5f 48 89 44 24 20 48 8b 35 88 f5 0f 00 ba e9 03 00 00 41 b8 80 01 00 00 45 31 c9 ff d6 48 8b 0d 09 75 10 00 48 c7 44 24 20 00 00 00 00 ba e9 03 00 00 41 b8 8b 01 00 00 45 31 c9 ff d6 83 c0 ff 4c 63 c8 48 8b 0d e3 74 10 00 48 c7 44 24 20 00 00 00 00 ba e9 03 00 00 41 b8 97 01 00 00 ff d6 8b 05 d7 74 10 00 83 f8 7f 7f 0b 83 c0 01 89 05 c9 74 10 00 eb 6a 8b 05 c9 78 10 00 83 f8 7f 7f 0b 83 c0 01 89 05 bb 78 10 00 eb 54 3d 80 00 00 00 75 4d 8b 05 bc 7c 10 00 8d 48 01 8d 90 80 00 00 00 85 c9 0f 49 d1 83 e2 80 f7 da 01 d0 83 c0 01 89 05 Data Ascii: yI)H=yHcHHtHL$PHE1THH1uHt_HD$ H5AE1HuHD$ AE1LcHtHD$ AttjxxT=uM\|HI
2023-11-14 10:11:30 UTC	149	IN	Data Raw: f9 89 f2 41 b8 82 01 00 00 49 89 e9 41 ff d4 49 63 ee 48 89 5c 24 20 48 89 f9 89 f2 41 b8 81 01 00 00 49 89 e9 41 ff d4 49 63 c7 48 89 44 24 20 48 89 f9 89 f2 41 b8 9a 01 00 00 49 89 e9 41 ff d4 48 c7 44 24 20 00 00 00 00 48 89 f9 89 f2 41 b8 86 01 00 00 49 89 e9 41 ff d4 48 89 d9 48 83 c4 30 5b 5d 5f 5e 41 5c 41 5e 41 5f e9 60 d1 01 00 41 57 41 56 41 54 56 57 53 48 83 ec 28 49 89 d4 48 89 cf 31 db 4c 8d 35 a2 4d 0f 00 4c 8d 3d 81 2a 0f 00 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 90 c6 44 37 78 00 48 83 c3 01 48 83 fb 10 74 2c 41 0f b6 4c 1c 14 85 c9 74 ec e8 3e 96 0a 00 0f b6 f0 80 7c 37 78 00 75 d8 4c 89 f1 4c 89 fa 41 b8 cb 04 00 00 e8 23 3d 0a 00 eb c5 48 83 c4 28 5b 5f 5e 41 5c 41 5e 41 5f c3 cc cc cc cc cc cc cc 56 48 83 ec 20 48 89 ce 48 8d 0d 21 00 00 Data Ascii: AIAIcH\$ HAIAIcHD$ HAIAHD$ HAIAHH0[]_^A\A^A_`AWAVATVWSH(IH1L5ML=*f.D7xHHt,ALt>\|7xuLLA#=H([_^A\A^A_VH HH!
2023-11-14 10:11:30 UTC	157	IN	Data Raw: d1 0b 0f 00 41 b8 d7 06 00 00 e8 ae 1e 0a 00 8b 53 10 48 8b 8c 24 b0 00 00 00 ff 15 a9 b5 0f 00 48 89 c6 48 85 c0 75 19 48 8d 0d 84 f1 0e 00 48 8d 15 9f 0b 0f 00 41 b8 da 06 00 00 e8 7c 1e 0a 00 48 89 f1 48 8d 94 24 a0 00 00 00 41 ff d7 85 c0 0f 84 6a ff ff ff 8b 6b 0c 85 ed 0f 8e 5f ff ff ff 8b 8c 24 a4 00 00 00 03 8c 24 ac 00 00 00 44 89 f0 29 c8 8d 48 fe 83 f9 fc 0f 87 40 ff ff ff 41 89 c5 41 c1 ed 1f 41 01 c5 41 d1 fd 8b 5b 08 48 8b b4 24 b0 00 00 00 eb 12 66 0f 1f 44 00 00 83 c3 01 83 c5 ff 0f 84 14 ff ff ff 48 89 f1 89 da ff 15 11 b5 0f 00 48 89 c7 48 89 c1 48 8d 94 24 f0 00 00 00 41 ff d7 85 c0 74 d4 8b 84 24 f0 00 00 00 89 84 24 e8 00 00 00 8b 84 24 f4 00 00 00 44 01 e8 89 84 24 ec 00 00 00 48 89 f1 48 8d 94 24 e8 00 00 00 ff 15 5c b6 0f 00 85 c0 Data Ascii: ASH$HHuHHA\|HH$Ajk_$$D)H@AAAA[H$fDHHHH$At$$$D$HH$\
2023-11-14 10:11:30 UTC	164	IN	Data Raw: 07 77 7c 48 8d 15 97 00 00 00 48 63 0c 8a 48 01 d1 ff e1 4c 89 e0 8a 50 40 4c 89 f1 e8 80 e3 ff ff 49 89 c6 8b 57 08 4d 85 f6 74 45 48 8b 0e 4d 89 f0 ff 15 29 98 0f 00 4c 89 f1 48 83 c4 28 5b 5f 5e 41 5c 41 5e 41 5f e9 04 93 01 00 41 8a 54 24 40 4c 89 f1 e8 47 e3 ff ff 49 89 c6 8b 47 08 8d 50 02 41 80 7c 24 60 00 0f 44 d0 4d 85 f6 75 bb 48 83 c4 28 5b 5f 5e 41 5c 41 5e 41 5f c3 48 8d 0d 49 41 0f 00 48 8d 15 08 ec 0e 00 41 b8 58 09 00 00 e8 e5 fe 09 00 e8 94 dd fd ff cc 0f 1f 00 75 ff ff ff 75 ff ff ff 72 ff ff ff 72 ff ff ff 72 ff ff ff de ff ff ff ac ff ff ff 72 ff ff ff 41 57 41 56 41 54 56 57 53 48 83 ec 28 4d 89 c6 48 89 d6 83 7a 48 00 7e 3c 49 89 cc 31 ff 4c 8d 3d fb c2 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 48 8b 44 fe 08 48 8b 08 4c 89 e2 4d 89 f8 Data Ascii: w\|HHcHLP@LIWMtEHM)LH([_^A\A^A_AT$@LGIGPA\|$`DMuH([_^A\A^A_HIAHAXuurrrrAWAVATVWSH(MHzH~<I1L=f.HDHLM
2023-11-14 10:11:30 UTC	172	IN	Data Raw: f1 48 83 c4 20 5e e9 06 74 01 00 cc cc cc cc cc cc 56 57 48 83 ec 38 48 89 d0 48 89 ce 4c 89 44 24 60 4c 89 4c 24 68 48 8b 0d e3 d4 0f 00 48 31 e1 48 89 4c 24 30 48 8d 54 24 60 48 89 54 24 28 48 89 c1 e8 79 66 01 00 48 89 c7 48 89 f1 48 89 c2 e8 6b fe ff ff 48 89 f9 e8 b3 73 01 00 48 8b 4c 24 30 48 31 e1 e8 16 d1 08 00 90 48 83 c4 38 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec 78 01 00 00 4c 89 cb 44 89 c7 89 d5 48 89 ce 48 8b 05 6b d4 0f 00 48 31 e0 48 89 84 24 70 01 00 00 8b 41 50 83 f8 04 75 68 48 85 db 75 75 48 8d 7c 24 48 48 89 f9 e8 a6 a2 02 00 4c 8d 05 b8 16 0e 00 48 8d 5c 24 70 ba 18 00 00 00 48 89 d9 49 89 f9 e8 f6 28 0a 00 85 ed 48 8d 05 d5 d2 0d 00 4c 8d 05 8e d2 0d 00 4c 0f 44 c0 48 8d 15 b6 Data Ascii: H ^tVWH8HHLD$`LL$hHH1HL$0HT$`HT$(HyfHHHkHsHL$0H1H8_^AWAVAUATVWUSHxLDHHkH1H$pAPuhHuuH\|$HHLH\$pHI(HLLDH
2023-11-14 10:11:31 UTC	180	IN	Data Raw: 89 88 01 00 00 48 85 c9 74 0b 48 8b 41 08 48 8b 40 78 48 ff e0 c3 cc cc cc cc cc cc cc cc cc cc cc 48 8b 89 80 01 00 00 48 85 c9 74 0a 48 8b 01 48 8b 40 18 48 ff e0 c3 cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 58 48 89 ce 48 8b 05 80 b5 0f 00 48 31 e0 48 89 44 24 50 0f 57 c0 0f 29 44 24 30 48 c7 44 24 40 00 00 00 00 48 8b 89 80 01 00 00 48 85 c9 74 67 48 8b 01 48 8d 15 41 0f 00 00 4c 8d 44 24 30 ff 50 10 48 8b 4c 24 30 48 85 c9 74 4b 48 8d 54 24 40 4c 8b 4c 24 38 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 b8 10 00 00 00 e8 2c 54 01 00 48 89 44 24 30 48 8b 4c 24 38 48 8d 51 01 48 89 54 24 38 48 c1 e1 04 48 c7 04 08 00 00 00 00 48 c7 44 08 08 20 00 00 00 48 8b 4e 38 e8 eb 53 01 00 48 8b 7c 24 30 48 89 7e 38 48 8b 4c 24 50 48 31 e1 e8 45 b1 08 00 48 89 f8 Data Ascii: HtHAH@xHHHtHH@HVWHXHHH1HD$PW)D$0HD$@HHtgHHALD$0PHL$0HtKHT$@LL$8D$(HD$ A,THD$0HL$8HQHT$8HHHD HN8SH\|$0H~8HL$PH1EH
2023-11-14 10:11:31 UTC	188	IN	Data Raw: 89 5c 24 70 4d 8d 47 18 48 8d 44 24 48 48 89 44 24 20 48 89 d9 31 d2 45 31 c9 e8 02 56 04 00 84 c0 74 6f 41 0f 10 47 08 0f 11 44 24 28 48 8d 4c 24 38 48 8d 54 24 28 e8 b5 40 04 00 48 83 7c 24 40 00 74 3d 0f 10 44 24 38 0f 29 44 24 50 48 8d 4c 24 50 e8 89 3f 04 00 48 85 c0 74 4b 80 b8 d8 00 00 00 00 74 5a 48 8b 74 24 38 48 8b 4c 24 40 e8 8c 76 04 00 48 8d 0d 9c 52 0e 00 e9 ac 00 00 00 48 8d 0d 57 48 0e 00 e8 04 a3 01 00 e9 a5 00 00 00 48 8b 54 24 48 48 8d 0d 03 5d 0d 00 e8 ee 27 01 00 e9 8f 00 00 00 48 8b 74 24 38 48 8b 4c 24 40 e8 4a 76 04 00 48 8d 0d 12 53 0e 00 eb 6d 41 0f 10 47 08 48 8b 18 0f 11 44 24 50 48 8d 54 24 50 48 89 c1 ff d3 48 85 c0 74 3b 48 89 c6 48 89 c1 ba 01 00 00 00 e8 b5 70 04 00 48 89 c7 4d 89 7c 24 68 49 8b 4c 24 18 4c 89 f2 49 89 c0 Data Ascii: \$pMGHD$HHD$ H1E1VtoAGD$(HL$8HT$(@H\|$@t=D$8)D$PHL$P?HtKtZHt$8HL$@vHRHWHHT$HH]'Ht$8HL$@JvHSmAGHD$PHT$PHHt;HHpHM\|$hIL$LI
2023-11-14 10:11:31 UTC	196	IN	Data Raw: b8 01 00 00 00 48 89 fa ff 50 10 c6 44 24 6f 01 48 8b 0e 48 8b 01 41 b8 01 00 00 00 48 89 fa ff 50 10 c7 46 5c 00 00 00 00 48 8b 4e 10 48 8b 01 31 d2 ff 90 b0 00 00 00 48 8b 4e 10 48 8b 01 4c 8d 05 6a c0 0d 00 41 b9 03 00 00 00 31 d2 ff 10 48 3d 01 10 00 00 0f 93 c2 48 8b 0e 48 8b 01 ff 50 28 48 8b 4c 24 70 48 31 e1 e8 52 73 08 00 31 c0 48 83 c4 78 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 28 48 89 cf 48 8d b1 70 ff ff ff 48 8b 49 80 e8 87 bf 02 00 84 c0 74 09 48 8b 4f 80 e8 ca bf 02 00 48 8b 0e 48 85 c9 74 06 48 8b 01 ff 50 08 48 8b 4f f0 48 85 c9 74 05 e8 3e 7d 02 00 48 8b 4f c0 e8 a5 f0 00 00 48 8b 4f a0 e8 6c 15 01 00 48 89 f1 48 83 c4 28 5f 5e e9 5e 15 01 00 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: HPD$oHHAHPF\HNH1HNHLjA1H=HHP(HL$pH1Rs1Hx[]_^A\A]A^A_VWH(HHpHItHOHHtHPHOHt>}HOHOlHH(_^^
2023-11-14 10:11:31 UTC	203	IN	Data Raw: 8d 0d a2 96 0d 00 48 8d 3d 96 96 0d 00 48 0f 44 f9 00 c0 0c fc 88 44 24 2e 40 88 6c 24 2f 49 8b 0f 48 8b 01 48 8d 54 24 2d 41 b8 03 00 00 00 ff 50 10 49 89 47 68 49 8b 4f 18 4c 89 74 24 20 48 8d 15 8c 1b 0d 00 4c 8d 05 16 fe 0c 00 49 89 f9 e8 bc 82 ff ff e9 1e 02 00 00 48 8d 35 b0 b8 0b 00 48 8d 05 19 b9 0b 00 81 ff fd 00 00 00 0f 85 c1 fe ff ff 48 63 48 14 41 8b 54 8f 38 83 fa 03 0f 84 98 00 00 00 83 fa 02 0f 84 da 00 00 00 85 d2 0f 85 e1 01 00 00 41 c7 44 8f 38 01 00 00 00 48 8b 36 48 8b 4c 24 30 48 31 e1 e8 d1 53 08 00 4c 89 f9 48 89 f2 48 83 c4 38 5b 5d 5f 5e 41 5e 41 5f e9 ba 02 00 00 41 c7 44 87 38 02 00 00 00 48 8b 06 8b 78 04 c6 44 24 2d ff 40 88 7c 24 2e 40 88 6c 24 2f 49 8b 0f 48 8b 01 48 8d 54 24 2d 41 b8 03 00 00 00 ff 50 10 49 89 47 68 8d 87 Data Ascii: H=HDD$.@l$/IHHT$-APIGhIOLt$ HLIH5HHcHAT8AD8H6HL$0H1SLHH8[]_^A^A_AD8HxD$-@\|$.@l$/IHHT$-APIGh
2023-11-14 10:11:31 UTC	211	IN	Data Raw: 00 48 89 f9 e8 c8 d7 00 00 bb 02 00 00 00 e9 af f6 ff ff 4d 85 ed 0f 84 24 0e 00 00 bb 02 00 00 00 45 85 e4 0f 88 2c 0e 00 00 f6 05 50 2a 0b 00 02 0f 85 10 0e 00 00 45 85 e4 0f 85 05 01 00 00 4c 89 e9 e8 7d 56 09 00 4c 89 f1 ba 01 00 00 00 41 89 c0 e8 69 bd 00 00 bb 02 00 00 00 e9 ea f6 ff ff 4d 85 ed 0f 84 d5 0d 00 00 bb 02 00 00 00 45 85 e4 0f 88 dd 0d 00 00 f6 05 01 2a 0b 00 02 0f 85 c1 0d 00 00 45 85 e4 0f 85 b6 00 00 00 bb 02 00 00 00 4c 89 f1 ba 02 00 00 00 e8 00 b5 00 00 83 f8 03 0f 85 cc 04 00 00 48 8b 3d 40 6d 0f 00 48 85 ff 74 1f 48 89 f9 e8 13 91 09 00 48 89 f9 48 89 c2 e8 58 20 04 00 48 8b 0d 21 6d 0f 00 e8 fc d6 00 00 4c 89 e9 e8 f4 44 01 00 48 89 05 0d 6d 0f 00 4c 89 e9 e8 e5 90 09 00 4c 89 e9 48 89 c2 e8 2a 20 04 00 e9 67 f6 ff ff 48 8d 0d Data Ascii: HM$E,PEL}VLAiMEELH=@mHtHHHX H!mLDHmLLH* gH
2023-11-14 10:11:31 UTC	219	IN	Data Raw: 8c 00 00 00 e8 e8 97 00 00 48 8d 15 5f 0e 0d 00 4c 89 f9 49 89 c0 e8 76 4f 00 00 48 89 e9 ba 61 00 00 00 e8 79 95 00 00 44 0f b6 c0 48 8d 15 94 f1 0c 00 4c 89 f9 e8 66 4f 00 00 48 89 e9 ba 62 00 00 00 e8 59 95 00 00 44 0f b6 c0 48 8d 15 cc ec 0c 00 4c 89 f9 e8 46 4f 00 00 48 89 e9 ba 89 00 00 00 e8 39 95 00 00 44 0f b6 c0 48 8d 15 e8 e9 0c 00 4c 89 f9 e8 26 4f 00 00 48 89 e9 ba 8a 00 00 00 e8 19 95 00 00 44 0f b6 c0 48 8d 15 aa 31 0d 00 4c 89 f9 e8 06 4f 00 00 48 89 e9 ba 8b 00 00 00 e8 b9 95 00 00 48 8d 15 89 ee 0c 00 4c 89 f9 41 89 c0 e8 e7 4e 00 00 48 89 e9 ba 6f 00 00 00 e8 9a 95 00 00 48 8d 15 e2 24 0d 00 4c 89 f9 41 89 c0 e8 c8 4e 00 00 48 89 e9 ba 70 00 00 00 e8 bb 94 00 00 44 0f b6 c0 48 8d 15 1a e9 0c 00 4c 89 f9 e8 a8 4e 00 00 48 89 e9 ba 71 00 Data Ascii: H_LIvOHayDHLfOHbYDHLFOH9DHL&OHDH1LOHHLANHoH$LANHpDHLNHq
2023-11-14 10:11:31 UTC	227	IN	Data Raw: 00 00 85 c0 0f 95 c0 4c 89 e1 ba 1d 00 00 00 41 89 c0 e8 3a 7e 00 00 48 8d 0d ee 16 0d 00 31 d2 e8 fc f9 03 00 4d 85 ed 74 18 44 0f b6 c0 48 8d 15 d7 16 0d 00 4c 89 e9 e8 f4 30 00 00 85 c0 0f 95 c0 4c 89 e1 ba 1e 00 00 00 41 89 c0 e8 ff 7d 00 00 48 8d 0d b8 07 0d 00 31 d2 e8 c1 f9 03 00 4d 85 ed 74 18 44 0f b6 c0 48 8d 15 a1 07 0d 00 4c 89 e9 e8 b9 30 00 00 85 c0 0f 95 c0 4c 89 e1 ba 1f 00 00 00 41 89 c0 e8 c4 7d 00 00 48 8d 0d 81 16 0d 00 31 d2 e8 86 f9 03 00 4d 85 ed 74 18 44 0f b6 c0 48 8d 15 6a 16 0d 00 4c 89 e9 e8 7e 30 00 00 85 c0 0f 95 c0 4c 89 e1 ba 2d 00 00 00 41 89 c0 e8 89 7d 00 00 48 8d 15 68 ce 0c 00 4c 89 e9 e8 4a 30 00 00 48 89 c6 48 85 c0 75 23 48 8d 0d 51 ce 0c 00 e8 06 f9 03 00 48 89 c6 48 85 c0 75 0f 48 8d 0d 61 c9 0d 00 e8 52 06 01 00 Data Ascii: LA:~H1MtDHL0LA}H1MtDHL0LA}H1MtDHjL~0L-A}HhLJ0HHu#HQHHuHaR
2023-11-14 10:11:31 UTC	235	IN	Data Raw: 62 0d 00 48 89 f1 31 d2 e8 d4 da 03 00 48 89 f9 48 89 f2 41 89 c0 e8 d6 11 00 00 41 b8 02 00 00 00 41 29 c0 4c 89 e1 ba b4 00 00 00 e8 d0 5f 00 00 48 8d 35 0e 5e 0d 00 48 89 f1 31 d2 e8 9f da 03 00 48 89 f9 48 89 f2 41 89 c0 e8 a1 11 00 00 41 b8 02 00 00 00 41 29 c0 4c 89 e1 ba bb 00 00 00 e8 9b 5f 00 00 48 8d 35 3c 5e 0d 00 48 89 f1 31 d2 e8 6a da 03 00 48 89 f9 48 89 f2 41 89 c0 e8 6c 11 00 00 89 c6 41 b8 02 00 00 00 41 29 c0 4c 89 e1 ba b5 00 00 00 e8 64 5f 00 00 85 f6 75 34 48 8d 35 6a 43 0d 00 48 89 f1 31 d2 e8 2f da 03 00 48 89 f9 48 89 f2 41 89 c0 e8 31 11 00 00 83 f8 01 75 10 4c 89 e1 ba b5 00 00 00 45 31 c0 e8 2c 5f 00 00 48 8d 35 f7 5c 0d 00 48 89 f1 31 d2 e8 fb d9 03 00 48 89 f9 48 89 f2 41 89 c0 e8 fd 10 00 00 41 b8 02 00 00 00 41 29 c0 4c 89 Data Ascii: bH1HHAAA)L_H5^H1HHAAA)L_H5<^H1jHHAlAA)Ld_u4H5jCH1/HHA1uLE1,_H5\H1HHAAA)L
2023-11-14 10:11:31 UTC	243	IN	Data Raw: 05 cc bb 0e 00 48 31 e0 48 89 84 24 50 02 00 00 4c 8d 05 7a f6 0c 00 31 c9 48 c7 c2 01 00 00 80 45 31 c9 e8 79 89 00 00 48 85 c0 74 43 48 89 c3 48 8d 15 d7 ce 0c 00 48 89 c1 e8 42 8c 00 00 48 89 c6 48 89 d9 e8 87 8a 00 00 48 85 f6 74 21 4c 8d 44 24 28 48 89 f1 89 ea e8 f3 06 00 00 89 c3 48 89 f1 e8 69 5a 00 00 84 db 0f 85 f2 01 00 00 80 3d e2 f0 0e 00 00 74 11 48 8b 35 e9 f0 0e 00 48 85 f6 75 4b e9 f8 00 00 00 48 8d 0d c9 ac 0c 00 e8 6b 87 00 00 48 89 05 c4 f0 0e 00 48 85 c0 74 15 48 8d 15 37 25 0d 00 48 89 c1 ff 15 b7 61 0e 00 48 89 c6 eb 02 31 f6 48 89 35 a9 f0 0e 00 c6 05 92 f0 0e 00 01 48 85 f6 0f 84 b2 00 00 00 48 8d bc 24 40 01 00 00 48 89 7c 24 20 31 c9 ba 1c 00 00 00 45 31 c0 45 31 c9 ff d6 85 c0 78 3b 48 8d 15 11 22 0d 00 48 8d 8c 24 40 01 00 00 Data Ascii: H1H$PLz1HE1yHtCHHHBHHHt!LD$(HHiZ=tH5HuKHkHHtH7%HaH1H5HH$@H\|$ 1E1E1x;H"H$@
2023-11-14 10:11:31 UTC	250	IN	Data Raw: c0 74 10 8b 58 04 eb 10 bb 01 00 00 00 eb 09 31 db eb 05 bb 02 00 00 00 48 8b 0d 3a d3 0e 00 4c 89 e2 e8 1a 67 00 00 89 d9 ba 01 00 00 00 45 31 c0 ff 15 da d2 0e 00 49 89 44 24 08 48 83 f8 ff 0f 84 73 01 00 00 49 89 c7 48 89 c1 ba 01 00 00 00 45 31 c0 ff 15 df 44 0e 00 41 80 7c 24 50 00 74 29 c7 44 24 30 01 00 00 00 c7 44 24 20 04 00 00 00 4c 8d 4c 24 30 4c 89 f9 ba ff ff 00 00 41 b8 00 01 00 00 ff 15 7e d2 0e 00 41 80 7c 24 51 00 74 29 c7 44 24 30 01 00 00 00 c7 44 24 20 04 00 00 00 4c 8d 4c 24 30 4c 89 f9 ba 06 00 00 00 41 b8 01 00 00 00 ff 15 4d d2 0e 00 41 80 7c 24 52 00 74 29 c7 44 24 30 01 00 00 00 c7 44 24 20 04 00 00 00 4c 8d 4c 24 30 4c 89 f9 ba ff ff 00 00 41 b8 08 00 00 00 ff 15 1c d2 0e 00 31 c0 41 80 7c 24 53 00 be ff 03 00 00 0f 44 f0 83 fb Data Ascii: tX1H:LgE1ID$HsIHE1DA\|$Pt)D$0D$ LL$0LA~A\|$Qt)D$0D$ LL$0LAMA\|$Rt)D$0D$ LL$0LA1A\|$SD
2023-11-14 10:11:31 UTC	258	IN	Data Raw: a5 0d 00 48 8d 15 b3 89 0d 00 41 b8 81 01 00 00 e8 68 88 08 00 48 8d 05 e5 e8 0a 00 83 3c 98 04 74 19 48 8d 0d 18 a6 0d 00 48 8d 15 8d 89 0d 00 41 b8 82 01 00 00 e8 42 88 08 00 89 7c 24 28 48 8b 0e 48 8d 54 24 28 45 31 c0 e8 52 3e 00 00 48 89 c6 48 85 c0 75 19 48 8d 0d 25 4d 0d 00 48 8d 15 58 89 0d 00 41 b8 85 01 00 00 e8 0d 88 08 00 48 8b 76 10 48 8b 4c 24 38 48 31 e1 e8 40 79 07 00 48 89 f0 48 83 c4 40 5b 5f 5e c3 cc cc cc cc cc 56 57 53 48 83 ec 40 89 d7 48 89 ce 48 8b 05 ad 7c 0e 00 48 31 e0 48 89 44 24 38 48 63 da 48 8d 05 9b eb 0a 00 83 3c 98 00 74 19 48 8d 0d 3a a5 0d 00 48 8d 15 f3 88 0d 00 41 b8 8e 01 00 00 e8 a8 87 08 00 48 8d 05 25 e8 0a 00 83 3c 98 05 74 19 48 8d 0d 0c 9b 0d 00 48 8d 15 cd 88 0d 00 41 b8 8f 01 00 00 e8 82 87 08 00 89 7c 24 28 Data Ascii: HAhH<tHHAB\|$(HHT$(E1R>HHuH%MHXAHvHL$8H1@yHH@[_^VWSH@HH\|H1HD$8HcH<tH:HAH%<tHHA\|$(
2023-11-14 10:11:31 UTC	266	IN	Data Raw: 4d 85 f6 74 ef 49 89 36 48 8b 4b 08 48 2b 4f 08 49 89 4e 08 eb de cc cc cc cc cc cc cc cc cc cc cc 56 57 53 48 83 ec 20 48 8b 79 08 48 85 ff 7e 35 48 89 d6 48 8b 19 48 01 df 48 83 c3 01 0f 1f 00 0f be 53 ff 48 89 f1 e8 dc 76 07 00 48 85 c0 75 0c 48 8d 4b 01 48 39 fb 48 89 cb 72 e3 48 85 c0 0f 95 c0 eb 02 31 c0 48 83 c4 20 5b 5f 5e c3 cc 56 57 53 48 83 ec 20 48 8b 79 08 48 85 ff 7e 35 48 89 d6 48 8b 19 48 01 df 48 83 c3 01 0f 1f 00 0f be 53 ff 48 89 f1 e8 8c 76 07 00 48 85 c0 74 0c 48 8d 4b 01 48 39 fb 48 89 cb 72 e3 48 85 c0 0f 95 c0 eb 02 b0 01 48 83 c4 20 5b 5f 5e c3 cc 56 57 48 83 ec 28 48 89 ce 48 8b 49 08 48 83 c1 01 ba 01 00 00 00 45 31 c0 e8 92 fb ff ff 48 89 c7 48 8b 16 4c 8b 46 08 48 89 c1 e8 00 6c 07 00 48 8b 46 08 c6 04 07 00 48 89 f8 48 83 c4 Data Ascii: MtI6HKH+OINVWSH HyH~5HHHHSHvHuHKH9HrH1H [_^VWSH HyH~5HHHHSHvHtHKH9HrHH [_^VWH(HHIHE1HHLFHlHFHH
2023-11-14 10:11:31 UTC	274	IN	Data Raw: 48 83 c4 20 5b 5f 5e c3 c7 46 10 00 00 00 00 48 c7 06 00 00 00 00 8b 46 18 e9 22 fe ff ff cc cc cc 41 57 41 56 56 57 53 48 83 ec 50 4c 89 c7 48 89 d6 48 89 cb 48 8b 05 95 3e 0e 00 48 31 e0 48 89 44 24 48 48 85 d2 74 61 48 85 ff 74 7a 48 8b 03 48 89 44 24 40 b8 ff ff ff ff 48 89 44 24 34 48 8d 4c 24 20 31 db 31 d2 e8 83 fd ff ff 4c 8b 7c 24 20 4d 85 ff 74 59 4c 8d 74 24 20 4c 89 fb 90 48 85 f6 74 48 48 89 f1 48 89 da ff d7 85 c0 74 3f 4c 89 f1 89 c2 e8 55 fd ff ff 48 8b 5c 24 20 48 85 db 75 db 31 db eb 27 48 8d 0d fe 76 0d 00 48 8d 15 cb 53 0d 00 41 b8 18 02 00 00 e8 3a 49 08 00 48 85 ff 75 86 48 8b 7b 08 eb 80 4c 89 fb 48 8b 4c 24 48 48 31 e1 e8 63 3a 07 00 48 89 d8 48 83 c4 50 5b 5f 5e 41 5e 41 5f c3 cc cc cc cc 48 83 ec 28 48 c7 44 24 20 00 00 00 00 e8 Data Ascii: H [_^FHF"AWAVVWSHPLHHH>H1HD$HHtaHtzHHD$@HD$4HL$ 11L\|$ MtYLt$ LHtHHHt?LUH\$ Hu1'HvHSA:IHuH{LHL$HH1c:HHP[_^A^A_H(HD$
2023-11-14 10:11:31 UTC	282	IN	Data Raw: 31 ff ba 01 00 00 00 45 31 c0 e8 e2 bd ff ff 48 89 c7 48 89 f1 e8 77 78 08 00 ba 08 00 00 00 48 89 c1 45 31 c0 e8 c7 bd ff ff 48 89 c5 48 89 f1 e8 5c 78 08 00 ba 08 00 00 00 48 89 c1 45 31 c0 e8 ac bd ff ff 48 89 c3 8a 06 84 c0 0f 84 cd 01 00 00 45 31 ff eb 11 66 2e 0f 1f 84 00 00 00 00 00 8a 46 01 48 83 c6 01 3c 09 74 f5 3c 20 74 f1 84 c0 0f 84 a7 01 00 00 4c 89 6c 24 30 4c 89 64 24 38 4c 89 74 24 40 48 89 6c 24 28 4a 89 7c fd 00 48 89 5c 24 20 4a 89 34 fb 8a 06 84 c0 0f 84 4d 01 00 00 45 31 ed eb 1c 0f 1f 84 00 00 00 00 00 48 83 c6 01 88 07 48 83 c7 01 8a 06 84 c0 0f 84 2c 01 00 00 41 f6 c5 01 75 26 3c 5b 7f 26 31 ed 3c 22 74 48 3c 09 0f 84 14 01 00 00 3c 20 75 d0 e9 0b 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 90 3c 22 74 26 3c 5c 75 b8 31 ed 66 0f 1f 44 Data Ascii: 1E1HHwxHE1HH\xHE1HE1f.FH<t< tLl$0Ld$8Lt$@Hl$(J\|H\$ J4ME1HH,Au&<[&1<"tH<< uf.<"t&<\u1fD
2023-11-14 10:11:31 UTC	289	IN	Data Raw: 0a 00 66 44 0f 6f 15 66 93 0a 00 66 0f 6f 25 ee 92 0a 00 66 0f 6f 2d 06 f7 09 00 66 0f 6f 35 5e 93 0a 00 66 0f 6f 3d 66 93 0a 00 66 0f 6f 0d 6e 93 0a 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 66 0f 6f d0 66 41 0f fd d0 f3 0f 7f 42 90 f3 0f 7f 52 a0 66 0f 6f d0 66 41 0f fd d1 66 0f 6f d8 66 41 0f fd da f3 0f 7f 52 b0 f3 0f 7f 5a c0 66 0f 6f d0 66 0f fd d4 66 0f 6f d8 66 0f fd dd f3 0f 7f 52 d0 f3 0f 7f 5a e0 66 0f 6f d0 66 0f fd d6 66 0f 6f d8 66 0f fd df f3 0f 7f 52 f0 f3 0f 7f 1a 66 0f fd c1 48 83 ea 80 48 83 c3 fc 75 90 ba 00 01 00 00 29 fa 44 39 f2 0f 8d bf 01 00 00 49 8b 44 c8 10 4c 63 ca 45 8d 04 3e 41 81 c0 ff fe ff ff 4c 89 ca 41 83 f8 0f 0f 82 1c 01 00 00 4a 8d 14 4e 41 8d 0c 3e 81 c1 ff fe ff ff 48 8d 2c 48 48 83 c5 02 48 39 ea 73 17 4c 01 c9 Data Ascii: fDoffo%fo-fo5^fo=ffonf.@fofABRfofAfofARZfoffofRZfoffofRfHHu)D9IDLcE>ALAJNA>H,HHH9sL
2023-11-14 10:11:31 UTC	297	IN	Data Raw: fd ff 4c 8b 35 48 85 0d 00 48 89 f1 ba f0 ff ff ff 49 89 f8 41 ff d6 48 89 f1 ba ec ff ff ff 49 89 d8 41 ff d6 c7 44 24 30 27 00 00 00 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 48 89 f1 31 d2 45 31 c0 45 31 c9 ff 15 13 85 0d 00 90 48 83 c4 38 5b 5f 5e 41 5e c3 cc cc cc cc cc cc cc cc 56 57 53 48 83 ec 20 4c 89 c3 48 89 d7 48 89 ce 41 83 f9 02 74 3a 45 85 c9 0f 85 7d 00 00 00 8b 56 20 48 89 d9 e8 56 5d ff ff 8b 5e 48 85 db 7e 74 48 8b 56 60 31 c9 66 0f 1f 84 00 00 00 00 00 3b 04 ca 74 7d 48 83 c1 01 48 39 cb 75 f2 eb 57 48 89 f1 48 89 fa e8 b5 e0 fd ff 89 c7 85 c0 78 05 3b 7e 48 7c 19 48 8d 0d d9 b7 0c 00 48 8d 15 a4 ea 0c 00 41 b8 29 00 00 00 e8 5d eb 07 00 48 8b 46 60 48 63 cf 44 8b 04 c8 8b 56 20 48 89 d9 48 83 c4 20 5b 5f 5e e9 04 65 ff ff 90 48 Data Ascii: L5HHIAHIAD$0'D$(D$ H1E1E1H8[_^A^VWSH LHHAt:E}V HV]^H~tHV`1f;t}HH9uWHHx;~H\|HHA)]HF`HcDV HH [_^eH
2023-11-14 10:11:31 UTC	305	IN	Data Raw: 0d 41 b8 0b 00 48 89 f9 41 b0 64 e8 81 8e 00 00 48 8d 0d e8 5c 0b 00 48 8b 2d 73 b3 09 00 48 89 ea e8 ab 53 ff ff 48 89 c6 48 8d 15 1d 5e 0b 00 4c 89 f9 49 89 c0 e8 d6 7c 00 00 48 89 f1 e8 8e 60 ff ff 8b 8c 24 bc 00 00 00 e8 92 9a fe ff 48 85 c0 74 17 f6 80 a8 00 00 00 01 74 0e 80 bc 24 bb 00 00 00 00 0f 85 ef 00 00 00 48 8d 15 db 5d 0b 00 4c 8d 05 66 c6 0b 00 4c 8d 0d a7 5d 0b 00 48 8b 8c 24 c0 00 00 00 e8 04 7e 00 00 48 89 c7 48 89 c1 ba 02 00 00 00 41 b8 32 00 00 00 41 b9 32 00 00 00 e8 08 81 00 00 48 8d 35 31 69 0a 00 48 89 f1 e8 c9 78 00 00 48 89 c3 b9 7e 00 00 00 e8 ac 78 00 00 48 89 5c 24 38 48 89 44 24 30 4c 89 74 24 28 48 8d 1d 76 c5 0b 00 48 89 5c 24 20 48 8d 15 4c 79 0b 00 48 89 f9 41 b0 6d 41 b9 64 00 00 00 e8 39 82 00 00 c7 40 14 00 00 00 00 Data Ascii: AHAdH\H-sHSHH^LI\|H`$Htt$H]LfL]H$~HHA2A2H51iHxH~xH\$8HD$0Lt$(HvH\$ HLyHAmAd9@
2023-11-14 10:11:31 UTC	313	IN	Data Raw: e8 cc 61 00 00 48 89 c7 48 89 c1 e8 31 5a 00 00 48 89 44 24 28 48 8d 2d 55 34 00 00 48 89 6c 24 20 48 8d 15 85 a7 0b 00 48 89 d9 41 b0 72 4d 89 f9 e8 eb 67 00 00 48 89 47 08 c7 40 14 01 00 00 00 48 8b 47 08 c6 40 10 01 48 89 f9 e8 f0 59 00 00 48 89 44 24 28 48 89 6c 24 20 48 89 d9 31 d2 45 31 c0 4d 89 f9 e8 96 68 00 00 48 89 47 10 c7 40 44 02 00 00 00 48 8b 47 10 c6 40 60 00 48 8b 57 08 48 89 d9 e8 77 6d 00 00 31 c9 e8 b0 59 00 00 48 89 c6 48 89 f9 e8 a5 59 00 00 48 89 74 24 38 48 89 44 24 30 48 89 6c 24 28 4c 89 7c 24 20 48 8d 15 74 3a 0b 00 48 89 d9 41 b0 6b 41 b9 50 00 00 00 e8 29 63 00 00 48 89 47 18 c7 40 14 00 00 00 00 48 89 f9 e8 66 59 00 00 48 89 44 24 28 48 89 6c 24 20 48 8d 15 a7 39 0b 00 48 89 d9 41 b0 79 4d 89 f9 44 8a bc 24 bb 00 00 00 e8 1f Data Ascii: aHH1ZHD$(H-U4Hl$ HHArMgHG@HG@HYHD$(Hl$ H1E1MhHG@DHG@`HWHwm1YHHYHt$8HD$0Hl$(L\|$ Ht:HAkAP)cHG@HfYHD$(Hl$ H9HAyMD$
2023-11-14 10:11:31 UTC	321	IN	Data Raw: 8b 4c 24 78 48 31 e1 e8 b5 7f 06 00 48 89 f1 ba 01 00 00 00 41 89 f8 48 81 c4 80 00 00 00 5b 5f 5e e9 1b 08 ff ff c6 44 24 20 00 4c 8d 44 24 20 48 89 d9 48 89 fa e8 86 85 fd ff 48 8b 4c 24 78 48 31 e1 e8 79 7f 06 00 90 48 81 c4 80 00 00 00 5b 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 28 44 89 cd 4c 89 c6 49 89 d7 48 89 cb 4c 89 c1 ba 02 00 00 00 e8 97 ff fe ff 41 89 c4 48 8b 7b 20 85 ed 0f 84 92 00 00 00 80 7f 20 00 0f 85 b9 02 00 00 83 fd 03 0f 84 a6 01 00 00 83 fd 02 0f 85 a7 02 00 00 48 39 5f 10 0f 85 9d 02 00 00 48 89 d9 4c 89 fa e8 e7 82 fd ff 89 c5 85 c0 78 05 3b 6b 48 7c 19 48 8d 0d 0b 5a 0c 00 48 8d 15 d6 8c 0c 00 41 b8 66 01 00 00 e8 8f 8d 07 00 48 8b 43 60 48 63 cd 8b 1c c8 83 fb ff 0f 85 92 01 Data Ascii: L$xH1HAH[_^D$ LD$ HHHL$xH1yH[_^AWAVAUATVWUSH(DLIHLAH{ H9_HLx;kH\|HZHAfHC`Hc
2023-11-14 10:11:31 UTC	328	IN	Data Raw: 00 00 00 4d 89 f8 49 89 d9 e8 d3 eb fe ff 48 89 d9 e8 fb 02 ff ff 48 8b 4d 18 4c 89 f2 e8 5f 76 fd ff 48 8b 75 18 48 8b 4c 24 30 48 31 e1 e8 4e 60 06 00 48 89 f1 4c 89 f2 45 89 e8 48 83 c4 38 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f e9 80 6d fd ff d9 fc ff ff 08 fd ff ff 92 fd ff ff be fd ff ff 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 38 4d 89 c7 49 89 d4 48 89 cb 48 8b 05 90 63 0d 00 48 31 e0 48 89 44 24 30 48 8b 69 20 41 83 f9 01 74 4e 45 85 c9 0f 85 c2 02 00 00 48 39 5d 10 0f 84 53 01 00 00 48 39 5d 28 74 0a 48 39 5d 30 0f 85 a8 02 00 00 48 8b 4c 24 30 48 31 e1 e8 be 5f 06 00 48 89 d9 4c 89 e2 45 31 c0 48 83 c4 38 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f e9 e0 62 fd ff 48 39 5d 00 0f 84 e1 01 00 00 48 39 5d 08 0f 85 69 02 00 00 48 8b 4d 10 4c 89 e2 e8 f0 6a Data Ascii: MIHHML_vHuHL$0H1N`HLEH8[]_^A\A]A^A_mAWAVAUATVWUSH8MIHHcH1HD$0Hi AtNEH9]SH9](tH9]0HL$0H1_HLE1H8[]_^A\A]A^A_bH9]H9]iHMLj
2023-11-14 10:11:31 UTC	336	IN	Data Raw: ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 38 4d 89 c6 48 89 d7 49 89 cf 45 31 ed b9 01 00 00 00 ba 38 00 00 00 45 31 c0 e8 f2 e2 fe ff 49 89 c4 4d 8b 0f bd 00 00 00 00 4d 85 c9 74 7e 4d 8b 47 10 31 ed 49 8b 04 e8 48 8b 08 31 c0 31 f6 90 0f b6 1c 07 84 db 74 18 80 fb 2f 75 33 0f b6 14 01 eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 14 01 84 d2 74 44 80 fa 2f 74 04 84 d2 75 03 83 c6 01 38 d3 74 10 eb 16 66 0f 1f 44 00 00 0f b6 14 01 38 d3 75 08 48 83 c0 01 eb b2 66 90 81 fe ff ff ff 7f 74 14 44 39 ee 7c 0f 48 83 c5 01 41 89 f5 4c 39 cd 75 8b 4c 89 cd 48 89 f9 e8 fc 50 ff ff 49 89 04 24 49 c7 44 24 08 00 00 00 00 4c 89 f1 e8 e7 50 ff ff 49 89 44 24 10 41 c7 44 24 18 00 00 00 00 0f 57 c0 41 0f 11 44 Data Ascii: AWAVAUATVWUSH8MHIE18E1IMMt~MG1IH11t/u3f.tD/tu8tfD8uHftD9\|HAL9uLHPI$ID$LPID$AD$WAD
2023-11-14 10:11:31 UTC	344	IN	Data Raw: 00 00 00 44 89 cb 4d 89 c7 89 d5 49 89 ce 83 fa 5e 0f 85 e9 00 00 00 48 63 c3 4c 89 7c 24 30 48 89 44 24 40 48 c7 44 24 38 00 00 00 00 c7 44 24 48 00 00 00 00 48 8d 4c 24 30 48 89 4c 24 50 e8 ed bf fe ff 41 89 c7 48 8b 54 24 50 48 8d 4c 24 20 e8 5b c0 fe ff 4c 8b 6c 24 20 48 8b 5c 24 28 90 49 63 7c 24 0c 48 39 fb 48 0f 46 fb e8 cf ca fe ff 48 89 c6 48 8d 68 18 48 89 e9 31 d2 e8 9e ba fe ff 48 89 e9 b2 5e e8 14 ba fe ff 48 89 e9 44 89 fa e8 89 ba fe ff 48 89 e9 89 fa e8 7f ba fe ff 48 63 ff 48 89 e9 4c 89 ea 49 89 f8 e8 3e b9 fe ff 49 01 fd 8b 46 10 83 c0 fc 48 8b 0e 0f c8 89 01 48 8b 16 4c 8b 46 10 49 8b 4e 08 48 8b 01 ff 50 10 48 89 f1 e8 e5 ca fe ff 48 29 fb 75 80 48 8b 4c 24 60 48 31 e1 e8 13 21 06 00 90 48 83 c4 68 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f Data Ascii: DMI^HcL\|$0HD$@HD$8D$HHL$0HL$PAHT$PHL$ [Ll$ H\$(Ic\|$H9HFHHhH1H^HDHHcHLI>IFHHLFINHPHH)uHL$`H1!Hh[]_^A\A]A^A_
2023-11-14 10:11:31 UTC	352	IN	Data Raw: ff 41 89 c4 48 8b 86 90 bf ff ff 48 8b 48 20 48 8b 41 08 4c 89 ea ff 50 50 89 c5 48 8b 8c 24 00 01 00 00 e8 c9 a0 fe ff 48 8b 8c 24 00 01 00 00 e8 bc a0 fe ff 48 8b 8c 24 00 01 00 00 83 79 18 00 0f 84 58 03 00 00 48 8d 0d 7f b1 0a 00 e9 bd 00 00 00 83 fb 0f 0f 8f 33 01 00 00 48 8d 0d 3f b1 0a 00 e9 a8 00 00 00 48 8d 8c 24 e0 00 00 00 e8 7c a0 fe ff 41 89 c4 48 8b 84 24 00 01 00 00 83 78 18 00 0f 84 73 03 00 00 48 8d 0d 5a b1 0a 00 eb 7d 48 8d 0d 62 a4 0a 00 e9 71 01 00 00 0f 10 84 24 90 00 00 00 0f 29 84 24 a0 00 00 00 48 8d 15 ac 23 0b 00 48 8d 8c 24 a0 00 00 00 e8 6e a6 fe ff 84 c0 0f 84 87 03 00 00 4c 89 64 24 48 41 89 ec 48 8b 94 24 00 01 00 00 48 8d 8c 24 a0 00 00 00 e8 89 a0 fe ff 48 8b 8c 24 00 01 00 00 e8 fc 9f fe ff 89 c5 48 8b 84 24 00 01 00 00 Data Ascii: AHHH HALPPH$H$H$yXH3H?H$\|AH$xsHZ}Hbq$)$H#H$nLd$HAH$H$H$H$
2023-11-14 10:11:31 UTC	360	IN	Data Raw: c3 58 48 89 d9 48 89 fa 48 83 c4 20 5b 5d 5f 5e 41 5e e9 5a ee ff ff cc cc cc cc cc cc cc cc cc cc 56 57 53 48 83 ec 20 8b 02 3d ff 00 00 00 7f 1d 48 89 d7 48 89 ce 89 c1 c1 f9 05 48 63 c9 48 8d 15 db 96 09 00 8b 0c 8a 0f a3 c1 73 04 31 c0 eb 2f 48 8b 06 b9 03 00 00 00 ff 50 18 48 89 c3 8b 57 04 48 8d 48 60 e8 35 7c fe ff 48 83 c3 40 48 83 c6 58 48 89 f1 48 89 da e8 f2 ed ff ff b0 01 48 83 c4 20 5b 5f 5e c3 cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec 98 00 00 00 4c 89 cd 4d 89 c5 49 89 d4 48 89 cb 48 8b bc 24 28 01 00 00 4c 8b b4 24 08 01 00 00 48 8b 05 4a e6 0c 00 48 31 e0 48 89 84 24 90 00 00 00 4c 89 c1 ba c6 00 00 00 45 31 c0 e8 bf 67 fe ff 48 85 c0 0f 84 c4 01 00 00 48 85 ff 0f 84 db 00 00 00 48 8b 37 48 85 f6 74 2e 48 89 f1 Data Ascii: XHHH []_^A^ZVWSH =HHHcHs1/HPHWHH`5\|H@HXHHH [_^AWAVAUATVWUSHLMIHH$(L$HJH1H$LE1gHHH7Ht.H
2023-11-14 10:11:31 UTC	368	IN	Data Raw: f8 ff ff 48 8b 89 00 ff ff ff 48 8b 01 48 8b 40 10 48 83 c4 20 5e 48 ff e0 cc cc cc cc cc cc cc cc 48 83 79 a8 00 74 01 c3 48 8b 89 00 ff ff ff 48 8b 01 48 8b 40 18 48 ff e0 cc cc cc cc cc cc cc 48 83 ec 28 48 8d 0d 3d 0f 0c 00 48 8d 15 42 b2 0b 00 41 b8 1a 01 00 00 e8 9f d2 06 00 e8 4e b1 fa ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 28 48 89 ce 48 83 79 a0 00 75 19 48 8d 0d cb a4 0b 00 48 8d 15 06 b2 0b 00 41 b8 b8 01 00 00 e8 63 d2 06 00 48 8b 4e d0 ba 0f 00 00 00 e8 f9 43 fe ff 89 c7 48 8b 4e d0 ba 0e 00 00 00 e8 79 45 fe ff 48 8b 4e a0 48 8b 09 48 8b 51 18 48 8d 0d eb fb 0a 00 49 89 c0 41 89 f9 e8 fc 58 fe ff 90 48 83 c4 28 5f 5e c3 cc cc cc cc 48 8b 41 e0 c3 cc cc cc cc cc cc cc cc cc cc cc 48 8b 41 e8 c3 cc cc cc cc cc cc cc cc cc Data Ascii: HHH@H ^HHytHHH@HH(H=HBANVWH(HHyuHHAcHNCHNyEHNHHQHIAXH(_^HAHA
2023-11-14 10:11:31 UTC	375	IN	Data Raw: 00 c7 44 24 74 00 00 00 00 48 8d 5f 18 48 8b 57 28 48 8d 4f 08 48 8d 44 24 68 48 89 44 24 58 48 8d 44 24 74 48 89 44 24 50 48 8d 84 24 88 00 00 00 48 89 44 24 48 48 89 5c 24 40 48 8d 44 24 78 48 89 44 24 30 c7 44 24 38 00 00 00 00 c7 44 24 28 10 00 00 00 c7 44 24 20 00 00 00 00 ff 15 e6 e6 0c 00 89 07 4d 85 ff 75 09 4d 85 f6 0f 84 e4 00 00 00 48 be 00 6f ef 49 fd ff ff ff 48 8d 8c 24 c8 00 00 00 ff 15 d6 4e 0c 00 48 89 f1 8b ac 24 c8 00 00 00 8b b4 24 cc 00 00 00 48 89 f0 48 c1 e0 20 48 09 e8 49 bd bd 42 7a e5 d5 94 bf d6 74 13 49 f7 e5 48 c1 ea 17 48 01 ca 89 d5 48 89 d6 48 c1 ee 20 4d 85 f6 74 07 41 c7 06 00 00 00 00 4d 85 ff 74 07 49 c7 07 ff ff ff ff 48 8b 44 24 68 48 89 84 24 b8 00 00 00 48 8d 8c 24 b8 00 00 00 48 8d 94 24 c0 00 00 00 ff 15 61 4f 0c Data Ascii: D$tH_HW(HOHD$hHD$XHD$tHD$PH$HD$HH\$@HD$xHD$0D$8D$(D$ MuMHoIH$NH$$HH HIBztIHHHH MtAMtIHD$hH$H$H$aO
2023-11-14 10:11:31 UTC	383	IN	Data Raw: 7c 74 25 49 8b 04 24 4c 89 e2 48 81 c2 b0 00 00 00 48 39 50 20 75 0c 0f 11 70 18 49 8b 8c 24 a8 00 00 00 48 8b 01 ff 10 4c 89 e1 e8 21 28 fe ff e9 74 f6 ff ff 0f 28 84 24 80 00 00 00 0f 29 84 24 e0 05 00 00 48 89 d9 48 8d 15 ca 7c 0a 00 e8 dd 29 fe ff 84 c0 0f 84 a6 00 00 00 49 8b 7f 30 41 c7 47 40 00 00 00 00 48 8d 8c 24 b0 05 00 00 48 89 ea e8 f9 23 fe ff 48 89 e9 e8 f1 22 fe ff 41 89 c5 48 89 d9 48 89 ea e8 e3 23 fe ff 0f 10 84 24 e0 05 00 00 0f 29 84 24 90 00 00 00 48 89 d9 48 89 ea e8 c8 23 fe ff 41 83 7f 40 00 0f 85 88 00 00 00 49 8b 47 38 49 3b 47 30 75 7e 49 8b 8c 24 a8 00 00 00 48 8b 01 48 8b 40 48 0f 28 84 24 b0 05 00 00 0f 29 84 24 e0 05 00 00 0f 28 84 24 90 00 00 00 0f 29 84 24 a0 00 00 00 48 89 da 45 89 e8 4c 8d 8c 24 a0 00 00 00 ff d0 e9 c8 Data Ascii: \|t%I$LHH9P upI$HL!(t($)$HH\|)I0AG@H$H#H"AHH#$)$HH#A@IG8I;G0u~I$HH@H($)$($)$HEL$
2023-11-14 10:11:31 UTC	391	IN	Data Raw: c0 00 00 00 48 31 e1 e8 75 66 05 00 90 48 81 c4 c8 00 00 00 5b 5d 5f 5e 41 5e 41 5f c3 48 8d 15 27 47 0a 00 e8 68 a5 fc ff eb d1 cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec b8 00 00 00 48 8b 05 c6 69 0c 00 48 31 e0 48 89 84 24 b0 00 00 00 80 79 e8 00 0f 85 2c 02 00 00 48 89 4c 24 60 4c 8d 71 90 49 8d 86 c8 00 00 00 48 89 44 24 68 48 8d ac 24 80 00 00 00 eb 2a 66 90 4d 63 c7 48 03 5e 20 49 8b 8e 80 00 00 00 48 89 da e8 9a 77 fe ff 48 89 f1 e8 72 74 ff ff 41 83 fd 25 0f 84 cd 01 00 00 48 8b 4c 24 68 48 89 ca 41 b0 01 41 ff 96 f8 00 00 00 48 85 c0 0f 84 b7 01 00 00 48 89 c6 44 8b 68 10 49 83 be 08 01 00 00 00 0f 84 8b 00 00 00 48 8b 1e 48 89 ef 48 8b 6e 08 48 29 dd 48 03 5e 20 49 8b 8e 00 01 00 00 48 89 5c 24 70 48 89 6c 24 78 48 89 7c 24 Data Ascii: H1ufH[]_^A^A_H'GhAWAVAUATVWUSHHiH1H$y,HL$`LqIHD$hH$*fMcH^ IHwHrtA%HL$hHAAHHDhIHHHnH)H^ IH\$pHl$xH\|$
2023-11-14 10:11:31 UTC	399	IN	Data Raw: cd f6 ff ff 83 38 0e 0f 85 fa 01 00 00 48 8d 0d 0b 26 0a 00 e8 b8 dc fd ff 49 8b 4d 40 48 89 c2 e8 8c 75 fc ff 49 8b 8d d8 fd ff ff e8 f0 23 fd ff 49 89 85 18 fe ff ff 48 85 c0 0f 84 df 01 00 00 49 8b 45 08 48 8b 00 b9 04 00 00 00 ff 50 18 48 89 c6 49 8b 95 18 fe ff ff 48 8d 48 60 e8 7e e1 fd ff 48 83 c6 40 49 8b 4d 18 48 89 f2 e8 be 51 ff ff 49 8b 95 18 fe ff ff 48 8d 0d 98 0b 0b 00 e8 4b dc fd ff 49 8b 4d 40 48 89 c2 e8 1f 75 fc ff 49 8b 4d 48 48 8b 01 ff 90 c8 00 00 00 84 c0 75 15 49 8b 8c 24 80 02 00 00 48 8b 01 ff 90 d0 00 00 00 84 c0 74 1e 49 8b 95 18 fe ff ff 48 8d 0d 3e 18 0b 00 e8 06 dc fd ff 4c 89 e9 48 89 c2 e8 6b 61 ff ff 41 c7 04 24 a4 01 00 00 4c 89 e9 e8 fb 6b ff ff 84 c0 0f 85 e3 f5 ff ff 49 8b 8c 24 48 02 00 00 48 89 ca 41 b0 01 ff 51 30 Data Ascii: 8H&IM@HuI#IHIEHPHIHH`~H@IMHQIHKIM@HuIMHHuI$HtIH>LHkaA$LkI$HHAQ0
2023-11-14 10:11:31 UTC	407	IN	Data Raw: 48 31 e0 48 89 44 24 30 48 8d 05 da e5 08 00 48 39 01 74 19 48 8d 0d d4 12 0b 00 48 8d 15 b1 42 0b 00 41 b8 70 00 00 00 e8 90 36 06 00 48 8b 4e c8 48 85 c9 74 06 48 8b 01 ff 50 08 48 8b 4e c0 48 85 c9 74 06 48 8b 01 ff 50 08 40 8a ac 24 98 00 00 00 48 8b 4e e8 48 85 c9 74 06 48 8b 01 ff 50 18 48 8b bc 24 90 00 00 00 48 85 db 74 33 48 89 d9 ff 13 48 89 46 c0 48 8b 18 48 89 c1 4c 89 fa ff 53 18 48 8b 4e c0 48 8b 01 4c 89 f2 ff 50 10 48 8b 46 c0 48 8b 08 f6 41 5c 01 75 12 31 c9 eb 1c 48 c7 46 c0 00 00 00 00 c6 46 88 00 eb 33 8b 8e d8 00 00 00 c1 e9 09 f6 d1 80 e1 01 88 4e 88 48 8b 00 48 8b 50 60 48 8d 0d cb 05 0a 00 e8 bd bc fd ff 48 8b 8e 98 00 00 00 48 89 c2 e8 8e 55 fc ff 44 8a b4 24 b0 00 00 00 40 88 6e d0 48 85 ff 0f 84 9f 00 00 00 48 8b 9c 24 a0 00 00 Data Ascii: H1HD$0HH9tHHBAp6HNHtHPHNHtHP@$HNHtHPH$Ht3HHFHHLSHNHLPHFHA\u1HFF3NHHP`HHHUD$@nHH$
2023-11-14 10:11:31 UTC	414	IN	Data Raw: 84 24 28 02 00 00 00 00 00 00 c7 84 24 38 02 00 00 00 00 00 00 48 8d 8c 24 20 02 00 00 48 89 8c 24 40 02 00 00 e8 c7 a6 fd ff 48 8b 8c 24 40 02 00 00 e8 0a a6 fd ff 3c 0e 75 27 48 8b 94 24 40 02 00 00 48 8d 8c 24 60 01 00 00 e8 21 a7 fd ff 48 8b 84 24 40 02 00 00 83 78 18 00 0f 84 4f 04 00 00 48 8d 0d c4 ae 09 00 e8 e3 9d fd ff 49 8b 4c 24 40 48 89 c2 e8 b6 36 fc ff 48 8d 0d 27 d5 0a 00 e9 91 00 00 00 48 8b 94 24 20 02 00 00 48 8d 0d 2d b3 0a 00 e8 b6 9d fd ff 49 8b 4c 24 40 48 89 c2 e8 89 36 fc ff 48 8b bc 24 20 02 00 00 49 8b 8c 24 68 fd ff ff e8 24 df fe ff 48 8d 0d 32 d9 0a 00 48 89 c2 49 89 f8 e8 82 9d fd ff 4c 89 e1 48 89 c2 e8 e7 22 ff ff 49 8b 8c 24 78 fe ff ff e8 9a b1 fd ff e9 ae 00 00 00 48 8d 0d 2d b2 09 00 e9 77 03 00 00 48 8d 0d 01 ae 09 00 Data Ascii: $($8H$ H$@H$@<u'H$@H$`!H$@xOHIL$@H6H'H$ H-IL$@H6H$ I$h$H2HILH"I$xH-wH
2023-11-14 10:11:31 UTC	422	IN	Data Raw: 00 00 00 c7 40 08 01 00 00 00 c6 86 90 00 00 00 01 48 8b 8e 48 01 00 00 c7 86 c8 01 00 00 00 00 00 00 e8 ba 96 00 00 48 85 c0 74 6c 48 89 c7 48 89 c1 ff 90 98 00 00 00 48 8b 8e b8 02 00 00 89 c5 83 e5 04 80 b9 dd 00 00 00 00 ba 04 00 00 00 74 04 85 ed 75 15 83 e0 02 80 b9 dc 00 00 00 00 ba 02 00 00 00 74 31 85 c0 74 2d 89 96 c8 01 00 00 48 89 f9 ff 97 a0 00 00 00 48 89 c7 48 8b 8e 48 01 00 00 e8 88 8b fd ff 48 89 f9 e8 80 f9 fd ff 48 89 86 48 01 00 00 49 8b 44 24 08 48 8b 00 b9 32 00 00 00 ff 50 18 49 89 84 24 20 ff ff ff 49 8b 94 24 58 fe ff ff 48 8d 48 60 e8 60 83 fd ff 49 8b 84 24 60 fd ff ff 49 8b 8c 24 20 ff ff ff 48 8b 00 48 8b 50 38 48 83 c1 60 e8 40 83 fd ff 49 8b 8c 24 20 ff ff ff 48 83 c1 60 48 8d 15 01 82 09 00 e8 28 83 fd ff 49 8b 8c 24 20 ff Data Ascii: @HHHtlHHHtut1t-HHHHHHHID$H2PI$ I$XHH``I$`I$ HHP8H`@I$ H`H(I$
2023-11-14 10:11:31 UTC	430	IN	Data Raw: ff 48 89 f1 b2 32 e8 d6 62 fd ff 48 8b 97 08 01 00 00 48 89 f1 e8 c7 64 fd ff 48 8b 47 10 48 8b 00 48 8b 50 38 48 89 f1 e8 b4 64 fd ff 48 89 f1 4c 89 f2 e8 a9 64 fd ff 48 8b 03 48 89 44 24 38 48 8b 43 10 48 89 44 24 30 48 8b 87 98 00 00 00 48 8b 48 08 48 8b 50 18 4c 8d 44 24 30 4c 8d 4c 24 20 ff 51 48 48 89 d9 e8 94 73 fd ff 48 8d 15 a4 03 0a 00 4c 89 f1 e8 35 1c 06 00 48 8b 8f b8 02 00 00 48 8b 09 48 8b 51 18 85 c0 74 3d b9 32 00 00 00 ff d2 48 89 c3 48 8b 97 08 01 00 00 48 8d 70 60 48 89 f1 e8 36 64 fd ff 48 8b 47 10 48 8b 00 48 8b 50 38 48 89 f1 e8 23 64 fd ff 48 89 f1 4c 89 f2 e8 18 64 fd ff eb 0a b9 42 00 00 00 ff d2 48 89 c3 4c 8b 44 24 20 48 8b 54 24 28 48 8d 4b 60 e8 f9 62 fd ff 48 8b 4c 24 40 48 31 e1 e8 4c c9 04 00 48 89 d8 48 83 c4 48 5b 5f 5e Data Ascii: H2bHHdHGHHP8HdHLdHHD$8HCHD$0HHHHPLD$0LL$ QHHsHL5HHHQt=2HHHp`H6dHGHHP8H#dHLdBHLD$ HT$(HK`bHL$@H1LHHH[_^
2023-11-14 10:11:31 UTC	438	IN	Data Raw: 0f 84 a9 02 00 00 3d bc 06 00 00 0f 84 2c 06 00 00 41 c7 45 00 00 00 00 00 e9 6c 1b 00 00 49 8b 8d c0 04 00 00 48 89 fa e8 d4 62 fd ff 49 8b 8d 78 05 00 00 e8 d8 97 00 00 48 8b 28 4c 89 6c 24 28 48 8d 0d 69 f7 ff ff 48 89 4c 24 20 4c 8d 05 fc 82 09 00 48 8d 8c 24 50 02 00 00 48 89 c2 49 89 f1 ff 55 68 8b 84 24 50 02 00 00 48 8b 8c 24 54 02 00 00 8b 94 24 5c 02 00 00 48 8b ac 24 60 02 00 00 48 89 6b 10 48 8b ac 24 68 02 00 00 48 89 6b 18 89 03 48 89 4b 04 89 53 0c 41 c7 45 00 22 06 00 00 49 8d 85 88 03 00 00 41 8b 8d 88 03 00 00 85 c9 0f 84 d0 1a 00 00 83 c1 ff 83 f9 01 0f 86 84 1c 00 00 41 80 bd f3 01 00 00 00 0f 84 ea 00 00 00 49 8d 9d 88 03 00 00 49 8b bd 58 02 00 00 48 8b 77 48 49 8b 8d c0 04 00 00 48 89 fa 45 31 c0 e8 e9 6e fd ff 48 85 c0 74 19 c7 84 Data Ascii: =,AElIHbIxH(Ll$(HiHL$ LH$PHIUh$PH$T$\H$`HkH$hHkHKSAE"IAAIIXHwHIHE1nHt
2023-11-14 10:11:31 UTC	446	IN	Data Raw: 2d a2 fe ff 84 c0 74 75 4c 8d 35 51 c7 09 00 48 8d b4 24 60 01 00 00 48 8d bc 24 50 01 00 00 48 8d 9c 24 80 01 00 00 48 8d ac 24 70 01 00 00 eb 0f 48 89 d9 48 89 ea e8 f5 a1 fe ff 84 c0 74 3d 0f 10 84 24 70 01 00 00 0f 29 84 24 60 01 00 00 4c 89 b4 24 50 01 00 00 48 c7 84 24 58 01 00 00 0a 00 00 00 48 89 f1 48 89 fa e8 02 30 fd ff 84 c0 74 be 41 c6 85 86 03 00 00 01 eb b4 0f 28 84 24 e0 01 00 00 0f 29 84 24 80 01 00 00 48 8d 8c 24 80 01 00 00 48 8d 94 24 70 01 00 00 e8 8f a1 fe ff 84 c0 0f 84 c6 00 00 00 4c 8d b4 24 20 01 00 00 31 db 48 8d 35 86 49 08 00 48 8d bc 24 60 01 00 00 4c 8d bc 24 80 01 00 00 48 8d ac 24 70 01 00 00 eb 0a 48 83 c3 01 48 83 fb 11 74 79 48 89 d8 48 c1 e0 04 48 8b 04 30 48 8b 90 c0 00 00 00 0f 10 84 24 70 01 00 00 0f 29 84 24 60 01 Data Ascii: -tuL5QH$`H$PH$H$pHHt=$p)$`L$PH$XHH0tA($)$H$H$pL$ 1H5IH$`L$H$pHHtyHHH0H$p)$`
2023-11-14 10:11:31 UTC	453	IN	Data Raw: 72 df eb 26 48 8b 4b 18 4c 89 f2 e8 71 52 01 00 85 c0 0f 95 c0 eb 13 39 6b 18 76 04 31 c0 eb 0a 39 6b 1c 0f 93 c0 eb 02 b0 01 40 30 c6 40 80 e6 01 89 f0 48 83 c4 20 5b 5d 5f 5e 41 5e c3 48 8d 0d 5a ba 0a 00 48 8d 15 b9 6a 0a 00 41 b8 53 02 00 00 e8 e6 7a 05 00 e8 95 59 f9 ff cc 40 ff ff ff 77 ff ff ff e1 ff ff ff a7 ff ff ff ba ff ff ff 56 57 48 83 ec 28 8b 01 48 83 f8 04 77 5b 48 89 ce 48 8d 0d 70 00 00 00 48 63 04 81 48 01 c8 ff e0 48 83 7e 20 00 74 1f 31 ff 66 0f 1f 44 00 00 48 8b 46 18 48 8b 0c f8 e8 c3 ff ff ff 48 83 c7 01 48 3b 7e 20 72 e9 48 8b 4e 18 e8 50 0e fd ff eb 09 48 8b 4e 18 e8 a5 ff ff ff 48 89 f1 48 83 c4 28 5f 5e e9 37 0e fd ff 48 8d 0d 06 bd 0a 00 48 8d 15 1d 6a 0a 00 41 b8 4a 01 00 00 e8 4a 7a 05 00 e8 f9 58 f9 ff cc 99 ff ff ff 99 ff Data Ascii: r&HKLqR9kv19k@0@H []_^A^HZHjASzY@wVWH(Hw[HHpHcHH~ t1fDHFHHH;~ rHNPHNHH(_^7HHjAJJzX
2023-11-14 10:11:31 UTC	461	IN	Data Raw: 00 48 8d 35 b9 0f 08 00 eb 07 48 8d 35 90 0f 08 00 48 8d 94 24 c0 01 00 00 4c 89 f1 e8 20 09 00 00 84 c0 0f 84 24 01 00 00 48 b8 43 6f 6d 6d 65 6e 74 00 48 39 84 24 c0 01 00 00 0f 85 0c 01 00 00 4c 89 f1 e8 58 09 00 00 48 85 c0 0f 84 fb 00 00 00 89 ac 24 9c 00 00 00 48 89 b4 24 80 00 00 00 48 89 84 24 88 00 00 00 48 89 9c 24 a0 00 00 00 66 0f ef c0 66 0f 7f 84 24 f0 00 00 00 66 0f 7f 84 24 e0 00 00 00 48 c7 84 24 00 01 00 00 00 00 00 00 48 8d 94 24 c0 01 00 00 4c 89 f1 e8 9e 08 00 00 48 8d 0d c1 21 09 00 48 89 4c 24 78 84 c0 74 2c 48 b8 50 75 62 6c 69 63 2d 4c 48 33 84 24 c0 01 00 00 48 ba 63 2d 4c 69 6e 65 73 00 48 8b 8c 24 c5 01 00 00 48 31 d1 48 09 c1 74 76 31 db 45 31 ff 31 ed 45 31 ed 31 f6 48 8b 8c 24 88 00 00 00 e8 d9 ee fc ff 48 8b 8c 24 a0 00 00 Data Ascii: H5H5H$L $HCommentH9$LXH$H$H$H$ff$f$H$H$LH!HL$xt,HPublic-LH3$Hc-LinesH$H1Htv1E11E11H$H$
2023-11-14 10:11:31 UTC	469	IN	Data Raw: 24 c0 00 00 00 48 31 e1 e8 f4 2d 04 00 89 f0 48 81 c4 c8 00 00 00 5b 5f 5e 41 5e c3 be 0a 00 00 00 eb d0 be 08 00 00 00 eb c9 cc cc cc cc cc cc cc 41 57 41 56 56 57 53 48 83 ec 30 4d 89 ce 4c 89 c3 48 89 d7 4c 8b bc 24 80 00 00 00 4c 89 fa e8 7c d2 ff ff 48 85 c0 74 44 48 89 c6 48 89 c1 48 83 c1 18 4c 89 7c 24 20 48 89 fa 49 89 d8 4d 89 f1 e8 aa f0 ff ff 89 c3 48 8b 0e 48 8b 56 10 e8 5c 19 00 00 ba 40 00 00 00 48 89 f1 e8 4f 19 00 00 48 89 f1 e8 f7 cf fc ff 89 d8 eb 02 31 c0 48 83 c4 30 5b 5f 5e 41 5e 41 5f c3 cc cc cc cc cc 41 57 41 56 56 57 53 48 83 ec 50 49 89 d7 48 89 cf 48 8b 05 c8 30 0b 00 48 31 e0 48 89 44 24 48 48 85 d2 74 07 49 c7 07 00 00 00 00 48 8b 4f 20 31 f6 31 db 66 2e 0f 1f 84 00 00 00 00 00 66 90 e8 8b ca fc ff 3c 0a 0f 84 50 01 00 00 3c Data Ascii: $H1-H[_^A^AWAVVWSH0MLHL$L\|HtDHHHL\|$ HIMHHV\@HOH1H0[_^A^A_AWAVVWSHPIHH0H1HD$HHtIHO 11f.f<P<
2023-11-14 10:11:31 UTC	477	IN	Data Raw: 48 8d 05 6a 51 0b 00 48 89 46 08 48 8b 05 67 51 0b 00 48 89 46 10 48 89 28 48 8b 46 08 48 89 68 08 48 8b 0d 79 12 0b 00 ff 15 bb ba 0a 00 4c 89 e1 ff 15 ba b9 0a 00 45 85 f6 74 60 48 8b 4e 18 ba ff ff ff ff ff 15 0e bb 0a 00 80 7e 21 00 0f 84 dc fe ff ff 48 8d 3d 25 51 0b 00 48 89 f9 ff 15 24 b7 0a 00 48 8d 05 05 51 0b 00 48 89 46 08 48 8b 05 02 51 0b 00 48 89 46 10 48 89 28 48 8b 46 08 48 89 68 08 48 8b 0d 14 12 0b 00 ff 15 56 ba 0a 00 48 89 f9 ff 15 55 b9 0a 00 48 85 db 74 0b 48 8b 4c 24 30 ff 15 65 b6 0a 00 48 8b 4c 24 58 48 31 e1 e8 08 0e 04 00 31 c0 0f 28 74 24 60 48 83 c4 78 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 41 57 41 56 56 57 55 53 48 83 ec 48 45 89 cf 4c 89 c3 48 89 d7 48 89 cd 48 8b 05 61 11 0b 00 48 31 e0 48 89 44 24 40 b9 01 00 00 00 ba 50 Data Ascii: HjQHFHgQHFH(HFHhHyLEt`HN~!H=%QH$HQHFHQHFH(HFHhHVHUHtHL$0eHL$XH11(t$`Hx[]_^A\A]A^A_AWAVVWUSHHELHHHaH1HD$@P
2023-11-14 10:11:31 UTC	485	IN	Data Raw: 15 c2 d0 08 00 e8 47 03 00 00 48 8d 15 4b d4 08 00 48 89 f1 e8 e8 0b fd ff 48 89 f0 48 83 c4 28 5f 5e c3 48 8b 97 88 df ff ff 48 89 c1 e8 2f 0d fd ff 48 8b 8f 88 df ff ff e8 a3 f5 ff ff 48 c7 87 88 df ff ff 00 00 00 00 c6 87 81 df ff ff 01 c7 06 03 00 00 00 48 c7 46 10 00 00 00 00 eb b9 cc 56 48 83 ec 30 48 89 ce 48 83 b9 70 df ff ff 00 74 0c 48 8b 8e 78 df ff ff e8 82 db ff ff c6 46 da 01 44 8b 4e e8 48 8b 4e a0 4c 8b 46 e0 48 8b 01 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 ba 02 00 00 00 ff 10 90 48 83 c4 30 5e c3 48 8d 91 48 df ff ff 48 8d 0d 42 03 00 00 e9 6d 25 fb ff cc cc cc cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 20 48 83 b9 48 df ff ff 00 74 06 48 83 c4 20 5e c3 48 89 ce 48 81 c6 48 df ff ff 48 8d 0d 6c bc 08 00 e8 15 84 fc ff 48 89 06 Data Ascii: GHKHHH(_^HH/HHHFVH0HHptHxFDNHNLFHD$(HD$ H0^HHHBm%VH HHtH ^HHHHlH
2023-11-14 10:11:31 UTC	493	IN	Data Raw: c7 c0 ff ff ff ff eb 7e 48 c7 c0 ff ff ff ff 49 c7 c3 c1 ff ff ff e9 93 00 00 00 4d 89 ca 49 83 e2 fe 49 c7 c3 ff ff ff ff 31 d2 48 c7 c0 ff ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 8b 0c d0 49 8b 74 d0 08 48 89 cf 48 d1 ef 89 cb 83 e3 01 48 09 fb 48 0f 45 c1 4c 89 d9 48 0f 45 ca 48 89 f7 48 d1 ef 89 f3 83 e3 01 4c 8d 5a 01 48 09 fb 48 0f 45 c6 4c 0f 44 d9 48 83 c2 02 4c 39 d2 75 bb 41 f6 c1 01 74 1a 49 8b 3c d0 48 89 f9 48 d1 e9 89 fb 83 e3 01 48 09 cb 48 0f 45 c7 4c 0f 45 da 49 c1 e3 06 49 83 cb 01 31 c9 48 89 c2 48 c1 ea 20 48 0f 44 d0 0f 95 c1 48 c1 e1 05 48 89 d0 48 c1 e8 10 31 db 48 81 fa 00 00 01 00 0f 93 c3 48 0f 42 c2 48 c1 e3 04 48 09 cb 48 89 c1 48 c1 e9 08 31 d2 48 3d 00 01 00 00 0f 93 c2 48 0f 42 c8 48 8d 04 d3 48 89 ca 48 c1 Data Ascii: ~HIMII1Hf.DIItHHHHELHEHHLZHHELDHL9uAtI<HHHHELEII1HH HDHHH1HHBHHHH1H=HBHHH
2023-11-14 10:11:31 UTC	500	IN	Data Raw: cc 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec 38 01 00 00 4c 89 cf 4d 89 c7 48 89 d6 49 89 cc 48 8b 05 6a b4 0a 00 48 31 e0 48 89 84 24 30 01 00 00 4d 8b 28 48 8b 02 4c 39 e8 4c 0f 47 e8 48 8b 11 4c 39 ea 4c 0f 42 ea 4c 89 eb 4c 01 eb 48 8d 04 5b 49 39 01 73 1d 48 8d 0d 20 eb 09 00 48 8d 15 4d a3 09 00 41 b8 f7 03 00 00 e8 4c bf 04 00 49 8b 14 24 48 c1 e2 03 49 8b 4c 24 08 e8 5e 9c ff ff 4c 8b 36 49 83 fd 18 0f 82 a6 02 00 00 4d 85 f6 0f 84 9a 02 00 00 49 8b 0f 48 85 c9 0f 84 91 02 00 00 4c 89 e8 48 d1 e8 4c 89 ea 48 29 c2 49 39 d6 48 89 5c 24 28 48 89 d3 49 0f 42 de 48 89 9c 24 20 01 00 00 48 8b 76 08 48 89 b4 24 28 01 00 00 48 39 d1 49 89 f8 48 89 d7 48 0f 42 f9 48 89 bc 24 10 01 00 00 49 8b 6f 08 49 29 de 49 39 c6 4c 0f 43 f0 48 89 ac 24 18 01 00 00 Data Ascii: AWAVAUATVWUSH8LMHIHjH1H$0M(HL9LGHL9LBLLH[I9sH HMALI$HIL$^L6IMIHLHLH)I9H\$(HIBH$ HvH$(H9IHHBH$IoI)I9LCH$
2023-11-14 10:11:31 UTC	508	IN	Data Raw: ff 48 03 14 d8 40 0f 92 c7 48 01 f2 48 83 d7 00 48 89 14 d8 48 83 c3 01 48 89 fa 49 39 dd 74 09 49 39 19 77 cc 31 f6 eb d0 48 8b 4c 24 68 48 31 e1 e8 8b 91 03 00 4c 89 f0 48 83 c4 70 5b 5f 5e 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc cc cc cc 41 57 41 56 41 54 56 57 53 48 83 ec 28 4d 89 c6 49 89 d7 49 89 cc 48 8b 59 10 48 8d 3c dd 00 00 00 00 b9 01 00 00 00 ba 10 00 00 00 49 89 f8 e8 2c 33 fc ff 48 89 c6 48 85 db 75 19 48 8d 0d 4b 67 09 00 48 8d 15 d8 83 09 00 41 b8 48 00 00 00 e8 d7 9f 04 00 48 89 1e 48 89 f1 48 83 c1 10 48 89 4e 08 48 89 fa e8 e5 7c ff ff 4c 89 e1 48 89 f2 4d 89 f8 4d 89 f1 e8 74 fb ff ff 48 89 f0 48 83 c4 28 5b 5f 5e 41 5c 41 5e 41 5f c3 cc cc cc 48 8b 41 28 c3 cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 54 56 57 53 48 83 ec 28 49 Data Ascii: H@HHHHHI9tI9w1HL$hH1LHp[_^A\A]A^A_AWAVATVWSH(MIIHYH<I,3HHuHKgHAHHHHHNH\|LHMMtHH([_^A\A^A_HA(AWAVATVWSH(I
2023-11-14 10:11:31 UTC	516	IN	Data Raw: eb 39 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 4c 8b 14 ef 49 21 f1 31 d2 48 01 c1 0f 92 c2 4c 01 d1 48 83 d2 00 48 89 0c ef 48 83 c5 01 4d 8b 55 00 48 89 d0 4c 39 d5 73 36 89 da 48 89 e9 4c 31 c1 48 89 cf 48 d1 ef 83 e1 01 31 db 48 09 f9 0f 94 c3 09 d3 48 89 d9 48 f7 d9 4c 21 c9 48 8d 73 ff 49 8b 7d 08 49 39 ea 77 a5 45 31 d2 eb a4 b9 01 00 00 00 ba 10 00 00 00 48 8b 74 24 60 49 89 f0 e8 e9 13 fc ff 48 83 7c 24 30 00 48 89 44 24 30 75 1e 48 8d 0d 03 48 09 00 48 8d 15 90 64 09 00 41 b8 48 00 00 00 e8 8f 80 04 00 48 8b 44 24 30 48 8b 4c 24 28 48 89 08 48 89 c1 48 83 c1 10 48 89 48 08 48 89 f2 e8 93 5d ff ff 4c 8b 5c 24 30 49 8b 1b 48 85 db 4c 8b 54 24 20 4c 8b 7c 24 50 74 7d 4d 8d 87 c0 00 00 00 49 c1 e8 06 31 ff b9 01 00 00 00 31 c0 31 f6 eb 2d 0f 1f Data Ascii: 9f.DLI!1HLHHHMUHL9s6HL1HH1HHHL!HsI}I9wE1Ht$`IH\|$0HD$0uHHHdAHHD$0HL$(HHHHHH]L\$0IHLT$ L\|$Pt}MI111-
2023-11-14 10:11:31 UTC	524	IN	Data Raw: 00 00 ba 10 00 00 00 4d 89 f8 e8 22 f5 fb ff 48 89 c7 48 85 db 75 19 48 8d 0d 41 29 09 00 48 8d 15 ce 45 09 00 41 b8 48 00 00 00 e8 cd 61 04 00 48 89 1f 48 89 f9 48 83 c1 10 48 89 4f 08 4c 89 fa e8 db 3e ff ff 48 89 f1 4c 89 f2 45 31 c0 49 89 f9 e8 ca da ff ff 48 8b 16 48 8b 4e 08 48 c1 e2 03 e8 ba 3e ff ff ba 10 00 00 00 48 89 f1 e8 ad 3e ff ff 48 89 f1 e8 55 f5 fb ff 48 89 f8 48 83 c4 20 5b 5f 5e 41 5e 41 5f c3 cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 53 48 83 ec 20 4c 89 c3 48 89 d7 49 89 cc 48 89 d1 4c 89 e2 e8 7d a0 ff ff 49 89 c6 48 89 c1 48 89 da e8 0f ff ff ff 49 89 c5 48 8b 37 48 8d 3c f5 00 00 00 00 b9 01 00 00 00 ba 10 00 00 00 49 89 f8 e8 4f f4 fb ff 49 89 c7 48 85 f6 75 19 48 8d 0d 6e 28 09 00 48 8d 15 fb 44 09 00 41 b8 48 00 00 00 e8 Data Ascii: M"HHuHA)HEAHaHHHHOL>HLE1IHHNH>H>HUHH [_^A^A_AWAVAUATVWSH LHIHL}IHHIH7H<IOIHuHn(HDAH
2023-11-14 10:11:31 UTC	532	IN	Data Raw: 85 c0 75 dd 41 c6 87 88 00 00 00 01 eb d3 4c 89 f9 e8 fb 0c 00 00 84 c0 0f 84 c4 01 00 00 49 8b 47 18 48 8b 08 31 d2 41 b8 0a 00 00 00 e8 7f 9a 04 00 49 89 47 78 e9 a7 01 00 00 a8 03 0f 84 bd 00 00 00 83 f8 03 0f 85 96 01 00 00 b9 01 00 00 00 ba 38 00 00 00 45 31 c0 e8 93 d5 fb ff 48 89 c3 0f 57 c0 0f 11 00 0f 11 40 10 0f 11 40 20 48 c7 40 30 00 00 00 00 e8 45 dc fb ff 48 89 43 10 e8 3c dc fb ff 48 89 43 18 e8 33 dc fb ff 48 89 43 20 e8 2a dc fb ff 48 89 43 28 c7 43 08 00 00 00 00 4c 89 f9 e8 67 0c 00 00 84 c0 0f 84 9a 00 00 00 49 8b 45 00 48 8b 08 48 8d 15 e7 6c 08 00 e8 88 3e 04 00 85 c0 0f 84 97 00 00 00 49 8b 45 00 48 8b 08 48 8d 15 da d9 07 00 e8 6d 3e 04 00 85 c0 0f 84 4a 01 00 00 49 8b 45 00 4c 8b 00 48 8d 15 8c 5e 08 00 48 89 d9 e8 63 0b 00 00 eb Data Ascii: uALIGH1AIGx8E1HW@@ H@0EHC<HC3HC *HC(CLgIEHHl>IEHHm>JIELH^Hc
2023-11-14 10:11:31 UTC	539	IN	Data Raw: 22 48 8b 35 51 29 07 00 4c 8d 47 08 48 8d 4f 04 48 8d 5c 24 68 48 89 5c 24 60 48 8d 5c 24 6c 48 89 5c 24 58 4c 89 64 24 50 4c 89 5c 24 40 89 54 24 28 48 89 74 24 20 48 c7 44 24 48 00 00 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 00 00 00 00 31 d2 4d 89 d1 ff 90 90 00 00 00 89 07 4d 85 ff 74 07 8b 44 24 68 41 89 07 4d 85 f6 74 21 83 7c 24 68 ff 74 10 31 c9 e8 e8 21 04 00 8b 4c 24 68 48 01 c1 eb 07 48 c7 c1 ff ff ff ff 49 89 0e 8b 07 31 c9 83 f8 01 0f 95 c1 8d 34 89 83 c6 01 85 c0 0f 44 f0 48 8b 4c 24 70 48 31 e1 e8 0f 14 03 00 89 f0 48 83 c4 78 5b 5f 5e 41 5c 41 5e 41 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 30 48 89 c8 48 8b 0d 71 17 0a 00 48 31 e1 48 89 4c 24 28 48 8d 4c 24 24 ff 90 98 00 00 00 89 c6 85 c0 b8 06 00 00 00 0f 45 f0 Data Ascii: "H5Q)LGHOH\$hH\$`H\$lH\$XLd$PL\$@T$(Ht$ HD$HHD$8D$01MMtD$hAMt!\|$ht1!L$hHHI14DHL$pH1Hx[_^A\A^A_VH0HHqH1HL$(HL$$E
2023-11-14 10:11:31 UTC	547	IN	Data Raw: 8b 4f 10 89 da e8 e7 b4 fb ff 49 89 c4 83 c3 01 48 85 c0 0f 84 03 03 00 00 41 83 3c 24 02 75 df 4d 8b 4c 24 20 4d 85 c9 4c 89 e8 48 0f 44 c7 41 8b 4c 24 08 48 89 f5 48 0f 44 ef 4c 0f 44 cf 49 8b 54 24 10 48 85 d2 4c 8d 05 1f 72 08 00 4c 0f 44 c7 48 0f 44 d7 48 89 44 24 30 89 4c 24 28 48 89 6c 24 20 48 8d 0d cd ba 07 00 e8 a1 8a fb ff 48 89 44 24 60 41 83 7c 24 04 44 75 14 31 c0 48 89 44 24 58 e9 28 01 00 00 0f 1f 84 00 00 00 00 00 4d 8b 44 24 28 4d 85 c0 4c 89 e8 48 0f 44 c7 49 89 f1 4c 0f 44 cf 41 8b 4c 24 0c 4c 0f 44 c7 49 8b 54 24 18 48 89 44 24 28 89 4c 24 20 48 8d 0d 80 ba 07 00 e8 47 8a fb ff 48 89 44 24 58 41 8b 44 24 04 83 f8 44 0f 84 d4 00 00 00 83 f8 4c 0f 85 86 01 00 00 41 8b 44 24 38 49 8d 74 24 40 4c 8b 7c 24 50 4d 8b 17 4d 8b 44 24 10 45 8b Data Ascii: OIHA<$uML$ MLHDAL$HHDLDIT$HLrLDHDHD$0L$(Hl$ HHD$`A\|$Du1HD$X(MD$(MLHDILDAL$LDIT$HD$(L$ HGHD$XAD$DLAD$8It$@L\|$PMMD$E
2023-11-14 10:11:31 UTC	555	IN	Data Raw: ff ff 48 81 c1 50 ff ff ff 4c 8d 05 b1 ff ff ff 31 c0 84 d2 4c 0f 44 c0 48 8d 15 36 11 08 00 45 31 c9 e8 4a 40 fd ff 48 89 c7 48 8d 48 60 48 89 f2 e8 ab 70 fb ff 48 83 c7 40 48 8b 8b 00 01 00 00 48 89 fa 48 83 c4 20 5b 5f 5e e9 e1 e0 fc ff cc 56 57 53 48 83 ec 20 4c 89 c6 48 8b 99 50 ff ff ff 48 81 c1 50 ff ff ff 4c 8d 05 51 ff ff ff 31 c0 84 d2 4c 0f 44 c0 48 8d 15 46 c7 07 00 45 31 c9 e8 ea 3f fd ff 48 89 c7 48 8d 48 60 48 89 f2 e8 4b 70 fb ff 48 83 c7 40 48 8b 8b 00 01 00 00 48 89 fa e8 88 e0 fc ff b0 01 48 83 c4 20 5b 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 48 8d 0d 87 1b 09 00 48 8d 15 cc c9 08 00 41 b8 7e 01 00 00 e8 1f e4 03 00 e8 ce c2 f7 ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 48 8d 0d 57 1b 09 00 48 8d 15 Data Ascii: HPL1LDH6E1J@HHH`HpH@HHH [_^VWSH LHPHPLQ1LDHFE1?HHH`HKpH@HHH [_^H(HHA~H(HWH
2023-11-14 10:11:31 UTC	563	IN	Data Raw: 00 48 89 4c 24 20 48 c7 44 24 28 04 00 00 00 48 8d 54 24 20 89 c1 e8 36 22 00 00 85 db 0f 85 4a ff ff ff 85 c0 0f 94 c3 48 8b 4c 24 30 48 31 e1 e8 cc b6 02 00 89 d8 48 83 c4 38 5b 5f 5e 41 5c 41 5e 41 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 28 b9 01 00 00 00 ba 28 00 00 00 45 31 c0 e8 88 58 fb ff 48 89 c6 b9 01 00 00 00 ba fc 8f 03 00 45 31 c0 e8 73 58 fb ff 48 85 c0 74 41 48 89 c7 48 89 06 41 b8 00 00 03 00 48 89 c1 b2 ff e8 88 cf 02 00 48 89 f9 48 81 c1 04 80 03 00 41 b8 ee 0f 00 00 b2 ff e8 71 cf 02 00 c7 87 00 80 03 00 00 00 00 00 c7 87 f8 8f 03 00 00 00 00 00 48 89 f7 48 83 c7 20 48 8d 05 9f 82 06 00 48 89 46 20 48 8d 05 74 16 00 00 48 89 46 10 48 8d 05 69 17 00 00 48 89 46 18 b9 01 00 00 00 ba 18 00 00 00 45 31 c0 e8 f3 57 fb ff 0f Data Ascii: HL$ HD$(HT$ 6"JHL$0H1H8[_^A\A^A_VWH((E1XHE1sXHtAHHAHHHAqHH HHF HtHFHiHFE1W
2023-11-14 10:11:31 UTC	571	IN	Data Raw: 00 89 c8 83 e0 01 8d 34 70 d1 f9 83 c7 ff 75 f1 e9 5c ff ff ff 41 83 fd 09 b8 09 00 00 00 41 0f 4c c5 89 44 24 28 c7 44 24 20 00 00 00 00 48 8d 4c 24 60 4c 89 e2 45 31 c9 e8 33 00 00 00 48 89 c6 48 8b 8c 24 60 05 00 00 48 31 e1 e8 70 97 02 00 48 89 f0 48 81 c4 68 05 00 00 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 48 44 89 4c 24 3c 45 89 c7 49 89 d5 48 89 4c 24 40 8b 9c 24 b8 00 00 00 44 8b a4 24 b0 00 00 00 bd 01 00 00 00 b9 01 00 00 00 ba 10 00 00 00 45 31 c0 e8 fa 38 fb ff 48 89 c7 41 be ff ff ff ff 44 89 e1 41 d3 e6 be ff ff ff ff 89 d9 48 d3 e5 ba 10 00 00 00 48 89 e9 45 31 c0 e8 d1 38 fb ff 49 89 d9 48 89 47 08 44 89 c9 d3 e6 f7 d6 89 37 66 c7 40 02 ff ff 48 8b 47 08 c6 00 00 48 8b Data Ascii: 4pu\AALD$(D$ HL$`LE13HH$`H1pHHh[]_^A\A]A^A_AWAVAUATVWUSHHDL$<EIHL$@$D$E18HADAHHE18IHGD7f@HGH
2023-11-14 10:11:31 UTC	578	IN	Data Raw: 9d fe ff 48 c7 46 28 00 00 00 00 48 8b 4e 30 48 85 c9 74 0d e8 b8 9d fe ff 48 c7 46 30 00 00 00 00 48 83 c4 20 5e c3 cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 20 48 89 ce 48 8b 49 18 48 85 c9 74 0d e8 8a 9d fe ff 48 c7 46 18 00 00 00 00 48 8b 4e 20 48 85 c9 74 0d e8 74 9d fe ff 48 c7 46 20 00 00 00 00 48 8b 4e 28 48 85 c9 74 0d e8 5e 9d fe ff 48 c7 46 28 00 00 00 00 48 8b 4e 30 48 85 c9 74 0d e8 48 9d fe ff 48 c7 46 30 00 00 00 00 48 8b 4e 08 48 85 c9 74 0d e8 32 9d fe ff 48 c7 46 08 00 00 00 00 48 8b 4e 10 48 85 c9 74 0d e8 1c 9d fe ff 48 c7 46 10 00 00 00 00 48 8b 4e 38 48 85 c9 74 0d e8 46 1a fb ff 48 c7 46 38 00 00 00 00 48 83 c4 20 5e c3 cc cc cc cc cc cc cc cc 56 57 48 83 ec 68 48 89 cf 48 8b 05 20 7b 09 00 48 31 e0 48 89 44 24 60 48 8b 02 48 8b 4a Data Ascii: HF(HN0HtHF0H ^VH HHIHtHFHN HttHF HN(Ht^HF(HN0HtHHF0HNHt2HFHNHtHFHN8HtFHF8H ^VWHhHH {H1HD$`HHJ
2023-11-14 10:11:31 UTC	586	IN	Data Raw: fd 41 83 c0 f8 48 83 c7 08 41 83 f8 08 0f 87 9e fd ff ff 48 8b 44 24 28 48 89 c5 48 c1 ed 08 48 89 c1 48 c1 e9 10 48 89 c2 48 c1 ea 30 88 44 24 4f 40 88 6c 24 4e 88 4c 24 4d 44 88 6c 24 4c 44 88 74 24 4b 44 88 7c 24 4a 88 54 24 49 eb 00 44 88 64 24 48 48 8d 4c 24 48 ba 08 00 00 00 e8 be 44 fe ff 48 8b 4c 24 50 48 31 e1 e8 d1 58 02 00 90 48 83 c4 58 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 20 48 89 ce b9 01 00 00 00 ba a0 01 00 00 45 31 c0 e8 86 fa fa ff 48 89 b0 98 01 00 00 48 05 98 01 00 00 48 83 c4 20 5e c3 cc cc cc 56 48 83 ec 20 48 89 ce 48 81 c6 68 fe ff ff ba a0 01 00 00 48 89 f1 e8 44 44 fe ff 48 89 f1 48 83 c4 20 5e e9 e7 fa fa ff cc cc cc cc cc cc cc 0f b6 42 07 44 0f b6 42 06 44 0f b6 4a 05 Data Ascii: AHAHD$(HHHHHH0D$O@l$NL$MDl$LDt$KD\|$JT$IDd$HHL$HDHL$PH1XHX[]_^A\A]A^A_VH HE1HHH ^VH HHhHDDHH ^BDBDJ
2023-11-14 10:11:31 UTC	594	IN	Data Raw: 0f b6 f2 41 03 9c b1 00 0c 00 00 31 c3 41 33 99 08 10 00 00 89 d8 c1 e8 18 89 d9 c1 e9 10 0f b6 c9 41 8b 8c 89 00 04 00 00 41 03 0c 81 0f b6 c7 41 33 8c 81 00 08 00 00 0f b6 c3 41 03 8c 81 00 0c 00 00 31 d1 41 33 89 04 10 00 00 41 33 99 00 10 00 00 41 89 18 41 89 48 04 5b 5e c3 cc cc cc cc 56 57 53 48 83 ec 70 48 89 d3 48 89 cf 48 8b 05 1c 3d 09 00 48 31 e0 48 89 44 24 68 48 8b 01 83 78 48 41 72 1c 48 8d 0d 32 72 08 00 48 8d 15 21 4f 08 00 41 b8 0f 00 00 00 e8 1e 48 03 00 48 8b 07 48 8d 74 24 20 48 89 f9 48 89 f2 ff 50 20 48 8b 07 4c 63 40 48 48 89 f1 48 89 da e8 7f 7a 01 00 85 c0 0f 95 c3 ba 40 00 00 00 48 89 f1 e8 0d 25 fe ff 48 8b 4c 24 68 48 31 e1 e8 20 39 02 00 89 d8 48 83 c4 70 5b 5f 5e c3 cc cc cc cc cc cc 56 57 55 53 48 83 ec 28 44 89 ce 44 89 c5 Data Ascii: A1A3AAA3A1A3A3AAH[^VWSHpHHH=H1HD$hHxHArH2rH!OAHHHt$ HHP HLc@HHHz@H%HL$hH1 9Hp[_^VWUSH(DD
2023-11-14 10:11:31 UTC	602	IN	Data Raw: 0f 84 81 00 00 00 48 8b 85 20 02 00 00 4c 8b 85 28 02 00 00 49 83 c0 18 0f 10 40 08 48 8b 01 48 8b 40 18 0f 11 84 24 c0 00 00 00 48 8d 94 24 c0 00 00 00 ff d0 84 c0 0f 85 dd 00 00 00 48 8b 8d 80 05 00 00 48 8d 15 b0 b1 06 00 e8 c1 5b f9 ff e9 b0 f8 ff ff 48 8b 8d 80 05 00 00 48 8d 15 dc 06 07 00 e8 19 5d f9 ff e9 98 f8 ff ff 48 8b b5 78 04 00 00 48 8b 8d 80 05 00 00 48 8d 15 b4 e5 06 00 e9 62 06 00 00 48 8b 8d 58 01 00 00 48 8b 95 10 02 00 00 e8 17 e8 ff ff 48 85 c0 74 4a 48 8b 8d 80 05 00 00 48 8d 15 7b e8 06 00 49 89 c0 e8 5c 5b f9 ff e9 4b f8 ff ff 48 8b 85 30 05 00 00 48 8b 80 90 00 00 00 8b 48 04 8b 50 08 e8 4e 31 fc ff 44 8b 03 48 8b 8d 80 05 00 00 48 8d 15 52 ca 07 00 e9 14 f8 ff ff 48 8b 8d 58 01 00 00 48 8b 95 10 02 00 00 e8 25 e8 ff ff 48 89 c6 Data Ascii: H L(I@HH@$H$HH[HH]HxHHbHXHHtJHH{I\[KH0HHPN1DHHRHXH%H
2023-11-14 10:11:31 UTC	610	IN	Data Raw: f9 48 89 f2 e8 98 95 fe ff 48 89 c3 4c 89 f9 e8 bd 20 fe ff 48 89 f1 e8 b5 20 fe ff 48 8b 47 e8 48 8b 50 40 4c 89 e9 e8 a5 6b fe ff 48 89 c6 4c 89 e9 e8 9a 20 fe ff 48 8b 47 e8 4c 8b 40 40 48 89 d9 48 89 f2 e8 77 63 fe ff 49 89 c7 48 89 d9 e8 7c 20 fe ff 48 89 f1 e8 74 20 fe ff 48 8b 07 48 8b 90 c0 00 00 00 49 8b 4e 10 e8 b1 95 fa ff e8 cc a3 fa ff 48 89 c6 48 8d 78 18 48 89 f9 4c 89 e2 e8 3a 3b fe ff 48 89 f9 4c 89 fa e8 2f 3b fe ff 49 8b 4e 10 48 89 f2 e8 03 96 fa ff 4c 89 e1 e8 2b 20 fe ff 4c 89 f9 e8 23 20 fe ff 48 8b 4c 24 58 48 31 e1 e8 c6 fa 01 00 90 48 83 c4 60 5b 5f 5e 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec 98 00 00 00 4d 89 c4 48 89 ce 48 8b 05 20 fe 08 00 48 31 e0 48 89 84 24 90 00 00 00 48 8b 01 Data Ascii: HHL H HGHP@LkHL HGL@@HHwcIH\| Ht HHINHHxHL:;HL/;INHL+ L# HL$XH1H`[_^A\A]A^A_AWAVAUATVWUSHMHH H1H$H
2023-11-14 10:11:31 UTC	618	IN	Data Raw: 3c b5 00 00 00 00 49 8d 1c b4 48 83 c3 08 44 29 c6 41 0f 42 f1 48 c1 e6 02 48 29 f5 4c 01 e5 4f 8d 04 84 49 83 c0 04 4e 8d 0c 95 00 00 00 00 49 29 f1 4d 01 e1 4b 8d 14 94 48 83 c2 04 48 83 cf 04 48 29 f7 4c 01 e7 48 39 d5 0f 92 44 24 38 4d 39 c1 0f 92 44 24 2c 48 39 dd 40 0f 92 c6 4c 39 c7 40 0f 92 c5 49 39 d9 41 0f 92 c0 48 39 d7 41 0f 92 c1 8a 54 24 2c 84 54 24 38 0f 85 57 01 00 00 40 20 ee 0f 85 4e 01 00 00 45 20 c8 0f 85 45 01 00 00 8b 54 24 40 83 e2 fc 48 89 54 24 38 83 c2 fc 89 d6 c1 ee 02 83 c6 01 85 d2 48 8b 54 24 20 89 74 24 2c 0f 84 84 03 00 00 83 e6 fe 8d 7a fb 45 31 db 66 0f ef c0 48 8b 5c 24 30 0f 1f 40 00 44 8d 47 04 f3 43 0f 6f 4c 84 f4 44 8d 4b ff f3 43 0f 6f 54 8c f4 66 0f fe d1 f3 43 0f 7f 54 8c f4 f3 43 0f 6f 4c 84 f4 89 da f3 41 0f 6f Data Ascii: <IHD)ABHH)LOINI)MKHHH)LH9D$8M9D$,H9@L9@I9AH9AT$,T$8W@ NE ET$@HT$8HT$ t$,zE1fH\$0@DGCoLDKCoTfCTCoLAo
2023-11-14 10:11:31 UTC	625	IN	Data Raw: d2 f7 f1 48 89 56 08 81 fd 00 40 00 00 4c 89 e7 0f 82 4b ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 4c 8b 4e 10 48 8b 4e 20 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 b8 04 00 00 00 4c 89 fa e8 5c 5f fa ff 48 89 46 20 48 8b 4e 10 48 8d 51 01 48 89 56 10 c7 04 88 01 00 00 00 81 c5 ff 00 00 00 89 e8 c1 e8 08 81 fd ff ff 3f 00 89 c5 77 b0 e9 ed fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 4c 8b 4e 10 48 8b 4e 20 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 b8 04 00 00 00 4c 89 fa e8 fc 5e fa ff 48 89 46 20 48 8b 4e 10 48 8d 51 01 48 89 56 10 c7 04 88 00 00 00 00 48 8b 0e 48 8b 46 08 48 83 c0 01 48 89 c2 48 09 ca 48 c1 ea 20 0f 84 4b fe ff ff 31 d2 48 f7 f1 e9 45 fe ff ff 49 83 fd 01 74 19 48 8d 0d ab ee 07 00 48 8d 15 0c ad 07 00 41 b8 b5 02 00 00 e8 bd ca 02 Data Ascii: HV@LKf.LNHN D$(HD$ AL\_HF HNHQHV?wf.LNHN D$(HD$ AL^HF HNHQHVHHFHHHH K1HEItHHA
2023-11-14 10:11:31 UTC	633	IN	Data Raw: 0f ef e4 66 0f 61 d4 66 0f 61 dc 66 0f 6f 25 7e 98 05 00 66 0f fe d4 66 0f fe dc 66 0f 72 d2 10 66 0f fe c2 66 0f 72 d3 10 66 0f fe cb 66 0f 76 d2 66 0f fe c2 66 0f fe ca 66 0f fe c1 66 0f 70 c8 ee 66 0f fe c8 66 0f 70 c1 55 66 0f fe c1 66 0f 7e c5 4c 39 e0 74 24 66 0f 1f 84 00 00 00 00 00 0f b7 0c 46 81 c1 ff ff 00 00 c1 e9 10 01 cd 83 c5 ff 48 83 c0 01 49 39 c4 75 e5 89 f8 31 e8 0f b7 c0 05 ff ff 00 00 c1 e8 10 f7 d8 48 85 ff 0f 84 25 01 00 00 83 ff 10 73 07 31 c9 e9 f7 00 00 00 89 f9 83 e1 f0 66 0f 6e c0 f2 0f 70 c0 00 66 0f 70 c0 00 48 8d 51 f0 48 89 d3 48 c1 eb 04 48 83 c3 01 48 85 d2 0f 84 52 02 00 00 48 89 dd 48 83 e5 fe 31 d2 66 0f 6f 0d 23 98 05 00 66 0f db c8 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f3 0f 6f 14 56 f3 0f 6f 5c 56 10 f3 0f 6f Data Ascii: fafafo%~fffrffrffvffffpffpUff~L9t$fFHI9u1H%s1fnpfpHQHHHHRHH1fo#ff.DoVo\Vo
2023-11-14 10:11:31 UTC	641	IN	Data Raw: 0f d5 d8 66 0f 6f c3 66 0f 69 c0 66 0f 61 db 66 0f fa cb 66 0f fa e0 66 0f 72 f4 10 66 0f 72 e4 10 66 0f 72 f1 10 66 0f 72 e1 10 66 0f 6b cc f3 0f 7f 0c 37 48 83 c6 10 49 39 f0 0f 85 50 fe ff ff 4c 39 f3 74 40 66 2e 0f 1f 84 00 00 00 00 00 90 0f b7 2c 5f 01 d5 48 89 c6 48 0f af f5 48 c1 ee 30 0f af f1 29 f5 89 ee f7 d6 44 01 ee c1 ee 0f 83 e6 01 0f af f1 29 f5 66 89 2c 5f 48 83 c3 01 49 39 de 75 cb 49 8b 4f 20 e8 82 20 fa ff 4c 89 f9 e8 7a 20 fa ff 48 8b 4c 24 48 48 31 e1 e8 dd 7d 01 00 48 8b 44 24 28 0f 28 74 24 50 0f 28 7c 24 60 44 0f 28 44 24 70 44 0f 28 8c 24 80 00 00 00 44 0f 28 94 24 90 00 00 00 44 0f 28 9c 24 a0 00 00 00 44 0f 28 a4 24 b0 00 00 00 44 0f 28 ac 24 c0 00 00 00 44 0f 28 b4 24 d0 00 00 00 48 81 c4 e8 00 00 00 5b 5d 5f 5e 41 5c 41 5d 41 Data Ascii: fofifafffrfrfrfrfk7HI9PL9t@f.,_HHH0)D)f,_HI9uIO Lz HL$HH1}HD$((t$P(\|$`D(D$pD($D($D($D($D($D($H[]_^A\A]A
2023-11-14 10:11:31 UTC	649	IN	Data Raw: 8b 42 04 89 41 14 8b 42 08 89 41 18 8b 42 0c 89 41 1c 8b 42 10 89 41 20 8b 42 14 89 41 24 8b 42 18 89 41 28 8b 42 1c 89 41 2c c7 81 80 00 00 00 40 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 54 56 57 55 53 48 81 ec 80 00 00 00 4d 89 cf 4c 89 c6 49 89 d6 48 89 cb 8b ac 24 e0 00 00 00 48 8b 05 65 62 08 00 48 31 e0 48 89 44 24 78 48 8d 0d 36 74 05 00 ff 15 30 74 05 00 48 89 c7 48 85 c0 74 09 48 8b 07 48 89 f9 ff 50 08 48 8b 4f 08 48 89 da e8 53 fa f9 ff 48 8b 4f 08 48 89 f2 e8 d7 9e fd ff 48 8b 07 4c 8d 64 24 30 48 89 f9 4c 89 e2 ff 50 18 48 8b 07 48 89 f9 ff 50 08 48 8b 4f 08 41 b8 40 00 00 00 4c 89 e2 e8 5b f6 f9 ff 4c 63 c5 48 8b 4f 08 4c 89 fa e8 4c f6 f9 ff 48 8b 07 48 89 f9 4c 89 e2 ff 50 18 48 8b 07 48 89 f9 ff 50 20 4c 89 f1 e8 8f Data Ascii: BABABABA BA$BA(BA,@AWAVATVWUSHMLIH$HebH1HD$xH6t0tHHtHHPHOHSHOHHLd$0HLPHHPHOA@L[LcHOLLHHLPHHP L
2023-11-14 10:11:31 UTC	657	IN	Data Raw: ff e9 10 03 00 00 80 79 01 00 0f 85 5c ff ff ff 4c 8b 80 c0 00 00 00 48 8b 84 24 18 01 00 00 48 8b 48 10 48 8d 15 c4 f3 06 00 e8 82 dc f9 ff e9 28 fe ff ff 48 8b 9c 24 18 01 00 00 48 8b 4b 10 48 8d 15 13 07 07 00 e8 65 dc f9 ff 44 8b 46 a8 41 83 f8 01 0f 84 46 02 00 00 41 83 f8 02 48 8b 7c 24 28 0f 85 4e 02 00 00 48 8b 4b 10 48 8d 15 85 e4 05 00 e8 38 dc f9 ff e9 49 02 00 00 48 39 46 c8 0f 86 69 02 00 00 48 8b 4e b8 48 8b 41 10 48 85 c0 4c 8b bc 24 18 01 00 00 48 8b 6c 24 30 0f 84 7c 02 00 00 48 8b 49 08 48 89 4c 24 70 48 89 84 24 80 00 00 00 48 c7 44 24 78 00 00 00 00 c7 84 24 88 00 00 00 00 00 00 00 48 89 bc 24 90 00 00 00 4c 8d 6c 24 60 48 8d 5c 24 40 4c 89 e9 48 89 fa e8 c9 dd f9 ff 48 8b 84 24 90 00 00 00 83 78 18 00 0f 85 ab 02 00 00 0f 10 44 24 60 Data Ascii: y\LH$HHH(H$HKHeDFAFAH\|$(NHKH8IH9FiHNHAHL$Hl$0\|HIHL$pH$HD$x$H$Ll$`H\$@LHH$xD$`
2023-11-14 10:11:31 UTC	664	IN	Data Raw: 5e 48 ff 60 08 cc cc cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 20 48 8b 35 5c 43 05 00 48 8b 46 08 80 38 00 74 0f 80 78 01 00 74 23 48 8d 0d f6 42 05 00 eb 4b ff 16 48 8b 4e 08 88 41 01 48 8b 46 08 c6 00 01 48 8b 46 08 80 78 01 00 75 dd 48 8b 35 ab 43 05 00 48 8b 46 08 80 38 00 75 14 ff 16 48 8b 4e 08 88 41 01 48 8b 46 08 c6 00 01 48 8b 46 08 80 78 01 00 74 23 48 8d 0d 31 43 05 00 ff 11 48 89 c6 48 85 c0 74 09 48 8b 06 48 89 f1 ff 50 08 48 89 f0 48 83 c4 20 5e c3 48 8d 0d 42 65 07 00 48 8d 15 ab 19 07 00 41 b8 24 00 00 00 e8 c8 2e 02 00 e8 77 0d f6 ff cc cc cc cc cc cc cc 56 53 44 0f be 01 41 8d 40 bf 3c 19 77 06 41 83 c0 bf eb 1a 41 8d 40 9f 3c 19 77 06 41 83 c0 b9 eb 0c 41 8d 40 d0 3c 09 77 33 41 83 c0 04 44 0f be 49 01 41 8d 41 bf 3c 1a 73 06 41 83 c1 Data Ascii: ^H`VH H5\CHF8txt#HBKHNAHFHFxuH5CHF8uHNAHFHFxt#H1CHHtHHPHH ^HBeHA$.wVSDA@<wAA@<wAA@<w3ADIAA<sA
2023-11-14 10:11:31 UTC	672	IN	Data Raw: c1 f3 41 0f 7f 2e f3 41 0f 7f 46 10 48 83 c4 28 5b 5f 5e 41 5e c3 cc cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 20 48 8b 71 e0 48 81 c1 70 ff ff ff ba a0 00 00 00 e8 26 ed fc ff 48 89 f1 48 83 c4 20 5e e9 c9 a3 f9 ff cc cc cc cc cc cc cc cc cc 41 57 41 56 56 57 53 48 81 ec c0 00 00 00 66 44 0f 7f bc 24 b0 00 00 00 66 44 0f 7f b4 24 a0 00 00 00 66 44 0f 7f ac 24 90 00 00 00 66 44 0f 7f a4 24 80 00 00 00 66 44 0f 7f 5c 24 70 66 44 0f 7f 54 24 60 66 44 0f 7f 4c 24 50 66 44 0f 7f 44 24 40 66 0f 7f 7c 24 30 66 0f 7f 74 24 20 4d 85 c0 0f 84 c2 03 00 00 4c 89 c6 48 89 d7 49 89 ce 4c 8d 79 a8 66 44 0f 6f 05 13 12 05 00 66 44 0f 6f 1d da 12 05 00 66 44 0f 6f 25 e1 12 05 00 66 44 0f 6f 2d e8 12 05 00 66 44 0f 6f 35 ef 12 05 00 eb 19 66 2e 0f 1f 84 00 00 00 00 00 0f Data Ascii: A.AFH([_^A^VH HqHp&HH ^AWAVVWSHfD$fD$fD$fD$fD\$pfDT$`fDL$PfDD$@f\|$0ft$ MLHILyfDofDofDo%fDo-fDo5f.
2023-11-14 10:11:31 UTC	680	IN	Data Raw: d4 fc ff 48 89 c6 4d 85 ed 74 17 48 8d 15 ef fd ff ff 4c 89 e9 49 89 d8 41 89 e9 e8 d1 d0 fc ff eb 02 31 c0 48 89 44 24 20 4c 8d a7 70 df ff ff 4c 89 e1 e8 99 9a f8 ff 48 85 c0 74 4b 48 8d 6c 24 30 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 e9 4c 89 e2 e8 55 f5 f9 ff 48 8b 54 24 30 4c 8b 44 24 38 48 89 f1 e8 13 d7 fc ff 48 8b 54 24 38 4c 89 e1 e8 66 f4 f9 ff 4c 89 e1 e8 4e 9a f8 ff 48 85 c0 75 c9 80 bf 98 df ff ff 00 74 08 48 89 f1 e8 48 d8 fc ff 0f b6 af 99 df ff ff 48 8b 8f 68 df ff ff 48 8b 01 ff 10 4c 89 e1 e8 cd f2 f9 ff 48 8d 05 be f4 04 00 48 89 07 89 af 98 df ff ff 48 8d 8f a0 df ff ff e8 51 f2 f9 ff 48 8d 8f c8 df ff ff e8 e5 eb ff ff 4c 89 bf 70 df ff ff 48 8b 44 24 28 48 89 87 88 df ff ff 4c 89 b7 68 df ff ff 48 89 b7 80 df ff ff 4c 89 Data Ascii: HMtHLIA1HD$ LpLHtKHl$0f.DHLUHT$0LD$8HHT$8LfLNHutHHHhHLHHHQHLpHD$(HLhHL
2023-11-14 10:11:31 UTC	688	IN	Data Raw: 05 8c c6 07 00 48 31 e0 48 89 44 24 58 41 0f 10 00 0f 29 44 24 30 48 8d 51 08 4c 8b 09 48 8b 49 10 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 b8 18 00 00 00 e8 67 65 f9 ff 48 89 46 10 48 8b 1e 48 8d 43 01 48 89 06 48 89 f9 e8 41 d3 f9 ff 48 8b 4e 10 48 c1 e3 03 48 8d 3c 5b 48 89 04 39 48 8b 46 10 c7 44 38 08 01 00 00 00 0f 28 44 24 30 0f 29 44 24 40 48 8d 4c 24 40 e8 61 6e f9 ff 48 8b 4e 10 48 89 44 39 10 48 8b 4c 24 58 48 31 e1 e8 6b c2 00 00 90 48 83 c4 60 5b 5f 5e c3 cc cc 41 56 56 57 53 48 83 ec 38 4d 89 c6 48 89 d3 48 89 ce 48 8d 51 08 4c 8b 09 48 8b 49 10 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 b8 18 00 00 00 e8 ca 64 f9 ff 48 89 46 10 48 8b 3e 48 8d 47 01 48 89 06 48 89 d9 e8 a4 d2 f9 ff 48 8b 4e 10 48 c1 e7 03 48 8d 3c 7f 48 89 04 39 48 8b Data Ascii: H1HD$XA)D$0HQLHID$(HD$ AgeHFHHCHHAHNHH<[H9HFD8(D$0)D$@HL$@anHNHD9HL$XH1kH`[_^AVVWSH8MHHHQLHID$(HD$ AdHFH>HGHHHNHH<H9H
2023-11-14 10:11:31 UTC	696	IN	Data Raw: d0 49 89 d9 e8 38 0e fd ff 48 89 d9 e8 00 c9 fc ff 4d 85 f6 74 0f 48 8b 17 48 8b 4e 08 e8 7f 15 fd ff 49 89 06 48 83 c4 28 5b 5f 5e 41 5e c3 cc cc 48 8b 49 08 31 d2 e9 85 ef fc ff cc cc cc cc cc 41 56 56 57 53 48 83 ec 28 48 89 d7 48 89 ce 48 8b 49 08 4c 89 c2 e8 45 14 fd ff 49 89 c6 48 8b 4e 08 48 89 fa e8 36 14 fd ff 48 89 c7 b9 01 00 00 00 ba 28 00 00 00 45 31 c0 e8 31 45 f9 ff 48 89 c3 48 89 70 20 0f 57 c0 0f 11 40 10 48 89 38 4c 89 70 08 48 8b 4e 08 48 89 fa 4d 89 f0 e8 ad 11 fd ff 48 89 43 18 48 8b 4e 08 e8 30 12 fd ff 48 89 c1 e8 58 d1 fc ff 48 89 43 10 48 89 d8 48 83 c4 28 5b 5f 5e 41 5e c3 cc cc cc cc cc cc cc 56 48 83 ec 20 48 89 ce 48 8b 09 e8 30 c8 fc ff 48 8b 4e 08 e8 27 c8 fc ff 48 8b 4e 10 e8 1e c8 fc ff 48 8b 4e 18 e8 15 c8 fc ff ba 28 00 Data Ascii: I8HMtHHNIH([_^A^HI1AVVWSH(HHHILEIHNH6H(E11EHHp W@H8LpHNHMHCHN0HXHCHH([_^A^VH HH0HN'HNHN(
2023-11-14 10:11:31 UTC	703	IN	Data Raw: ff ff 66 0f 38 dc 99 58 fe ff ff 66 0f 38 dc 99 68 fe ff ff 66 0f 38 dc 99 78 fe ff ff 66 0f 38 dc 99 88 fe ff ff 66 0f 38 dc 99 98 fe ff ff 66 0f 38 dc 99 a8 fe ff ff 66 0f 38 dc 99 b8 fe ff ff 66 0f 38 dd 99 c8 fe ff ff f3 0f 6f 22 66 0f ef e3 f3 0f 7f 22 66 0f 6f 61 e8 66 0f d4 e1 66 0f 6f dc 66 0f 38 29 da 66 0f 73 d3 3f 66 0f 73 fb 08 66 0f d4 dc 66 0f 7f 59 e8 48 83 c2 10 48 39 c2 0f 82 49 ff ff ff c3 cc cc cc cc cc cc cc cc 45 85 c0 0f 8e f0 00 00 00 49 63 c0 48 01 d0 66 0f 6f 59 e8 66 0f 6f 05 24 a1 04 00 66 0f 6f 0d 2c a1 04 00 66 0f ef d2 0f 1f 84 00 00 00 00 00 66 0f 38 00 d8 66 0f ef 99 08 fe ff ff 66 0f 38 dc 99 18 fe ff ff 66 0f 38 dc 99 28 fe ff ff 66 0f 38 dc 99 38 fe ff ff 66 0f 38 dc 99 48 fe ff ff 66 0f 38 dc 99 58 fe ff ff 66 0f 38 dc Data Ascii: f8Xf8hf8xf8f8f8f8f8o"f"foaffof8)fs?fsffYHH9IEIcHfoYfo$fo,ff8ff8f8(f88f8Hf8Xf8
2023-11-14 10:11:31 UTC	711	IN	Data Raw: 89 fa 83 e2 fa c1 e2 0c 81 e7 55 55 00 00 09 d7 c1 e8 04 25 aa 0a 00 00 09 c7 48 8b 44 24 58 66 44 33 10 66 33 68 02 66 44 33 78 04 66 33 48 06 66 44 33 70 08 66 33 58 0a 66 33 70 0c 66 33 78 0e 0f b7 c7 0f b7 d3 48 c1 e0 20 48 c1 e2 10 48 09 c2 0f b7 c1 48 09 d0 48 c1 e0 10 0f b7 ed 48 09 c5 0f b7 c6 41 0f b7 ce 48 c1 e0 20 48 c1 e1 10 48 09 c1 41 0f b7 c7 48 09 c8 48 c1 e0 10 41 0f b7 ca 48 09 c1 48 89 c8 48 c1 e8 08 48 31 e8 48 ba ff 00 ff 00 ff 00 ff 00 48 21 d0 48 89 c3 48 c1 e3 08 48 31 cb 48 31 e8 48 89 da 48 c1 ea 1c 31 da 81 e2 f0 f0 f0 f0 48 89 d1 48 c1 e1 1c 48 09 d1 48 31 d9 48 89 c2 48 c1 ea 1c 31 c2 81 e2 f0 f0 f0 f0 48 89 d5 48 c1 e5 1c 48 09 d5 48 31 c5 48 89 c8 48 c1 e8 0e 48 31 c8 48 bb cc cc 00 00 cc cc 00 00 48 21 d8 48 89 c2 48 c1 e2 Data Ascii: UU%HD$XfD3f3hfD3xf3HfD3pf3Xf3pf3xH HHHHHAH HHAHHAHHHH1HH!HHH1H1HH1HHHH1HH1HHHH1HHH1HH!HH
2023-11-14 10:11:31 UTC	719	IN	Data Raw: 00 ff 00 ff 00 48 21 c3 48 89 dd 48 c1 e5 08 48 31 fd 0f b7 f5 48 83 c1 10 48 d3 e6 89 e8 c1 e8 10 48 d3 e0 4c 31 c3 49 89 d0 4c 89 f2 49 09 f5 4c 8b 34 24 49 09 c6 48 89 e8 48 c1 e8 20 0f b7 c0 48 d3 e0 48 c1 ed 30 48 d3 e5 0f b7 fb 48 d3 e7 49 09 c4 48 09 ea 49 09 f8 89 d8 c1 e8 10 48 d3 e0 48 89 df 48 c1 ef 20 0f b7 ef 48 d3 e5 48 c1 eb 30 48 d3 e3 49 09 c7 49 09 ea 49 09 d9 48 83 f9 30 0f 85 38 fe ff ff 48 8b 44 24 40 4c 33 28 4c 33 40 08 4c 33 70 10 4c 33 78 18 4c 33 60 20 4c 33 50 28 48 33 50 30 4c 33 48 38 8b b8 b0 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 83 c0 40 83 c7 ff 0f 84 b2 07 00 00 89 7c 24 68 48 89 44 24 40 4c 89 f0 4c 31 e0 48 89 c1 4c 89 c7 4c 31 cf 48 89 7c 24 30 4c 89 f0 4c 31 c8 4c 89 4c 24 28 49 89 c3 49 31 d2 4c 89 6c Data Ascii: H!HHH1HHHL1ILIL4$IHH HH0HHIHIHHH HH0HIIIH08HD$@L3(L3@L3pL3xL3` L3P(H3P0L3H8f.@H@\|$hHD$@LL1HLL1H\|$0LL1LL$(II1Ll
2023-11-14 10:11:31 UTC	727	IN	Data Raw: 48 8b 87 20 ff ff ff 48 89 44 24 48 48 8b 87 28 ff ff ff 48 89 44 24 50 48 8b 87 30 ff ff ff 48 89 44 24 58 48 8b 87 38 ff ff ff 48 89 44 24 60 48 8b 87 40 ff ff ff 48 89 44 24 68 44 8b 87 48 ff ff ff 48 8d 74 24 30 4c 89 f1 48 89 f2 e8 de 38 00 00 ba 80 00 00 00 48 89 f1 e8 41 12 fc ff 48 8b 8c 24 b0 00 00 00 48 31 e1 e8 51 26 00 00 90 48 81 c4 b8 00 00 00 5b 5f 5e 41 5e c3 cc cc cc 56 48 83 ec 20 48 89 ce 48 81 c6 08 ff ff ff ba 08 01 00 00 48 89 f1 e8 04 12 fc ff 48 89 f1 48 83 c4 20 5e e9 a7 c8 f8 ff cc cc cc cc cc cc cc 41 57 41 56 56 57 53 48 83 ec 30 4d 85 c0 0f 84 b1 00 00 00 4c 89 c6 49 89 d7 48 89 cb 48 81 c3 20 ff ff ff 4c 8d 73 44 48 8b 83 c8 00 00 00 eb 59 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 bf 80 00 00 00 48 29 c7 48 39 f7 48 0f 47 Data Ascii: H HD$HH(HD$PH0HD$XH8HD$`H@HD$hDHHt$0LH8HAH$H1Q&H[_^A^VH HHHHH ^AWAVVWSH0MLIHH LsDHYf.DH)H9HG
2023-11-14 10:11:31 UTC	735	IN	Data Raw: cc 48 89 51 b8 4c 89 41 c0 c3 cc cc cc cc cc cc cc 56 57 53 48 83 ec 20 48 89 d6 48 89 cf 48 8b 59 50 48 8b 43 08 80 38 00 74 5b 80 78 01 00 74 6f b9 01 00 00 00 ba 90 08 00 00 45 31 c0 e8 2e a9 f8 ff 48 89 c3 48 8d 48 08 41 b8 88 08 00 00 31 d2 e8 4a 20 00 00 48 8d 43 60 48 89 7b 60 48 89 33 0f 28 05 48 2e 04 00 0f 11 43 18 48 8d 4b 48 48 8d 15 d9 03 00 00 48 89 53 48 48 89 4b 58 48 89 4b 68 eb 1c ff 13 48 8b 4b 08 88 41 01 48 8b 43 08 c6 00 01 48 8b 43 08 80 78 01 00 75 91 31 c0 48 83 c4 20 5b 5f 5e c3 cc cc cc cc cc cc cc 56 48 83 ec 20 48 89 ce 48 83 c6 a0 ba 90 08 00 00 48 89 f1 e8 97 f2 fb ff 48 89 f1 48 83 c4 20 5e e9 3a a9 f8 ff cc cc cc cc cc cc cc cc cc cc 56 57 48 83 ec 68 0f 29 74 24 50 48 89 ce 48 8b 05 1b 0a 07 00 48 31 e0 48 89 44 24 48 0f Data Ascii: HQLAVWSH HHHYPHC8t[xtoE1.HHHA1J HC`H{`H3(H.CHKHHHSHHKXHKhHKAHCHCxu1H [_^VH HHHHH ^:VWHh)t$PHHH1HD$H
2023-11-14 10:11:31 UTC	743	IN	Data Raw: 09 b0 f3 42 0f 6f 4c 0a c0 f3 42 0f 7f 4c 09 c0 f3 42 0f 6f 4c 0a d0 f3 42 0f 7f 4c 09 d0 f3 42 0f 6f 4c 0a e0 f3 42 0f 7f 4c 09 e0 f3 42 0f 7f 6c 01 f0 f3 0f 7f 00 c3 66 0f 1f 84 00 00 00 00 00 4c 8b d9 4c 8b d2 48 2b d1 49 03 c8 0f 10 44 11 f0 48 83 e9 10 49 83 e8 10 f6 c1 0f 74 17 48 8b c1 48 83 e1 f0 0f 10 c8 0f 10 04 11 0f 11 08 4c 8b c1 4d 2b c3 4d 8b c8 49 c1 e9 07 74 6f 0f 29 01 eb 14 66 66 66 66 66 0f 1f 84 00 00 00 00 00 0f 29 41 10 0f 29 09 0f 10 44 11 f0 0f 10 4c 11 e0 48 81 e9 80 00 00 00 0f 29 41 70 0f 29 49 60 0f 10 44 11 50 0f 10 4c 11 40 49 ff c9 0f 29 41 50 0f 29 49 40 0f 10 44 11 30 0f 10 4c 11 20 0f 29 41 30 0f 29 49 20 0f 10 44 11 10 0f 10 0c 11 75 ae 0f 29 41 10 49 83 e0 7f 0f 28 c1 4d 8b c8 49 c1 e9 04 74 1a 66 66 0f 1f 84 00 00 00 Data Ascii: BoLBLBoLBLBoLBLBlfLLH+IDHItHHLM+MIto)fffff)A)DLH)Ap)I`DPL@I)AP)I@D0L )A0)I Du)AI(MItff
2023-11-14 10:11:31 UTC	750	IN	Data Raw: 48 8b 08 44 0f b7 04 51 49 8d 49 01 41 81 e0 00 80 00 00 49 0f 44 c9 41 ff c2 4c 8d 49 01 44 3b d6 7c cf 48 8b 5c 24 30 41 8b c2 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 54 48 83 ec 50 83 49 28 10 48 8b d9 8b 41 30 41 bc df ff 00 00 85 c0 79 1c 0f b7 41 3a 66 83 e8 41 66 41 23 c4 66 f7 d8 1b c0 83 e0 f9 83 c0 0d 89 41 30 eb 1e 75 1c 66 83 79 3a 67 74 09 33 c0 66 83 79 3a 47 75 0c c7 41 30 01 00 00 00 b8 01 00 00 00 4c 8b 41 08 48 8d 79 50 05 5d 01 00 00 48 8b cf 48 63 d0 e8 fc 21 00 00 41 b8 00 02 00 00 84 c0 75 24 48 83 bb 58 04 00 00 00 75 05 41 8b c0 eb 0a 48 8b 83 50 04 00 00 48 d1 e8 8d 88 a3 fe ff ff 89 4b 30 eb 03 8b 4b 30 48 8b 87 08 04 00 00 48 85 c0 48 0f 44 c7 48 89 43 40 48 83 43 18 08 48 8b 43 18 4c 8b Data Ascii: HDQIIAIDALID;\|H\$0AHt$8H _H\$Hl$VWATHPI(HA0AyA:fAfA#fA0ufy:gt3fy:GuA0LAHyP]HHc!Au$HXuAHPHK0K0HHHDHC@HCHCL
2023-11-14 10:11:31 UTC	758	IN	Data Raw: 8b cb e8 1a d3 ff ff 4c 8b 4f 40 45 33 d2 85 f6 7e 31 41 80 39 00 74 2b 41 0f b6 11 48 8b 43 18 48 8b 08 44 0f b7 04 51 49 8d 49 01 41 81 e0 00 80 00 00 49 0f 44 c9 41 ff c2 4c 8d 49 01 44 3b d6 7c cf 48 8b 5c 24 30 41 8b c2 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 54 48 83 ec 50 83 49 28 10 48 8b d9 8b 41 30 41 bc df ff 00 00 85 c0 79 1c 0f b7 41 3a 66 83 e8 41 66 41 23 c4 66 f7 d8 1b c0 83 e0 f9 83 c0 0d 89 41 30 eb 1e 75 1c 66 83 79 3a 67 74 09 33 c0 66 83 79 3a 47 75 0c c7 41 30 01 00 00 00 b8 01 00 00 00 4c 8b 41 08 48 8d 79 50 05 5d 01 00 00 48 8b cf 48 63 d0 e8 9c 02 00 00 41 b8 00 02 00 00 84 c0 75 24 48 83 bb 58 04 00 00 00 75 05 41 8b c0 eb 0a 48 8b 83 50 04 00 00 48 d1 e8 8d 88 a3 fe ff ff 89 4b 30 eb 03 Data Ascii: LO@E3~1A9t+AHCHDQIIAIDALID;\|H\$0AHt$8H _H\$Hl$VWATHPI(HA0AyA:fAfA#fA0ufy:gt3fy:GuA0LAHyP]HHcAu$HXuAHPHK0
2023-11-14 10:11:31 UTC	766	IN	Data Raw: ff 40 f6 c7 04 75 18 40 f6 c7 01 74 56 40 f6 c7 02 74 07 45 3b f0 76 51 eb 05 45 3b f1 76 4d 8b c7 41 c6 45 30 01 83 e7 02 41 c7 45 2c 22 00 00 00 a8 01 75 06 41 83 ce ff eb 31 48 8b 53 08 85 ff 74 10 48 85 d2 74 06 48 8b 0b 48 89 0a 41 8b c0 eb 2b 48 85 d2 74 06 48 8b 0b 48 89 0a 41 8b c1 eb 1b 40 f6 c7 02 74 03 41 f7 de 48 8b 43 08 48 85 c0 74 06 48 8b 0b 48 89 08 41 8b c6 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 8b 7c 24 68 48 83 c4 30 41 5f 41 5e 41 5d c3 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 48 83 ec 20 48 b8 ff ff ff ff ff ff ff 3f 48 8b e9 48 3b d0 76 11 41 c6 40 30 01 32 c0 41 c7 40 2c 0c 00 00 00 eb 60 33 ff 48 8d 34 95 00 00 00 00 48 39 b9 08 04 00 00 75 09 48 81 fe 00 04 00 00 76 09 48 3b b1 00 04 00 00 77 04 b0 01 eb 37 48 8b Data Ascii: @u@tV@tE;vQE;vMAE0AE,"uA1HStHtHHA+HtHHA@tAHCHtHHAH\$PHl$XHt$`H\|$hH0A_A^A]H\$Hl$Ht$WH H?HH;vA@02A@,`3H4H9uHvH;w7H
2023-11-14 10:11:31 UTC	774	IN	Data Raw: 73 34 8b 85 20 03 00 00 44 89 84 85 24 03 00 00 44 8b b5 20 03 00 00 41 ff c6 44 89 b5 20 03 00 00 eb 1d 44 8b b5 20 03 00 00 eb 14 45 33 db 4c 8d 25 4b de f3 ff 45 8b f3 44 89 9d 20 03 00 00 45 85 ff 74 70 45 8b c3 45 85 f6 74 33 41 8b c8 41 ff c0 41 8b d7 8b 84 8d 24 03 00 00 48 03 d0 89 94 8d 24 03 00 00 44 8b b5 20 03 00 00 48 c1 ea 20 44 8b fa 8b c2 45 3b c6 75 d1 85 c0 74 35 bb 26 00 00 00 41 83 fe 73 73 1e 41 8b c6 44 89 bc 85 24 03 00 00 44 8b b5 20 03 00 00 41 ff c6 44 89 b5 20 03 00 00 eb 11 45 8b f3 44 89 9d 20 03 00 00 eb 05 bb 26 00 00 00 44 8b 44 24 30 45 85 c0 0f 84 0c 05 00 00 b8 cd cc cc cc 41 f7 e0 8b c2 c1 e8 03 89 44 24 34 8b c8 89 44 24 3c 85 c0 0f 84 bc 03 00 00 3b cb 8b c1 0f 47 c3 33 d2 89 44 24 38 ff c8 8b f8 41 0f b6 8c 84 02 c4 Data Ascii: s4 D$D AD D E3L%KED EtpEEt3AAA$H$D H DE;ut5&AssAD$D AD ED &DD$0EAD$4D$<;G3D$8A
2023-11-14 10:11:31 UTC	782	IN	Data Raw: 89 40 08 4c 8b d0 41 80 48 3f 20 8a 00 49 8b 48 08 48 8b f5 3c 5d 0f 84 a0 00 00 00 49 8b d2 84 c0 0f 84 95 00 00 00 3c 2d 75 5e 48 8d 4a ff 48 3b ce 74 55 49 3b d2 74 50 80 7a 01 5d 74 4a 0f b6 09 48 8d 72 01 3a 4a 01 8b d9 0f b6 42 01 44 0f b6 5a 01 0f 46 d8 fe c3 3a 4a 01 44 0f 46 d9 eb 20 41 0f b6 d3 48 c1 ea 03 41 0f b6 c3 83 e0 07 42 0f b6 4c 02 34 0f ab c1 42 88 4c 02 34 41 fe c3 44 3a db 75 db eb 1b 0f b6 d0 48 c1 ea 03 0f b6 c0 83 e0 07 42 0f b6 4c 02 34 0f ab c1 42 88 4c 02 34 49 8b 48 08 48 ff c1 49 89 48 08 48 8b d1 8a 01 3c 5d 0f 85 63 ff ff ff 40 38 29 75 26 49 c7 40 10 16 00 00 00 66 41 89 68 18 41 88 68 1a 49 89 68 20 41 89 68 28 41 88 68 2c 41 89 68 30 e9 dd fe ff ff 40 80 ff 5e 75 18 49 8d 51 20 4c 3b ca 74 0f 41 f6 11 49 ff c1 4c 3b ca Data Ascii: @LAH? IHH<]I<-u^HJH;tUI;tPz]tJHr:JBDZF:JDF AHABL4BL4AD:uHBL4BL4IHHIHH<]c@8)u&I@fAhAhIh Ah(Ah,Ah0@^uIQ L;tAIL;
2023-11-14 10:11:31 UTC	789	IN	Data Raw: 49 8b c2 4d 3b ca 77 2d 49 8b c9 49 8b c2 45 84 c0 74 22 41 80 f8 ff 74 1c 4c 8b 02 4d 8b 58 10 4d 3b 18 74 10 49 8d 43 ff 49 89 40 10 48 8b 4a 10 48 8b 42 08 48 89 4c 24 60 48 ff c1 48 89 4a 10 48 85 c0 74 1d 48 3b c8 76 18 32 c9 eb 2a 48 8d 4c 24 20 e8 44 03 00 00 b8 07 00 00 00 e9 a3 00 00 00 4c 8b 02 49 8b 40 10 49 3b 40 08 74 db 8a 08 48 ff c0 49 89 40 10 88 0b 45 33 c0 41 3a 8c 30 40 c5 0f 00 74 0a 41 3a 8c 30 48 c5 0f 00 75 7f 48 8b 42 10 48 ff c0 48 83 7a 08 00 48 89 42 10 74 0a 48 3b 42 08 76 04 32 c9 eb 16 4c 8b 0a 49 8b 41 10 49 3b 41 08 74 ef 8a 08 48 ff c0 49 89 41 10 49 ff c0 88 0b 49 83 f8 05 75 af 48 8b 42 10 48 ff c8 48 83 7a 08 00 48 89 42 10 74 06 48 3b 42 08 77 1a fe c1 80 f9 01 76 13 4c 8b 02 49 8b 48 10 49 3b 08 74 07 48 ff c9 49 89 Data Ascii: IM;w-IIEt"AtLMXM;tICI@HJHBHL$`HHJHtH;v2*HL$ DLI@I;@tHI@E3A:0@tA:0HuHBHHzHBtH;Bv2LIAI;AtHIAIIuHBHHzHBtH;BwvLIHI;tHI
2023-11-14 10:11:31 UTC	797	IN	Data Raw: c8 48 8b f2 4c 8b c2 48 81 c1 58 02 00 00 ba 55 00 00 00 e8 01 e9 00 00 85 c0 75 2a 48 8b 53 08 4c 8b cf 48 8b 0b 4c 8b c6 e8 eb e8 00 00 85 c0 75 14 48 8b 74 24 48 c6 43 18 01 48 8b 5c 24 40 48 83 c4 30 5f c3 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 52 a9 00 00 cc cc 48 89 5c 24 08 48 89 74 24 10 4c 89 4c 24 20 57 48 83 ec 30 49 8b f9 8b 0a e8 ee 92 00 00 90 48 8d 1d 36 64 06 00 48 8d 35 a7 18 06 00 48 89 5c 24 20 48 8d 05 2b 64 06 00 48 3b d8 74 19 48 39 33 74 0e 48 8b d6 48 8b cb e8 7a ef 00 00 48 89 03 48 83 c3 08 eb d6 8b 0f e8 ca 92 00 00 48 8b 5c 24 40 48 8b 74 24 48 48 83 c4 30 5f c3 cc cc 48 89 5c 24 08 4c 89 4c 24 20 57 48 83 ec 20 49 8b f9 49 8b d8 8b 0a e8 80 92 00 00 90 48 8b 43 08 48 8b 10 48 8b 0b 48 8b 92 90 00 00 00 48 8b 09 e8 Data Ascii: HLHXUu*HSLHLuHt$HCH\$@H0_Hd$ E3E333RH\$Ht$LL$ WH0IH6dH5H\$ H+dH;tH93tHHzHHH\$@Ht$HH0_H\$LL$ WH IIHCHHHH
2023-11-14 10:11:31 UTC	805	IN	Data Raw: 89 84 24 50 02 00 00 48 8b ac 24 d8 02 00 00 4d 8b e8 4c 8d 05 b0 7d 05 00 4d 8b f9 48 8b fa 48 8b d9 e8 46 c8 00 00 45 33 f6 85 c0 0f 85 ab 04 00 00 4c 8d 05 cc 48 05 00 48 8b d7 48 8b cb e8 a5 c7 00 00 85 c0 0f 85 91 04 00 00 4c 8d 05 be 7d 05 00 48 8b d7 48 8b cb e8 8b c7 00 00 85 c0 0f 85 77 04 00 00 be 0a 02 00 00 48 8d 4c 24 40 44 8b c6 33 d2 e8 e7 06 ff ff 4c 8d 44 24 30 4c 89 74 24 30 48 8b d5 41 8d 4e 06 ff 15 b8 97 05 00 bd 05 01 00 00 48 8d 54 24 40 f7 d8 44 8b c5 48 1b c9 48 23 4c 24 30 48 89 4c 24 30 ff 15 8e 97 05 00 85 c0 75 1b 4c 8d 05 6b 7a 05 00 8b d5 48 8d 4c 24 40 e8 a3 c7 00 00 85 c0 0f 85 0b 04 00 00 48 83 cd ff 48 8d 4c 24 40 48 8b d5 48 8d 44 24 40 48 ff c2 66 44 39 34 50 75 f6 48 8d 42 0b 48 83 f8 40 76 42 48 8d 04 55 96 ff ff ff Data Ascii: $PH$ML}MHHFE3LHHHL}HHwHL$@D3LD$0Lt$0HANHT$@DHH#L$0HL$0uLkzHL$@HHL$@HHD$@HfD94PuHBH@vBHU
2023-11-14 10:11:31 UTC	813	IN	Data Raw: 14 c1 e8 0c 24 01 74 07 e8 50 e9 00 00 eb e1 e8 8d 72 00 00 90 48 8b d7 48 8b cb e8 f1 fe ff ff 8b f8 48 8b cb e8 83 72 00 00 8b c7 eb c5 cc cc cc 48 83 ec 28 48 85 c9 75 14 e8 5a cb ff ff c7 00 16 00 00 00 e8 c3 6a 00 00 33 c0 eb 09 8b 41 14 c1 e8 04 83 e0 01 48 83 c4 28 c3 cc 48 83 ec 38 48 89 4c 24 48 48 85 c9 75 07 e8 bd 01 00 00 eb 4c 8b 51 14 8b c2 24 03 3c 02 75 05 f6 c2 c0 75 0a 0f ba e2 0b 72 04 33 c0 eb 32 48 8d 44 24 48 48 89 44 24 58 4c 8d 4c 24 50 48 8b 44 24 48 4c 8d 44 24 58 48 8d 54 24 20 48 89 44 24 50 48 8d 4c 24 40 48 89 44 24 20 e8 4b 03 00 00 48 83 c4 38 c3 cc cc b1 01 e9 61 01 00 00 cc 48 89 5c 24 08 48 89 7c 24 10 55 48 8b ec 48 83 ec 60 48 83 65 c0 00 48 8b d9 83 3d 33 1a 06 00 00 c6 45 d0 00 c6 45 e8 00 c6 45 f0 00 c6 45 f8 00 75 Data Ascii: $tPrHHHrH(HuZj3AH(H8HL$HHuLQ$<uur32HD$HHD$XLL$PHD$HLD$XHT$ HD$PHL$@HD$ KH8aH\$H\|$UHH`HeH=3EEEEu
2023-11-14 10:11:31 UTC	821	IN	Data Raw: 30 e8 af 4a 00 00 48 8b 07 48 63 08 48 c1 e1 05 48 83 64 19 30 00 8b 4b 10 49 8b c7 89 0e 48 8b 0f 48 63 11 48 c1 e2 05 48 89 74 1a 30 48 8b 0f 48 63 11 48 ff c2 48 c1 e2 05 4c 89 3c 1a e9 1b fe ff ff 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 95 4b 00 00 cc 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 7f 4b 00 00 cc cc cc 48 89 5c 24 08 4c 89 4c 24 20 57 48 83 ec 20 49 8b d9 49 8b f8 8b 0a e8 1c 35 00 00 90 48 8b cf e8 3f fd ff ff 48 8b f8 8b 0b e8 25 35 00 00 48 8b c7 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 4c 8b d9 f6 c1 07 74 12 8a 01 84 c0 0f 84 91 00 00 00 48 ff c1 f6 c1 07 75 ee 48 8b 01 4c 8b d0 49 b9 ff fe fe fe fe fe fe 7e 4d 03 ca 49 83 f2 ff 4d 33 d1 48 83 c1 08 49 b9 00 01 01 01 Data Ascii: 0JHHcHHd0KIHHcHHt0HHcHHL<Hd$ E3E333KHd$ E3E333KH\$LL$ WH II5H?H%5HH\$0H _ffLtHuHLI~MIM3HI
2023-11-14 10:11:31 UTC	828	IN	Data Raw: cc 8b 05 4a 96 05 00 4c 8b d2 4c 8b c1 83 f8 05 0f 8c cc 00 00 00 41 f6 c0 01 74 29 48 8d 04 51 48 8b d1 48 3b c8 0f 84 a1 01 00 00 33 c9 66 39 0a 0f 84 96 01 00 00 48 83 c2 02 48 3b d0 75 ee e9 88 01 00 00 83 e1 1f b8 20 00 00 00 48 2b c1 49 8b d0 48 f7 d9 4d 1b db 4c 23 d8 49 d1 eb 4d 3b d3 4d 0f 42 da 33 c9 4b 8d 04 58 4c 3b c0 74 0e 66 39 0a 74 09 48 83 c2 02 48 3b d0 75 f2 49 2b d0 48 d1 fa 49 3b d3 0f 85 45 01 00 00 4d 8d 0c 50 49 8b c2 49 2b c3 48 83 e0 e0 48 03 c2 49 8d 14 40 4c 3b ca 74 1d c5 f1 ef c9 c4 c1 75 75 09 c5 fd d7 c1 85 c0 c5 f8 77 75 09 49 83 c1 20 4c 3b ca 75 e3 4b 8d 04 50 eb 0a 66 41 39 09 74 09 49 83 c1 02 4c 3b c8 75 f1 49 8b d1 e9 eb 00 00 00 83 f8 01 0f 8c c6 00 00 00 41 f6 c0 01 74 29 48 8d 04 51 49 8b d0 4c 3b c0 0f 84 cc 00 Data Ascii: JLLAt)HQHH;3f9HH;u H+IHML#IM;MB3KXL;tf9tHH;uI+HI;EMPII+HHI@L;tuuwuI L;uKPfA9tIL;uIAt)HQIL;
2023-11-14 10:11:31 UTC	836	IN	Data Raw: 8d 1c c9 48 8b 3c c7 48 8b 44 df 28 48 83 c0 02 48 83 f8 01 76 0a 80 4c df 38 80 e9 8b 00 00 00 c6 44 df 38 81 8b ce 85 f6 74 16 83 e9 01 74 0a 83 f9 01 b9 f4 ff ff ff eb 0c b9 f5 ff ff ff eb 05 b9 f6 ff ff ff ff 15 3d 1b 05 00 48 8b e8 48 8d 48 01 48 83 f9 01 76 2d 48 8b c8 ff 15 af 1a 05 00 85 c0 74 20 0f b6 c0 48 89 6c df 28 83 f8 02 75 07 80 4c df 38 40 eb 31 83 f8 03 75 2c 80 4c df 38 08 eb 25 80 4c df 38 40 48 c7 44 df 28 fe ff ff ff 48 8b 05 ee c7 05 00 48 85 c0 74 0b 49 8b 04 06 c7 40 18 fe ff ff ff ff c6 49 83 c6 08 83 fe 03 0f 85 31 ff ff ff 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 8b 7c 24 48 48 83 c4 20 41 5e c3 48 83 ec 28 ff 15 ca 19 05 00 48 89 05 33 c7 05 00 ff 15 c5 19 05 00 48 89 05 2e c7 05 00 b0 01 48 83 c4 28 c3 cc cc cc b0 01 Data Ascii: H<HD(HHvL8D8tt=HHHHv-Ht Hl(uL8@1u,L8%L8@HD(HHtI@I1H\$0Hl$8Ht$@H\|$HH A^H(H3H.H(
2023-11-14 10:11:31 UTC	844	IN	Data Raw: 8a d7 eb 48 ba 01 00 00 00 8b c2 48 d3 e0 48 2b c2 49 23 c0 49 85 c4 75 33 41 83 fe 30 74 19 49 c1 e8 04 48 b8 ff ff ff ff ff ff 00 00 4c 23 c5 4c 23 c0 49 d3 e8 eb 11 48 b8 00 00 00 00 00 00 f0 7f 4c 85 c0 41 0f 95 c0 41 22 d0 8a c2 eb 28 3d 00 02 00 00 75 0c 66 85 db 74 a3 4c 39 3f 7c 9e eb 93 3d 00 01 00 00 75 0c 66 85 db 74 90 4c 39 3f 7d 8b eb 80 32 c0 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 24 50 48 8b 7c 24 58 48 83 c4 20 41 5f 41 5e 41 5c c3 cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 41 54 41 55 41 56 41 57 48 83 ec 50 8b 84 24 a8 00 00 00 45 33 db 85 c0 44 88 1a 41 8b fb 4d 8b d1 0f 49 f8 48 8b da 4c 8b f1 8d 47 0b 4c 63 c8 4d 3b c1 77 33 48 8b 8c 24 c8 00 00 00 41 8d 5b 22 48 89 4c 24 28 45 33 c9 45 33 c0 4c 89 5c 24 20 33 d2 c6 41 30 Data Ascii: HHH+I#Iu3A0tIHL#L#IHLAA"(=uftL9?\|=uftL9?}2H\$@Hl$HHt$PH\|$XH A_A^A\H\$Hl$Ht$WATAUAVAWHP$E3DAMIHLGLcM;w3H$A["HL$(E3E3L\$ 3A0
2023-11-14 10:11:31 UTC	852	IN	Data Raw: 8d 46 54 41 b9 56 00 00 00 4c 8b c7 48 89 44 24 20 33 d2 e8 25 cf 00 00 0b d8 48 8d 4d f0 49 8d 46 55 41 b9 57 00 00 00 4c 8b c7 48 89 44 24 20 33 d2 e8 06 cf 00 00 0b d8 48 8d 4d f0 49 8d 46 56 41 b9 52 00 00 00 4c 8b c7 48 89 44 24 20 33 d2 e8 e7 ce 00 00 0b d8 48 8d 4d f0 49 8d 46 57 41 b9 53 00 00 00 4c 8b c7 48 89 44 24 20 33 d2 e8 c8 ce 00 00 41 b9 15 00 00 00 48 8d 4d f0 0b d8 4c 8b c7 49 8d 46 68 48 89 44 24 20 41 8d 51 ed e8 a7 ce 00 00 41 b9 14 00 00 00 48 8d 4d f0 0b d8 4c 8b c7 49 8d 46 70 48 89 44 24 20 41 8d 51 ee e8 86 ce 00 00 41 b9 16 00 00 00 48 8d 4d f0 0b d8 4c 8b c7 49 8d 46 78 48 89 44 24 20 41 8d 51 ec e8 65 ce 00 00 41 b9 17 00 00 00 48 8d 4d f0 0b d8 4c 8b c7 49 8d 86 80 00 00 00 48 89 44 24 20 41 8d 51 eb e8 41 ce 00 00 41 b9 50 Data Ascii: FTAVLHD$ 3%HMIFUAWLHD$ 3HMIFVARLHD$ 3HMIFWASLHD$ 3AHMLIFhHD$ AQAHMLIFpHD$ AQAHMLIFxHD$ AQeAHMLIHD$ AQAAP
2023-11-14 10:11:31 UTC	860	IN	Data Raw: 00 00 e8 32 8d ff ff 85 c0 74 2f 8b 44 24 30 83 f8 03 7d 05 b8 e9 fd 00 00 48 8b 5c 24 38 48 8b 74 24 40 48 83 c4 20 5f c3 48 8b cb e8 24 34 ff ff eb e6 ba 04 10 00 20 eb b6 33 c0 eb db cc cc cc 40 53 48 83 ec 40 48 8b 05 c3 16 05 00 48 33 c4 48 89 44 24 38 41 b9 09 00 00 00 4c 8d 44 24 20 48 8b d9 41 8d 51 50 e8 cc 8c ff ff 85 c0 74 1e 41 b8 09 00 00 00 48 8d 4c 24 20 48 8b d3 e8 a5 85 ff ff 85 c0 75 07 b8 01 00 00 00 eb 02 33 c0 48 8b 4c 24 38 48 33 cc e8 e3 12 fe ff 48 83 c4 40 5b c3 cc 40 55 53 56 57 41 54 41 56 41 57 48 8b ec 48 83 ec 40 48 8b 05 53 16 05 00 48 33 c4 48 89 45 f0 49 8b f8 4c 8b fa 4c 8b f1 e8 56 99 ff ff 48 8b f0 33 c0 48 89 45 e0 89 45 e8 e8 45 99 ff ff 48 8d 4d e0 45 33 e4 48 8d 9e a0 00 00 00 48 89 88 a0 03 00 00 49 8d 86 80 00 00 Data Ascii: 2t/D$0}H\$8Ht$@H _H$4 3@SH@HH3HD$8ALD$ HAQPtAHL$ Hu3HL$8H3H@[@USVWATAVAWHH@HSH3HEILLVH3HEEEHME3HHI
2023-11-14 10:11:31 UTC	868	IN	Data Raw: 75 18 33 c0 48 8b 5c 24 40 48 8b 74 24 48 48 8b 7c 24 50 48 83 c4 30 41 5e c3 33 c9 48 8b c7 48 39 0f 74 0d 48 ff c1 48 8d 40 08 48 83 38 00 75 f3 48 ff c1 ba 08 00 00 00 e8 1f b1 ff ff 48 8b d8 48 85 c0 74 7e 48 8b 07 48 85 c0 74 51 4c 8b f3 4c 2b f7 48 83 ce ff 48 ff c6 80 3c 30 00 75 f7 ba 01 00 00 00 48 8d 4e 01 e8 ee b0 ff ff 33 c9 49 89 04 3e e8 bb 8e ff ff 49 8b 0c 3e 48 85 c9 74 41 4c 8b 07 48 8d 56 01 e8 72 69 ff ff 85 c0 75 1b 48 83 c7 08 48 8b 07 48 85 c0 75 b5 33 c9 e8 8f 8e ff ff 48 8b c3 e9 56 ff ff ff 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 aa 8f ff ff cc e8 2c 0a ff ff cc cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 56 48 83 ec 30 33 ed 48 8b f9 48 85 c9 75 1d 33 c0 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 Data Ascii: u3H\$@Ht$HH\|$PH0A^3HH9tHH@H8uHHHt~HHtQLL+HH<0uHN3I>I>HtALHVriuHHHu3HVHd$ E3E333,HHXHhHpHx AVH03HHu3H\$@Hl$HHt
2023-11-14 10:11:31 UTC	875	IN	Data Raw: 10 00 83 cf ff 48 8b 5c 24 30 8b c7 48 8b 7c 24 40 48 8b 74 24 38 48 83 c4 20 41 5e c3 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 45 33 c9 45 33 c0 48 8b 54 24 38 48 8b 4c 24 30 ff 15 a0 80 04 00 48 83 c4 28 c3 cc cc cc 48 89 5c 24 08 57 48 83 ec 20 49 8b f8 48 8b d9 e8 b3 e1 fd ff f6 43 04 66 75 0d 81 3b 63 73 6d e0 75 05 83 f8 01 74 0b 48 8b 5c 24 30 48 83 c4 20 5f c3 e8 18 49 ff ff 48 89 58 20 e8 0f 49 ff ff 48 89 78 28 e8 d2 3b ff ff cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 20 57 48 83 ec 50 48 8b e9 49 8b f9 48 8d 48 e8 41 8b f0 e8 76 00 00 00 33 db f2 0f 10 00 8b 40 08 f2 0f 11 44 24 30 89 44 24 38 3a c3 74 47 44 8b 44 24 30 48 8d 4c 24 70 44 8b ce c7 44 24 20 80 01 00 00 48 8b d5 e8 22 82 00 00 85 c0 75 26 ff 05 58 2b 05 00 8b 44 24 34 f0 09 Data Ascii: H\$0H\|$@Ht$8H A^HT$HL$H(E3E3HT$8HL$0H(H\$WH IHCfu;csmutH\$0H _IHX IHx(;HHXHhHp WHPHIHHAv3@D$0D$8:tGDD$0HL$pDD$ H"u&X+D$4
2023-11-14 10:11:31 UTC	883	IN	Data Raw: c3 eb 45 48 ff c0 48 85 f6 74 32 48 3b c5 76 29 48 83 7c 24 70 ff 74 18 88 1e be 22 00 00 00 89 77 2c c6 47 30 01 48 89 7c 24 28 e9 61 ff ff ff 48 8b c5 41 bc 50 00 00 00 88 5c 30 ff 4d 85 f6 74 03 49 89 06 41 8b c4 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 83 c4 30 41 5e 41 5c 5f c3 48 8d 05 c9 0e 02 00 c3 48 8d 05 21 10 02 00 c3 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 45 33 d2 49 8b d8 4c 8b da 4d 85 c9 75 31 48 85 c9 75 31 48 85 d2 74 14 e8 bc b1 fe ff bb 16 00 00 00 89 18 e8 24 51 ff ff 44 8b d3 48 8b 5c 24 30 41 8b c2 48 8b 74 24 38 48 83 c4 20 5f c3 48 85 c9 74 d4 4d 85 db 74 cf 4d 85 c9 75 05 44 88 11 eb d9 48 85 db 75 05 44 88 11 eb bb 48 2b d9 48 8b d1 4d 8b c3 49 8b f9 49 83 f9 ff 75 14 8a 04 13 88 02 48 ff c2 84 c0 74 b1 49 83 e8 01 Data Ascii: EHHt2H;v)H\|$pt"w,G0H\|$(aHAP\0MtIAH\$PHl$XHt$`H0A^A\_HH!H\$Ht$WH E3ILMu1Hu1Ht$QDH\$0AHt$8H _HtMtMuDHuDH+HMIIuHtI
2023-11-14 10:11:31 UTC	891	IN	Data Raw: 42 04 00 cc cc 40 53 48 83 ec 20 8b d9 4c 8d 0d 75 f1 01 00 b9 02 00 00 00 4c 8d 05 61 f1 01 00 48 8d 15 5a f7 03 00 e8 d9 00 00 00 8b cb 48 85 c0 74 0c 48 83 c4 20 5b 48 ff 25 92 69 05 00 48 83 c4 20 5b 48 ff 25 ae 42 04 00 cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b da 4c 8d 0d 30 f1 01 00 8b f9 48 8d 15 07 f7 03 00 b9 03 00 00 00 4c 8d 05 13 f1 01 00 e8 8a 00 00 00 48 8b d3 8b cf 48 85 c0 74 08 ff 15 46 69 05 00 eb 06 ff 15 6e 42 04 00 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 41 8b f0 4c 8d 0d df f0 01 00 8b da 4c 8d 05 ce f0 01 00 48 8b f9 48 8d 15 b4 f1 03 00 b9 04 00 00 00 e8 2e 00 00 00 8b d3 48 8b cf 48 85 c0 74 0b 44 8b c6 ff 15 e7 68 05 00 eb 06 ff 15 7f 40 04 00 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 Data Ascii: B@SH LuLaHZHtH [H%iH [H%BH\$WH HL0HLHHtFinBH\$0H _H\$Ht$WH ALLHH.HHtDh@H\$0Ht$8H
2023-11-14 10:11:31 UTC	899	IN	Data Raw: fe ff ff 48 83 c4 30 41 5f 41 5e 41 5d 41 5c 5f 5e 5b c3 e8 dd 8d fe ff 90 e8 d7 8d fe ff 90 cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 48 83 ec 20 48 8b e9 49 8b f8 49 8b c8 48 8b f2 e8 43 fd ff ff 4c 8d 4c 24 48 4c 8b c7 48 8b d6 48 8b cd 8b d8 e8 7e 36 ff ff 4c 8b c7 48 8b d6 48 8b cd e8 00 fe ff ff 3b d8 7e 23 44 8b c3 48 8d 4c 24 48 48 8b d7 e8 a4 fd ff ff 44 8b cb 4c 8b c7 48 8b d6 48 8b cd e8 9f fd ff ff eb 10 4c 8b c7 48 8b d6 48 8b cd e8 cb fd ff ff 8b d8 48 8b 6c 24 38 8b c3 48 8b 5c 24 30 48 8b 74 24 40 48 83 c4 20 5f c3 cc cc 40 53 56 57 41 54 41 55 41 56 41 57 48 83 ec 70 48 8b f9 45 33 ff 44 89 7c 24 20 44 21 bc 24 b0 00 00 00 4c 21 7c 24 28 4c 21 bc 24 c8 00 00 00 e8 eb ea fe ff 4c 8b 68 28 4c 89 6c 24 40 e8 dd ea fe ff 48 8b 40 Data Ascii: H0A_A^A]A\_^[H\$Hl$Ht$WH HIIHCLL$HLHH~6LHH;~#DHL$HHDLHHLHHHl$8H\$0Ht$@H _@SVWATAUAVAWHpHE3D\|$ D!$L!\|$(L!$Lh(Ll$@H@
2023-11-14 10:11:31 UTC	907	IN	Data Raw: 1f 41 0f b6 c1 ba 01 00 00 00 41 0f b6 c9 83 e1 07 48 c1 e8 03 d3 e2 84 54 04 20 75 1f 49 ff c0 45 8a 08 45 84 c9 75 d9 33 c0 48 8b 4c 24 40 48 33 cc e8 ca 57 fd ff 48 83 c4 58 c3 49 8b c0 eb e9 e8 77 58 fd ff cc cc cc 45 33 c0 e9 00 00 00 00 48 89 5c 24 08 57 48 83 ec 40 48 8b da 48 8b f9 48 85 c9 75 14 e8 2e 54 fe ff c7 00 16 00 00 00 e8 97 f3 fe ff 33 c0 eb 60 48 85 db 74 e7 48 3b fb 73 f2 49 8b d0 48 8d 4c 24 20 e8 3c da fd ff 48 8b 4c 24 30 48 8d 53 ff 83 79 08 00 74 24 48 ff ca 48 3b fa 77 0a 0f b6 02 f6 44 08 19 04 75 ee 48 8b cb 48 2b ca 48 8b d3 83 e1 01 48 2b d1 48 ff ca 80 7c 24 38 00 74 0c 48 8b 4c 24 20 83 a1 a8 03 00 00 fd 48 8b c2 48 8b 5c 24 50 48 83 c4 40 5f c3 48 83 ec 28 48 85 c9 75 19 e8 a6 53 fe ff c7 00 16 00 00 00 e8 0f f3 fe ff 48 Data Ascii: AAHT uIEEu3HL$@H3WHXIwXE3H\$WH@HHHu.T3`HtH;sIHL$ <HL$0HSyt$HH;wDuHH+HH+H\|$8tHL$ HH\$PH@_H(HuSH
2023-11-14 10:11:31 UTC	914	IN	Data Raw: 83 c4 20 5b c3 45 33 c0 f2 0f 11 44 24 08 48 8b 54 24 08 48 b9 ff ff ff ff ff ff ff 7f 48 8b c2 48 23 c1 48 b9 00 00 00 00 00 00 40 43 48 3b d0 41 0f 95 c0 48 3b c1 72 17 48 b9 00 00 00 00 00 00 f0 7f 48 3b c1 76 7e 48 8b ca e9 41 11 00 00 48 b9 00 00 00 00 00 00 f0 3f 48 3b c1 73 2b 48 85 c0 74 62 4d 85 c0 74 17 48 b8 00 00 00 00 00 00 00 80 48 89 44 24 08 f2 0f 10 44 24 08 eb 46 f2 0f 10 05 09 b0 01 00 eb 3c 48 8b c2 b9 33 00 00 00 48 c1 e8 34 2a c8 b8 01 00 00 00 48 d3 e0 48 ff c8 48 f7 d0 48 23 c2 48 89 44 24 08 f2 0f 10 44 24 08 4d 85 c0 75 0d 48 3b c2 74 08 f2 0f 58 05 cb af 01 00 c3 cc cc cc cc cc cc cc cc cc cc 48 83 ec 58 66 0f 7f 74 24 20 83 3d b7 90 04 00 00 0f 85 e9 02 00 00 66 0f 28 d8 66 0f 28 e0 66 0f 73 d3 34 66 48 0f 7e c0 66 0f fb 1d df Data Ascii: [E3D$HT$HHH#H@CH;AH;rHH;v~HAH?H;s+HtbMtHHD$D$F<H3H4*HHHH#HD$D$MuH;tXHXft$ =f(f(fs4fH~f
2023-11-14 10:11:31 UTC	922	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 01 01 00 00 00 00 00 00 40 7a 00 40 01 00 00 00 b0 7a 00 40 01 00 00 00 50 7d 00 40 01 00 00 00 20 80 00 40 01 00 00 00 90 80 00 40 01 00 00 00 60 82 00 40 01 00 00 00 00 83 00 40 01 00 Data Ascii: @z@z@P}@ @@`@@
2023-11-14 10:11:31 UTC	930	IN	Data Raw: 00 74 1b 00 00 7e 1b 00 00 00 00 00 00 80 1b 00 00 81 1b 00 00 11 00 00 00 82 1b 00 00 a1 1b 00 00 00 00 00 00 a2 1b 00 00 a5 1b 00 00 11 00 00 00 a6 1b 00 00 a7 1b 00 00 00 00 00 00 a8 1b 00 00 a9 1b 00 00 11 00 00 00 aa 1b 00 00 aa 1b 00 00 00 00 00 00 ab 1b 00 00 ad 1b 00 00 11 00 00 00 ae 1b 00 00 e5 1b 00 00 00 00 00 00 e6 1b 00 00 e6 1b 00 00 11 00 00 00 e7 1b 00 00 e7 1b 00 00 00 00 00 00 e8 1b 00 00 e9 1b 00 00 11 00 00 00 ea 1b 00 00 ec 1b 00 00 00 00 00 00 ed 1b 00 00 ed 1b 00 00 11 00 00 00 ee 1b 00 00 ee 1b 00 00 00 00 00 00 ef 1b 00 00 f1 1b 00 00 11 00 00 00 f2 1b 00 00 f3 1b 00 00 00 00 00 00 fc 1b 00 00 2b 1c 00 00 00 00 00 00 2c 1c 00 00 33 1c 00 00 11 00 00 00 34 1c 00 00 35 1c 00 00 00 00 00 00 36 1c 00 00 37 1c 00 00 11 00 00 00 3b 1c Data Ascii: t~+,34567;
2023-11-14 10:11:31 UTC	938	IN	Data Raw: 00 00 00 00 00 a0 bc 01 00 a3 bc 01 00 12 00 00 00 00 cf 01 00 2d cf 01 00 11 00 00 00 30 cf 01 00 46 cf 01 00 11 00 00 00 50 cf 01 00 c3 cf 01 00 00 00 00 00 00 d0 01 00 f5 d0 01 00 00 00 00 00 00 d1 01 00 26 d1 01 00 00 00 00 00 29 d1 01 00 66 d1 01 00 00 00 00 00 67 d1 01 00 69 d1 01 00 11 00 00 00 6a d1 01 00 72 d1 01 00 00 00 00 00 73 d1 01 00 7a d1 01 00 12 00 00 00 7b d1 01 00 82 d1 01 00 11 00 00 00 83 d1 01 00 84 d1 01 00 00 00 00 00 85 d1 01 00 8b d1 01 00 11 00 00 00 8c d1 01 00 a9 d1 01 00 00 00 00 00 aa d1 01 00 ad d1 01 00 11 00 00 00 ae d1 01 00 e8 d1 01 00 00 00 00 00 42 d2 01 00 44 d2 01 00 11 00 00 00 e0 d2 01 00 f3 d2 01 00 00 00 00 00 60 d3 01 00 78 d3 01 00 00 00 00 00 00 d4 01 00 54 d4 01 00 00 00 00 00 56 d4 01 00 9c d4 01 00 00 00 Data Ascii: -0FP&)fgijrsz{BD`xTV
2023-11-14 10:11:31 UTC	946	IN	Data Raw: 00 25 73 20 53 65 63 75 72 69 74 79 20 41 6c 65 72 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 68 65 20 66 69 72 73 74 20 25 73 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 65 20 73 65 72 76 65 72 0a 69 73 20 25 73 2c 20 77 68 69 63 68 20 69 73 20 62 65 6c 6f 77 20 74 68 65 20 63 6f 6e 66 69 67 75 72 65 64 0a 77 61 72 6e 69 6e 67 20 74 68 72 65 73 68 6f 6c 64 2e 0a 44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 63 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 74 68 69 73 20 63 6f 6e 6e 65 63 74 69 6f 6e 3f 0a 00 00 00 00 00 25 73 20 53 65 63 75 72 69 74 79 20 41 6c 65 72 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 68 65 20 66 69 72 73 74 20 68 6f 73 74 20 6b 65 79 20 74 79 70 65 20 77 65 20 68 61 76 65 20 73 74 6f 72 65 64 20 66 6f 72 20 74 68 69 Data Ascii: %s Security AlertThe first %s supported by the serveris %s, which is below the configuredwarning threshold.Do you want to continue with this connection?%s Security AlertThe first host key type we have stored for thi
2023-11-14 10:11:31 UTC	953	IN	Data Raw: 00 03 00 00 00 03 00 00 00 03 00 00 00 02 00 00 00 03 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 04 00 00 00 04 00 00 00 03 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 00 00 00 04 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00 03 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 01 00 Data Ascii:
2023-11-14 10:11:31 UTC	961	IN	Data Raw: 00 60 00 61 00 62 00 63 00 64 00 65 00 66 00 67 00 68 00 69 00 6a 00 6b 00 6c 00 6d 00 6e 00 6f 00 70 00 71 00 72 00 73 00 74 00 75 00 76 00 77 00 78 00 79 00 7a 00 7b 00 7c 00 7d 00 7e 00 7f 00 a0 1e ae 1e b0 1e b6 1e a4 1e a6 1e a8 1e ac 1e bc 1e b8 1e be 1e c0 1e c2 1e c4 1e c6 1e d0 1e d2 1e d4 1e d6 1e d8 1e e2 1e da 1e dc 1e de 1e ca 1e ce 1e cc 1e c8 1e e6 1e 68 01 e4 1e f2 1e d5 00 af 1e b1 1e b7 1e a5 1e a7 1e a8 1e ad 1e bd 1e b9 1e bf 1e c1 1e c3 1e c5 1e c7 1e d1 1e d3 1e d5 1e d7 1e e0 1e a0 01 d9 1e dd 1e df 1e cb 1e f0 1e e8 1e ea 1e ec 1e a1 01 db 1e af 01 c0 00 c1 00 c2 00 c3 00 a2 1e 02 01 b3 1e b5 1e c8 00 c9 00 ca 00 ba 1e cc 00 cd 00 28 01 f3 1e 10 01 e9 1e d2 00 d3 00 d4 00 a1 1e f7 1e eb 1e ed 1e d9 00 da 00 f9 1e f5 1e dd 00 e1 1e Data Ascii: `abcdefghijklmnopqrstuvwxyz{\|}~h(
2023-11-14 10:11:31 UTC	969	IN	Data Raw: 00 e0 30 11 40 01 00 00 00 00 00 00 00 00 00 00 00 41 4e 56 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 10 e0 02 40 01 00 00 00 d0 7c 05 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0@ANV@\|@
2023-11-14 10:11:31 UTC	977	IN	Data Raw: fe 01 81 41 c1 21 a1 61 e1 11 91 51 d1 31 b1 71 f1 09 89 49 c9 29 a9 69 e9 19 99 59 d9 39 b9 79 f9 05 85 45 c5 25 a5 65 e5 15 95 55 d5 35 b5 75 f5 0d 8d 4d cd 2d ad 6d ed 1d 9d 5d dd 3d bd 7d fd 03 83 43 c3 23 a3 63 e3 13 93 53 d3 33 b3 73 f3 0b 8b 4b cb 2b ab 6b eb 1b 9b 5b db 3b bb 7b fb 07 87 47 c7 27 a7 67 e7 17 97 57 d7 37 b7 77 f7 0f 8f 4f cf 2f af 6f ef 1f 9f 5f df 3f bf 7f ff 01 01 00 00 03 00 00 00 03 00 00 00 02 01 00 00 04 00 00 00 04 00 00 00 03 01 00 00 05 00 00 00 05 00 00 00 04 01 00 00 06 00 00 00 06 00 00 00 05 01 00 00 07 00 00 00 07 00 00 00 06 01 00 00 08 00 00 00 08 00 00 00 07 01 00 00 09 00 00 00 09 00 00 00 08 01 00 00 0a 00 00 00 0a 00 00 00 09 01 01 00 0b 00 00 00 0c 00 00 00 0a 01 01 00 0d 00 00 00 0e 00 00 00 0b 01 01 00 0f 00 Data Ascii: A!aQ1qI)iY9yE%eU5uM-m]=}C#cS3sK+k[;{G'gW7wO/o_?
2023-11-14 10:11:31 UTC	985	IN	Data Raw: 00 02 00 00 00 00 00 00 00 30 79 0f 40 01 00 00 00 00 00 00 00 00 00 00 00 40 5b 09 40 01 00 00 00 79 17 11 40 01 00 00 00 21 16 11 40 01 00 00 00 00 00 00 00 00 00 00 00 20 9d 0f 40 01 00 00 00 00 00 00 00 00 00 00 00 50 79 0f 40 01 00 00 00 60 79 0f 40 01 00 00 00 01 00 00 00 00 00 00 00 90 79 0f 40 01 00 00 00 00 00 00 00 00 00 00 00 70 5b 09 40 01 00 00 00 25 14 11 40 01 00 00 00 5d 0b 11 40 01 00 00 00 00 00 00 00 00 00 00 00 30 a2 0f 40 01 00 00 00 00 00 00 00 00 00 00 00 a8 79 0f 40 01 00 00 00 b8 79 0f 40 01 00 00 00 01 00 00 00 00 00 00 00 e8 79 0f 40 01 00 00 00 00 00 00 00 00 00 00 00 a0 5b 09 40 01 00 00 00 55 14 11 40 01 00 00 00 07 0c 11 40 01 00 00 00 00 00 00 00 00 00 00 00 30 a2 0f 40 01 00 00 00 00 00 00 00 00 00 00 00 00 7a 0f 40 01 00 Data Ascii: 0y@@[@y@!@ @Py@`y@y@p[@%@]@0@y@y@y@[@U@@0@z@
2023-11-14 10:11:31 UTC	993	IN	Data Raw: 00 01 00 00 00 00 00 00 00 17 7d 10 40 01 00 00 00 aa 18 11 40 01 00 00 00 e0 39 0a 40 01 00 00 00 80 3a 0a 40 01 00 00 00 30 3b 0a 40 01 00 00 00 b0 41 0a 40 01 00 00 00 30 42 0a 40 01 00 00 00 40 42 0a 40 01 00 00 00 80 42 0a 40 01 00 00 00 e0 42 0a 40 01 00 00 00 40 43 0a 40 01 00 00 00 50 43 0a 40 01 00 00 00 40 46 0a 40 01 00 00 00 50 46 0a 40 01 00 00 00 60 46 0a 40 01 00 00 00 00 4a 0a 40 01 00 00 00 10 4a 0a 40 01 00 00 00 60 4a 0a 40 01 00 00 00 b0 50 0a 40 01 00 00 00 00 51 0a 40 01 00 00 00 f0 5a 0a 40 01 00 00 00 a0 5b 0a 40 01 00 00 00 b0 5b 0a 40 01 00 00 00 c0 5c 0a 40 01 00 00 00 00 5d 0a 40 01 00 00 00 10 5d 0a 40 01 00 00 00 17 7d 10 40 01 00 00 00 9e 18 11 40 01 00 00 00 58 98 0f 40 01 00 00 00 01 00 00 00 00 00 00 00 d8 82 0f 40 01 00 Data Ascii: }@@9@:@0;@A@0B@@B@B@B@@C@PC@@F@PF@`F@J@J@`J@P@Q@Z@[@[@\@]@]@}@@X@@
2023-11-14 10:11:31 UTC	1000	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 90 12 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 13 40 01 00 00 00 10 60 13 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 60 13 40 01 00 00 00 18 60 13 40 01 00 00 00 20 60 13 40 01 00 Data Ascii: P@`@`@`@`@ `@
2023-11-14 10:11:31 UTC	1008	IN	Data Raw: 00 84 00 84 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 81 00 81 00 81 00 81 00 81 00 81 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 10 00 10 00 10 00 10 00 10 00 10 00 82 00 82 00 82 00 82 00 82 00 82 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 10 00 10 00 10 00 10 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-11-14 10:11:31 UTC	1016	IN	Data Raw: 00 d0 0c 12 40 01 00 00 00 71 00 00 00 00 00 00 00 10 e6 11 40 01 00 00 00 00 00 00 00 00 00 00 00 20 0b 12 40 01 00 00 00 d8 00 00 00 00 00 00 00 70 08 12 40 01 00 00 00 da 00 00 00 00 00 00 00 28 f8 11 40 01 00 00 00 b1 00 00 00 00 00 00 00 38 09 12 40 01 00 00 00 a0 00 00 00 00 00 00 00 88 fe 11 40 01 00 00 00 8f 00 00 00 00 00 00 00 28 ff 11 40 01 00 00 00 cf 00 00 00 00 00 00 00 48 fa 11 40 01 00 00 00 d5 00 00 00 00 00 00 00 38 0c 12 40 01 00 00 00 d2 00 00 00 00 00 00 00 20 f9 11 40 01 00 00 00 a9 00 00 00 00 00 00 00 e8 0d 12 40 01 00 00 00 b9 00 00 00 00 00 00 00 80 04 12 40 01 00 00 00 c4 00 00 00 00 00 00 00 40 0d 12 40 01 00 00 00 dc 00 00 00 00 00 00 00 30 0d 12 40 01 00 00 00 43 00 00 00 00 00 00 00 b8 f8 11 40 01 00 00 00 cc 00 00 00 00 00 Data Ascii: @q@ @p@(@8@@(@H@8@ @@@@@0@C@
2023-11-14 10:11:31 UTC	1024	IN	Data Raw: 3e bc d5 7c 62 3d 7d 29 3e 13 aa bc f9 5c b1 20 3e dd 76 cf 63 20 5b 31 3e 48 27 aa f3 e6 83 29 3e 94 e9 ff f4 64 4c 3f 3e 0f 5a e8 7c ba be 46 3e b8 a6 4e fd 69 9c 3b 3e ab a4 5f 83 a5 6a 2b 3e d1 ed 0f 79 c3 cc 43 3e e0 4f 40 c4 4c c0 29 3e 9d d8 75 7a 4b 73 40 3e 12 16 e0 c4 04 44 1b 3e 94 48 ce c2 65 c5 40 3e cd 35 d9 41 14 c7 33 3e 4e 3b 6b 55 92 a4 72 3d 43 dc 41 03 09 fa 20 3e f4 d9 e3 09 70 8f 2e 3e 45 8a 04 8b f6 1b 4b 3e 56 a9 fa df 52 ee 3e 3e bd 65 e4 00 09 6b 45 3e 66 76 77 f5 9e 92 4d 3e 60 e2 37 86 a2 6e 48 3e f0 a2 0c f1 af 65 46 3e 74 ec 48 af fd 11 2f 3e c7 d1 a4 86 1b be 4c 3e 65 76 a8 fe 5b b0 25 3e 1d 4a 1a 0a c2 ce 41 3e 9f 9b 40 0a 5f cd 41 3e 70 50 26 c8 56 36 45 3e 60 22 28 35 d8 7e 37 3e d2 b9 40 30 bc 17 24 3e f2 ef 79 7b ef 8e Data Ascii: >\|b=})>\ >vc [1>H')>dL?>Z\|F>Ni;>_j+>yC>O@L)>uzKs@>D>He@>5A3>N;kUr=CA >p.>EK>VR>>ekE>fvwM>`7nH>eF>tH/>L>ev[%>JA>@_A>pP&V6E>`"(5~7>@0$>y{
2023-11-14 10:11:31 UTC	1032	IN	Data Raw: 00 50 72 6f 6d 70 74 00 61 63 63 65 70 74 00 63 6f 6e 66 69 67 2d 73 73 68 2d 70 72 6f 74 00 53 73 68 50 72 6f 74 00 63 6f 6e 66 69 67 2d 66 6f 6e 74 00 43 68 61 6e 67 65 20 74 68 65 20 73 69 7a 65 20 6f 66 20 74 68 65 20 66 6f 6e 74 00 54 68 65 20 66 6f 6e 74 00 57 69 64 65 46 6f 6e 74 00 57 69 64 65 42 6f 6c 64 46 6f 6e 74 00 59 6f 75 20 6e 65 65 64 20 74 6f 20 73 70 65 63 69 66 79 20 61 20 68 6f 73 74 20 6b 65 79 20 6f 72 20 66 69 6e 67 65 72 70 72 69 6e 74 00 53 48 41 32 35 36 20 66 69 6e 67 65 72 70 72 69 6e 74 00 4d 44 35 20 66 69 6e 67 65 72 70 72 69 6e 74 00 70 6f 69 6e 74 00 4d 6f 6e 69 74 6f 72 46 72 6f 6d 50 6f 69 6e 74 00 6e 6f 6e 65 78 69 73 74 65 6e 74 00 50 72 65 73 65 6e 74 00 65 72 72 6f 72 73 2d 68 6f 73 74 6b 65 79 2d 61 62 73 65 6e 74 Data Ascii: Promptacceptconfig-ssh-protSshProtconfig-fontChange the size of the fontThe fontWideFontWideBoldFontYou need to specify a host key or fingerprintSHA256 fingerprintMD5 fingerprintpointMonitorFromPointnonexistentPresenterrors-hostkey-absent
2023-11-14 10:11:31 UTC	1039	IN	Data Raw: 25 73 00 25 73 4d 61 6b 69 6e 67 20 25 73 20 25 73 00 25 73 20 6e 65 67 6f 74 69 61 74 69 6f 6e 3a 20 25 73 20 25 73 00 4c 6f 6f 6b 69 6e 67 20 75 70 20 68 6f 73 74 20 22 25 73 22 25 73 20 66 6f 72 20 25 73 00 4f 70 65 6e 69 6e 67 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 74 6f 20 25 73 3a 25 64 20 66 6f 72 20 25 73 00 25 73 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 74 6f 20 25 73 00 43 6f 6e 6e 65 63 74 69 6e 67 20 74 6f 20 25 73 00 52 65 71 75 65 73 74 69 6e 67 20 72 65 6d 6f 74 65 20 70 6f 72 74 20 25 73 20 66 6f 72 77 61 72 64 20 74 6f 20 25 73 00 43 6f 6e 6e 65 63 74 65 64 20 74 6f 20 25 73 00 66 6f 72 77 61 72 64 69 6e 67 20 66 72 6f 6d 20 25 73 00 44 6f 69 6e 67 20 47 53 53 41 50 49 20 28 77 69 74 68 20 4b 65 72 62 65 72 6f 73 20 56 35 29 20 25 73 20 77 69 74 Data Ascii: %s%sMaking %s %s%s negotiation: %s %sLooking up host "%s"%s for %sOpening connection to %s:%d for %s%s connection to %sConnecting to %sRequesting remote port %s forward to %sConnected to %sforwarding from %sDoing GSSAPI (with Kerberos V5) %s wit
2023-11-14 10:11:31 UTC	1047	IN	Data Raw: 61 74 69 6f 6e 00 62 79 20 61 70 70 6c 69 63 61 74 69 6f 6e 00 41 70 70 6c 69 63 61 74 69 6f 6e 00 68 6f 73 74 20 6b 65 79 20 76 65 72 69 66 69 63 61 74 69 6f 6e 00 27 25 73 27 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 66 6f 72 6d 61 74 20 66 6f 72 20 61 20 6d 61 6e 75 61 6c 20 68 6f 73 74 20 6b 65 79 20 73 70 65 63 69 66 69 63 61 74 69 6f 6e 00 75 6e 61 62 6c 65 20 74 6f 20 70 61 72 73 65 20 70 6f 72 74 20 6e 75 6d 62 65 72 20 73 70 65 63 69 66 69 63 61 74 69 6f 6e 00 42 61 73 69 63 20 6f 70 74 69 6f 6e 73 20 66 6f 72 20 79 6f 75 72 20 25 73 20 73 65 73 73 69 6f 6e 00 4c 6f 61 64 2c 20 73 61 76 65 20 6f 72 20 64 65 6c 65 74 65 20 61 20 73 74 6f 72 65 64 20 73 65 73 73 69 6f 6e 00 73 61 76 65 64 20 73 65 73 73 69 6f 6e 20 27 25 73 27 20 69 73 20 6e Data Ascii: ationby applicationApplicationhost key verification'%s' is not a valid format for a manual host key specificationunable to parse port number specificationBasic options for your %s sessionLoad, save or delete a stored sessionsaved session '%s' is n
2023-11-14 10:11:31 UTC	1055	IN	Data Raw: 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 00 30 78 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 65 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 00 30 78 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 Data Ascii: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff0xffffffff00000001000000000000000000000000fffff
2023-11-14 10:11:31 UTC	1063	IN	Data Raw: 00 2d 70 72 6f 78 79 63 6d 64 00 53 68 61 64 6f 77 42 6f 6c 64 00 49 73 42 6f 6c 64 00 41 4e 53 49 20 59 65 6c 6c 6f 77 20 42 6f 6c 64 00 41 4e 53 49 20 47 72 65 65 6e 20 42 6f 6c 64 00 41 4e 53 49 20 43 79 61 6e 20 42 6f 6c 64 00 41 4e 53 49 20 42 6c 61 63 6b 20 42 6f 6c 64 00 41 4e 53 49 20 42 6c 75 65 20 42 6f 6c 64 00 41 4e 53 49 20 57 68 69 74 65 20 42 6f 6c 64 00 41 4e 53 49 20 52 65 64 20 42 6f 6c 64 00 41 4e 53 49 20 4d 61 67 65 6e 74 61 20 42 6f 6c 64 00 70 61 72 73 65 20 65 72 72 6f 72 20 69 6e 20 44 69 67 65 73 74 20 71 6f 70 20 66 69 65 6c 64 00 70 61 72 73 65 20 65 72 72 6f 72 20 69 6e 20 44 69 67 65 73 74 20 72 65 61 6c 6d 20 66 69 65 6c 64 00 70 61 72 73 65 20 65 72 72 6f 72 20 69 6e 20 44 69 67 65 73 74 20 61 6c 67 6f 72 69 74 68 6d 20 66 Data Ascii: -proxycmdShadowBoldIsBoldANSI Yellow BoldANSI Green BoldANSI Cyan BoldANSI Black BoldANSI Blue BoldANSI White BoldANSI Red BoldANSI Magenta Boldparse error in Digest qop fieldparse error in Digest realm fieldparse error in Digest algorithm f
2023-11-14 10:11:31 UTC	1071	IN	Data Raw: 61 66 74 65 72 20 74 68 65 20 69 6e 69 74 69 61 6c 20 4e 45 57 4b 45 59 53 00 4e 41 57 53 00 53 53 48 31 5f 53 4d 53 47 5f 45 58 49 54 5f 53 54 41 54 55 53 00 4e 41 4f 56 54 53 00 57 41 49 54 53 00 4e 41 4f 48 54 53 00 52 54 53 2f 43 54 53 00 53 53 48 32 5f 4d 53 47 5f 52 45 51 55 45 53 54 5f 53 55 43 43 45 53 53 00 53 53 48 32 5f 4d 53 47 5f 43 48 41 4e 4e 45 4c 5f 53 55 43 43 45 53 53 00 50 4c 55 47 49 4e 5f 41 55 54 48 5f 53 55 43 43 45 53 53 00 53 53 48 32 5f 4d 53 47 5f 55 53 45 52 41 55 54 48 5f 53 55 43 43 45 53 53 00 52 65 6d 6f 74 65 20 73 69 64 65 20 73 65 6e 74 20 53 53 48 32 5f 4d 53 47 5f 45 58 54 5f 49 4e 46 4f 20 6e 6f 74 20 65 69 74 68 65 72 20 70 72 65 63 65 64 65 64 20 62 79 20 4e 45 57 4b 45 59 53 20 6f 72 20 66 6f 6c 6c 6f 77 65 64 20 Data Ascii: after the initial NEWKEYSNAWSSSH1_SMSG_EXIT_STATUSNAOVTSWAITSNAOHTSRTS/CTSSSH2_MSG_REQUEST_SUCCESSSSH2_MSG_CHANNEL_SUCCESSPLUGIN_AUTH_SUCCESSSSH2_MSG_USERAUTH_SUCCESSRemote side sent SSH2_MSG_EXT_INFO not either preceded by NEWKEYS or followed
2023-11-14 10:11:31 UTC	1078	IN	Data Raw: 45 30 46 31 44 34 35 42 37 46 46 35 38 35 41 43 35 34 42 44 34 30 37 42 32 32 42 34 31 35 34 41 41 43 43 38 46 36 44 37 45 42 46 34 38 45 31 44 38 31 34 43 43 35 45 44 32 30 46 38 30 33 37 45 30 41 37 39 37 31 35 45 45 46 32 39 42 45 33 32 38 30 36 41 31 44 35 38 42 42 37 43 35 44 41 37 36 46 35 35 30 41 41 33 44 38 41 31 46 42 46 46 30 45 42 31 39 43 43 42 31 41 33 31 33 44 35 35 43 44 41 35 36 43 39 45 43 32 45 46 32 39 36 33 32 33 38 37 46 45 38 44 37 36 45 33 43 30 34 36 38 30 34 33 45 38 46 36 36 33 46 34 38 36 30 45 45 31 32 42 46 32 44 35 42 30 42 37 34 37 34 44 36 45 36 39 34 46 39 31 45 36 44 43 43 34 30 32 34 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 00 30 78 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 43 39 30 46 44 41 41 32 32 31 36 Data Ascii: E0F1D45B7FF585AC54BD407B22B4154AACC8F6D7EBF48E1D814CC5ED20F8037E0A79715EEF29BE32806A1D58BB7C5DA76F550AA3D8A1FBFF0EB19CCB1A313D55CDA56C9EC2EF29632387FE8D76E3C0468043E8F663F4860EE12BF2D5B0B7474D6E694F91E6DCC4024FFFFFFFFFFFFFFFF0xFFFFFFFFFFFFFFFFC90FDAA2216
2023-11-14 10:11:31 UTC	1086	IN	Data Raw: 62 63 65 33 33 35 37 36 62 33 31 35 65 63 65 63 62 62 36 34 30 36 38 33 37 62 66 35 31 66 35 00 68 6d 61 63 2d 6d 64 35 00 4d 44 35 00 38 35 2c 38 35 2c 38 35 00 32 35 35 2c 38 35 2c 38 35 00 38 35 2c 32 35 35 2c 38 35 00 32 35 35 2c 32 35 35 2c 38 35 00 38 35 2c 38 35 2c 32 35 35 00 32 35 35 2c 38 35 2c 32 35 35 00 38 35 2c 32 35 35 2c 32 35 35 00 32 35 35 2c 32 35 35 2c 32 35 35 00 43 69 73 63 6f 2d 31 2e 32 35 00 67 72 6f 75 70 31 35 00 50 6f 6c 79 31 33 30 35 00 30 78 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: bce33576b315ececbb6406837bf51f5hmac-md5MD585,85,85255,85,8585,255,85255,255,8585,85,255255,85,25585,255,255255,255,255Cisco-1.25group15Poly13050x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2023-11-14 10:11:31 UTC	1094	IN	Data Raw: 54 59 2c 20 57 48 45 54 48 45 52 20 49 4e 20 41 4e 20 41 43 54 49 4f 4e 20 4f 46 20 43 4f 4e 54 52 41 43 54 2c 20 54 4f 52 54 20 4f 52 20 4f 54 48 45 52 57 49 53 45 2c 20 41 52 49 53 49 4e 47 20 46 52 4f 4d 2c 20 4f 55 54 20 4f 46 20 4f 52 20 49 4e 20 43 4f 4e 4e 45 43 54 49 4f 4e 20 57 49 54 48 20 54 48 45 20 53 4f 46 54 57 41 52 45 20 4f 52 20 54 48 45 20 55 53 45 20 4f 52 20 4f 54 48 45 52 20 44 45 41 4c 49 4e 47 53 20 49 4e 20 54 48 45 20 53 4f 46 54 57 41 52 45 2e 00 31 32 37 2e 00 54 72 79 69 6e 67 20 67 73 73 61 70 69 2d 6b 65 79 65 78 2e 2e 2e 00 4f 76 65 72 2d 75 73 65 20 6d 65 61 6e 73 20 74 68 69 73 20 6d 61 6e 79 20 62 65 6c 6c 73 2e 2e 2e 00 43 68 61 6e 26 67 65 20 53 65 74 74 69 6e 67 73 2e 2e 2e 00 54 72 79 69 6e 67 20 74 6f 20 65 6e 61 62 Data Ascii: TY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.127.Trying gssapi-keyex...Over-use means this many bells...Chan&ge Settings...Trying to enab
2023-11-14 10:11:31 UTC	1102	IN	Data Raw: 65 6e 74 20 72 65 71 75 65 73 74 65 64 20 73 65 72 76 69 63 65 20 27 25 2e 2a 73 27 20 77 68 65 6e 20 77 65 20 6f 6e 6c 79 20 73 75 70 70 6f 72 74 20 27 25 73 27 00 43 65 72 74 69 66 69 63 61 74 69 6f 6e 20 61 75 74 68 6f 72 69 74 79 20 6d 61 74 63 68 65 73 20 27 25 73 27 00 55 6e 73 75 70 70 6f 72 74 65 64 20 61 75 74 68 6f 72 69 73 61 74 69 6f 6e 20 70 72 6f 74 6f 63 6f 6c 20 27 25 73 27 00 75 6e 72 65 63 6f 67 6e 69 73 65 64 20 63 65 72 74 69 66 69 63 61 74 65 20 74 79 70 65 20 27 25 73 27 00 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 70 6c 75 67 69 6e 20 73 65 74 20 75 73 65 72 6e 61 6d 65 20 27 25 73 27 00 63 61 6e 27 74 20 6f 70 65 6e 20 69 6e 70 75 74 20 66 69 6c 65 20 27 25 73 27 00 75 6e 61 62 6c 65 20 74 6f 20 72 65 61 64 20 61 20 70 61 73 73 Data Ascii: ent requested service '%.*s' when we only support '%s'Certification authority matches '%s'Unsupported authorisation protocol '%s'unrecognised certificate type '%s'Authentication plugin set username '%s'can't open input file '%s'unable to read a pass
2023-11-14 10:11:31 UTC	1110	IN	Data Raw: 00 77 00 6c 00 65 00 6e 00 20 00 3e 00 3d 00 20 00 62 00 6f 00 74 00 74 00 6f 00 6d 00 20 00 26 00 26 00 20 00 70 00 77 00 6c 00 65 00 6e 00 20 00 3c 00 3d 00 20 00 74 00 6f 00 70 00 00 00 63 00 74 00 78 00 2d 00 3e 00 6c 00 67 00 66 00 70 00 00 00 74 00 65 00 72 00 6d 00 2d 00 3e 00 77 00 72 00 61 00 70 00 00 00 61 00 64 00 64 00 65 00 64 00 20 00 3d 00 3d 00 20 00 72 00 6d 00 61 00 70 00 00 00 64 00 73 00 61 00 2d 00 3e 00 70 00 00 00 70 00 73 00 2d 00 3e 00 70 00 6e 00 00 00 21 00 63 00 2d 00 3e 00 63 00 74 00 72 00 6c 00 2d 00 3e 00 66 00 69 00 6c 00 65 00 73 00 65 00 6c 00 65 00 63 00 74 00 2e 00 6a 00 75 00 73 00 74 00 5f 00 62 00 75 00 74 00 74 00 6f 00 6e 00 00 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 73 00 73 00 68 00 2d 00 Data Ascii: wlen >= bottom && pwlen <= topctx->lgfpterm->wrapadded == rmapdsa->pps->pn!c->ctrl->fileselect.just_buttondirectionssh-
2023-11-14 10:11:31 UTC	1118	IN	Data Raw: 00 6d 00 65 00 6d 00 2f 00 2e 00 62 00 75 00 69 00 6c 00 64 00 2f 00 77 00 6f 00 72 00 6b 00 64 00 69 00 72 00 73 00 2f 00 62 00 6f 00 62 00 2d 00 66 00 66 00 66 00 62 00 6b 00 39 00 6d 00 79 00 2f 00 70 00 75 00 74 00 74 00 79 00 2f 00 70 00 72 00 6f 00 78 00 79 00 2f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 6f 00 72 00 2e 00 63 00 00 00 2f 00 68 00 6f 00 6d 00 65 00 2f 00 73 00 69 00 6d 00 6f 00 6e 00 2f 00 6d 00 65 00 6d 00 2f 00 2e 00 62 00 75 00 69 00 6c 00 64 00 2f 00 77 00 6f 00 72 00 6b 00 64 00 69 00 72 00 73 00 2f 00 62 00 6f 00 62 00 2d 00 66 00 66 00 66 00 62 00 6b 00 39 00 6d 00 79 00 2f 00 70 00 75 00 74 00 74 00 79 00 2f 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f 00 6e 00 61 00 6d 00 65 00 64 00 2d 00 70 00 69 00 70 00 65 00 Data Ascii: mem/.build/workdirs/bob-fffbk9my/putty/proxy/interactor.c/home/simon/mem/.build/workdirs/bob-fffbk9my/putty/windows/named-pipe
2023-11-14 10:11:31 UTC	1125	IN	Data Raw: 00 63 00 75 00 74 00 73 00 5b 00 73 00 5d 00 00 00 62 00 61 00 63 00 6b 00 65 00 6e 00 64 00 73 00 5b 00 69 00 5d 00 00 00 66 00 69 00 6e 00 67 00 65 00 72 00 70 00 72 00 69 00 6e 00 74 00 73 00 5b 00 66 00 70 00 74 00 79 00 70 00 65 00 5d 00 00 00 53 00 69 00 6d 00 6f 00 6e 00 54 00 61 00 74 00 68 00 61 00 6d 00 2e 00 50 00 75 00 54 00 54 00 59 00 00 00 74 00 65 00 72 00 6d 00 2d 00 3e 00 77 00 69 00 6e 00 5f 00 72 00 65 00 73 00 69 00 7a 00 65 00 5f 00 70 00 65 00 6e 00 64 00 69 00 6e 00 67 00 20 00 3d 00 3d 00 20 00 57 00 49 00 4e 00 5f 00 52 00 45 00 53 00 49 00 5a 00 45 00 5f 00 41 00 57 00 41 00 49 00 54 00 5f 00 52 00 45 00 50 00 4c 00 59 00 00 00 63 00 20 00 26 00 26 00 20 00 63 00 2d 00 3e 00 63 00 74 00 72 00 6c 00 2d 00 3e 00 74 00 79 00 70 00 Data Ascii: cuts[s]backends[i]fingerprints[fptype]SimonTatham.PuTTYterm->win_resize_pending == WIN_RESIZE_AWAIT_REPLYc && c->ctrl->typ
2023-11-14 10:11:31 UTC	1133	IN	Data Raw: 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2c 00 20 00 26 00 64 00 75 00 6d 00 6d 00 79 00 2c 00 20 00 4e 00 55 00 4c 00 4c 00 29 00 00 00 21 00 28 00 63 00 2d 00 3e 00 63 00 6c 00 6f 00 73 00 65 00 73 00 20 00 26 00 20 00 43 00 4c 00 4f 00 53 00 45 00 53 00 5f 00 53 00 45 00 4e 00 54 00 5f 00 45 00 4f 00 46 00 29 00 00 00 21 00 28 00 63 00 2d 00 3e 00 63 00 6c 00 6f 00 73 00 65 00 73 00 20 00 26 00 20 00 43 00 4c 00 4f 00 53 00 45 00 53 00 5f 00 53 00 45 00 4e 00 54 00 5f 00 43 00 4c 00 4f 00 53 00 45 00 29 00 00 00 28 00 63 00 74 00 72 00 6c 00 2d 00 3e 00 63 00 6f 00 6c 00 75 00 6d 00 6e 00 73 00 2e 00 6e 00 63 00 6f 00 6c 00 73 00 20 00 3d 00 3d 00 20 00 31 00 29 00 20 00 5e 00 20 00 28 00 6e 00 63 00 6f 00 6c 00 73 00 20 00 3d 00 Data Ascii: onnections, &dummy, NULL)!(c->closes & CLOSES_SENT_EOF)!(c->closes & CLOSES_SENT_CLOSE)(ctrl->columns.ncols == 1) ^ (ncols =
2023-11-14 10:11:31 UTC	1141	IN	Data Raw: 00 48 48 3a 6d 6d 3a 73 73 00 00 00 00 00 00 00 00 74 6f 6f 20 6d 61 6e 79 20 73 79 6d 62 6f 6c 69 63 20 6c 69 6e 6b 20 6c 65 76 65 6c 73 00 00 00 54 6f 6f 20 6d 61 6e 79 20 6c 69 6e 6b 73 00 00 4e 6f 20 63 68 69 6c 64 20 70 72 6f 63 65 73 73 65 73 00 00 00 00 00 00 54 6f 6f 20 6d 61 6e 79 20 6f 70 65 6e 20 66 69 6c 65 73 00 00 00 00 00 6e 6f 20 73 74 72 65 61 6d 20 72 65 73 6f 75 72 63 65 73 00 00 00 00 00 42 61 64 20 66 69 6c 65 20 64 65 73 63 72 69 70 74 6f 72 00 00 00 00 00 6f 70 65 72 61 74 6f 72 00 00 00 00 00 00 00 00 49 6e 70 75 74 2f 6f 75 74 70 75 74 20 65 72 72 6f 72 00 00 00 00 00 00 45 78 65 63 20 66 6f 72 6d 61 74 20 65 72 72 6f 72 00 00 00 00 00 00 00 4e 6f 20 65 72 72 6f 72 00 00 00 00 00 00 00 00 55 6e 6b 6e 6f 77 6e 20 65 72 72 6f 72 00 Data Ascii: HH:mm:sstoo many symbolic link levelsToo many linksNo child processesToo many open filesno stream resourcesBad file descriptoroperatorInput/output errorExec format errorNo errorUnknown error
2023-11-14 10:11:31 UTC	1149	IN	Data Raw: 00 65 00 00 00 00 00 00 00 65 00 73 00 2d 00 76 00 65 00 00 00 00 00 00 00 54 00 75 00 65 00 00 00 63 00 68 00 69 00 6e 00 65 00 73 00 65 00 00 00 73 00 76 00 2d 00 73 00 65 00 00 00 00 00 00 00 73 00 6d 00 6a 00 2d 00 73 00 65 00 00 00 00 00 73 00 65 00 2d 00 73 00 65 00 00 00 00 00 00 00 73 00 6d 00 61 00 2d 00 73 00 65 00 00 00 00 00 63 00 68 00 69 00 6e 00 65 00 73 00 65 00 2d 00 73 00 69 00 6e 00 67 00 61 00 70 00 6f 00 72 00 65 00 00 00 00 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 69 00 72 00 65 00 00 00 71 00 75 00 7a 00 2d 00 70 00 65 00 00 00 00 00 65 00 73 00 2d 00 70 00 65 00 00 00 00 00 00 00 4a 00 75 00 6e 00 65 00 00 00 00 00 00 00 00 00 73 00 70 00 61 00 6e 00 69 00 73 00 68 00 2d 00 63 00 68 00 69 00 6c 00 65 00 00 00 00 00 Data Ascii: ees-veTuechinesesv-sesmj-sese-sesma-sechinese-singaporeenglish-irequz-pees-peJunespanish-chile
2023-11-14 10:11:31 UTC	1157	IN	Data Raw: 00 fa 42 12 00 00 00 00 00 10 43 12 00 00 00 00 00 1e 43 12 00 00 00 00 00 3a 43 12 00 00 00 00 00 48 43 12 00 00 00 00 00 58 43 12 00 00 00 00 00 68 43 12 00 00 00 00 00 78 43 12 00 00 00 00 00 88 43 12 00 00 00 00 00 9a 43 12 00 00 00 00 00 ac 43 12 00 00 00 00 00 be 43 12 00 00 00 00 00 da 43 12 00 00 00 00 00 f4 43 12 00 00 00 00 00 06 44 12 00 00 00 00 00 12 44 12 00 00 00 00 00 24 44 12 00 00 00 00 00 3a 44 12 00 00 00 00 00 4a 44 12 00 00 00 00 00 5c 44 12 00 00 00 00 00 6a 44 12 00 00 00 00 00 78 44 12 00 00 00 00 00 8c 44 12 00 00 00 00 00 a0 44 12 00 00 00 00 00 ac 44 12 00 00 00 00 00 be 44 12 00 00 00 00 00 ca 44 12 00 00 00 00 00 e0 44 12 00 00 00 00 00 f4 44 12 00 00 00 00 00 04 45 12 00 00 00 00 00 10 45 12 00 00 00 00 00 24 45 12 00 00 00 Data Ascii: BCC:CHCXChCxCCCCCCCDD$D:DJD\DjDxDDDDDDDDEE$E
2023-11-14 10:11:31 UTC	1164	IN	Data Raw: 00 bc 01 46 72 65 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 57 00 bd 01 46 72 65 65 4c 69 62 72 61 72 79 00 c4 01 47 65 74 41 43 50 00 00 d3 01 47 65 74 43 50 49 6e 66 6f 00 e6 01 47 65 74 43 6f 6d 6d 53 74 61 74 65 00 00 e8 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 41 00 e9 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 00 0e 02 47 65 74 43 6f 6e 73 6f 6c 65 4d 6f 64 65 00 00 12 02 47 65 74 43 6f 6e 73 6f 6c 65 4f 75 74 70 75 74 43 50 00 00 22 02 47 65 74 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 41 00 00 2a 02 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 00 2b 02 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 64 00 2e 02 47 65 74 43 75 72 72 65 6e 74 54 68 72 65 61 64 00 00 2f 02 47 65 74 43 75 72 72 65 6e 74 54 68 Data Ascii: FreeEnvironmentStringsWFreeLibraryGetACPGetCPInfoGetCommStateGetCommandLineAGetCommandLineWGetConsoleModeGetConsoleOutputCP"GetCurrentDirectoryA*GetCurrentProcess+GetCurrentProcessId.GetCurrentThread/GetCurrentTh
2023-11-14 10:11:31 UTC	1172	IN	Data Raw: 00 19 54 09 00 19 34 08 00 19 52 15 e0 01 14 08 00 14 64 0b 00 14 54 0a 00 14 34 09 00 14 52 10 70 19 2b 0c 00 1c 64 13 00 1c 54 12 00 1c 34 11 00 1c 92 18 f0 16 e0 14 d0 12 c0 10 70 84 48 0d 00 40 00 00 00 01 0f 06 00 0f 64 08 00 0f 34 07 00 0f 32 0b 70 01 12 08 00 12 54 10 00 12 34 0f 00 12 92 0e c0 0c 70 0b 60 01 0a 04 00 0a 34 08 00 0a 52 06 70 19 32 0b 00 21 64 9c 00 21 34 9b 00 21 01 94 00 12 f0 10 e0 0e c0 0c 70 0b 50 00 00 84 48 0d 00 90 04 00 00 01 22 0a 00 22 74 09 00 22 64 08 00 22 54 07 00 22 34 06 00 22 32 1e e0 01 12 08 00 12 54 0c 00 12 34 0b 00 12 52 0e e0 0c 70 0b 60 19 2d 0c 00 1f 74 13 00 1f 64 12 00 1f 34 11 00 1f 92 18 f0 16 e0 14 d0 12 c0 10 50 84 48 0d 00 40 00 00 00 01 06 02 00 06 52 02 30 01 14 08 00 14 64 0f 00 14 54 0e 00 14 34 Data Ascii: T4RdT4Rp+dT4pH@d42pT4p`4Rp2!d!4!pPH""t"d"T"4"2T4Rp`-td4PH@R0dT4
2023-11-14 10:11:31 UTC	1180	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 00 00 00 00 00 00 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
2023-11-14 10:11:31 UTC	1188	IN	Data Raw: 00 e0 e3 03 00 70 52 12 00 10 e4 03 00 b6 e4 03 00 3c 53 12 00 80 e7 03 00 c7 e9 03 00 b4 52 12 00 d0 e9 03 00 34 ea 03 00 84 52 12 00 40 ea 03 00 a4 ea 03 00 84 52 12 00 b0 ea 03 00 a9 eb 03 00 b0 54 12 00 c0 eb 03 00 11 ec 03 00 d4 52 12 00 20 ec 03 00 0f ef 03 00 98 58 12 00 10 ef 03 00 3c f0 03 00 98 58 12 00 80 f0 03 00 53 f1 03 00 a8 52 12 00 60 f1 03 00 ac f1 03 00 3c 53 12 00 c0 f1 03 00 e8 f2 03 00 24 53 12 00 f0 f2 03 00 0e f8 03 00 64 59 12 00 10 f8 03 00 46 f8 03 00 b8 56 12 00 50 f8 03 00 1a fc 03 00 80 59 12 00 20 fc 03 00 54 fc 03 00 84 52 12 00 60 fc 03 00 bc 01 04 00 98 59 12 00 e0 01 04 00 64 03 04 00 a8 59 12 00 70 03 04 00 3c 04 04 00 fc 52 12 00 50 04 04 00 9f 04 04 00 3c 53 12 00 a0 04 04 00 c9 04 04 00 3c 53 12 00 d0 04 04 00 2b 05 Data Ascii: pR<SR4R@RTR X<XSR`<S$SdYFVPY TR`YdYp<RP<S<S+
2023-11-14 10:11:31 UTC	1196	IN	Data Raw: 00 f0 04 08 00 3d 06 08 00 24 56 12 00 40 06 08 00 9c 14 08 00 ec 55 12 00 a0 14 08 00 e0 26 08 00 c0 54 12 00 e0 26 08 00 8f 27 08 00 8c 56 12 00 90 27 08 00 9a 29 08 00 24 53 12 00 a0 29 08 00 b6 2b 08 00 24 53 12 00 c0 2b 08 00 29 2d 08 00 1c 59 12 00 30 2d 08 00 99 2e 08 00 1c 59 12 00 a0 2e 08 00 5c 2f 08 00 fc 52 12 00 60 2f 08 00 c3 30 08 00 24 53 12 00 d0 30 08 00 fe 37 08 00 20 5a 12 00 00 38 08 00 4d 39 08 00 1c 59 12 00 50 39 08 00 0a 3a 08 00 8c 56 12 00 10 3a 08 00 6d 3b 08 00 1c 59 12 00 70 3b 08 00 93 3b 08 00 70 52 12 00 a0 3b 08 00 c3 3b 08 00 70 52 12 00 e0 3b 08 00 03 3c 08 00 70 52 12 00 10 3c 08 00 4c 3c 08 00 3c 53 12 00 50 3c 08 00 0b 3f 08 00 e4 5e 12 00 10 3f 08 00 91 3f 08 00 fc 52 12 00 a0 3f 08 00 30 40 08 00 fc 52 12 00 30 40 Data Ascii: =$V@U&T&'V')$S)+$S+)-Y0-.Y.\/R`/0$S07 Z8M9YP9:V:m;Yp;;pR;;pR;<pR<L<<SP<?^??R?0@R0@
2023-11-14 10:11:31 UTC	1203	IN	Data Raw: 00 7c 6a 12 00 64 64 0c 00 db 64 0c 00 98 66 12 00 dc 64 0c 00 53 65 0c 00 98 66 12 00 8c 65 0c 00 ca 65 0c 00 70 52 12 00 d4 65 0c 00 43 66 0c 00 88 6a 12 00 44 66 0c 00 74 66 0c 00 70 52 12 00 74 66 0c 00 a6 66 0c 00 70 5e 12 00 a8 66 0c 00 6d 67 0c 00 a0 6a 12 00 70 67 0c 00 3b 68 0c 00 c8 6a 12 00 3c 68 0c 00 74 68 0c 00 e8 6a 12 00 78 68 0c 00 fa 68 0c 00 0c 6b 12 00 08 69 0c 00 71 69 0c 00 70 5e 12 00 74 69 0c 00 15 6a 0c 00 1c 6b 12 00 18 6a 0c 00 95 6e 0c 00 24 6b 12 00 98 6e 0c 00 fd 6e 0c 00 44 6b 12 00 00 6f 0c 00 a2 6f 0c 00 70 68 12 00 a4 6f 0c 00 0a 71 0c 00 54 6b 12 00 0c 71 0c 00 69 74 0c 00 6c 6b 12 00 6c 74 0c 00 56 76 0c 00 3c 6a 12 00 58 76 0c 00 e8 78 0c 00 90 6b 12 00 e8 78 0c 00 16 79 0c 00 b4 6b 12 00 18 79 0c 00 d6 79 0c 00 70 52 Data Ascii: \|jdddfdSefeepReCfjDftfpRtffp^fmgjpg;hj<hthjxhhkiqip^tijkjn$knnDkoophoqTkqitlkltVv<jXvxkxykyypR
2023-11-14 10:11:31 UTC	1211	IN	Data Raw: f6 5e 11 00 00 00 00 00 00 70 2b d8 5a 5e af b9 be 61 11 00 00 00 00 00 00 70 f2 5b 1e f0 36 88 ad 7e 11 00 00 00 00 00 00 70 db 55 18 3b 16 31 e8 d4 11 00 00 00 00 00 00 70 ca 53 5e 21 be 45 f3 e7 11 00 00 00 00 00 00 70 d8 55 74 b3 2f 0d a9 ed 11 00 00 00 00 00 00 70 1a 51 50 63 3e c1 d1 f1 11 00 00 00 00 00 00 70 da 51 5a 4c 0f 3c b7 f2 11 00 00 00 00 00 00 70 da 51 5a 4c 0f 3c b7 f4 11 00 00 00 00 00 00 70 11 53 56 13 06 38 85 f5 11 00 00 00 00 00 00 70 da 51 5a 4c 0f 3c b7 f6 11 00 00 00 00 00 00 70 da 51 5a 4c 0f 3c b7 f7 11 00 00 00 00 00 00 70 08 57 18 1b be 2c aa f8 11 00 00 00 00 00 00 70 da 51 5a 4c 0f 3c b7 ff 11 00 00 00 00 00 00 70 da 51 5a 4c 0f 3c b7 09 12 00 00 00 00 00 00 70 3a de 50 39 37 98 8c d7 12 00 00 00 00 00 00 70 aa d1 54 a0 0f Data Ascii: ^p+Z^ap[6~pU;1pS^!EpUt/pQPc>pQZL<pQZL<pSV8pQZL<pQZL<pW,pQZL<pQZL<p:P97pT
2023-11-14 10:11:31 UTC	1219	IN	Data Raw: c6 6d 00 00 00 00 00 00 00 70 73 d7 50 49 86 c1 c6 21 00 00 00 00 00 00 00 70 30 52 5e 47 27 05 d3 78 00 00 00 00 00 00 00 70 70 d9 7c bd 17 fc c1 90 00 00 00 00 00 00 00 70 53 d8 1c 66 3f 5d 88 91 00 00 00 00 00 00 00 70 53 d8 1c 66 3f 5d 88 bb 00 00 00 00 00 00 00 70 1a d8 7c 02 8e bc d2 d8 00 00 00 00 00 00 00 70 3a de 50 39 37 98 8c e4 00 00 00 00 00 00 00 70 bb 54 10 fa a7 48 9f a4 00 00 00 00 00 00 00 70 78 d2 74 da be d5 a7 a5 00 00 00 00 00 00 00 70 00 5e 5c 12 36 41 ca a6 00 00 00 00 00 00 00 70 00 5e 5c 12 36 41 ca c1 00 00 00 00 00 00 00 70 30 56 16 f3 97 e4 c7 70 00 00 00 00 00 00 00 70 cb 50 76 01 a6 69 e0 71 00 00 00 00 00 00 00 70 bb 52 7c c9 16 19 85 72 00 00 00 00 00 00 00 70 cb 50 76 01 a6 69 e0 38 00 00 00 00 00 00 00 70 aa da 36 c7 a7 Data Ascii: mpsPI!p0R^G'xpp\|pSf?]pSf?]p\|p:P97pTHpxtp^\6Ap^\6Ap0VppPviqpR\|rpPvi8p6
2023-11-14 10:11:31 UTC	1227	IN	Data Raw: 00 01 fc 00 00 00 00 00 00 80 7f 00 00 00 3f 00 00 00 1f 00 00 80 1f 00 00 80 3f 00 00 80 3f 00 00 80 03 00 00 80 01 00 00 80 00 00 00 c0 00 00 00 fc 01 00 00 fc 01 00 00 fc 01 00 00 fc 01 00 00 fc 01 00 00 fe 03 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 01 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 00 7f ff c0 00 7f e1 e0 00 7f ff f0 00 7f ff f0 00 20 00 f0 00 0f ff 70 00 0f ff 80 00 08 03 80 00 08 03 80 00 08 43 80 00 08 23 80 00 08 1b 80 00 08 0d 80 00 08 06 00 00 0f fb bf f8 07 c1 dc 3c 00 3f e7 fe 00 0f fb fe 00 07 00 1e 00 03 bf ee 00 00 df f0 00 01 60 70 00 01 30 70 00 01 08 70 00 01 04 70 00 01 00 70 00 01 00 70 00 01 00 70 00 01 ff f0 00 00 ff f0 00 00 00 00 80 00 3f ff 00 00 Data Ascii: ???( @ pC#<?`p0pppppp?
2023-11-14 10:11:31 UTC	1235	IN	Data Raw: 67 2d 6c 6f 67 68 6f 73 74 2e 68 74 6d 6c 01 92 a7 26 99 51 17 2f 63 6f 6e 66 69 67 2d 6c 6f 67 70 61 6c 65 74 74 65 2e 68 74 6d 6c 01 91 c1 02 87 57 1c 2f 63 6f 6e 66 69 67 2d 6c 6f 67 73 73 68 2d 6f 6d 69 74 64 61 74 61 2e 68 74 6d 6c 01 8a c0 3b 86 5f 1a 2f 63 6f 6e 66 69 67 2d 6c 6f 67 73 73 68 2d 6f 6d 69 74 70 77 2e 68 74 6d 6c 01 8a b7 08 89 33 13 2f 63 6f 6e 66 69 67 2d 6c 6f 67 73 73 68 2e 68 74 6d 6c 01 8a ad 72 89 16 12 2f 63 6f 6e 66 69 67 2d 6d 6f 75 73 65 2e 68 74 6d 6c 01 90 8d 5f 8e 4d 15 2f 63 6f 6e 66 69 67 2d 6d 6f 75 73 65 70 74 72 2e 68 74 6d 6c 01 8e c9 51 87 51 17 2f 63 6f 6e 66 69 67 2d 6d 6f 75 73 65 73 68 69 66 74 2e 68 74 6d 6c 01 90 9c 2c 8e 16 14 2f 63 6f 6e 66 69 67 2d 6e 65 74 68 61 63 6b 2e 68 74 6d 6c 01 8c af 24 8a 71 14 Data Ascii: g-loghost.html&Q/config-logpalette.htmlW/config-logssh-omitdata.html;_/config-logssh-omitpw.html3/config-logssh.htmlr/config-mouse.html_M/config-mouseptr.htmlQQ/config-mouseshift.html,/config-nethack.html$q
2023-11-14 10:11:31 UTC	1243	IN	Data Raw: 01 a7 c0 3e 97 14 22 2f 70 61 67 65 61 6e 74 2d 63 6d 64 6c 69 6e 65 2d 72 65 73 74 72 69 63 74 2d 61 63 6c 2e 68 74 6d 6c 01 a7 ee 65 89 13 1a 2f 70 61 67 65 61 6e 74 2d 63 6d 64 6c 69 6e 65 2d 75 6e 69 78 2e 68 74 6d 6c 01 a7 d7 52 91 56 15 2f 70 61 67 65 61 6e 74 2d 63 6d 64 6c 69 6e 65 2e 68 74 6d 6c 01 a7 a2 12 8c 69 21 2f 70 61 67 65 61 6e 74 2d 64 65 66 65 72 72 65 64 2d 64 65 63 72 79 70 74 69 6f 6e 2e 68 74 6d 6c 01 a8 90 42 95 68 15 2f 70 61 67 65 61 6e 74 2d 66 6f 72 77 61 72 64 2e 68 74 6d 6c 01 a7 f7 78 98 4a 1c 2f 70 61 67 65 61 6e 74 2d 6d 61 69 6e 77 69 6e 2d 61 64 64 6b 65 79 2e 68 74 6d 6c 01 a7 8e 71 8b 5f 1d 2f 70 61 67 65 61 6e 74 2d 6d 61 69 6e 77 69 6e 2d 6b 65 79 6c 69 73 74 2e 68 74 6d 6c 01 a6 f7 20 97 51 1c 2f 70 61 67 65 61 6e Data Ascii: >"/pageant-cmdline-restrict-acl.htmle/pageant-cmdline-unix.htmlRV/pageant-cmdline.htmli!/pageant-deferred-decryption.htmlBh/pageant-forward.htmlxJ/pageant-mainwin-addkey.htmlq_/pageant-mainwin-keylist.html Q/pagean
2023-11-14 10:11:31 UTC	1250	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-11-14 10:11:31 UTC	1258	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-11-14 10:11:31 UTC	1266	IN	Data Raw: 03 04 6f b3 5a 07 ce 0d ec 5a aa d1 23 a7 cb f9 00 d6 09 dd 38 1a 36 af a3 5f 3f 6b c9 56 09 ea bb ff 8f 2a df 73 8d b3 a9 9c 30 3d 12 2c 30 6a b8 fd eb 01 0f 03 69 50 eb 76 a7 9b 45 7c 84 f7 10 26 d5 d2 a6 ee 4f 6b 05 87 45 c4 6f 30 3c c9 5d 3c f7 d0 2c 01 42 68 9f e2 bc 5d 04 51 29 22 6a 00 e3 bc e8 d7 ec c7 de b5 f8 ee 4f 76 fb 15 cd 5e a4 24 d8 f1 2c df a5 dd 11 0d 83 f6 12 e4 45 e8 45 a6 be bc d6 23 cb 90 fe ed 39 2d 9b 46 86 54 8d 16 45 98 dd 76 96 d9 ac 8b 86 cc 6d ad ae 0b 2a 7e 79 da f3 3e 8c d1 f5 67 af e2 b6 f9 a7 c4 fa c2 ba ae bc 3b 58 d7 24 9b 2f 16 a8 29 b0 35 cb ae 7a a5 36 b4 bc 72 cf c6 37 fb 8b 69 6a e8 f8 c7 c4 43 da a0 37 80 1f 12 ad 08 df 78 da 26 64 ad 2b 31 b3 ca 82 51 5d 6d f2 b2 d7 6f e4 c0 ba 4e 4b 57 5b 9f 61 f4 91 f7 c6 e9 14 Data Ascii: oZZ#86_?kVs0=,0jiPvE\|&OkEo0<]<,Bh]Q)"jOv^$,EE#9-FTEvm~y>g;X$/)5z6r7ijC7x&d+1Q]moNKW[a
2023-11-14 10:11:31 UTC	1274	IN	Data Raw: f8 1b 9e 35 5a 62 f8 3c 6c a0 d1 d9 e6 bf 8a d3 ba c4 07 64 cb 1b 6a 75 de 2e b4 ad f8 83 6b ce 79 2e 0a 53 33 83 ba d9 bd 00 60 23 ee 25 ef d3 72 b1 83 f3 ab 67 40 4a c4 99 cd e1 a3 31 a7 2d 44 d8 08 63 ea 89 a7 3d cb f5 06 86 cc 53 3c 97 57 07 7c 37 1b a4 a1 23 2d 94 8f fc 65 f3 5e dd ea 1f 8d 41 53 b0 a2 ef 87 f5 0c bd 78 fc 03 18 50 0d d3 c9 15 78 c8 dc 73 ee 0e 35 06 81 f5 42 57 c2 e2 14 fe 9f e2 47 62 89 b3 b7 28 1f 14 72 7f a0 2e a5 b9 be 99 70 5d ed d2 3a e1 2f 0e 5d 9b 08 7b 2c dd f1 5b 12 f2 2f b5 ef a3 f5 33 5e 13 be 0b 94 71 94 20 c7 ca e2 8b 44 77 3d 0d a9 67 ec 21 c5 73 64 a0 5b ff e1 ca a5 9e 12 46 15 92 c3 88 87 99 89 e6 b3 d2 73 22 f8 ab d6 10 ac 18 56 57 a7 4d 1f 86 e9 b0 e2 c0 62 8d 2e 8d 5c 16 b4 02 51 1f 84 8a 50 af 9c 9a 21 c6 f8 38 Data Ascii: 5Zb<ldju.ky.S3`#%rg@J1-Dc=S<W\|7#-e^ASxPxs5BWGb(r.p]:/]{,[/3^q Dw=g!sd[Fs"VWMb.\QP!8
2023-11-14 10:11:31 UTC	1282	IN	Data Raw: 6b 8a 1c c7 f2 81 3c 0b b9 81 7d 8f 10 24 f9 b0 19 23 21 8e 89 9f 32 6c ed 0d 42 31 f1 03 41 96 b9 dc 77 7d 33 66 b1 5c c8 59 4a 55 23 33 98 28 a6 7e bd f6 c4 03 ff fb e8 16 6a 3e cc 3c a5 c0 20 dc 36 e1 90 32 a6 8e 24 19 fa 47 d1 e3 5e 01 8b d5 fc 1d 4e 87 91 fd 89 15 f3 1b 2b 8a b5 12 30 c2 95 89 c9 1e 5d d9 75 70 9d 54 57 3a 14 68 d9 0c b6 f8 22 8b 83 fa 58 7c 06 a0 96 eb a1 24 20 d3 e8 28 f9 62 2c cb 2b 70 ea d9 18 55 b5 2f 14 2a 9f 85 b9 4d 35 97 21 65 45 61 e3 9b ff 1f 51 1b 0f 1a 2b 3b 56 9e b2 96 3e c2 86 25 98 3f 46 d8 05 81 de a5 e5 58 4f e3 02 6f 8d 36 65 4a 33 fa 1e 3d 0f 87 77 e9 63 e9 c1 61 61 cc b7 53 1b f0 2b 6c 13 13 c8 7e 9c 39 05 a7 38 9a 0f 92 34 bb b1 ca 85 bd c1 89 f6 2e c9 fb b0 c5 d0 1b 70 61 98 26 51 43 be ef 6f 7d 36 c5 07 31 60 Data Ascii: k<}$#!2lB1Aw}3f\YJU#3(~j>< 62$G^N+0]upTW:h"X\|$ (b,+pU/*M5!eEaQ+;V>%?FXOo6eJ3=wcaaS+l~984.pa&QCo}61`
2023-11-14 10:11:31 UTC	1289	IN	Data Raw: 8c 2e 2d 8a 69 7f 08 57 7d f1 47 19 9b 09 6b 76 bc 30 91 79 7e 94 25 0e 76 8f 39 9e 86 fb 71 63 90 5b ac 9d a0 d4 4a 14 07 92 79 e3 97 50 87 59 db f7 64 72 ea 54 ba 95 9c 6a dd 2a fe da a9 e5 8d 04 a0 83 a3 2a b8 5e 84 d7 42 d2 b3 70 46 7d 2a 82 0a e0 3b 03 17 11 75 1d c7 2d b8 6a 1a e6 d5 04 72 90 55 c2 5b c9 64 6f a5 43 17 f4 2a 90 0f 7c 00 5d a2 cb d8 b5 c4 d8 5f 93 42 7a ca 17 0c 44 48 e4 2b 3e be 12 74 90 9a 74 f5 53 ce e9 75 0e 2b 0c a4 e1 5f 70 59 83 45 20 9a f4 90 6b c8 85 02 7f 4c 81 41 ee ed e0 b8 04 29 56 98 35 03 0d 8f ad 70 8f 48 1e f4 7b 5b 52 94 27 88 ae b5 05 dc e7 bc d5 0c 9e 6b 2f 74 ad 6d 97 c8 e5 8c 62 10 5f 23 7b 98 d9 fc 45 bc fc be 77 e8 b8 95 a6 7e 19 85 15 04 71 a7 b9 61 f9 4b d0 d9 04 53 1d 33 7b 6a 2e d6 62 b8 b2 9e 53 94 8a 1f Data Ascii: .-iW}Gkv0y~%v9qc[JyPYdrTj*^BpF};u-jrU[doC*\|]_BzDH+>ttSu+_pYE kLA)V5pH{[R'k/tmb_#{Ew~qaKS3{j.bS
2023-11-14 10:11:31 UTC	1297	IN	Data Raw: c7 e2 5e e5 04 f5 8c 6d 18 a3 93 81 9a 4d ef 62 f6 01 8b 2b 3e 34 c5 43 b9 95 e9 56 73 fc 6e 4b 0e 72 0d aa ba 58 2a 43 a8 dc de 23 b8 8d 27 8e d2 0b 6c da a6 7f 6d 57 12 fd 8f db 6d 4b 63 95 6c 35 b8 0e a9 b4 f6 7c 40 fb 91 93 bb 6e ea 76 ed f7 15 bf c0 6a 5d 6f 48 12 d1 04 40 2f 41 ac 6c 07 79 b7 9c e4 d7 f6 32 e4 ca ad 6a 41 1a ce ed e6 76 69 72 ba df 9b 35 7a f1 a6 f1 da ea d7 33 b9 2a 22 46 0e bb 55 47 d0 03 1d 16 b1 e2 e0 53 6c 09 6c b6 d0 a0 96 b4 a1 cd 93 93 59 6d f5 ed 4e 2a 37 9c 18 21 af 21 f6 ec c0 8c 9b 55 91 c8 69 88 3f ec 8e 8b c6 59 c5 2e 0c 20 d9 63 b5 b8 5f 46 9a 0d ad 6a ce 42 b5 8a ab 65 85 15 60 17 02 ee cb fb 76 ce 1d 7e dd f8 cc e5 81 8b d8 39 a6 28 0c 21 4f ca 15 87 61 e2 c8 19 72 2e ce 2c c3 86 41 d8 5c c4 e6 67 81 61 e5 f6 3d 55 Data Ascii: ^mMb+>4CVsnKrXC#'lmWmKcl5\|@nvj]oH@/Aly2jAvir5z3"FUGSllYmN*7!!Ui?Y. c_FjBe`v~9(!Oar.,A\ga=U
2023-11-14 10:11:31 UTC	1305	IN	Data Raw: 0d 4f cc 5e ed 9c 4f 0b df 81 23 fc 5f ff 57 db 41 27 ef 37 06 91 50 62 f1 0f c4 9f 54 5e 45 d1 d0 ff 89 98 47 3b cc 89 0f c9 99 d7 fb ba 9e cd a7 1b f1 9e 5a ac 8b 75 31 74 f6 ac 30 70 21 cd fc 50 8a 64 4d 01 5d 16 6b d6 e5 64 3e 14 23 e2 e3 ca 2b e9 e2 98 31 dc cb e4 0a ed fe fb 8c d4 41 ee 1b e0 5e 82 be 72 c6 62 b7 77 aa bf 3a 66 06 86 f6 6b c8 5d db 7e 42 b6 99 f6 40 3a 30 21 55 97 2a b2 a4 85 97 4a 29 42 ef 4f eb 8c d7 9a fc e5 cb a4 58 61 46 3c 5c 19 83 22 c6 d9 39 70 cc 8a 80 f3 2a a0 5c c2 6f 2c 38 62 d8 62 be c4 2f ca c7 6c 7a 36 6a 5d b7 c9 64 e9 31 45 82 68 91 5f 68 0b 01 38 1a 9d 82 31 db 1d f3 4c 4f 4f 21 c2 d0 4d 98 95 25 d9 8c 4f a6 c2 78 fc 21 53 0f a0 f1 f4 9a 43 8e f9 65 f8 2d f7 f0 ee c1 00 74 88 f7 0b d7 13 87 33 ad ca 5f 4e f6 9f c3 Data Ascii: O^O#_WA'7PbT^EG;Zu1t0p!PdM]kd>#+1A^rbw:fk]~B@:0!UJ)BOXaF<\"9p\o,8bb/lz6j]d1Eh_h81LOO!M%Ox!SCe-t3_N
2023-11-14 10:11:31 UTC	1313	IN	Data Raw: 05 64 2b 61 e4 cb f9 98 3a 5d 77 00 ff 41 91 4d 1d 33 bb 17 de 4a 53 ab 0c 18 8c 89 56 0e be d3 d2 ce 44 b1 e1 78 e8 19 9d a8 ef 4c 87 cc 85 1f c8 2b 58 99 f0 67 c1 48 23 62 7b 50 2d 02 37 1b 67 73 83 f0 08 c8 23 d1 1d 56 e0 e2 f1 16 e3 d0 20 62 1e f1 a2 34 27 52 3e 71 e2 71 32 5d bd 93 1e 15 66 e8 a6 ef a2 b8 ce 2a 4e 82 a1 56 b3 c0 7b 72 c4 8e c2 e8 99 98 6b 7e 73 84 3e bc 6d 80 c6 46 77 26 4e 4e 17 78 38 b7 49 dd c4 ec 9d 1a 63 28 e1 2d 7b 2d b1 67 d3 49 2e 09 c4 e4 eb dc f0 e1 87 4e a2 28 6d 2e a3 20 99 25 99 25 c8 9b 55 5e 54 7e c3 a7 59 34 41 a6 70 8d 4c d2 9c 26 93 5c 1a d5 be 56 9e fc 45 43 01 5a ea 64 74 54 6f 06 af 80 5c 0f 88 cb 8d 78 4f 20 e5 b9 ce 59 00 73 0f 4f c9 39 3e cb cb 23 70 d3 5e ae fa a7 ff 82 5c 3c 23 a8 02 f7 cc 10 23 e1 a5 f9 af Data Ascii: d+a:]wAM3JSVDxL+XgH#b{P-7gs#V b4'R>qq2]f*NV{rk~s>mFw&NNx8Ic(-{-gI.N(m. %%U^T~Y4ApL&\VECZdtTo\xO YsO9>#p^\<##
2023-11-14 10:11:31 UTC	1321	IN	Data Raw: 54 58 b5 01 44 58 6e c1 ab 78 fe e9 7e 60 af c0 0d 26 7d b4 17 f2 d0 4e 0e 94 94 1e 48 00 87 94 a7 94 03 73 be 81 39 f0 eb ee c8 09 c4 c2 e1 15 3d 58 5e 77 d8 ea cc 41 2a ad c2 2e 5e 72 39 df df 2d 53 14 b2 c9 ea 42 f2 aa 75 59 08 53 15 fe 6e a1 0f 8f 94 b3 d4 79 b8 24 a1 b1 ee 1c 26 22 a4 7d be 5f 62 41 8f d9 bd 98 8d e1 2f 25 b5 9b f7 3c 24 43 78 93 e1 1c 69 78 7d af b0 98 48 ee b8 0d 5f 7f ae d6 e4 44 b0 e8 3e eb 72 c5 38 57 fd ca ec d9 43 8c 9c 98 e1 5f e4 c1 7c d4 4f 49 a3 73 31 0d df 30 ff f0 31 e5 0f b0 bd 59 ec 94 6e 98 e2 bd ef 60 5f 36 e3 de 83 b2 9a c5 0b 68 4b 97 da 48 db 0b ed 37 ce 51 71 7d b6 96 57 d8 83 06 fe 4e e8 3e ee 02 3e ce 91 93 67 32 87 6f 57 18 f9 97 fb 3a c2 8b 7a fd 39 f3 9f fb 23 2e c6 29 96 28 f3 9e 98 32 27 ec 74 e9 57 8f 34 Data Ascii: TXDXnx~`&}NHs9=X^wA*.^r9-SBuYSny$&"}_bA/%<$Cxix}H_D>r8WC_\|OIs101Yn`_6hKH7Qq}WN>>g2oW:z9#.)(2'tW4
2023-11-14 10:11:31 UTC	1328	IN	Data Raw: f1 96 cd fe f2 36 17 70 c3 9a cd 9b 9b 64 87 c2 7d 8a 86 a2 1e f0 ce d0 17 76 11 7f ab 81 f0 28 fa be cf a3 8d c7 29 6b 6b 79 c4 40 64 87 e8 83 cb 7c 91 89 7d ac 99 cd 51 68 f0 0f 65 05 20 1f 1a 7d cd 95 f6 60 b1 0a 4e 0d e4 d4 61 6e 8d ce dd 98 8a 61 58 1b ad 03 a8 5e 34 5f 3b a4 c0 9e 57 d4 33 fe 34 97 33 3b 8c 4a 97 19 66 b6 ea 25 a9 0c 91 09 7d bb f6 08 b4 bf cb be 64 17 8b a7 bc fe 23 f4 4a 90 b2 e9 68 b3 a7 93 04 cb c8 93 33 f7 2c f6 44 6b 1e 34 e2 78 4d 31 94 e5 c0 f0 f7 1e 49 c4 f4 85 43 c1 8d 38 03 a7 63 c9 74 0f 18 db 6c 35 4c 9a 57 6b d4 56 b5 ba 26 82 0a 51 15 da 0a c5 8a 3b f6 07 7a b8 51 a6 9b 81 a9 38 cb 9b b9 53 79 e9 23 32 7c f3 93 44 ed 96 18 1e 3d 0a 0c d1 de 6e ce f4 ed 58 5a f8 bb 6b 39 13 cc 12 e3 f7 38 4f 6c 66 b2 02 8c 0c 55 44 02 Data Ascii: 6pd}v()kky@d\|}Qhe }`NanaX^4_;W343;Jf%}d#Jh3,Dk4xM1IC8ctl5LWkV&Q;zQ8Sy#2\|D=nXZk98OlfUD
2023-11-14 10:11:31 UTC	1336	IN	Data Raw: 37 0c aa 90 9d fa 5b e2 b5 28 b6 e3 ac 71 36 6d 2b 4f 4d 18 33 6a 86 69 b3 b5 1c 9c 7d ca 16 b1 21 a8 b2 87 43 4a 30 cf d4 a1 8d 72 a3 f6 ec 47 a6 e8 a3 f8 04 a8 6f 5a 7a 34 1c 49 65 7c 5d ca a5 dc 8a d9 53 57 f4 fb 77 db b0 e6 0d 33 1e 49 ac b2 e8 bd 04 1d 0e 7f 2b be b8 ac 54 0f 51 ee d2 c1 89 02 a8 97 2b 26 6a 39 74 cd e2 21 9b 5a 0f cf 57 6f 32 0d 78 4b cc 88 ec b4 96 f2 eb 9e c9 bd 72 77 8d 24 8a c8 8c dc 02 68 29 ed 19 75 4d 9a bc c8 58 f4 73 d1 95 50 fe 13 8b 40 00 bd d0 ab 6c b4 5f ab a3 07 75 8e 84 d2 b7 1d 8c 92 8d 9c 83 65 dc 22 46 ba 9b c1 88 b1 3a bd 21 fa 44 a7 42 8a 19 e7 e2 19 e8 d8 66 cb b9 3d 6a 43 b1 8c 2e cd 12 4c af 6b e0 90 ae bf d4 8b 8d d1 96 fc 0c d2 8f fc 7f 1b af 76 1d f2 3c 86 23 ab 58 5f a1 04 9e 17 66 b3 69 65 6f 4a 9a d7 93 Data Ascii: 7[(q6m+OM3ji}!CJ0rGoZz4Ie\|]SWw3I+TQ+&j9t!ZWo2xKrw$h)uMXsP@l_ue"F:!DBf=jC.Lkv<#X_fieoJ
2023-11-14 10:11:31 UTC	1344	IN	Data Raw: 87 c9 99 05 72 ab d0 8f bf 80 e3 b5 7d 86 bb 0d d1 e0 02 15 e8 c4 56 4e 1b 8e 8c 8b f1 30 73 07 5b c7 d5 84 1b f1 01 07 ce 9c 19 72 9e ed 9f c3 f7 c1 53 77 e7 c8 cf 65 68 e0 24 0d 3a 93 84 3a 5f 97 97 2c d2 e6 90 62 bc 06 86 82 cb 1b 96 c9 80 e1 91 56 2e 55 da 56 ff 86 97 b9 2f 88 bf c4 b5 18 fb fb 99 e9 a7 02 55 09 4b c6 88 85 da eb 94 41 bf ab d9 32 7f 5c 55 c3 0d 5f aa 42 10 82 14 92 a2 f3 40 d2 2a 27 67 e2 0d 89 14 28 06 41 19 02 06 2e 7a 25 be 09 f8 46 be b9 72 7e 83 67 5a 1c df f3 8c f2 ac e9 e5 e8 f2 fd 6c a8 cc 29 16 2f a7 fd 03 88 d4 e6 40 ab 8a e7 f9 f5 75 0a 68 d1 ee be 63 7b 56 9e 8c a4 45 92 1e 43 ef 0f d8 49 ee 09 d1 49 ef df 6b 0c 4f 9c 0e 03 ce 6a 37 51 59 d0 bb fe 69 d4 28 e0 19 7b 07 36 30 4e 88 34 65 79 61 ed 93 59 fb 65 41 77 8c cc c0 Data Ascii: r}VN0s[rSweh$::_,bV.UV/UKA2\U_B@*'g(A.z%Fr~gZl)/@uhc{VECIIkOj7QYi({60N4eyaYeAw
2023-11-14 10:11:31 UTC	1352	IN	Data Raw: 8f af 8a e7 f5 99 cf de f5 dd 48 b2 4b 5b 23 66 08 63 df 85 c5 da f7 05 e9 69 5b f7 ed ed c6 8e 2c 1d 3a a2 95 97 30 c5 5b d0 31 b1 4a 9d 1b 52 49 21 bd 72 63 fc 2c 95 33 a8 38 07 64 d7 9e b2 d8 2a 29 5a da cc 0f 7e d2 7c ce 1f c6 e8 43 78 27 6a 07 3e 30 b5 9a 1a 1c b6 fb 45 4c 29 a7 e0 94 86 52 11 19 d9 1f 1d 35 f9 a9 ba b6 de 9c 22 d0 0e 87 c7 71 51 52 60 ca f7 0f a5 a7 db df 3d 3b 63 2f 5f e1 c1 fa 0d bc e7 db 6b c4 1a bc 7f 9e 41 43 52 b3 53 64 2d 9e 8a 10 88 90 f8 4b 6c 1e a3 80 bc ce 8b cb 9f 64 4e cb 08 23 da 99 4d 5d dc 58 66 80 14 02 fb a3 97 86 51 0f 87 9a 3a 55 06 04 50 c4 d2 9f 60 78 54 b3 49 40 a3 08 d2 57 c7 2a 22 39 80 f0 b6 56 ea 91 b6 63 13 a7 8a 91 8f 67 25 f1 fb a6 ef a8 a9 25 37 45 1a 96 e5 4b 1c a6 0f ba a8 e9 69 87 3d 85 bd cf 9f 5a Data Ascii: HK[#fci[,:0[1JRI!rc,38d)Z~\|Cx'j>0EL)R5"qQR`=;c/_kACRSd-KldN#M]XfQ:UP`xTI@W"9Vcg%%7EKi=Z
2023-11-14 10:11:31 UTC	1360	IN	Data Raw: 67 b5 55 27 60 b5 5c e0 92 0e 0d a3 0d 7e 04 1c 78 54 ae e6 29 98 6d 7a d0 55 9d e8 90 b8 84 d9 7a ae 08 3c c6 21 84 b2 15 06 2f 79 3b e4 f2 96 92 2b 1a 5a 09 1d 53 5d 29 e3 2c 3d 75 06 7f 91 6a fb 4f dd 5f 38 03 21 1a b5 3e 30 ae 77 ac 67 35 9d 76 ec 4c 55 7e eb ea ca 08 0b 8d 22 7c a9 42 69 b1 5b 94 0f 27 b2 dc 7d 2d c5 08 6d dc 6e 83 06 a7 aa a5 f1 08 61 21 48 f6 86 a1 d5 16 ff 82 ef 00 b5 4b 77 e4 4f cf 29 91 c0 20 bf 82 a1 25 ce 00 bd c4 cf c5 84 28 62 c3 93 46 93 83 87 79 26 2d 21 e7 d5 94 79 34 d1 61 4f b9 bc 5a b0 08 8e 1a e9 7e 39 7d 37 07 a3 d8 16 6b 1c 6e 51 f2 67 ee 2f 24 7d 3f 3c 35 ca 52 fb 94 92 90 3d 8d f5 3b e4 66 e4 bf 44 c6 43 6b 48 12 50 5a 3b 94 11 83 00 5f 8e 18 bc 99 f4 66 88 a1 31 82 69 75 89 b7 26 41 8a 74 db bb 66 84 b7 10 a6 1a Data Ascii: gU'`\~xT)mzUz<!/y;+ZS]),=ujO_8!>0wg5vLU~"\|Bi['}-mna!HKwO) %(bFy&-!y4aOZ~9}7knQg/$}?<5R=;fDCkHPZ;_f1iu&Atf
2023-11-14 10:11:31 UTC	1368	IN	Data Raw: 3e c4 c4 7c 85 0c 90 97 e3 4c 0e 2f e5 22 0c e1 5b 8f d0 1e 64 cd 62 0a 71 34 84 37 d3 4a d3 53 a7 4a 2c 30 d5 87 57 90 63 74 15 c1 fb 1c d0 30 82 1d d7 d1 ab 3f 4e 1f 21 47 27 10 e1 09 63 87 7f 52 cc ed 82 1f 78 97 bd fa 8a 0f 4b f2 d6 08 52 a6 e6 d7 07 7d d0 7e 52 30 1e d3 10 05 cf a2 61 09 1a 2a b5 73 c5 b8 97 46 ad 2c 28 8b f3 15 84 1d 02 66 99 f5 b0 83 7e f2 22 8e 38 5e 66 ac b7 5e 57 e1 62 2b 27 fb b8 74 c2 e3 2c 48 ef cf ee 2a 65 de e9 1c b8 4e 83 ff c9 34 d6 c3 a4 31 99 85 47 ed b1 b6 8b ec e0 31 43 4a 41 e9 86 e6 86 d8 c6 c9 3c 21 60 f2 9c bd 3b 83 13 66 f1 90 18 6e df 2b 5e 0e ac db db 4b 48 ed 92 4f 71 c7 34 4d b0 3e 6e 8f 2d 45 1a ec ba b7 d0 6b af 5f 5e 59 09 6a fa 38 66 6d 46 ac d4 44 29 09 c4 bd f3 bb de 0c cd 0e 06 f7 f7 ad 22 7c 6b fb e3 Data Ascii: >\|L/"[dbq47JSJ,0Wct0?N!G'cRxKR}~R0asF,(f~"8^f^Wb+'t,HeN41G1CJA<!`;fn+^KHOq4M>n-Ek_^Yj8fmFD)"\|k
2023-11-14 10:11:31 UTC	1375	IN	Data Raw: ca 45 b1 3f e5 bf ca ef 8f f9 7e fe b1 dc d0 b0 42 5a ec c3 87 4f 96 be be bf 1b 72 10 06 27 f7 f2 b2 74 64 d3 7a 5c 19 e4 fd fa d5 cb c9 bd 0f cc 38 38 70 3e 23 3f 31 06 aa 8e 6a 96 a4 6b 01 b0 c1 2d fe 92 e4 d3 52 55 fe 33 d4 47 47 aa eb 78 21 7e e6 8a ea 4a 0d d7 9f 8c 53 41 48 4d 0e af 23 f3 4a af a0 f5 2d 3e 6f 32 d1 a1 41 a9 3c 43 ea 10 0a e6 64 1b 24 d7 60 5c b5 63 28 b9 df bd 07 0c a4 18 81 38 74 31 b0 23 d6 ca bf a8 6c 2e 77 cf 28 19 de 4e e1 e5 d3 ff 5a 8a 78 ae 69 cd b1 d8 da 85 9b 1e bc d3 b0 a6 ba 07 31 fc 67 a3 6c f8 97 5a 76 c4 c5 61 5b e9 c9 85 5d cc 1b 45 31 f0 42 4d c4 81 d2 cb 0f bc 7b 41 51 78 a0 c3 38 03 d9 d0 e6 28 ae 95 74 c2 87 e4 72 de 17 fd dd c6 0a f7 d2 9e bd e3 43 44 7c bf d3 81 02 a3 c1 00 0b f5 3c c1 ef 50 4c 64 3d d3 86 fc Data Ascii: E?~BZOr'tdz\88p>#?1jk-RU3GGx!~JSAHM#J->o2A<Cd$`\c(8t1#l.w(NZxi1glZva[]E1BM{AQx8(trCD\|<PLd=
2023-11-14 10:11:31 UTC	1383	IN	Data Raw: 06 06 89 c2 cc 40 fb 8d 35 03 5d 64 56 0e 38 cd c6 2e b5 16 6f 7c c8 41 93 a7 d7 6d e0 02 4c 95 aa 88 00 17 38 12 e0 3e 08 83 f3 65 80 25 83 be 1f 50 a9 85 90 d8 d9 3e f5 9e 0a a3 bc b8 05 0a cf 49 83 56 63 c4 9c 94 10 68 7b 3b 49 3c 78 72 4d 90 99 dd 0c 6c f9 ce c5 2d 3c 49 1e b2 50 73 a4 ba 3f a3 d8 a5 22 77 03 d5 f3 25 54 c4 b6 fc 3f 39 d8 e1 65 98 06 15 df 29 4b 8c b7 82 aa a2 ee 7a 24 9d a2 dc cb cd 95 68 84 ae 52 75 e2 b8 56 9d dd 41 ae 0c 58 20 cd 51 02 f5 e8 31 6b 36 8a 71 5d 14 4b e7 14 ec 38 6c f5 11 76 7b 40 92 49 42 90 41 30 82 66 90 bd 43 65 f6 3f 58 11 53 45 0b ac 74 c8 5e 22 26 22 2e 76 88 4f 52 6c 8a 05 22 32 76 41 a5 99 4f 58 e3 9c 26 b9 c0 76 80 46 3e 3e 7e 88 63 9d 60 4f ac 05 a9 b6 07 33 ba bd 1c f0 6b 10 2e 4d 81 78 48 8e 07 d9 5a 21 Data Ascii: @5]dV8.o\|AmL8>e%P>IVch{;I<xrMl-<IPs?"w%T?9e)Kz$hRuVAX Q1k6q]K8lv{@IBA0fCe?XSEt^"&".vORl"2vAOX&vF>>~c`O3k.MxHZ!
2023-11-14 10:11:31 UTC	1391	IN	Data Raw: 98 df e7 ec 75 87 66 63 76 de 45 2c eb 59 15 27 d8 b3 f0 d7 e4 36 f3 54 63 79 33 85 f6 bd c9 2f 9a dd 08 af 2c 3b 47 df ec 03 93 ed b8 0f 61 5f d1 1f 74 fa 15 76 6b c1 ba cb de ed c3 25 79 bd 8d 47 76 48 af 79 22 42 c6 fa ca 4c 51 e4 2e 01 e4 6a 59 65 00 b1 bb 36 12 df 7d ba f4 d2 4b 23 c3 36 72 35 0a e1 60 51 60 46 76 46 9e a9 c8 bd 82 61 14 61 bf b3 8e f5 d1 6d e7 e1 1e 6d d7 30 3f 94 9f 56 6f 56 06 ef 3a 46 37 6f 03 f9 ab e2 93 e3 d7 8a ae c8 da 6c 1b 83 af 05 de 2f ef da 42 8d 84 0f 0a a3 9f 9a d3 c3 1e 31 69 48 f8 05 97 28 da e2 24 28 05 36 87 7a fd 36 1d e3 bc 78 ef dd 8e 72 03 cf fb 86 08 de bb e9 d7 79 70 6f 6d 87 4c eb 79 4f f2 b1 65 4b 2e b4 49 06 d6 32 cf 34 91 23 8f 25 d4 36 ff ae 71 3a 81 73 73 12 30 14 7c 58 ee e2 40 36 b0 88 bf 2c c8 19 0f Data Ascii: ufcvE,Y'6Tcy3/,;Ga_tvk%yGvHy"BLQ.jYe6}K#6r5`Q`FvFaamm0?VoV:F7ol/B1iH($(6z6xrypomLyOeK.I24#%6q:ss0\|X@6,
2023-11-14 10:11:31 UTC	1399	IN	Data Raw: 0c 8c d7 b0 0e 6a 3a 93 19 27 ec 06 84 5b 12 a0 04 86 82 b3 6d 99 38 53 2c db 02 6b 49 cb b8 54 2c 92 27 89 d2 ab ec 1f 65 c4 d5 49 e8 d5 cd 60 86 b0 cf 8b 36 de 06 c6 c5 29 1a 5f 63 d0 62 4a 25 b8 ad e1 32 be 74 39 11 49 7d 54 c9 df 2c 74 69 bd 13 e3 8a 74 e6 51 b3 33 ea 65 20 b7 57 a0 e0 34 a7 b1 73 a6 fb 7f fb df 50 71 be 31 d1 57 2a b9 e7 8d 45 7c 5c 3b b5 6f 0c e5 3d 62 ee 74 80 ee b0 78 51 fb b4 82 89 93 1c 19 e0 57 e8 e7 a0 c6 35 b3 a3 02 57 6e 54 ba c1 cf 37 f7 09 43 f9 d3 b8 e1 e0 df cf 53 bb b4 f8 ef 9b 7f 4a c8 31 e7 9e 23 7c 34 65 23 e9 aa e5 87 5a cf 38 58 10 48 54 8c 06 24 0d 9b 9d 20 fe a6 db d2 08 07 7f 37 df 9b 9d 69 6d b9 07 aa 67 e3 da 6f 33 f9 0a 9f 80 d1 81 c8 9d 4f 37 09 44 ef 51 f2 06 63 42 55 a0 89 c5 a7 cc 77 e1 f3 ba 3c 02 a1 48 Data Ascii: j:'[m8S,kIT,'eI`6)_cbJ%2t9I}T,titQ3e W4sPq1W*E\|\;o=btxQW5WnT7CSJ1#\|4e#Z8XHT$ 7imgo3O7DQcBUw<H
2023-11-14 10:11:31 UTC	1407	IN	Data Raw: 0f 01 7d 74 66 1a 05 61 2d 35 72 90 0a 6b 82 4c 4f dd 0a b5 74 32 78 23 be 0c ed 54 9c 84 4e d0 3a 95 7f ff 19 8f d1 b3 ea 95 0c f9 ba 39 6b 49 d8 c1 bd 30 60 f1 85 57 28 67 61 45 c5 21 94 35 76 1c c4 0c 9c 53 f0 b2 f6 7a 1f 91 93 b5 9a c9 c2 c8 be 85 60 58 35 f3 83 28 82 c8 34 17 80 6c 87 23 8b 6d ae a1 dd 8c 75 03 cf f9 03 59 33 86 c0 aa 27 38 41 c4 3c b0 7b 6c 1a b9 4f 38 80 23 53 61 0f f8 7a 4d a8 6c 3c 27 7a 37 a4 c6 3a 34 86 0b 5e 99 58 d7 e0 53 71 be a6 52 d2 0b 14 8b b1 99 47 a4 90 83 ba 83 33 6b 74 19 02 30 83 02 91 e3 2c 17 ad 48 70 5e b8 60 b4 f6 eb 24 e4 8e 8b 59 e9 51 31 9d 8b ce 8c 15 55 ee e3 03 33 7c 3b 0e 8f 33 00 00 3a c6 65 0e 16 6c 2d ed 0c 57 99 8f d8 cd 63 b0 c4 92 33 40 c8 91 8f c7 fb eb 55 f5 9d b3 19 c6 70 de 1e d7 36 a9 4c 79 4b Data Ascii: }tfa-5rkLOt2x#TN:9kI0`W(gaE!5vSz`X5(4l#muY3'8A<{lO8#SazMl<'z7:4^XSqRG3kt0,Hp^`$YQ1U3\|;3:el-Wc3@Up6LyK
2023-11-14 10:11:31 UTC	1414	IN	Data Raw: ac 44 45 c9 e4 13 65 62 f1 89 ea c5 46 b8 d2 f2 33 d6 06 6a ce fc 1c 47 11 b1 63 8d 1f 1a b6 99 92 53 f3 1e 0b e2 ee 4b 1b 8a e2 c3 16 ab b3 94 c7 c1 b1 0f 16 8a d9 df 44 68 7f f8 a4 b4 c1 f9 03 3e 16 bc da 38 c2 11 6f c4 59 be 7e 66 3e 60 84 b0 10 9a da 73 f0 03 c2 32 fb 67 6b b5 5c 66 67 fa 89 9d f8 03 57 c2 a9 af 87 3f fd 89 b6 51 84 6e 48 41 45 fd 36 61 9a f1 e7 bb 1d 72 ad 9a 59 1a 4d 6d 70 08 bf 5f 71 e0 dd ad 68 76 6d af a2 e1 c4 26 c3 77 cf fe 48 05 15 e0 3a ad 3e e5 e0 ea bc ac 8b e0 1a 35 b7 d8 e7 65 a5 55 8d ad 16 93 8b 21 eb 5d bf 56 5c 21 5a 47 88 27 99 b1 56 af b6 ce 19 18 54 88 94 cb 8b 64 b5 72 b5 b1 0c 05 e6 1a eb 22 36 ec ca a0 44 5a 45 3a 46 26 2a f5 1b e5 2c e7 5b 77 c1 45 ee 4c 51 99 18 9b ea 92 a9 9b be 4f 62 e2 b5 06 5e 01 3d cd 48 Data Ascii: DEebF3jGcSKDh>8oY~f>`s2gk\fgW?QnHAE6arYMmp_qhvm&wH:>5eU!]V\!ZG'VTdr"6DZE:F&*,[wELQOb^=H
2023-11-14 10:11:31 UTC	1422	IN	Data Raw: ae 57 34 61 d3 51 8f 13 23 77 87 0b 7b a9 69 d7 9a d5 39 a8 29 1a 77 c5 6d 9b be c0 8c 3b de 34 e0 5e 40 e0 5d 6e b5 69 ca 4a 39 4e 63 f5 23 de d8 22 96 28 80 d9 c3 4d af 7b 95 7d 72 f4 f7 69 49 17 87 89 8f 29 8c 75 d7 4b 6b 2b ec 3b 74 df 1b 11 ec 36 de 80 8d 8b 5f 15 1a 78 19 0b 24 d1 8c 7d bc d2 e0 2e fc b5 fe 38 53 c7 14 74 85 f6 59 95 11 4d 34 5d 62 02 9e 66 2f f3 ba 3d cc 9f 1d a2 91 7e 9d 7c 73 b8 42 28 99 9b 7b 55 90 f9 fe 72 bc 04 ff c2 22 06 07 fb 18 7b 27 e6 87 06 96 9b 1c 11 7d a6 4b de bc 0f a8 6c 7f 8b 22 3b e9 ce 2a 96 83 1d 90 63 9e e5 5e b3 89 38 b9 9c d1 3b 25 3d 73 08 a9 70 ed 09 9d 01 f3 5a 8e 40 e5 f0 cc f5 46 ed d7 f0 ad 3d 1b b3 07 42 83 0c 03 5b a3 77 d4 b2 f3 26 26 8f cb 4e bf 38 cd a4 f6 6e 8e 40 12 16 26 40 00 b6 f0 75 68 6e 86 Data Ascii: W4aQ#w{i9)wm;4^@]niJ9Nc#"(M{}riI)uKk+;t6_x$}.8StYM4]bf/=~\|sB({Ur"{'}Kl";*c^8;%=spZ@F=B[w&&N8n@&@uhn
2023-11-14 10:11:31 UTC	1430	IN	Data Raw: 0b f0 5a 74 e8 33 ef 06 bc 74 81 24 7b e4 14 bb 16 f8 20 b6 b3 3a ff e1 fa 2f 84 0c 37 48 0d 2b 3c 88 de dd 8b f2 0c 76 56 ae f9 da 6f 5e 60 16 c7 c6 c7 a7 f9 63 05 7a dd a2 93 49 c7 91 e7 9b f6 b3 3b 7b 74 e7 ac ff 3e 76 c7 ae 13 d4 25 34 28 b4 ae f7 7a 61 44 94 4f 96 1e 95 cf c1 c9 59 9e 63 4c 1b 6c 19 77 36 81 54 85 72 56 a8 b3 c5 5c ca f5 43 78 9a 12 27 68 b7 68 2c c3 d8 77 ad 25 90 b4 f6 90 af 2e 5d ef d4 bb ae da c3 a1 dc 29 24 86 1a 54 f8 f3 aa cb 46 a0 e3 5f 92 5f 44 5f fe c7 4f 44 d9 b0 6e 69 c3 50 70 04 d6 8f ab 77 3a 5c d7 df 96 bf b5 62 20 1c 75 95 c2 64 3c 00 bf 33 21 b3 ae 6a c6 19 b3 98 80 9d f4 3d b6 db 56 fa 46 b5 bb ae 67 95 f8 70 4b ff 75 63 77 41 88 e1 d0 2b ee fc 96 3f 91 90 b2 2e 03 d7 bf 4b b7 f5 26 43 77 57 a7 b8 1e b6 b5 cd 1c 69 Data Ascii: Zt3t${ :/7H+<vVo^`czI;{t>v%4(zaDOYcLlw6TrV\Cx'hh,w%.])$TF__D_ODniPpw:\b ud<3!j=VFgpKucwA+?.K&CwWi
2023-11-14 10:11:31 UTC	1438	IN	Data Raw: 30 63 72 8f 64 c5 c5 60 55 8b 27 ec 54 7e a0 43 6e 20 88 d1 c1 c1 3f c4 b1 b4 28 5f d1 db 79 bb 94 09 df 72 52 d6 9b 57 60 ba e6 d3 b6 02 a1 d7 fb e8 df 43 f4 47 d0 cb e2 52 90 dc 32 aa 22 90 e5 ca 56 59 3d 38 fd b9 17 e6 dd f9 d9 ce cd 71 7b 9e fe 6b cf e3 76 a6 97 33 6a 18 78 a6 65 06 56 ad d9 95 3d 8d d7 52 85 53 ed d8 55 b0 e1 69 be 33 0d c8 eb f0 07 8f 96 2c 17 4e 0c 2a 69 f1 81 5e 17 30 92 f9 8d 0c 0b 87 1f 7b 3f 0b 39 0d af c8 78 06 98 01 03 39 37 a9 2a 99 35 fb d2 98 1f 00 3e 79 d1 58 b8 ef ae bc 25 e6 51 53 fc c4 af 5c ea f9 20 53 f3 ef bd 9f df 68 df f8 31 7f 17 19 d9 da 8f fe 8f c2 16 9c 7d 27 6e 69 b7 27 9f 5b 1e e2 ed 07 2a e6 17 da c9 09 93 99 9f 6f 0e a6 7c 63 ab 8a 69 b3 ba f3 28 6e 71 e7 2e d6 b7 88 ae e6 84 f6 86 7e da 2c 43 40 f7 bd e8 Data Ascii: 0crd`U'T~Cn ?(_yrRW`CGR2"VY=8q{kv3jxeV=RSUi3,Ni^0{?9x975>yX%QS\ Sh1}'ni'[*o\|ci(nq.~,C@
2023-11-14 10:11:31 UTC	1446	IN	Data Raw: a6 66 e6 d3 c6 51 a8 cc 75 05 b8 48 8c 02 44 19 6d 50 3c 1a dc f0 aa b2 d4 ed 91 6f 1e bb 71 ad b2 83 5c 64 de a6 8b 99 d5 62 a0 bd 3a 88 a4 c1 c5 c9 e3 d8 be 4e 5e 09 40 48 10 c3 3d a6 e1 34 79 4d 72 54 bf 22 c0 d8 96 24 7c ef a5 2c 47 bd ed 11 df 37 29 7d 96 73 23 f5 8a 20 b5 6d 87 1a c8 58 14 a3 76 fb 04 9d c6 b1 b2 79 08 b6 52 ee af 48 f1 cb 84 1d ec 57 da 17 da 9a eb 81 81 75 ee 7f 47 21 19 c4 ba 7b 19 48 11 66 e3 a3 fc 41 94 95 b5 d6 13 c4 c9 9f 27 21 38 32 b8 b7 dd 9a 0c a9 6b 18 79 0d 4a f3 22 59 ff 1d 31 61 6f ff 3b ca 06 e5 e6 9d 5d e0 10 de 4b 96 f8 ac de fe 97 70 73 3d 8f 8c 58 28 40 3b fe 15 ce 0d 15 f3 73 6a cb 27 0d ba 1c ff ae ba b4 2c 01 d9 6b 04 16 9f 0b 61 4c f0 c1 68 f5 bc 3c ac 39 dd 7a fd ca e1 a8 98 fd d6 f0 f4 d9 9c 64 2b 83 f6 ff Data Ascii: fQuHDmP<oq\db:N^@H=4yMrT"$\|,G7)}s# mXvyRHWuG!{HfA'!82kyJ"Y1ao;]Kps=X(@;sj',kaLh<9zd+
2023-11-14 10:11:31 UTC	1453	IN	Data Raw: d1 2c 05 8c da d5 ca dc 19 07 70 c6 31 c8 1a 58 cb a1 5f 8f 62 53 fc c9 0a 3a 45 63 60 d6 50 e9 aa c4 e1 e9 09 6a 40 3e db 60 93 1f 83 14 88 92 06 eb 94 90 7f 22 f4 e3 ea 30 91 ab 2c 3b 0e a1 64 ae e3 82 95 dc e7 8e 6e 72 98 01 19 99 16 63 02 ce 1f fb 2b 80 51 af ea 32 bb 44 f6 7d 30 c2 b8 cb f5 02 51 5c bd b7 b1 89 92 cc c6 a6 66 a7 c5 13 2e 25 e5 88 f2 8c c7 c6 2d cd a2 70 21 c9 56 a7 fa 6d 1d 50 b6 a5 09 71 03 9b b5 c9 de ca 41 19 9c 38 36 9c bb 8f 78 2b ee 05 7d df 1e ab 73 c6 b4 e4 51 1f 01 e4 f5 30 49 03 49 1d 90 78 ad ea c7 09 41 eb 00 dd 9d 32 c9 6c ae 3c 72 47 08 19 5a 38 77 bd 37 46 93 22 27 29 07 c1 56 70 24 9b d0 15 75 f1 ae 24 75 b0 70 0f a6 eb 2a f9 46 dd a1 6b f8 9d e8 b5 af b5 c3 63 2f c1 09 3c 03 b2 86 a8 64 7b cd 94 5b 50 93 7f ac d1 1f Data Ascii: ,p1X_bS:Ec`Pj@>`"0,;dnrc+Q2D}0Q\f.%-p!VmPqA86x+}sQ0IIxA2l<rGZ8w7F"')Vp$u$up*Fkc/<d{[P
2023-11-14 10:11:31 UTC	1461	IN	Data Raw: bc b8 02 8d 80 ef 98 53 83 49 57 77 58 c9 1d 73 6f 81 97 92 4b 38 0d b0 84 f6 f5 9c 3c 61 25 14 c6 5f cf 91 57 0b ae 74 08 2d 19 56 67 94 15 41 d1 1e 6c f4 c4 8d 03 fe 6d 83 5f aa 4a 97 ec d0 de 97 92 0e 96 28 dd c6 30 46 88 4a ba e9 10 6e 99 65 a5 4a 98 c0 b1 f8 a8 da 25 75 c0 aa 48 52 33 0d 2e a0 7d 1f bc 3b 92 e0 cb bc 80 d4 d7 0a 79 e2 3a f3 3a 5e c8 4a 2e f6 08 7b e9 ac 73 35 93 e2 99 28 e4 76 fd 50 15 13 27 bc 83 b5 18 44 20 0f b9 a4 51 dc c2 37 b9 b0 a4 cc f6 f8 f7 be e0 b9 d8 4f 16 70 26 c0 d6 5e a5 57 03 b8 28 c7 1e af 0e 72 20 6c 74 04 68 d1 5c ca 47 1b 20 0c 4e 52 ca 30 b1 b9 5e 67 58 db aa 3b c5 68 67 2a 7b 03 38 9a 50 ad e6 79 95 02 02 61 bd 1f c5 84 0b 5c 69 b6 e3 6d b0 7e 02 a9 7e a2 fe 64 88 a8 83 ce d0 05 f4 2f e2 ee 92 db dd 02 ff e1 1a Data Ascii: SIWwXsoK8<a%_Wt-VgAlm_J(0FJneJ%uHR3.};y::^J.{s5(vP'D Q7Op&^W(r lth\G NR0^gX;hg*{8Pya\im~~d/
2023-11-14 10:11:31 UTC	1469	IN	Data Raw: 0b 01 46 2c 2b 59 52 d2 67 e7 47 2d d5 4f 90 9d 49 c8 bc 42 9f 98 6b ad 4e bf 1b b8 18 be 50 01 24 c2 8e 5e 10 bc 50 85 3f 57 11 50 2d 95 96 5c e6 a8 59 9f ca d7 78 5c fe a5 13 b8 4f bd 1a d6 6e 17 84 a6 87 c1 4b 5a f5 af fc 75 5f 05 c2 e8 2d 45 38 60 be 74 31 da 14 46 42 b1 76 b7 da 7e 4f 6b 17 1c 7f fd 6c fd d2 71 b0 75 91 80 5f 3a f9 16 d9 66 29 ae 29 15 1b ad fd f2 2f 5f fe 80 b2 8a 10 d7 28 b0 95 11 83 98 d8 12 b0 e8 c2 08 fa 11 e1 8c 4f 4b ce b6 74 17 12 02 8a da b4 96 e6 95 a3 71 03 e6 ef 7d 62 9b 7a ea 6e 7b 71 bd 14 2e 7a 4c 14 7c a6 62 16 19 79 8c af be 09 9a 78 ef 00 dc db 95 0a a3 12 31 14 a9 a1 75 77 5e e7 ab 7c 03 1f d9 43 c9 21 e0 2e 5c b5 04 5b c2 6a b6 4a 82 4a 91 b2 bd 15 ad fd f3 3c 5f 05 13 1b 36 07 a7 9f 10 92 2f 70 d4 ed 7a a9 d4 92 Data Ascii: F,+YRgG-OIBkNP$^P?WP-\Yx\OnKZu_-E8`t1FBv~Oklqu_:f))/_(OKtq}bzn{q.zL\|byx1uw^\|C!.\[jJJ<_6/pz
2023-11-14 10:11:31 UTC	1477	IN	Data Raw: be 2e 21 06 fa 6b 1d cd 87 22 a0 ce a3 dd 03 f9 4e f4 33 4a 3c 33 36 fd ef 6f b4 7d 1b d7 01 f9 fa 08 0f 18 75 20 01 3e fd db 2c bf 7a f5 34 46 24 a4 97 36 e4 f3 f3 db 50 1e e3 05 4e 86 3d e0 9b e9 8d d5 70 87 89 78 db 46 62 06 d7 a8 e6 74 cd 22 66 80 d2 71 50 a8 51 09 a7 7f 46 cf c8 03 e8 78 f3 12 93 5e ea c4 05 7c ea d0 4f 65 2e b7 b6 79 45 22 c0 d9 bc f0 77 c2 2a b9 3c ad 0b 85 f1 9d 0d 57 c0 7b 16 47 72 91 6b 47 2b 55 c1 69 de 29 8a 77 eb b4 0c 9f 61 81 fa cd ba e7 07 59 e7 51 f7 fc 37 0c 0a 45 94 3d bd 33 b9 ed c3 a9 34 20 8d dd 81 d9 8c a5 6a ce 38 e7 78 a4 63 e5 f6 2d d6 38 eb aa 93 c8 23 e1 3e 9e d1 47 df 39 7f f7 7f b2 c3 73 e3 f3 01 ac f1 1c cb fe 65 eb 21 0c f6 f8 d6 c2 79 4e 8e 24 50 1e 3f 2d 4e 68 9b b8 21 a9 0d b8 74 8e 25 81 ce 6c 0c 6c c8 Data Ascii: .!k"N3J<36o}u >,z4F$6PN=pxFbt"fqPQFx^\|Oe.yE"w*<W{GrkG+Ui)waYQ7E=34 j8xc-8#>G9se!yN$P?-Nh!t%ll
2023-11-14 10:11:31 UTC	1485	IN	Data Raw: f4 dc 37 f0 a0 73 dc 9c 37 ef 93 13 1d 7c ba 39 dc 99 66 6f 37 a7 88 5e b4 36 ba 55 cf dd 71 83 b9 39 9f 9c 1c a6 ec fe 6f 1c ed fc c5 9c 14 82 dc 6f ce cd ed cc 26 f8 6b 63 b8 39 9f 9c d0 f4 6d 03 3f 39 a4 ba da b6 fa 8e a9 1e 9d 98 9c 9f de 99 26 ee 5c 27 27 2c 9b 77 e9 b9 80 ba a8 66 ba f3 dd 9c a7 6d 91 69 b9 37 dd 9b bd 4f 37 41 1c 5c bf 09 ec cd bd f7 c6 9d 8e e3 9d d9 f3 de 9d d3 f4 9c f3 76 db e0 f7 ee 53 13 b3 73 da c0 d4 cd 31 23 dc b5 f2 4d 58 05 ce 64 62 e2 72 73 b1 d9 b9 31 f4 98 55 6a 06 9d 8b ee 7e 67 ff 09 7d eb 9b b7 b6 fd f3 98 e9 1f 9f 99 dd 9c aa ee 99 7e ee dd e7 a7 25 78 63 05 b3 b3 51 fc e9 bb e9 c9 cb b6 d9 19 e6 c9 36 02 bb d3 60 ba 8d b0 8c 44 ee 15 3a be 4d dd c8 fc 88 61 50 16 84 57 d2 be cf de ae 4d 4d 27 cc 4d 28 6e 5e dd 75 Data Ascii: 7s7\|9fo7^6Uq9oo&kc9m?9&\'',wfmi7O7A\vSs1#MXdbrs1Uj~g}~%xcQ6`D:MaPWMM'M(n^u
2023-11-14 10:11:31 UTC	1493	IN	Data Raw: 97 8b 5d d3 f0 7a c8 00 12 66 3f 0c 97 a0 83 2a 7d e8 86 d3 37 e6 51 45 d2 a3 c4 5a ac 01 d2 d8 dc 02 2f 76 de a7 87 f3 0f c7 2d d8 42 47 e6 cf f0 da f3 5b e4 07 cd 0d e1 ca 8d 7c 80 ca b9 b3 17 1e 81 d7 9d da 37 02 6b ed 0a c5 f4 d9 eb 42 ec 93 e1 21 91 55 c9 9f f5 16 15 07 87 fc 7f 41 97 d8 e9 ac 55 ad ef cf 10 37 fb 31 31 7e 53 c5 01 7b b5 81 33 37 d4 2b d9 00 10 cf ca e1 52 5e 0e ea 9a dc 5d a9 70 f4 74 f0 34 55 7e 55 fb 6e 88 0a c4 92 d1 bb e2 ae ef 21 b2 85 eb 0e 78 bd d7 7a fe 01 6f 58 d9 6a 41 88 56 6d f7 f7 2a dd 49 da bb 64 11 58 8f 22 c3 d6 c7 02 aa d7 9e c6 fb c8 63 fc d5 4c 87 84 67 8f 5a 1e d0 00 0b 97 98 af d2 ed 80 c7 ff d9 88 86 c8 6f 80 7a 59 82 c9 d4 f3 65 ac ec 71 77 5d 9a b4 19 55 c9 84 73 42 20 a9 3f b5 cc fb ae 82 28 86 dd 4e 73 56 Data Ascii: ]zf?}7QEZ/v-BG[\|7kB!UAU711~S{37+R^]pt4U~Un!xzoXjAVmIdX"cLgZozYeqw]UsB ?(NsV
2023-11-14 10:11:31 UTC	1500	IN	Data Raw: 13 b3 23 6a 6d e3 f3 90 36 92 2e 72 f4 2a e3 16 1f 2e c8 a1 d3 cb 42 77 1a da 91 97 64 6e b9 d7 fe b1 7a 37 72 f6 9e 2b fa f0 3e 80 27 1b 85 d1 6d 39 a0 28 7d e2 ef 6f 48 f8 dd 1a 10 e2 24 91 15 66 03 d2 a0 97 cf 6e d5 73 46 16 16 99 6c a5 05 ba 30 f7 85 88 71 ff 4e bf ed 03 14 8a da 42 bd cd b7 b9 38 00 82 74 de 02 1c d6 91 be 6e fb 20 8a ab e0 5f 74 21 ef 46 c9 52 50 24 fe b4 a3 04 38 a9 73 15 1c 30 fc 77 28 2c 20 29 e7 56 84 16 aa af 1c f6 e4 81 42 be ab 4d 35 4f fe 7f 4f d5 e9 9c 31 78 11 07 f0 ae 3e e6 bf d2 c9 2d dd 35 13 89 25 28 4b 2d 8c 4a b6 1b 15 61 f4 53 0d 7b 66 83 4c 3c f3 31 43 3b 5a 31 9b 24 80 cd 39 1b 2b bf d1 6f c7 b3 2a 2f c1 3e 95 9f ef 22 8c ad 17 fa 1d 9c 9b c0 c8 63 b9 fc c5 8d 4e a2 12 8d 75 5d 7c 0b 50 67 3d 13 16 a1 56 53 df 1e Data Ascii: #jm6.r.Bwdnz7r+>'m9(}oH$fnsFl0qNB8tn _t!FRP$8s0w(, )VBM5OO1x>-5%(K-JaS{fL<1C;Z1$9+o/>"cNu]\|Pg=VS
2023-11-14 10:11:31 UTC	1508	IN	Data Raw: c9 17 5e dd e4 b9 67 12 72 90 cb 0d 5b d1 59 f3 27 8c 49 e0 20 f0 10 4a cb fb b8 1d 2f 44 c5 ee 4d 21 b5 f6 b8 79 8e 7c 63 6c 48 2d 13 21 5b 57 46 cd ae f9 53 2d e9 e4 e5 e8 de d9 46 9d d1 1c 54 71 94 3f dc 4b c0 2f b9 47 be dd a4 4b 82 15 b5 e5 f1 dc 46 34 71 8f dc 96 81 6a 2c 96 b2 a2 bb 17 24 01 da a3 b7 b6 b9 35 5e d2 dd 87 d8 77 dc aa 8e 73 b5 e6 1c 58 09 b9 20 cf 6c 77 5a 7c f4 de a0 de 3b b1 c8 75 e3 a3 12 71 ed b9 33 89 16 99 53 47 7b e5 5e 33 8c 22 1e 16 d6 53 64 ba 0e ea 23 55 34 99 e2 52 71 fb bf c1 a4 38 4c e6 06 b0 09 d6 c0 52 e4 e9 72 dd 74 dd dd 5b 85 7d 27 aa 24 37 3f 62 77 8f 9c 60 a9 01 1a dd c7 b7 ac c0 d4 7e 8b d3 0e 4b 88 a3 6c 4a b0 70 13 ed 6f b5 62 fc b3 94 91 2f 51 d9 12 2a a2 15 57 20 fb bc 94 01 fb 8e 31 b4 7e b8 e7 ff 16 48 a3 Data Ascii: ^gr[Y'I J/DM!y\|clH-![WFS-FTq?K/GKF4qj,$5^wsX lwZ\|;uq3SG{^3"Sd#U4Rq8LRrt[}'$7?bw`~KlJpob/Q*W 1~H
2023-11-14 10:11:31 UTC	1516	IN	Data Raw: eb b8 87 c5 10 ac e4 21 65 fd bd dc cd da 25 cd 8c f1 8b bd db 23 65 39 45 0b c1 bb c7 75 75 0c 91 a9 36 9e ea 2a 3e fc cf 03 64 be 21 16 21 21 f5 0b ec 2d 96 91 29 5f 85 3f ff e9 74 3f 46 a1 8f d5 cf 58 74 b4 65 d0 c1 0f a8 fb 6e 72 63 9a 75 7f 85 1d d7 20 f4 94 96 83 48 5b f9 41 64 73 15 15 38 e2 33 bd 73 67 08 7e ef 40 85 c0 0b 19 7a 59 19 61 50 56 23 39 72 9f 69 15 f3 69 7b ec 67 4b 9a 42 7f 9e 83 2e 38 49 29 2e 02 ff 70 18 37 ac b5 da be fc bb f9 14 67 99 be 7d 5e 02 68 2d 58 84 00 85 65 3d 17 f0 50 72 d4 a7 98 2b a4 f6 f2 1e c4 64 6b 4d 48 2c 3c ce 1c 17 b3 63 28 b8 fa 47 68 f2 99 20 45 a0 f1 1d c4 09 f0 62 88 d5 bb 34 04 45 5f bc 9b cc 7a 9c 66 9d ce 4f df f3 47 d3 82 37 45 51 aa a2 a0 35 45 5b e5 78 e0 28 e9 8e 9b cf 77 7d 40 39 c3 39 f5 f6 b1 7c Data Ascii: !e%#e9Euu6*>d!!!-)_?t?FXtenrcu H[Ads83sg~@zYaPV#9rii{gKB.8I).p7g}^h-Xe=Pr+dkMH,<c(Gh Eb4E_zfOG7EQ5E[x(w}@99\|
2023-11-14 10:11:31 UTC	1524	IN	Data Raw: f3 6d 14 30 06 94 67 5a 4b 8d 5c 32 97 42 ba 06 64 bf bc da a8 19 85 56 3f 37 ff d0 29 de 21 37 c8 71 d3 3a f6 ae 59 b2 cc 8d 28 ed ee 40 1e 5e 69 5a 93 23 93 d1 c3 03 40 ec 7d 02 5e 03 5d 92 f4 ec 0a 83 e8 1b 7c 1f 1e eb 84 db e7 14 15 fb 93 8b 19 ef f3 dd 20 ab e8 8f a3 b9 ac 6d 9d cf 82 4e 74 39 2d 2c d4 9a 90 8b cc 7d 06 e2 1d 48 d4 ef 50 53 71 d5 fc 15 74 05 8d 86 ba 39 55 0d f6 00 cf bd 07 0c f2 f2 32 f7 83 58 d5 d2 26 61 a7 eb eb 65 82 b7 51 87 f0 9d a2 04 e1 34 cb 3d 39 a5 0a c5 a3 9a 5e 6f 54 d3 b6 16 1e b4 77 88 c4 ec 61 39 1a 43 74 4f af dc 19 a6 78 48 1e 55 d6 4a 89 7c 51 6f 96 73 8b cf 44 0c 1d 8a 5a 75 83 8a f0 eb ac ab 74 97 e5 11 a1 b8 8c 54 38 bf f4 fd c0 5f 33 d5 69 50 cf 33 22 1e 92 56 63 80 a2 2e c7 3a bd a2 28 d1 2f 6d 9b 83 58 4f 34 Data Ascii: m0gZK\2BdV?7)!7q:Y(@^iZ#@}^]\| mNt9-,}HPSqt9U2X&aeQ4=9^oTwa9CtOxHUJ\|QosDZutT8_3iP3"Vc.:(/mXO4
2023-11-14 10:11:31 UTC	1532	IN	Data Raw: cd 2b fe 1f 4d 0a 49 04 92 af 62 90 71 6a 72 d9 52 c5 d9 d7 00 68 a1 ba ab d8 3f d3 07 e3 3c b0 6c 60 75 7f d9 0d 3a c2 30 ee 00 b1 76 01 d5 d9 f4 06 63 f7 bb 6d 99 9f ba d5 6f c6 99 23 5f c2 18 4e f5 f9 a9 55 8b 83 d6 2a 10 b0 40 73 5d 2e 23 0c 2f 5e 9a 81 6f 36 41 17 69 c0 79 ff 3a de fb b3 f9 11 4f c6 53 ed c0 bd de ee cd d1 84 08 35 f7 b1 3c 29 7c cf 72 20 96 05 0f f2 a3 1d a7 3f ba c3 b2 bb 14 d3 c2 ae 89 24 b1 ac d5 6b f0 44 93 28 60 ce a0 a8 18 65 8d 8d c1 88 9e 79 85 d2 55 ca 4a 31 7c 0f 12 ad c0 a8 98 07 d1 74 e7 77 5e 89 af 00 c2 fc 1e f3 cd 2f cd 75 ac 42 08 43 df ea 5d cd 5f fb bc 13 f8 c3 b0 79 5d 60 ed ea 9c 21 be 3c d2 d1 41 b4 a5 fe 77 1b 2f b6 03 f6 26 1a 35 bd d2 48 1f ca 8c 3f 6b 63 6f b7 77 17 76 fb 43 73 9e b4 a8 98 e2 87 37 88 74 0b Data Ascii: +MIbqjrRh?<l`u:0vcmo#_NU*@s].#/^o6Aiy:OS5<)\|r ?$kD(`eyUJ1\|tw^/uBC]_y]`!<Aw/&5H?kcowvCs7t
2023-11-14 10:11:31 UTC	1539	IN	Data Raw: f4 2b e7 8b 04 ce 69 b3 e9 d7 ad 76 e7 c7 3d bd 7d 11 a3 97 9b 4e 3a b1 d6 fc f6 fe f6 03 61 65 6d 40 73 36 a1 e6 d2 17 ed 67 2c 86 c4 f3 da 45 79 dd 2c 00 a4 6f ee f5 28 58 ab 3f d3 e2 5f 36 6c 09 f2 32 81 58 ec 51 9a a0 4d 48 03 52 ce d9 7f 55 ce fc a1 f9 5c b7 6b 69 3d bd 75 93 4e fb 4d dd 18 62 b6 56 40 8e 45 e2 f5 ac 6c af b2 e5 01 d9 a7 06 5e f7 2f 37 14 4c d0 e0 1a 19 f4 bc 00 49 10 10 03 00 00 00 33 33 44 34 00 00 0a 55 05 50 1f 00 f8 84 8f cf 01 83 90 02 ae 39 63 39 30 4c 4c 03 2d 2b ca b0 b2 95 73 55 4e 2c 02 1f 9b 1d b9 bd f3 9c bb 77 77 67 65 6e f1 c5 ed 39 59 3f fc ff 00 84 66 00 88 66 00 8c a0 00 01 c2 e1 19 0b 4a 90 c0 72 2f af 01 07 15 73 e0 fc c4 a4 76 33 d4 b3 2c 22 89 15 6e a5 c6 c7 32 c5 2f a6 7f 28 96 19 e7 3e fa 6a 2d 32 3e 8d 46 d6 Data Ascii: +iv=}N:aem@s6g,Ey,o(X?_6l2XQMHRU\ki=uNMbV@El^/7LI33D4UP9c90LL-+sUN,wwgen9Y?ffJr/sv3,"n2/(>j-2>F
2023-11-14 10:11:31 UTC	1547	IN	Data Raw: 36 f2 13 7c 7a 40 f4 60 6d c2 4e 0f 9c 1e c1 4e 86 b9 28 e6 a7 bb 17 b0 2a 41 31 ef e3 ed ae 4a 40 a2 01 ea b3 ec 7a fc 1b eb 45 5d 1b 04 6e b0 86 c2 dc 0d 71 37 87 44 0f a9 28 52 ab be 0e d8 57 a8 eb 43 4d b4 d5 25 1d c8 3d 58 3b 96 bc 1e d7 46 34 81 ac 07 58 0f d0 26 43 de 13 79 6f b0 bd 41 e8 09 b0 37 c5 de 7c 17 15 f6 06 7c cf e0 1e 90 e9 bf 7d 55 2f 90 f6 a0 05 6d eb 1e 6e 63 50 b4 7d c1 e8 0b 43 a2 07 d7 12 ae c0 ac 07 ed 15 5f 8a d7 b0 2f 03 f6 15 b0 4d ab 59 1d 4f d2 7e c1 b2 07 5e ce a7 71 5d cc a9 8e 10 bb b9 7a 94 9d d9 6d 71 79 ed 77 5f 51 a1 b5 e4 73 cf 37 55 9a e4 5f f8 0b 06 3f 8f 7d 71 76 66 b7 00 28 81 f6 05 ed 1c 08 ab 06 3c 60 b0 bf 04 b4 bf 1a 4f c8 fb e0 5b 69 18 ed db 18 28 02 14 bc 08 56 cc 1e 5f aa c1 6a f1 fd f4 83 83 68 af f5 b0 Data Ascii: 6\|z@`mNN(*A1J@zE]nq7D(RWCM%=X;F4X&CyoA7\|\|}U/mncP}C_/MYO~^q]zmqyw_Qs7U_?}qvf(<`O[i(V_jh
2023-11-14 10:11:31 UTC	1555	IN	Data Raw: 34 4b 35 fc a4 8a 08 c9 33 4b 1a b1 52 d5 87 64 cb 12 43 76 aa 5b 91 4c b2 44 c3 af aa 5c 91 4c 59 a2 f8 2b 6a d7 24 93 2c 81 cc 8e d5 6b 92 49 4b 4c da 1d 7e 0d 32 a9 12 4b c0 c6 82 0d 32 a9 89 4c 9f 81 52 c7 7f aa 84 d2 08 e1 69 28 fe af 49 51 cf 76 ca bf 2d 29 ee 8a e8 a5 4a 0a a9 be 7f 29 98 da 94 5c 2d 0d d1 b6 4e 88 cf 24 4e 39 b6 fe 25 85 35 5b fa 3f 48 b4 bc d2 fa 29 92 02 97 2a 3e 67 a4 80 a6 86 0f 95 52 40 f3 41 ae e6 90 14 59 25 fa 9b a6 02 8e 31 3d ce 53 01 d8 0c 68 9d 5e 2b 2d e8 2a 68 1a 5b ad b3 4b 05 66 3d bd 93 52 01 4c c7 88 1e 8f af 00 31 8c d6 73 42 b9 75 3f fd 68 eb 46 77 ca b0 5b 9f 28 43 f7 72 d0 d7 d0 d1 64 e5 ae 40 34 11 31 cf 1b 5a 1a 2a f3 94 a1 41 90 e7 45 d7 21 a1 b5 58 85 23 28 10 93 7b 49 e1 10 78 fe ea a4 80 0b b3 b7 a2 29 Data Ascii: 4K53KRdCv[LD\LY+j$,kIKL~2K2LRi(IQv-)J)\-N$N9%5[?H)>gR@AY%1=Sh^+-h[Kf=RL1sBu?hFw[(Crd@41Z*AE!X#({Ix)
2023-11-14 10:11:31 UTC	1563	IN	Data Raw: 3c ba 54 2d 51 ff 6d b7 e4 03 5d f6 53 c7 03 b0 a0 89 f0 cb 0e 3d c7 1a 59 b3 4c dd 1e 18 05 73 a1 86 3c c7 5b 6f 77 44 9c 13 db 3d be 52 7d 44 f1 62 d8 27 f7 79 61 c7 80 52 6b 0c c6 3b 76 1f 03 c6 bb 1b 77 b3 14 ec 1e 26 af a5 19 47 38 c0 69 8b 43 cc a8 ef d3 66 df 41 f9 57 43 9c bd b7 a0 52 17 3a a6 0c e4 23 ed 0f 85 cb 6f 60 48 f5 47 9c 19 43 0e 64 81 4e f0 67 31 df 6d 38 ce a0 c0 29 56 ee f8 f1 94 94 8e 9d 4f bd 82 c1 f2 e0 9a 78 72 84 b2 d7 28 d7 e7 d8 c7 8a 01 ec 6a 66 1f 0b ed 3e 98 8a c8 78 cd c2 d7 00 5f d4 59 31 78 8d 7b b3 5d 63 0e b4 33 29 80 43 05 50 ca bb b1 e2 52 6a 0e c1 e0 2a 79 ef 26 bc 09 2f 1b b4 34 37 d4 02 ba ef fc c5 b2 64 ea 0e e5 e0 f3 60 bc b8 be b7 f4 b4 9c 0f 93 15 d0 19 95 fd 1c f3 ff 6e cf 4c 38 e3 c9 58 6c e7 83 fb 1c e4 be Data Ascii: <T-Qm]S=YLs<[owD=R}Db'yaRk;vw&G8iCfAWCR:#o`HGCdNg1m8)VOxr(jf>x_Y1x{]c3)CPRj*y&/47d`nL8Xl
2023-11-14 10:11:31 UTC	1571	IN	Data Raw: 00 00 db 02 ed e5 ef 85 df 97 7c d2 2f be 35 b6 5f d7 a3 2c 6c 4a 00 e6 00 00 ba 06 ab 80 e7 65 08 87 e7 df 00 d8 00 80 01 00 e8 cf 63 06 cf 69 00 b8 00 80 01 00 4f ff 54 d6 db 89 44 59 a5 f0 95 71 ad 32 98 e3 00 00 11 00 04 d4 9d 69 9e ef 8c bf 49 2f 2f 5f 01 90 00 00 03 00 40 7d f9 27 72 ff 5b db f7 44 00 78 00 08 00 00 ff 15 2c 80 80 fe d8 17 80 00 00 00 3d 01 ef 3f af cf eb 1a e1 16 00 e1 18 20 10 10 03 00 00 00 05 00 23 42 00 00 07 53 e9 61 bd 3b f6 f0 2d a2 c2 42 39 ad 10 6a df df 20 cc 00 00 42 00 00 45 52 00 8f 40 ec f1 6f 6c bf 7f 36 df 08 3f 65 78 d3 40 1c 06 0c 30 b0 8d 00 c0 00 00 0c 00 41 c9 81 50 92 0e ef 57 f1 df 6f 08 a6 2f 24 30 40 fd 00 00 be 3e 5a cf eb f3 21 9d eb 87 cb d3 30 85 40 95 00 00 26 00 16 a0 52 3a de ff 04 c0 00 00 0f 00 fe Data Ascii: \|/5_,lJeciOTDYq2iI//_@}'r[Dx,=? #BSa;-B9j BER@ol6?ex@0APWo/$0@>Z!0@&R:
2023-11-14 10:11:31 UTC	1578	IN	Data Raw: e9 72 6f 25 63 2c 2f aa 11 f8 54 8d 09 7d a5 8f a2 1f 21 8d b5 d1 62 c8 df 62 5b 2d 0d 33 50 3f b3 ad b4 ca 19 8b 75 26 7b bd bc 83 2c 86 4b 4b 53 0b fd 8a df d2 fd d8 c3 2e 31 e4 7e 64 56 bf d7 41 c9 52 c8 aa ee 12 b2 e7 aa e8 f5 7d 81 7a e1 f3 3d 2e d6 49 0e 11 ef 25 0d 17 51 1a 82 de b2 7a 0e 61 13 98 87 ce 10 b3 ff d5 28 e7 81 59 d0 22 9d f9 7d 84 a5 52 c6 64 97 23 1b 9c eb 90 3a 2c a6 b5 6e 55 4d 55 94 88 60 83 97 e3 ad 62 ad 4f 74 b1 a0 53 8c 78 98 75 55 43 fa 1e bb 6b 7f d6 02 3d 85 66 56 d0 3d 0f 68 3b 68 aa d1 8e 26 2d b4 6c 14 ef 33 4b 02 4d 77 2a bf 7e 3a e2 6c 2e b3 75 8e 8b bd 49 04 44 2d ec c4 e5 bd 2d ed 7d b3 9e e2 a9 3d 7b 2b 7f f8 b0 19 06 cb b4 b4 8d 20 ed ff 7c dc 99 6f 3e 11 60 29 2d 4a d7 83 5e 59 15 fa 0e d0 f4 bf 8a 1e 92 32 68 85 Data Ascii: ro%c,/T}!bb[-3P?u&{,KKS.1~dVAR}z=.I%Qza(Y"}Rd#:,nUMU`bOtSxuUCk=fV=h;h&-l3KMw*~:l.uID--}={+ \|o>`)-J^Y2h
2023-11-14 10:11:31 UTC	1586	IN	Data Raw: a7 50 a7 58 a7 60 a7 68 a7 70 a7 78 a7 80 a7 98 a7 a0 a7 a8 a7 c8 a7 d0 a7 d8 a7 e0 a7 f0 a7 f8 a7 00 a8 08 a8 10 a8 18 a8 20 a8 28 a8 30 a8 38 a8 40 a8 48 a8 50 a8 58 a8 60 a8 68 a8 70 a8 78 a8 80 a8 88 a8 90 a8 98 a8 a0 a8 a8 a8 b0 a8 b8 a8 c0 a8 c8 a8 d0 a8 d8 a8 e0 a8 e8 a8 f0 a8 f8 a8 00 a9 08 a9 10 a9 18 a9 20 a9 28 a9 30 a9 38 a9 40 a9 48 a9 50 a9 58 a9 60 a9 68 a9 70 a9 78 a9 80 a9 88 a9 90 a9 98 a9 a0 a9 a8 a9 b0 a9 b8 a9 c0 a9 c8 a9 d0 a9 d8 a9 e0 a9 e8 a9 f0 a9 f8 a9 00 aa 08 aa 10 aa 18 aa 20 aa 28 aa 30 aa 38 aa 40 aa 48 aa 50 aa 58 aa 60 aa 68 aa 70 aa 78 aa 80 aa 88 aa 90 aa 98 aa a0 aa a8 aa b0 aa b8 aa c0 aa c8 aa d0 aa d8 aa e0 aa e8 aa f0 aa f8 aa 00 ab 08 ab 10 ab 18 ab 20 ab 28 ab 30 ab 38 ab 40 ab 48 ab 50 ab 58 ab 60 ab 68 ab 70 ab Data Ascii: PX`hpx (08@HPX`hpx (08@HPX`hpx (08@HPX`hpx (08@HPX`hp
2023-11-14 10:11:31 UTC	1594	IN	Data Raw: 06 09 2a 86 48 86 f7 0d 01 01 0c 05 00 30 54 31 0b 30 09 06 03 55 04 06 13 02 47 42 31 18 30 16 06 03 55 04 0a 13 0f 53 65 63 74 69 67 6f 20 4c 69 6d 69 74 65 64 31 2b 30 29 06 03 55 04 03 13 22 53 65 63 74 69 67 6f 20 50 75 62 6c 69 63 20 43 6f 64 65 20 53 69 67 6e 69 6e 67 20 43 41 20 52 33 36 30 1e 17 0d 32 31 31 31 30 36 30 30 30 30 30 30 5a 17 0d 32 34 31 31 30 35 32 33 35 39 35 39 5a 30 54 31 0b 30 09 06 03 55 04 06 13 02 47 42 31 17 30 15 06 03 55 04 08 0c 0e 43 61 6d 62 72 69 64 67 65 73 68 69 72 65 31 15 30 13 06 03 55 04 0a 0c 0c 53 69 6d 6f 6e 20 54 61 74 68 61 6d 31 15 30 13 06 03 55 04 03 0c 0c 53 69 6d 6f 6e 20 54 61 74 68 61 6d 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 a8 b8 fe bf d5 Data Ascii: H0T10UGB10USectigo Limited1+0)U"Sectigo Public Code Signing CA R360211106000000Z241105235959Z0T10UGB10UCambridgeshire10USimon Tatham10USimon Tatham0"0H0
2023-11-14 10:11:31 UTC	1602	IN	Data Raw: 52 79 89 fe 6e 77 37 d7 bb 50 9f fa 18 25 4f 13 f2 5e 7c a9 b1 20 5a 29 ab a3 42 87 77 e0 f4 4c 02 48 dd 58 a5 53 a6 a3 a0 ed 19 96 65 15 29 c5 ed 33 30 25 e6 96 83 81 9a f6 60 66 90 58 07 80 cd 42 75 ac fb b4 91 d0 c5 dd 01 40 6a b6 a8 10 ee f6 8d 7a b7 9e 75 af d3 a5 4b 18 a1 0c 9f 57 b0 5e 25 47 91 74 cd 75 12 d1 9c 6f e4 5e 0d 9b ec 75 26 ee fe d3 f5 92 2f 52 85 e8 da 44 51 2a a2 cc 00 ca 87 66 43 a3 1b 00 ef a2 b5 96 9d 62 ad 27 0b f2 1b 4a c9 c3 94 42 37 88 20 84 a8 87 ae c3 ba 23 72 7b f8 54 ef f8 6b 27 b0 85 f5 a7 43 85 d8 2b 39 74 db 5a 77 02 d1 a4 fa f5 cd 9c 3d cc 1f ae 51 d0 7b 6c d8 1d 2d 11 42 53 71 74 c2 e5 35 aa 2d 52 12 d9 25 cf f0 d3 d0 91 43 12 d7 32 7d 98 6c e3 77 41 c8 ff 1f 24 54 ef 6e ad c6 3e 55 7b f1 5c 87 3a 64 f1 60 4b 05 4f ef Data Ascii: Rynw7P%O^\| Z)BwLHXSe)30%`fXBu@jzuKW^%Gtuo^u&/RDQ*fCb'JB7 #r{Tk'C+9tZw=Q{l-BSqt5-R%C2}lwA$Tn>U{\:d`KO
2023-11-14 10:11:31 UTC	1610	IN	Data Raw: 43 65 72 74 69 66 69 63 61 74 65 20 53 65 72 76 69 63 65 73 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 be 40 9d f4 6e e1 ea 76 87 1c 4d 45 44 8e be 46 c8 83 06 9d c1 2a fe 18 1f 8e e4 02 fa f3 ab 5d 50 8a 16 31 0b 9a 06 d0 c5 70 22 cd 49 2d 54 63 cc b6 6e 68 46 0b 53 ea cb 4c 24 c0 bc 72 4e ea f1 15 ae f4 54 9a 12 0a c3 7a b2 33 60 e2 da 89 55 f3 22 58 f3 de dc cf ef 83 86 a2 8c 94 4f 9f 68 f2 98 90 46 84 27 c7 76 bf e3 cc 35 2c 8b 5e 07 64 65 82 c0 48 b0 a8 91 f9 61 9f 76 20 50 a8 91 c7 66 b5 eb 78 62 03 56 f0 8a 1a 13 ea 31 a3 1e a0 99 fd 38 f6 f6 27 32 58 6f 07 f5 6b b8 fb 14 2b af b7 aa cc d6 63 5f 73 8c da 05 99 a8 38 a8 cb 17 78 36 51 ac e9 9e f4 78 3a 8d cf 0f d9 42 e2 98 0c ab 2f 9f 0e 01 de Data Ascii: Certificate Services0"0H0@nvMEDF]P1p"I-TcnhFSL$rNTz3`U"XOhF'v5,^deHav PfxbV18'2Xok+c_s8x6Qx:B/

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Wzphku.exePID: 3680, Parent PID: 1028

General

Target ID:	0
Start time:	11:10:53
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0xaf0000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2382030464.0000000003050000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2385183591.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2382030464.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 4180, Parent PID: 3680

General

Target ID:	3
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x860000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 5568, Parent PID: 3680

General

Target ID:	4
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x920000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 6436, Parent PID: 3680

General

Target ID:	5
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x7b0000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 1308, Parent PID: 3680

General

Target ID:	6
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x630000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 2616, Parent PID: 3680

General

Target ID:	7
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0xde0000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 2448, Parent PID: 3680

General

Target ID:	8
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0xf90000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 2780, Parent PID: 3680

General

Target ID:	9
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x4a0000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 5644, Parent PID: 3680

General

Target ID:	10
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x7d0000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 3560, Parent PID: 3680

General

Target ID:	11
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0x720000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Wzphku.exePID: 6984, Parent PID: 3680

General

Target ID:	12
Start time:	11:11:30
Start date:	14/11/2023
Path:	C:\Users\user\Desktop\Wzphku.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Wzphku.exe
Imagebase:	0xe70000
File size:	425'472 bytes
MD5 hash:	EFFFB97AA9F53110AB5035C995E7D62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Wzphku.exePID: 3680, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	40.9%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Executed Functions

Function 05E40740 Relevance: 16.1, Strings: 12, Instructions: 1148COMMON

Download Yara Rule

Strings

$]q, xrefs: 05E40C57
$]q, xrefs: 05E40BA7
,aq, xrefs: 05E4120A
$]q, xrefs: 05E40B97
$]q, xrefs: 05E409E3
$]q, xrefs: 05E40C47
4, xrefs: 05E41125
$]q, xrefs: 05E41021
$]q, xrefs: 05E41031
$]q, xrefs: 05E4107A
$]q, xrefs: 05E409D3
$]q, xrefs: 05E4108A

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3443518476
Opcode ID: 3de8240ae9b5229fe0163238aa141cf13aaa1a6753888cf9048f39710303f306
Instruction ID: 0db8651ff9d0b1c9077be1fbc84c5880881437287b48f6997998b3ad6e8195c8
Opcode Fuzzy Hash: 3de8240ae9b5229fe0163238aa141cf13aaa1a6753888cf9048f39710303f306
Instruction Fuzzy Hash: 19B23A34A002189FDB18CFA9D898FADB7B6BF48304F1585A9E545AB3A5DB70DC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E40A77 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

,aq, xrefs: 05E4120A
$]q, xrefs: 05E40B97
$]q, xrefs: 05E40C47
4, xrefs: 05E41125
$]q, xrefs: 05E41021
$]q, xrefs: 05E4107A

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q
API String ID: 0-324474496
Opcode ID: 74d158fd33e57e38a9f90c46da7f1ae642714f5f3674a547335560dd84ceae96
Instruction ID: 83fb22f6da4ceecc9904e08ba14494530298c7a1534b626ff5abee8f0fd096ee
Opcode Fuzzy Hash: 74d158fd33e57e38a9f90c46da7f1ae642714f5f3674a547335560dd84ceae96
Instruction Fuzzy Hash: 0622FA34A00218CFEB28DFA5D994BADB7B2BF48304F1591A9D549AB3A5DB30DD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05F60638 Relevance: 3.3, Strings: 2, Instructions: 818
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 05F60928
(aq, xrefs: 05F60F73

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 1ad551488d182567dc66a7e8cc6b6967f6799261bcf55740fb8e628bbad346bd
Instruction ID: 4325c48ebe01bf63e9611811d6063fc0b083dc296ca17ef0cd38bedabfbaa78b
Opcode Fuzzy Hash: 1ad551488d182567dc66a7e8cc6b6967f6799261bcf55740fb8e628bbad346bd
Instruction Fuzzy Hash: 09627B74B0461A9FCB14CF69C498A6EFBF6FF88310F248929D55A97381CF34A905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E44328 Relevance: 3.1, Strings: 2, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pl]q, xrefs: 05E44510
$]q, xrefs: 05E445F6

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: Pl]q$$]q
API String ID: 0-2369359564
Opcode ID: c6db83a12a0a8ac85a60c1750b88eb7f994b7ce39feff13f5beafa414b02d156
Instruction ID: f8c67dcd971bf2b192ced50a93433562860d496bdfa0cbbccd9f7fab14978950
Opcode Fuzzy Hash: c6db83a12a0a8ac85a60c1750b88eb7f994b7ce39feff13f5beafa414b02d156
Instruction Fuzzy Hash: 4E225634B002058FDB14DF29D988A6ABBF6BF89704B1594A9E546CB3B1DB34EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0128435A Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

`Q]q, xrefs: 01284874

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: `Q]q
API String ID: 0-1594560043
Opcode ID: e76fabcaa8ebc122dffabc51d72b8e659057acfcc6ace14a7ffabbe9ed6dd954
Instruction ID: cfaae1adc2eb3786933b672629f033c68590d11089924f19d84b4a8a06e65de7
Opcode Fuzzy Hash: e76fabcaa8ebc122dffabc51d72b8e659057acfcc6ace14a7ffabbe9ed6dd954
Instruction Fuzzy Hash: DDE19F30A112579FDB04EFA8C894BAEBBF2FF84314F148569D5059B2A5DB70EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05F657C6 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fada97c7960c4e100e977b63f4328c7b79508ce10838567ba71fb249108eab1
Instruction ID: 186bd96d9636caba60c44688d0efd25cbe27207ecf30da39d677b7788462e46e
Opcode Fuzzy Hash: 7fada97c7960c4e100e977b63f4328c7b79508ce10838567ba71fb249108eab1
Instruction Fuzzy Hash: ED025070B002199FDB18DF79C850B6EBBE7BF84610F5485A9D40AAB394DE31DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0128227F Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e679e1e29405713eabf9f6d3b323ce2eee5595da53e8d581f1f8c7f56169933
Instruction ID: d2a5f85264a6297c751cc79b424635af6939d8db33e2bab9f0b1cc72c60bdbe1
Opcode Fuzzy Hash: 0e679e1e29405713eabf9f6d3b323ce2eee5595da53e8d581f1f8c7f56169933
Instruction Fuzzy Hash: 01817A30A26205CFD705DF69C494BDDBBF2FF89320F1981A5D146AB2A9D770E885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01282290 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7392186ebf2c3b63481fb472ba573fabc39594a0d3d55b2a685807c3a4afaa3
Instruction ID: d7128ed8eec320481ce9b9e9dde77fa4467685bcf3bc189cb7c2cb023732e274
Opcode Fuzzy Hash: c7392186ebf2c3b63481fb472ba573fabc39594a0d3d55b2a685807c3a4afaa3
Instruction Fuzzy Hash: 6E816B30A26205CFD705EF59C494B9DBBF2FB89320F19C165D106AB3A9D770E885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012819C0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadcf8a536285c0ab2a46fc28a62e742f0eedc0551c2d80cb92266309984dde8
Instruction ID: 1ba2dce1737594aa1f54a5cd4fc927111a47af5197731a9b8b1d17d058e3304f
Opcode Fuzzy Hash: eadcf8a536285c0ab2a46fc28a62e742f0eedc0551c2d80cb92266309984dde8
Instruction Fuzzy Hash: 1381AA75A12204CFE745DF58D484B99BBF2FB89310F2982A5D105AB3EAC370ED96CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0128ABD8 Relevance: 5.1, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0128ADA5
d%cq, xrefs: 0128ACE1
d%cq, xrefs: 0128AC4A
$]q, xrefs: 0128ADB1

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: d%cq$d%cq$$]q$$]q
API String ID: 0-2396156113
Opcode ID: 6e8d077dbd5e00078547b1379e02b8db3c7cf08a76ccd9340536cc516c320b5b
Instruction ID: 9fb5666af0c16587f39df131becbb0598782b2fb4d3aa70d10c3f51fcebf3e98
Opcode Fuzzy Hash: 6e8d077dbd5e00078547b1379e02b8db3c7cf08a76ccd9340536cc516c320b5b
Instruction Fuzzy Hash: FD41F330B513099FD718AE398C65B6E3AE7BF84710F20496AE506CB3E9CE75CC028791

Uniqueness

Uniqueness Score: -1.00%

Function 05E467F8 Relevance: 4.2, Strings: 3, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05E46D4C
Haq, xrefs: 05E46CFC
Haq, xrefs: 05E46CCD

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq
API String ID: 0-3013282719
Opcode ID: 11292d5c839b78694e78141a68a276c5580bc7fe08a51dbe46f91de42465bc58
Instruction ID: e878301b1cf9c69fba361424b2204a8d231cb7473e9192c22075e703c1d43695
Opcode Fuzzy Hash: 11292d5c839b78694e78141a68a276c5580bc7fe08a51dbe46f91de42465bc58
Instruction Fuzzy Hash: A1126B70A006099FDB24DFA5D488AAEBBF2FF89304B14946DD4869B354DB31ED4ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E484A8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 05E48821
4']q, xrefs: 05E487A1
4']q, xrefs: 05E486C2

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 8d8bad3f6b4a26acf1ca682ec7dad28adf47d6e694578a7f13a2d0246dd8c060
Instruction ID: 17c3b700d26abde486092d3031fd69d6b1188e330fa178ee53f7a246f0dcc16d
Opcode Fuzzy Hash: 8d8bad3f6b4a26acf1ca682ec7dad28adf47d6e694578a7f13a2d0246dd8c060
Instruction Fuzzy Hash: C7F1C634A14118DFCB04DFA4E998A9DBBB2FF88304F519158E546AB3A5DB70EC42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05E4CA80 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05E4CC01
(aq, xrefs: 05E4CBA9
(aq, xrefs: 05E4CBD5

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq
API String ID: 0-2456560092
Opcode ID: dc56730629d7cfad94bd45dfd495b039b709d9a01a50328fda0b821687311ba1
Instruction ID: d815fd80be7559bfc3fa9d5f0be16eb20b38bf3b491ade452401b0ba3f8f3efd
Opcode Fuzzy Hash: dc56730629d7cfad94bd45dfd495b039b709d9a01a50328fda0b821687311ba1
Instruction Fuzzy Hash: EDE11E34A05209DFCB04EF64E4949AEBBB2FF89310F108569E845AB364DB34ED46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012879B3 Relevance: 3.9, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 012879BB
TJbq, xrefs: 012879D3
@, xrefs: 01287A7A

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: @$TJbq$Te]q
API String ID: 0-2800237591
Opcode ID: f647b6f4bd13a7416e2eef21830ef25e99e0fa66892b4c41fa97633fb62b5e8e
Instruction ID: 82e8aafe42d93eda9317afc7fb567ec73af57e63c5505693ed88358b69425ff5
Opcode Fuzzy Hash: f647b6f4bd13a7416e2eef21830ef25e99e0fa66892b4c41fa97633fb62b5e8e
Instruction Fuzzy Hash: 9D610434B201059FDB14EFA8D898B6DBBB2FF88714F2480A9E506DB3A5CA709D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E50078 Relevance: 2.9, Strings: 2, Instructions: 365COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E504E1
4']q, xrefs: 05E504D5

Memory Dump Source

Source File: 00000000.00000002.2385416956.0000000005E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 1f9a5e7c58176eef678a30d82eb1ea836aa6e58710942f648ca66b8dae330de4
Instruction ID: 3e0bb43b310ec7566d713529c816e72644273abdfa3a23efe0390fc4947ce45b
Opcode Fuzzy Hash: 1f9a5e7c58176eef678a30d82eb1ea836aa6e58710942f648ca66b8dae330de4
Instruction Fuzzy Hash: 04B1B220B142249FD7355679466DA3E5BEBBFC8774B846829FDC6CB384EE218C01C792

Uniqueness

Uniqueness Score: -1.00%

Function 05E45EA8 Relevance: 2.8, Strings: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 05E45EBC
d, xrefs: 05E46109

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$d
API String ID: 0-3557608343
Opcode ID: b031bd174b0db581519e89ce28c41c84462f3f66cc4a4f799e9976ca9c81b6fd
Instruction ID: c38c573f066c313720d35df02bfd00581cf08590133cde0bfae467249b5e434c
Opcode Fuzzy Hash: b031bd174b0db581519e89ce28c41c84462f3f66cc4a4f799e9976ca9c81b6fd
Instruction Fuzzy Hash: C5D17B346006069FCB24CF18D48496ABBF2FF89314B559969E49A9B366DB30FC46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E40318 Relevance: 2.7, Strings: 2, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 05E40484
(aq, xrefs: 05E404B0

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 2fb7c4297c15c7b95715623e3b4cbae19f9f8abe001ac8b76d9a0aff21d85998
Instruction ID: 92f08bffc7701b481c53a92b1b0e94024d3f84c07ca54a6ccd288025aabd6d51
Opcode Fuzzy Hash: 2fb7c4297c15c7b95715623e3b4cbae19f9f8abe001ac8b76d9a0aff21d85998
Instruction Fuzzy Hash: 996110317042154FD718DB2AA844AAFBFE6BFC5210B158179E58ACB2A6DE38DD0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 05E42628 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05E427BA
(aq, xrefs: 05E4272B

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 786932411d1c3ff241df5dc4295965ad702ded09ed0e01b28c4a73a5ab3b4384
Instruction ID: 1fee63f3af410f9a7ab08ae734b9e47f374dd61204d9ce892c326a6614ef3cb3
Opcode Fuzzy Hash: 786932411d1c3ff241df5dc4295965ad702ded09ed0e01b28c4a73a5ab3b4384
Instruction Fuzzy Hash: B951AA35B102158FD718EB38D458A6E7BA3FF95314B2044ACE6868B3A4DE35ED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E506F0 Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 05E508D9
4']q, xrefs: 05E508CD

Memory Dump Source

Source File: 00000000.00000002.2385416956.0000000005E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 0efb52a7fb10847fca757d1c40c8d5798dc522fdf470f1cdd4b4848bdabb60c6
Instruction ID: bac2e13fc7c4278296cb67632aac07f402187029a787f50c59da07e264b4ba26
Opcode Fuzzy Hash: 0efb52a7fb10847fca757d1c40c8d5798dc522fdf470f1cdd4b4848bdabb60c6
Instruction Fuzzy Hash: 3151DF32B0821587463AF634065DDBE2BD7ABC473875529AAFCC78B248EF64CC4587C2

Uniqueness

Uniqueness Score: -1.00%

Function 05E50510 Relevance: 2.6, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 05E506B2
4']q, xrefs: 05E506BE

Memory Dump Source

Source File: 00000000.00000002.2385416956.0000000005E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: cf304d20ce3cfa8f2532a305fe4dbe5b513eb0a6a2e38b78bb964e61b1ba8ef7
Instruction ID: f707f422cc02b8ce72f4d2ea992f663bcf6a03f95021ed43fc2fe65c0602bcc4
Opcode Fuzzy Hash: cf304d20ce3cfa8f2532a305fe4dbe5b513eb0a6a2e38b78bb964e61b1ba8ef7
Instruction Fuzzy Hash: F741D231704224DBDB34D626552DBBE27D7AFC8334B506829FDC28B644EFA1C809C792

Uniqueness

Uniqueness Score: -1.00%

Function 05E49380 Relevance: 1.9, Strings: 1, Instructions: 677
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 05E496FB

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 5a09c328f575c1d4c2cf52eb649c92c0091990d8454d2b2e50172331a64bcc24
Instruction ID: 0f1c962bd4014c0d9b8a6bfcd69d8217b0cda5a2a6d0879002982ad8c5bf88f3
Opcode Fuzzy Hash: 5a09c328f575c1d4c2cf52eb649c92c0091990d8454d2b2e50172331a64bcc24
Instruction Fuzzy Hash: 9952F475A002288FDB64CF69C985BEDBBF6BB88310F1541D9E549EB351DA309E80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05E43BA0 Relevance: 1.8, Strings: 1, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_]q, xrefs: 05E43E30

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (_]q
API String ID: 0-188044275
Opcode ID: 4fbdca90f53c6b84afc5925d81d483e72e4c3b8b76e6ae75e8a1a32a80acff98
Instruction ID: 0976494bd664ab77e40f4c791d22321b6e844a2ff9cb75c2a9c142e542db046f
Opcode Fuzzy Hash: 4fbdca90f53c6b84afc5925d81d483e72e4c3b8b76e6ae75e8a1a32a80acff98
Instruction Fuzzy Hash: 6E229E31B102089FDB04DFA9E494AADBBF2FF88314F148469E9459B395DB31ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05F651DC Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05F6541E

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d8d2773f3a7b55349914b3007138392980afb2e4af0d7785568a2c9c728b97ae
Instruction ID: fcbd1701663ec6185de0ef609a2bc4e00f7b6189c33e735283ba6ed61f335a08
Opcode Fuzzy Hash: d8d2773f3a7b55349914b3007138392980afb2e4af0d7785568a2c9c728b97ae
Instruction Fuzzy Hash: ABA17B71D00219DFDB24CF69C885BEDBBB2BF48314F5481AAD809B7240DB789985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05F651E8 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05F6541E

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f7b62284f19401bb3e2f9c33bac42813541d4a3a33d62f8dd6b36256dd6bcb09
Instruction ID: 0df41f9002edfa0baffd334aef5ca761121147a2fc53ba47bacd8d7004c12613
Opcode Fuzzy Hash: f7b62284f19401bb3e2f9c33bac42813541d4a3a33d62f8dd6b36256dd6bcb09
Instruction Fuzzy Hash: 7E916A71D00219DFDB24CFA9C885BEDBBB2BF48314F5481AAD809B7240DB789985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05E4A1D2 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

$]q, xrefs: 05E4A34F

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: e4f499b3d589970def391745cd39dfa151ce5aa413764247989d167c1f5a4491
Instruction ID: 863de61556d83e6d04b5765b8a723b81cc10d9591f10c9520966d9f3c72afabf
Opcode Fuzzy Hash: e4f499b3d589970def391745cd39dfa151ce5aa413764247989d167c1f5a4491
Instruction Fuzzy Hash: 24F1C8307482069FD714DF28E4696BE7BE3EF94220F1550BAE5C2CB395EA34C985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05F64EA0 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 05F64F26

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: dc43af2c948f51ad79b9b5781a6c6226c91ce50bd9773a84582473b1c64edfdd
Instruction ID: 37bbbfd93c3d68117d9bd84326cf48a49c146dbe9e97aac821dfb85f1384dc86
Opcode Fuzzy Hash: dc43af2c948f51ad79b9b5781a6c6226c91ce50bd9773a84582473b1c64edfdd
Instruction Fuzzy Hash: 67212875D002098FDB10DFAAC4857EEBBF4FF88314F10842AD459A7241C7789545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05F65621 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05F656A8

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4dfff2395333c4cf47720020bb590ca138a4f737de6f296633d5a04914ad9fe3
Instruction ID: a027264c48a88fb10f3b5c0fcd38bf3bd12925538a130aa411cfa23d37a01780
Opcode Fuzzy Hash: 4dfff2395333c4cf47720020bb590ca138a4f737de6f296633d5a04914ad9fe3
Instruction Fuzzy Hash: 44212AB1D003599FCB10DFA9C884AEEFBF5FF88310F50842AE519A7250C7399951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05F64EA8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 05F64F26

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0b2384643862e4089c0bb69d6a3639fdf109ea252127b6993d7c746e60c2f089
Instruction ID: 0e08c32f56190ab844064c45f46453e43f5137fa456e84925f461389d7952b7f
Opcode Fuzzy Hash: 0b2384643862e4089c0bb69d6a3639fdf109ea252127b6993d7c746e60c2f089
Instruction Fuzzy Hash: 6E2115B1D002098FDB10DFAAC485BEEBBF4FF88314F14842AD519A7241CB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05F65628 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05F656A8

Memory Dump Source

Source File: 00000000.00000002.2385691865.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f60000_Wzphku.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9e9cca260702ba9f9732c26086bb6bcec9c71e73f5771258ccdd1d75e7f4d709
Instruction ID: 7a454fb17a6b93fc94e59174b67020995e0390e3d6715288a3dac464bd75486c
Opcode Fuzzy Hash: 9e9cca260702ba9f9732c26086bb6bcec9c71e73f5771258ccdd1d75e7f4d709
Instruction Fuzzy Hash: 81211AB1C003499FCB10DFAAC885AEEFBF5FF88310F50842AE519A7250D7799945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E48498 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E486C2

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 0d05236f0c713a38510be222f7611a48139b9d11a3348515a07619bddc2f86dd
Instruction ID: eccb31d9ee9412f857d7859628b3cf72496ccdbf753462a46f165661a06cb0be
Opcode Fuzzy Hash: 0d05236f0c713a38510be222f7611a48139b9d11a3348515a07619bddc2f86dd
Instruction Fuzzy Hash: DEA10A34B14218CFCB04EFA4E99899DBBB2FF89304F559159E446AB365DB30AC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0128F070 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

(aq, xrefs: 0128F0E4

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 8191287588189586d86bd56fdfbfea6145f14be8409c30a7d9fcebbb21ebc44b
Instruction ID: ee0d5be62359fa75628df93bf4fa0b9122cf3bfcb0886095b6b12c2ed70d9aa7
Opcode Fuzzy Hash: 8191287588189586d86bd56fdfbfea6145f14be8409c30a7d9fcebbb21ebc44b
Instruction Fuzzy Hash: 6181AF35B12216DFCB05EF68C59496EBBB1FF8A310B158195E915EB3A6C730EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0128E0B0 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

paq, xrefs: 0128E160

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: paq
API String ID: 0-3273118895
Opcode ID: 4f0dd17b4953481793f81a184b7cf0100b2b8a338efd7ac967a379d609d5736a
Instruction ID: 7b1a75b84cb7bdd6bb2e32ee79dbce6265ad7625112fefe842770d5d34cb4502
Opcode Fuzzy Hash: 4f0dd17b4953481793f81a184b7cf0100b2b8a338efd7ac967a379d609d5736a
Instruction Fuzzy Hash: 46516C76610104AFCB459FA8C915D6ABFF7FF8C3147168498E2099B376DA32DC22EB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D198 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

(aq, xrefs: 05E4D2C4

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: fd6048c40fa934d719078f606ddeda0d1721bb061af0acb2804e68d4400fa982
Instruction ID: f1b6cd532ed3fc5b09e62ff51feaef80ab5c81086e2f71c4ac94746b1cae515f
Opcode Fuzzy Hash: fd6048c40fa934d719078f606ddeda0d1721bb061af0acb2804e68d4400fa982
Instruction Fuzzy Hash: 1E418F76714204AFDB068F68D914E697FB2FF89324B1580E6E6458B272CB31DC11DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E4C139 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E4C182

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 8278ef594600969887b3e66151c1f1375100d139c3dadd43627b72a54f046beb
Instruction ID: 765e11e4c3898fea25f15acffaa1136b58bd60c534c5ea9c308c4e45dadefe54
Opcode Fuzzy Hash: 8278ef594600969887b3e66151c1f1375100d139c3dadd43627b72a54f046beb
Instruction Fuzzy Hash: 14418034B106188FCB05EBA4E498AAEB7F7AFC9700F50541AE446AB394DF749C06CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05E4DA20 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Haq, xrefs: 05E4DA8B

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: f6f424161db6fe03b4a2faa07208b8b285633b5f82ff504e701f5b3cd0b49e1c
Instruction ID: ebb61810eea666dd92cc8c6cf7807fbe8bd7a9f8a2dd660820229852e381097f
Opcode Fuzzy Hash: f6f424161db6fe03b4a2faa07208b8b285633b5f82ff504e701f5b3cd0b49e1c
Instruction Fuzzy Hash: 5531B032B001148FCB05DF58D804EA97BA3FF89310F0680A9E605AF361CB71EC16DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05E40040 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

,aq, xrefs: 05E400A3

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: f2fbd324cc1796136ccfb4a1cd78d8a38c0729bc2f6000a96f6d0cf942739448
Instruction ID: 5d790db66a787e0c0455cf1485471197e86ae0b269a18871eaa88943375d5dda
Opcode Fuzzy Hash: f2fbd324cc1796136ccfb4a1cd78d8a38c0729bc2f6000a96f6d0cf942739448
Instruction Fuzzy Hash: B9417C35B002059FCB05DF69D8549AEBBB6EF85310B1580BAEA42DF361DB31ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01285B2A Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

, xrefs: 01285CB2

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5ef02eb4ead8d23d3769c95b694763149ae6bfbf0de958fcedebd8bbfff83f5f
Instruction ID: 6eb5e09ebff2299bc9a4167ac437baa51dd5b3605edbf187df6326f9510c422a
Opcode Fuzzy Hash: 5ef02eb4ead8d23d3769c95b694763149ae6bfbf0de958fcedebd8bbfff83f5f
Instruction Fuzzy Hash: A3418B30E2525ADFCB01EFA8D4845ADBBF1FF45310F2486A6D401EB289D774AA46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E4BB40 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E4BBF7

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2537f9db8edf6e52c8d259e539371d196217fd8399e16bfebc244dbfa8ff236e
Instruction ID: 9f185f7785476881cc335b18e66f86cf0db58810680cf6ddc14ae02c6d0c6b90
Opcode Fuzzy Hash: 2537f9db8edf6e52c8d259e539371d196217fd8399e16bfebc244dbfa8ff236e
Instruction Fuzzy Hash: 82318B753446109FD308DB29D999F2A7BEBAF88B04F104568E646CF3A5CE75EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4BB50 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E4BBF7

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 251145daf3c84d70722cd2daabcea498389e77678389539f4c2db6693821031b
Instruction ID: 16d4b2a202ffd06ae16089abbe03875c419f06df8679dddd4002d0a1d14b8357
Opcode Fuzzy Hash: 251145daf3c84d70722cd2daabcea498389e77678389539f4c2db6693821031b
Instruction Fuzzy Hash: 6A315C753406149FD708DB29D999F2A77EBAFC8B04F104568E646CB3A5CE75EC02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0128E960 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

(aq, xrefs: 0128E9B0

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: f2b95d965147ea9e30593c179726624e372c1bf9bd9e567df7c2901dec89a0e3
Instruction ID: bc9d45ab9a511a3301b93bd36d1e08e9d610bb85b4c8ccd63afa693d78ce97ac
Opcode Fuzzy Hash: f2b95d965147ea9e30593c179726624e372c1bf9bd9e567df7c2901dec89a0e3
Instruction Fuzzy Hash: DC3164363151569BDB05AE6CD840A7EBFA6FFC9320B15407AFA08CB392DE728C01C390

Uniqueness

Uniqueness Score: -1.00%

Function 05E47518 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E47561

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 07a69e6f95c02dfa40ecf530b6bbec8f13d8fb8636c5aa94d9c274e79e05a68e
Instruction ID: 3c3bdc2c8ede2f911c751e38969f0301be8e2b7df9afde77745d3eb3a6c63143
Opcode Fuzzy Hash: 07a69e6f95c02dfa40ecf530b6bbec8f13d8fb8636c5aa94d9c274e79e05a68e
Instruction Fuzzy Hash: 2A31D131700204DFCB19DF94D959D997BB7FF88310B4540A9F64A9B365DA31EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E50000 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E504D5

Memory Dump Source

Source File: 00000000.00000002.2385416956.0000000005E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_Wzphku.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 0a5c49da4f39c26c3cd81a1bc1c417b9ad0a49d2d2c3d3c9f778c045dc01ccea
Instruction ID: 331d02ceb881c62fe067d2008a8cd8dcae5ce9934c05c56736139473c12614bc
Opcode Fuzzy Hash: 0a5c49da4f39c26c3cd81a1bc1c417b9ad0a49d2d2c3d3c9f778c045dc01ccea
Instruction Fuzzy Hash: 4E21C57290E3D19FD7174A75486966A7F71AF83334B0A14EBE8C1DB193F5194805C392

Uniqueness

Uniqueness Score: -1.00%

Function 01287B62 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

Te]q, xrefs: 01287B62

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: f112521dc416d2df5d1ec259b6767a99799931ddb124335081d12015bbebf94c
Instruction ID: 9d315a62d3395017b80f5b619c3e7beb325e4252f9d08f1273c2474407d8a4de
Opcode Fuzzy Hash: f112521dc416d2df5d1ec259b6767a99799931ddb124335081d12015bbebf94c
Instruction Fuzzy Hash: FF312774B11105CFDB18EF68D599BADBBB2BF88714F204469E902DB3A1DB709D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E40006 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

,aq, xrefs: 05E400A3

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 71b281f412f538a3e241c146626aa95d0f365efabc51abd92f7f2ac0f84133fc
Instruction ID: 7ce99019a26e0977311ed3b0ff07c5c91593c42d3931eb395f967cb73ad33e1f
Opcode Fuzzy Hash: 71b281f412f538a3e241c146626aa95d0f365efabc51abd92f7f2ac0f84133fc
Instruction Fuzzy Hash: 4921BF316093458FCB06DF79D8589AABFB5AF46310B1640A6E581DF3A2E734EC05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E42EF8 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<]q, xrefs: 05E42F32

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: aa35fd03ad1ae584583efc159b7f40887d8d3300e4ba1de5533019410df52168
Instruction ID: 10be65f8c1cf38a4e08932f47c2fda84eb98cd70b8ea447874cc9493a6c4915c
Opcode Fuzzy Hash: aa35fd03ad1ae584583efc159b7f40887d8d3300e4ba1de5533019410df52168
Instruction Fuzzy Hash: 4F216A743041549FDB02CF2AE844AAA7BEABF8A304F485095FE95DB3A0CA35DC50CB30

Uniqueness

Uniqueness Score: -1.00%

Function 05E42EE8 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

p<]q, xrefs: 05E42F32

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: 1ff4549ea5f5ec8c042b7fb8348232443da90b1b2e0916f982ecaf73d6df0010
Instruction ID: ed327cd9da76e8e305db19bc3b76c70a394c40be62d4687c1de8e7cd71095b85
Opcode Fuzzy Hash: 1ff4549ea5f5ec8c042b7fb8348232443da90b1b2e0916f982ecaf73d6df0010
Instruction Fuzzy Hash: A1219D743041949FDB06CF2AE8449AA3BEABF8A304F485095FA95DB261CA31DC40CB20

Uniqueness

Uniqueness Score: -1.00%

Function 01281CC2 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

h^q, xrefs: 01281D32

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: h^q
API String ID: 0-1951170149
Opcode ID: e6313772c5d1f66f5f395b1cf09f0720e1c8e647c15cc2eb454324be806f243b
Instruction ID: cef2ec2f75eece07cc23d2baf3624469662afbd5bddc7027f3ed42c3d8d8b4a1
Opcode Fuzzy Hash: e6313772c5d1f66f5f395b1cf09f0720e1c8e647c15cc2eb454324be806f243b
Instruction Fuzzy Hash: 1E018432D1074B9BCB509FA9D8144DDBBB6EFCA731F254A12D140BB164EB70258BCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01282178 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

h^q, xrefs: 012821EA

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: h^q
API String ID: 0-1951170149
Opcode ID: f09546ab034f4dda69c7dfb40c17ae1cc84e4ffbcb708b51d4c4d7f1e6e3c179
Instruction ID: 659e77526988ec0411209bf435b3af6c96136f833d547b873d580fe0bfe06306
Opcode Fuzzy Hash: f09546ab034f4dda69c7dfb40c17ae1cc84e4ffbcb708b51d4c4d7f1e6e3c179
Instruction Fuzzy Hash: 5B019A32C1460B9ACB049BB9C8404EEFBB2EECA310B218616C110B7160EB70214ECBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01282188 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

h^q, xrefs: 012821EA

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: h^q
API String ID: 0-1951170149
Opcode ID: f87c13093cdaf9d325db7f151e9e1df3156881002463ffba24b73224fa76e999
Instruction ID: 9feaceaa14949648977a3604028f505a1df9c04ece6d602ed238add217ba8056
Opcode Fuzzy Hash: f87c13093cdaf9d325db7f151e9e1df3156881002463ffba24b73224fa76e999
Instruction Fuzzy Hash: BCF08C32D1460B96CB009BB9D8044DEF7B6EFCA310F21CA12D51077164EB70218ECBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01281CD0 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

h^q, xrefs: 01281D32

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: h^q
API String ID: 0-1951170149
Opcode ID: eca50f3868647420939e89527d4b5a6666b37da2582c432b48a6c3de4222e29e
Instruction ID: de100eb1b8efe250abb8bc37d4cac99aa67073ae84b387fae4060b736229e8a1
Opcode Fuzzy Hash: eca50f3868647420939e89527d4b5a6666b37da2582c432b48a6c3de4222e29e
Instruction Fuzzy Hash: 41F0AF32D1060F96CB50DBA9C8044DEFBB6EFCA321F258B12D10077164EB70218ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01283D33 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

h, xrefs: 01283D33

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 59d60dbf227589e1b06fe7dfb040aecff9c82a4f9caa8bbeacf038bbc35c5e18
Instruction ID: 2bb274ea850004e6c1f5c7c4406ade00d9d18713fbb3ce82f99afd37881cd9d7
Opcode Fuzzy Hash: 59d60dbf227589e1b06fe7dfb040aecff9c82a4f9caa8bbeacf038bbc35c5e18
Instruction Fuzzy Hash: 80D05E30C24288DFCB48EFA4C81696CBBB1BF09B00F008259C4429F285D3714807CF01

Uniqueness

Uniqueness Score: -1.00%

Function 05E4C388 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ae8014a0dfc06f4d4b1fd4284bbf4b1cd5dbdb3a715ea8d7e7aad8ceff2fda
Instruction ID: 2994315a41a5ba3a0a2d0af0e96ad5621ddddcaf8b9c6181efae3c3dff3956fc
Opcode Fuzzy Hash: 34ae8014a0dfc06f4d4b1fd4284bbf4b1cd5dbdb3a715ea8d7e7aad8ceff2fda
Instruction Fuzzy Hash: DA120C34B002198FCB14EF64D898A9DB7B2BF89304F5095A8E58AAB355DF30ED85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0128F3E8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe11e990f3871eb134a507867302607151744b2b8db34d972ce837b1953e40e
Instruction ID: e999ad85998ed03bd056bd2feaedb2c58398fbad2a91600865ae93a0dcf5ff63
Opcode Fuzzy Hash: fbe11e990f3871eb134a507867302607151744b2b8db34d972ce837b1953e40e
Instruction Fuzzy Hash: A2A1DE35B122198FDB05EF6AE549AADBBB2FF88305F14806AEA11D7390CB35DD01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D330 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4a734d96ab352e10b37e3342a17a4329305d73d4d28a0f03cd510f62ef8f85
Instruction ID: 75614bafc39590b6938cea94653fb4bdf12c35f539ab764f9a3bea07480a1fc1
Opcode Fuzzy Hash: ae4a734d96ab352e10b37e3342a17a4329305d73d4d28a0f03cd510f62ef8f85
Instruction Fuzzy Hash: C8813B34B14114CFDB04DF68E998A6DBBB6BF88714F1440A9E5869B3A5CB34EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E45088 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a30e7ed644dea990bd0d678bc34012a294a84a98f2fe327c4cd10523204ff0
Instruction ID: cdf98136eaebf0adebd1c5cbf6dea558ed6dc440727b0e932c4e6627de98cf0e
Opcode Fuzzy Hash: 05a30e7ed644dea990bd0d678bc34012a294a84a98f2fe327c4cd10523204ff0
Instruction Fuzzy Hash: 29810435A00618CFCB14DFA8D58499EBBF6BF49314B1691AAE8569B360DB30ED41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01285668 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a628564ff7c61ec5d48d5a050a9526a4421d083c30a825c22fc782c78a5acfba
Instruction ID: cd1a3c8fdcf8d7ca31c00060e214a1f5ce6b233bee29106b6b4c4341f5656b05
Opcode Fuzzy Hash: a628564ff7c61ec5d48d5a050a9526a4421d083c30a825c22fc782c78a5acfba
Instruction Fuzzy Hash: 4C718330625B028FD725EF29D48062BB7F2FF95314F148A2DC08A8BB96D774F8458B90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D320 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4fcb161358acb74f76342028cea3439bf32a64638944189e5f8352884d26d3
Instruction ID: 8e02efd2e0fc611f69e71a6f525c5d6ed85a64ed91fcbbc874f7286ef7802c7a
Opcode Fuzzy Hash: 8b4fcb161358acb74f76342028cea3439bf32a64638944189e5f8352884d26d3
Instruction Fuzzy Hash: 2D610934B10614DFCB04DF64E898AADBBB6FF88614F1051A9E5869B365CB30EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01285008 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1c16b16d6012869510818e00cff7e7056744101263ebdacde8a9222c22991f
Instruction ID: e385d216aa448645c1266f86c32de39cd84031fbad60f6ecfc68ee306bed55e7
Opcode Fuzzy Hash: bf1c16b16d6012869510818e00cff7e7056744101263ebdacde8a9222c22991f
Instruction Fuzzy Hash: 5E51283123A615DFC724EF69C84187EBBF1FB98361B04892AD157CB685C7B4A806CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 01284100 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29a4b0ef91c38210004160d1b8a8ff89314a57dfc02e77ac72a12b0a0009561
Instruction ID: bbdd1179e520330080ec7d4141f764a05f5900a4386fa452f5fee709ac935672
Opcode Fuzzy Hash: d29a4b0ef91c38210004160d1b8a8ff89314a57dfc02e77ac72a12b0a0009561
Instruction Fuzzy Hash: 4741283173E28BDBC715FB68E4127B97BB1EB94354B048567D206C76C8EAB1DC018B92

Uniqueness

Uniqueness Score: -1.00%

Function 05E48078 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c466874c67072977eeb50d521752776f9d5f30f18ddeacc57ff62235a86496c1
Instruction ID: 82aba4e92b684854a0eacd85c887e8656af07ea9b0adca9432319656462e76f7
Opcode Fuzzy Hash: c466874c67072977eeb50d521752776f9d5f30f18ddeacc57ff62235a86496c1
Instruction Fuzzy Hash: F0518A35B146099FCB04EF65E499AAEBBB6FF88705F008119F5429B364DF30A906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01287460 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a647a9a823db7712f929717bf19a44258d9891f69af9b3c46a95ed52e1fba6
Instruction ID: 049357625d1c6569796f195c446d5712484bbc84f627175e1591f34c9d0fdcea
Opcode Fuzzy Hash: e8a647a9a823db7712f929717bf19a44258d9891f69af9b3c46a95ed52e1fba6
Instruction Fuzzy Hash: AB41E371A3A155DFC714BB2CE44293ABFB5EB84350731816AE80BC76E1D6B4EC0087B2

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D621 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43421c906737b940657274073292754857384b28a744ce22e7a1acab0a9ba094
Instruction ID: 153cd1bc4d8178ac0ae5b555dc07e94bf1105159571df670fb46656ebc51d6c0
Opcode Fuzzy Hash: 43421c906737b940657274073292754857384b28a744ce22e7a1acab0a9ba094
Instruction Fuzzy Hash: B7416C36B00208DFDB14DF65E959AEE77B5FF88314F148069E846A72A0DB319D05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01288873 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6be52ced23da431d1b4ba9ca2d472b89e310dc2721abfece016903e7f6f495
Instruction ID: f5b6346fad02090002b6a4f315041bad3674624583a4f63b5f8838f3a1d929b1
Opcode Fuzzy Hash: 9c6be52ced23da431d1b4ba9ca2d472b89e310dc2721abfece016903e7f6f495
Instruction Fuzzy Hash: 3851A470A2524ACFCB05EF98D4859ADBBB2FF94310F68C46AD542A7395C734AC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0128A0AF Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76be037117a4a383992b490b0052a9f7a412cb8a50dbda6aa52e4e3e2270b3f
Instruction ID: 5e5f41a7c22ba08f6ea6ae42c5317086f6c8ae9676acf8c952a77be0e85fdc7f
Opcode Fuzzy Hash: a76be037117a4a383992b490b0052a9f7a412cb8a50dbda6aa52e4e3e2270b3f
Instruction Fuzzy Hash: C141AE30626616CFDB31EF68C485AAAB7F1BB48340F00892BD957872D9DA75E885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B467 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68aa540b216186d2a454806a5d0531620e0047032d2a17160a5a999a65a29031
Instruction ID: bff76a068ed55de2015f39ea39c8c147631b0bff8aaddb1538b43daaf59198d5
Opcode Fuzzy Hash: 68aa540b216186d2a454806a5d0531620e0047032d2a17160a5a999a65a29031
Instruction Fuzzy Hash: C141BE36604208AFDF158F14D844FA6BBBAFF49314F0580A5EA899B272C735EC42DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E42418 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4c476085b699a7e8b1c19052cd79f4eeb19dbdea81a69521aef36d23043cd9
Instruction ID: e3a0bd8b406e724f11b99f604e83e348c83df72422ac5febdaf2b960f746e604
Opcode Fuzzy Hash: 9c4c476085b699a7e8b1c19052cd79f4eeb19dbdea81a69521aef36d23043cd9
Instruction Fuzzy Hash: 50214BA69093C49FC702CB74A8154DD7FB1EF93200F0550EBE6C6CB293E5245A0ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01283F78 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6fa05404eefd4653eb697e038643861c3430d5fb6ecf05ffaaa43d5aef2897
Instruction ID: a9a6aa723123eb4ce35feeefe4a3c11fb5fb19288a2feea5482f03c7ab62fd07
Opcode Fuzzy Hash: de6fa05404eefd4653eb697e038643861c3430d5fb6ecf05ffaaa43d5aef2897
Instruction Fuzzy Hash: 5F41FB74E2524ADFCB04EFA8D5819AEBBF1FF48350B10456AE806EB354D771A906CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01288220 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e5b8cd18633d2fb1b1bbe662ad69ce636e81871448d7af1ea0af8de1fe9027
Instruction ID: 0343a8b089edf2f307ad1da21c5a8809fa063643d7c6f3496df2c26b70c1d3a2
Opcode Fuzzy Hash: 52e5b8cd18633d2fb1b1bbe662ad69ce636e81871448d7af1ea0af8de1fe9027
Instruction Fuzzy Hash: 3431F43123FAC2DFE761BA6D99463B97A85FB41354FC80227E502C25D9D3A4C8408352

Uniqueness

Uniqueness Score: -1.00%

Function 05E4AC50 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16433da22656da4ea0bfca5bfb159742a27f061650d11069a0e75e1f4dfd8821
Instruction ID: 193f8ced320aa6a056b70559c762b8844a0945ae24a9319eae3e5274c149a360
Opcode Fuzzy Hash: 16433da22656da4ea0bfca5bfb159742a27f061650d11069a0e75e1f4dfd8821
Instruction Fuzzy Hash: D33104766501089FCB05DF68E888EA9BBB2FF48325B1640A8F5099B372C731EC51CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01283F88 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8269d91ffa9f4489e672ad861b975fa4e3aeb54861156ef37f4fbfe328beb3d8
Instruction ID: dba34582613c8f711c90cdc967c61b22e2d104b9927045d920f1fe4fbdfc8e1a
Opcode Fuzzy Hash: 8269d91ffa9f4489e672ad861b975fa4e3aeb54861156ef37f4fbfe328beb3d8
Instruction Fuzzy Hash: E841CA74E2524AEFCB04EFA8D5819AEBBF1FF48340F104425E806AB354D771A906CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01282BB1 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedc5d7ee88816bfc9e4079412ab5c69daa6a12fe6da78abad9ae5ad4d4dafce
Instruction ID: 420e41625dc21105181f1cb718b33e35b7177ef98699611a0cd78396f00f5bfd
Opcode Fuzzy Hash: fedc5d7ee88816bfc9e4079412ab5c69daa6a12fe6da78abad9ae5ad4d4dafce
Instruction Fuzzy Hash: F641B134616209CFDB15DF9CD855BA977F2FF85300F1AC1A6D106AB2A9C3749C85CB11

Uniqueness

Uniqueness Score: -1.00%

Function 01287E8B Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137b524d9be9bb9857f18cf6d6afa68911a4abccd94e7ef419825998e970e619
Instruction ID: e9c90244893da2c883ca8b3c4297d4a411c5b8c79fe4e21f39e1a15a014a9290
Opcode Fuzzy Hash: 137b524d9be9bb9857f18cf6d6afa68911a4abccd94e7ef419825998e970e619
Instruction Fuzzy Hash: 6B21B53173620AEFDB18FB2AA05127937A2ABE5251B748974E606CB2C8DF70DC41C751

Uniqueness

Uniqueness Score: -1.00%

Function 05E44BF4 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21500b525f752c278db66f2900b7d1de082c0f752ddeb66f9d184a136464b107
Instruction ID: 688b5f552b66aaf25a4b1dadfc10dd977b98a4aa7f16a99643b6a619d9460be8
Opcode Fuzzy Hash: 21500b525f752c278db66f2900b7d1de082c0f752ddeb66f9d184a136464b107
Instruction Fuzzy Hash: 8431D3313183448FDB059F25E895BAE3FB6AF81354F1440AAE841CF2E2CE64DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0128A166 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313d7c71044d23a12152cf5654b6e381561fa83be9a9796e5d1571dcf1dbc969
Instruction ID: 05c0fb1ec2588b0393d8aad81d5e12d15c8af3d86199b0800530a5e2bdbaf10d
Opcode Fuzzy Hash: 313d7c71044d23a12152cf5654b6e381561fa83be9a9796e5d1571dcf1dbc969
Instruction Fuzzy Hash: EF319C34629215CFC731EF58D489AAEBBF5FF48340F04842BD84687699DB75E886CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01282BC0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5ef4cd578791f18a869c77cff3504ea0b599d24e2b78c2d307271fbbd91eec
Instruction ID: 897f485763dff5a7e4969424eddd62eba70ab284d09ed8aa9fbced021addffae
Opcode Fuzzy Hash: fb5ef4cd578791f18a869c77cff3504ea0b599d24e2b78c2d307271fbbd91eec
Instruction Fuzzy Hash: 5531C134626208CFDB15EF5CD954BAA77F2FB85300F19C2A6D106A73A9C3749845CB11

Uniqueness

Uniqueness Score: -1.00%

Function 012825C9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7143fa38fe2f42342bca73a809d64713ae481425cb79a2ed39d4601858a2e4ee
Instruction ID: e742ac8ab00b738ce6c6b83186b0b44866a2b44f462aefc7a2c5614a33fb70b9
Opcode Fuzzy Hash: 7143fa38fe2f42342bca73a809d64713ae481425cb79a2ed39d4601858a2e4ee
Instruction Fuzzy Hash: 7A31EF31B002169FCB05EF68C54099EBBF2FF89310B15816BD446EB265DB31AC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05E42618 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb145dd0bfb67316bde4cf19a5554f71d5f632be47ed583ca73688dea9cd9ada
Instruction ID: d8c40e42ebebf173329b732805e5953e3198565ec9a3e6cda29321a96b494406
Opcode Fuzzy Hash: cb145dd0bfb67316bde4cf19a5554f71d5f632be47ed583ca73688dea9cd9ada
Instruction Fuzzy Hash: 113180397003059FD725AF71E44896ABBB6FF81214B10546CE9868B361DB35E84ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 01282758 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4830fca4ced5715c04b33273c9f91a00b2c0192ebf4ec2b878a0d14a827f511
Instruction ID: 6ccdde82734ee8aab733e6584b9cceba234b532673ed9b446893b88d89e7beb3
Opcode Fuzzy Hash: e4830fca4ced5715c04b33273c9f91a00b2c0192ebf4ec2b878a0d14a827f511
Instruction Fuzzy Hash: 75317E71F111059FCB05EF69D98099EBBF2EFC8250B14806AD805EB369DB31AD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01282C74 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ada8d4c05e11477b8b3b9128da12bffc4d40a3f98d4b506801bd99d382b9bf
Instruction ID: de7f6a703fc748376d4607221137624c333bbd54dd34004a23dfa480bc56fe21
Opcode Fuzzy Hash: 71ada8d4c05e11477b8b3b9128da12bffc4d40a3f98d4b506801bd99d382b9bf
Instruction Fuzzy Hash: 5131D274623209CFDB15EF9CD958BA977F2FB84300F1AC1A2C105AB2AAC374D845CB11

Uniqueness

Uniqueness Score: -1.00%

Function 05E48E18 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b19cec9f2e03b92b5084756aa4d15cb9550150d716e5130669d0734539680e7
Instruction ID: 2812c3e3cb661ec7c704e6ab832e620bf961c161ff954e9f7e81382ec0368e42
Opcode Fuzzy Hash: 1b19cec9f2e03b92b5084756aa4d15cb9550150d716e5130669d0734539680e7
Instruction Fuzzy Hash: 2021D6323092004FD7248A6AF888966BBE5EFC1315F05D0BAE18DC7252DB31EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01282749 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2718c28b70e943241c3e4a308c5e7c5341eef83b67527c8beedadef814490bb8
Instruction ID: 259fffaf3eac851753b41378364e3e74e850d6983ed012fa2614303629708578
Opcode Fuzzy Hash: 2718c28b70e943241c3e4a308c5e7c5341eef83b67527c8beedadef814490bb8
Instruction Fuzzy Hash: 7631C371E10205DFCB05EFA9D98099EFBF2FF88310B15806AD845AB265DB31AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05E4502B Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bfe72a39cf56d3022e977e090aba1e7eeff3c5e171211d7604a0704e6ea3d95
Instruction ID: 6ac696f79e751fc61da495ed779e4d3ead0fef5626c9554cac658274195de09e
Opcode Fuzzy Hash: 2bfe72a39cf56d3022e977e090aba1e7eeff3c5e171211d7604a0704e6ea3d95
Instruction Fuzzy Hash: 08218DB6E04118EFC719DF94E844DEEBBB9EF89210F1145ABE585DB250EA30A905CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 01286EA8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e22aa940a789e49660b1e2d6311b875aa4cde054497c790144e82313ff549f7
Instruction ID: e6b33865ee79b5729cfd02232156039a04b41551e0859662384b8963866a32bd
Opcode Fuzzy Hash: 6e22aa940a789e49660b1e2d6311b875aa4cde054497c790144e82313ff549f7
Instruction Fuzzy Hash: 4521D63163A507DFCB20EE58D546D7EB7F2FBA4250B508926E117D76D4C6B0E8018B51

Uniqueness

Uniqueness Score: -1.00%

Function 01286E98 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372eaf2e25c2ba4e415a99eb386dcb4854bb63d5fbb20b5ebd130b1502fb56d7
Instruction ID: fe80c1918679841d474e2e006b114d10c626aa264d297e9d04614efca1076cb1
Opcode Fuzzy Hash: 372eaf2e25c2ba4e415a99eb386dcb4854bb63d5fbb20b5ebd130b1502fb56d7
Instruction Fuzzy Hash: 2421053163A607DFC720EF68C542A7EBBF2BB65314B548926E143C76C1C6B1E8008B52

Uniqueness

Uniqueness Score: -1.00%

Function 05E40228 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3001e5ef5e6768338ec5c556c48d91cb0d52c77e95a8565c9837e84419095be3
Instruction ID: 909cf3e24d7ee5ce20437ae0ce897c4194cf848f24cb29e90a290b836f6ef258
Opcode Fuzzy Hash: 3001e5ef5e6768338ec5c556c48d91cb0d52c77e95a8565c9837e84419095be3
Instruction Fuzzy Hash: 0D314A34304215CFE704DF69E898D6A77B6BF85648B002478DA46CF3A2EB30E801CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E4E300 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4707c3b48d52f31a552315dd444ad40913c74416b2c3c2f2129b8992b77a3b30
Instruction ID: b899298030d8cca129b3e6d8f808f43a3e4531dc4bb8d105fb94a95dcfecf36f
Opcode Fuzzy Hash: 4707c3b48d52f31a552315dd444ad40913c74416b2c3c2f2129b8992b77a3b30
Instruction Fuzzy Hash: 59217634B10A098FCB01FF68D5448AEBBB5FF89700F105529D54697314EF709906CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01288486 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a1677ee8dadae462896782431d0e05e1c9f08c1e9152b2a9d80e59eb785d18
Instruction ID: 26f70306d56791b807a22b33c730c8ee125b82c7a5fcad1bf21f60348ebdd156
Opcode Fuzzy Hash: e2a1677ee8dadae462896782431d0e05e1c9f08c1e9152b2a9d80e59eb785d18
Instruction Fuzzy Hash: 4B312535526205CFC721EF58E48166BB7F1FF44300F40892AC14783799D778E804CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0128A64C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6147b532909a5db29a3f319c7a66d8800ae23bb3e1aa0034fdfc09e78b70732
Instruction ID: a47f38a746553b9ebade1d11105056c948205264288a388b3bcfb15b101a9527
Opcode Fuzzy Hash: e6147b532909a5db29a3f319c7a66d8800ae23bb3e1aa0034fdfc09e78b70732
Instruction Fuzzy Hash: F221AE35A21115EFEF14EF64D895A7AB7B2FF84314F20C867E9028B289CA74D811CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05E416B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c3df5aca58a4552e7a8fabc641eec03da4931468a4bec2153bb400e3f8fd35
Instruction ID: 76701d0c448d9b9d600bd8fc3dbf822a9307d2bccd67a5b862d75ed5a2c97810
Opcode Fuzzy Hash: a2c3df5aca58a4552e7a8fabc641eec03da4931468a4bec2153bb400e3f8fd35
Instruction Fuzzy Hash: 8221D536B042198F8F188F69F8494BEB7FAFBC12A57145476E495D7240EB31D881CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05E4E2D1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd720d150297ee5409af636635b285e4db04a62257a940e0986d735623075d4c
Instruction ID: 5a6c326c815e49cc2f5638e799b00e5cec7b3b1203dc3b40887c19a8f1881bf1
Opcode Fuzzy Hash: fd720d150297ee5409af636635b285e4db04a62257a940e0986d735623075d4c
Instruction Fuzzy Hash: 0921B274B047098FCB02EF64D5545AEBBB5FF8A300F00516AD581D7361EB349A06CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0121D770 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381297194.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ef267eedbf927d52eab910bd488a6a49c75db6e8e998a6292aec610b1bd3c5
Instruction ID: 27e9c48e65a3bd9a79643c73ba7356cb87c7ae882ec9d4b474ce1d6521675a58
Opcode Fuzzy Hash: 63ef267eedbf927d52eab910bd488a6a49c75db6e8e998a6292aec610b1bd3c5
Instruction Fuzzy Hash: 58214871514248DFDB05DF94D9C4F26BFA5FBA8320F20C569DD090B25AC37AD406C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0121D684 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381297194.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366456d3465e2ef0cc89924255bf9d6936905f972f7d532b42bb23ba3f038bbf
Instruction ID: 7671cc631dd619b1b24d98088fad7c9fadb8af7bbe069e3522f2492fe7551116
Opcode Fuzzy Hash: 366456d3465e2ef0cc89924255bf9d6936905f972f7d532b42bb23ba3f038bbf
Instruction Fuzzy Hash: 5E216A75510288DFDB19DF54D9C8F17BFA5FBA4310F20C569D9090B25AC336D406C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05E42510 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc7820971ea4c36a2381a982f71152dfc28039886f36993bb9c79654f520202
Instruction ID: 51f1259f87457801953fe3d4b1ee8b662e9ca25e48cd47ebc592ad54f1808ed8
Opcode Fuzzy Hash: abc7820971ea4c36a2381a982f71152dfc28039886f36993bb9c79654f520202
Instruction Fuzzy Hash: F9215175E00249DFEB10DF74E414BEEB7F6AB04344F508066E69AD7290E638CA55CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01284B50 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab19e6a2889eab6452c15732c7957e432c92080233aaca44d9de8b1fac0e8a59
Instruction ID: 5ffdd234fa8c7b81fc7f2e99a1d18b81afb3b6d5acf41734c42cc5851227e885
Opcode Fuzzy Hash: ab19e6a2889eab6452c15732c7957e432c92080233aaca44d9de8b1fac0e8a59
Instruction Fuzzy Hash: 11214A34B15105EFCB14EFA8D499AACBBF2FF9C320B1490A5D906A73A4DB748C42CB11

Uniqueness

Uniqueness Score: -1.00%

Function 01282A20 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021f00f33dcc62cc09172c94bd2bb500922a142fb92a4df24a6ed91aadd55c8f
Instruction ID: 2d0ed52ea8a30981e879a60761263cb25fb5212a05b603726bf693df25beea6e
Opcode Fuzzy Hash: 021f00f33dcc62cc09172c94bd2bb500922a142fb92a4df24a6ed91aadd55c8f
Instruction Fuzzy Hash: E721D631E2220ACFDB60DBADD8907DEB7B6EF88300F55C226C115A72A4D774558ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E462B0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0296b95e3e07fc5aa99aeaebdcfdbe08d56660edf9323c9cfc3fa53c34291f23
Instruction ID: f684a4546569128261eea0e00532705507a189e5d09c1e88a8efe3ab1644020f
Opcode Fuzzy Hash: 0296b95e3e07fc5aa99aeaebdcfdbe08d56660edf9323c9cfc3fa53c34291f23
Instruction Fuzzy Hash: E7213C31A00208CFDB05DF64D649ADDB7F2FB89300F2055A8E481BB2A5DB75AD45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E4AC40 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca435feeff4eadb4458a0af505bc897bf63d841e902571204163ea830a21a3c
Instruction ID: 77064d457c888cc1e08155a382507ab924450fda639edd7303d3d8e5926e578c
Opcode Fuzzy Hash: 1ca435feeff4eadb4458a0af505bc897bf63d841e902571204163ea830a21a3c
Instruction Fuzzy Hash: 8921F9766101049FDB45CF99E988E99BBB2FF48324F0540A9F6099B372D731E815DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0128D388 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05151970f8e33ab083ffe3ec5eb5391d775a0eb9ccde9daf2bcd2117d0e117f4
Instruction ID: 8f6420c731950b3b0c4bcd69dee7c91d0db7a2f990a1555be063de73e856c7cd
Opcode Fuzzy Hash: 05151970f8e33ab083ffe3ec5eb5391d775a0eb9ccde9daf2bcd2117d0e117f4
Instruction Fuzzy Hash: D811E63023E10CDBC304BBE9884796B77A59F85711B104462E506DB2E5D7F0AC0D8F92

Uniqueness

Uniqueness Score: -1.00%

Function 05E462C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c28a6862a09ca74229b6457129af418963a6a6a39510f94b738cca366a1424
Instruction ID: 9ba3eea963c502c1a96c6ff581d4916cff7129e59c0733f4b6418f6ab3a1a043
Opcode Fuzzy Hash: b2c28a6862a09ca74229b6457129af418963a6a6a39510f94b738cca366a1424
Instruction Fuzzy Hash: 2C210631A00209CFDB04DF98D685ADDB7F2FF89304F1045A4E445AB2A1DB75AD44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01282A30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694f9f2b3f63a0e4e7bc7cb80b48ec5cd80685d317bc8e04dc9461788722ab68
Instruction ID: b48f4496b947956845a5290c7b409500c3e4b2341505f5d979e68b7ad5ef00a5
Opcode Fuzzy Hash: 694f9f2b3f63a0e4e7bc7cb80b48ec5cd80685d317bc8e04dc9461788722ab68
Instruction Fuzzy Hash: 1C21D731D2210ACBDB60DA9DD9907DEF3B6EF88300F558226C21167194D770644ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 01284EB1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b517303bb5d54f08a964679d7b592af08c1b643ac40ddec1df25b7c38bb6c3d3
Instruction ID: 7d9ae3043bfb41e257b5820267b60583e4c3aba19216aa203d45b12c08581761
Opcode Fuzzy Hash: b517303bb5d54f08a964679d7b592af08c1b643ac40ddec1df25b7c38bb6c3d3
Instruction Fuzzy Hash: BD11B134A3E297CFD714BA58941A7BDBBE1AB64210F14019FE402976D4DAB14D008791

Uniqueness

Uniqueness Score: -1.00%

Function 0128359F Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed60fbec2222c333ec2b370499e54b33173044c1cfcd90db33b91bb65af53533
Instruction ID: cae2ce6b414f8a454182c17958d217ece464430da685450f54a608ebef1141eb
Opcode Fuzzy Hash: ed60fbec2222c333ec2b370499e54b33173044c1cfcd90db33b91bb65af53533
Instruction Fuzzy Hash: 78219F7093E28A9FD705FA6CE426B697BF4FB54204F0440AAC602D72DDDBB59804CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05E4745F Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d1976bbed2ed0e194a22dc716a443e4f02f3c30b483c30e21ce41aaa75552a
Instruction ID: 792dcb5a1f93788b7cbe9571365db95884acfb5445f9d6bcf031573ad12316a0
Opcode Fuzzy Hash: 78d1976bbed2ed0e194a22dc716a443e4f02f3c30b483c30e21ce41aaa75552a
Instruction Fuzzy Hash: 8C1148A670D2545FCB1109697C977B6BFB5DF9261078A10EAE4C5CB242EA08CC03CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 012880DF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bec5baafec5bdfec710257604c0c7eac77fcb909eb58412255b675576a884e1
Instruction ID: b1c4fe65bf92806865a113103eabcc9fd9db007f2c8851eba9bc7a5d191b7106
Opcode Fuzzy Hash: 2bec5baafec5bdfec710257604c0c7eac77fcb909eb58412255b675576a884e1
Instruction Fuzzy Hash: 2C11BC34A3A205DFC364BA58C847BBA73F2AB99750F90455AE0039B3D5CEB08C018B66

Uniqueness

Uniqueness Score: -1.00%

Function 012880F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e970a35a3d72f98c324feb61416d3de0c8bd7d82ef3bc6154150e7c8960687
Instruction ID: c0ed2a9905b9878284cbd0a8e34c1c4f58777b7438d66714aa5bd78553b1534d
Opcode Fuzzy Hash: f3e970a35a3d72f98c324feb61416d3de0c8bd7d82ef3bc6154150e7c8960687
Instruction Fuzzy Hash: 7D11213473A111DBC224BA48D843B3A73E6FB89760FD0451AE117973D8CEF09C0086A6

Uniqueness

Uniqueness Score: -1.00%

Function 01287288 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c32bae49372a08a30e678d13e1d079ccbadfd1e86a82e9a196b6d5280b218eb
Instruction ID: 5c84caecf858f253504e780008f606098857c9ef85b984790a38840bd92086a3
Opcode Fuzzy Hash: 9c32bae49372a08a30e678d13e1d079ccbadfd1e86a82e9a196b6d5280b218eb
Instruction Fuzzy Hash: CA115130A3E202DFD315BB78D957B353AA1AF84340F31446AE9028B6EDDBE5D9418752

Uniqueness

Uniqueness Score: -1.00%

Function 01284EC0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af395d62aef01a2c88ea5a855e5af1032069af2c0164e4fc5865f30e3f85700d
Instruction ID: 4f5f408b799efdb0b20f9ef543e3d3d8fe1106a8058675895e330526cd5cfe8b
Opcode Fuzzy Hash: af395d62aef01a2c88ea5a855e5af1032069af2c0164e4fc5865f30e3f85700d
Instruction Fuzzy Hash: BB11903463E19BDBC714BB15C41A7BDBAE6AB68210F14419EE403976D0DAF58C008B91

Uniqueness

Uniqueness Score: -1.00%

Function 05E4CF50 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc010eeb0fd8cd145c3165c7019fd4e83a2f485c9dd69f7ac368b88c6aeeed8
Instruction ID: 0db9ec8b334a7677a19e822143305643bcfe2d25fda488bcca7ed26b358ff420
Opcode Fuzzy Hash: 0fc010eeb0fd8cd145c3165c7019fd4e83a2f485c9dd69f7ac368b88c6aeeed8
Instruction Fuzzy Hash: 26219D347046048FC715EF68E888A6EBBF6EF89300F144469E5869B361DB34AD06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01281861 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3955aca792cd31ca5405ae6604e209458f1eb60ee3b953eb66377cc079f1f634
Instruction ID: 3e4be340c29163b7e3ca6b87cb77fe2629899d52298d9eb07ff6b35530a594f5
Opcode Fuzzy Hash: 3955aca792cd31ca5405ae6604e209458f1eb60ee3b953eb66377cc079f1f634
Instruction Fuzzy Hash: BB110331D2120ACFE704DBA9D8157EDBBB6EFC6320F198222C110671E4D770659BC750

Uniqueness

Uniqueness Score: -1.00%

Function 05E42861 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32d1263538a960de557400aaa5698b58cf4109617a286f43f16bbbf199d3d0f
Instruction ID: b9627158281aecc66e3ef4d6aaac743dd9357aa845af64b791ef77eedce2e79b
Opcode Fuzzy Hash: a32d1263538a960de557400aaa5698b58cf4109617a286f43f16bbbf199d3d0f
Instruction Fuzzy Hash: 0A11C63AA04218DBEF14DA50A9196ED77B2AB8C300F1414BDE681BB790DA715840CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0121D76B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381297194.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: f93750fa304bdfdad1db39b2f9c06a62927f6e632de0c2c4093c17bf18cafb4e
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 7011DF72804244CFCB02CF54D9C4B16BFA2FB98324F24C5A9DD090B25BC336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0121D67F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381297194.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: b78749342bbc23feba5ecb0f0f9a421fb8a0d21ebe3a0aa5e5d21aca086a72e7
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 76110376404284CFDB16CF54D9C8B16BFB1FB94314F24C5A9D9490B25BC336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E4DE1F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df75733bf453d25ff2a385970cf8f6fbed41273af645c282e92ee3226a5283b
Instruction ID: 6bac3bb5a01c9b422c6febcc13f89d8a148836c8e8fbfe403d7cb24a4eba9ae2
Opcode Fuzzy Hash: 4df75733bf453d25ff2a385970cf8f6fbed41273af645c282e92ee3226a5283b
Instruction Fuzzy Hash: BF014536F453418FEB215F34AE2A3953B71EF21600F0CA8AFD8818F282DB358406CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0128FEC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dec3bcd3dc897536f46cca456abc7730b3cd237ec59ac46999edc28cfcc7a67
Instruction ID: acb6c10c8df86dfa859a29c97500af14b858501571e2678d4ee296a6e69649f9
Opcode Fuzzy Hash: 9dec3bcd3dc897536f46cca456abc7730b3cd237ec59ac46999edc28cfcc7a67
Instruction Fuzzy Hash: D801D8336152596FE754EAACE040BDABFF4EB55320F2880ABF684D72D1D631E990C790

Uniqueness

Uniqueness Score: -1.00%

Function 01287C13 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5768408f00b13e1a77fd920f8b550e8bed9fca5007726eea003de9644169d3
Instruction ID: 680f49931da49a83d678da2dc2bb7c56eca0e37076007e9402b2b4cfe7ce9879
Opcode Fuzzy Hash: 0b5768408f00b13e1a77fd920f8b550e8bed9fca5007726eea003de9644169d3
Instruction Fuzzy Hash: 4A11C434B21104CFDB28EFA8E499BACBB71FB54708F208065E506EB3D4C7719901CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0128EE68 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcc4575c8514b1ca6d37e46437cd6466f8195da684ed9c46ecb0f8b448c6501
Instruction ID: 585a13c6b3cb79f6fbecdf63b52a39ec5d01fe9bb5b2f07f5894f061ee20e9d3
Opcode Fuzzy Hash: edcc4575c8514b1ca6d37e46437cd6466f8195da684ed9c46ecb0f8b448c6501
Instruction Fuzzy Hash: 9A018436350315AFDB049E59EC84FAB7BA9EB89721F10802AFA04CB291CAB1D8108750

Uniqueness

Uniqueness Score: -1.00%

Function 0128539E Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1061a4bc3124488bf84bd6f0a2719d5b8bb36cf14cfa7aed4259765bc308cd75
Instruction ID: edc5f81031d9e9848a9df1981238449322c414acaa31af8c268cf7f474c653a0
Opcode Fuzzy Hash: 1061a4bc3124488bf84bd6f0a2719d5b8bb36cf14cfa7aed4259765bc308cd75
Instruction Fuzzy Hash: D8115731226B01DFE7319F25E8597667BF1EB44312F105C2AD48B86A92DBB8E884DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01288078 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c9825df1273975c8d3587106671f52cd0b56fcbf53c896271f12379e6f89f8
Instruction ID: 7c96d3309c236fae7d51b487aaf406b9e238cb9b1da4df7e60cf9f48b6bcb9ec
Opcode Fuzzy Hash: 11c9825df1273975c8d3587106671f52cd0b56fcbf53c896271f12379e6f89f8
Instruction Fuzzy Hash: B201A23073A500DFD214BA1A8802E23B3E6AF94711B90C066A607873E4DAF1AC078651

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D778 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f572319bff6328bf3f91be1491b031761c32d95de0a3c9a02aefe7b66930e979
Instruction ID: 7bcd173b7bba9d3509ba73559c9a359f8e6ec11b0ec28e084e1c0006a609f0d1
Opcode Fuzzy Hash: f572319bff6328bf3f91be1491b031761c32d95de0a3c9a02aefe7b66930e979
Instruction Fuzzy Hash: 1D01C0323006108FD725AA34E858B3B37A3EB85324F185668E1968B7D0CB75E802CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0128D318 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ef4f2f4fc6c0470e1a37089f67dff31507e14cb32b6525d7a51c6a66e8ee4c
Instruction ID: eca634542c75a071d322366f922e964f4b0c91ef0b9b54ccc50886059c2ba342
Opcode Fuzzy Hash: 68ef4f2f4fc6c0470e1a37089f67dff31507e14cb32b6525d7a51c6a66e8ee4c
Instruction Fuzzy Hash: FCF0443433F508DBC2187BDAA956E2677E6ABC9610B188066F10BC73E5DAE1DC098D53

Uniqueness

Uniqueness Score: -1.00%

Function 01284C21 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597c3f46e50132b3c174c2ca821d7631c4f2fdab2f134c99842f0472dd14e4ff
Instruction ID: e686e79bd399f71e51585df8c41507fa738ad5dc15395739a32cf3c585887063
Opcode Fuzzy Hash: 597c3f46e50132b3c174c2ca821d7631c4f2fdab2f134c99842f0472dd14e4ff
Instruction Fuzzy Hash: C911A330E1070ADBDB14EFA5D058799F7F1BF84310F208A19E559A7394DF749880CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0121D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381297194.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca08c5296d1391d05d65cd825eb534603ada3a49637a2c88257231e854cd4b42
Instruction ID: a3bf93f6103daa858f1f1663d63fd23df7cebc84ab172899c7998481ca85f1c2
Opcode Fuzzy Hash: ca08c5296d1391d05d65cd825eb534603ada3a49637a2c88257231e854cd4b42
Instruction Fuzzy Hash: 1701F731414308DAE720CA59C888B67BFD8EF953A4F18C42AEE484A28AC2799841C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E4DA11 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a556ec6b0b89935d3de79a91b80a126c75d5795c6d669c5bfc5707ce564352
Instruction ID: 1ee92b8456cfae1f5fb7f8a18df626b6631701ff40d88fa90b9a022b4da9d416
Opcode Fuzzy Hash: 78a556ec6b0b89935d3de79a91b80a126c75d5795c6d669c5bfc5707ce564352
Instruction Fuzzy Hash: C3015A31B405008FD704DB28D999B2973E6AF85B15F2980A9F646CF3A0DA71EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01288068 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521690e81a5e0807bb6d7c0636b2f81b341cc3b3b7b7e2e3e67d3c7c43d78e0e
Instruction ID: ac25f41fea94b2862f90364889d2dd51a72f5d47ca2689ce63400c01b550223b
Opcode Fuzzy Hash: 521690e81a5e0807bb6d7c0636b2f81b341cc3b3b7b7e2e3e67d3c7c43d78e0e
Instruction Fuzzy Hash: 57F0283027A600DFD300AA698802A6277E6EFA42117908076D307CB3D5E6E19C078611

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D788 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0d62a2bfb566eaa87413978eb1b68f191acc88a451a34d929c75cb4bc6284b
Instruction ID: b83c9e436ce103e8961e0561003c4aa092f0f9942ec639f34b6054f940d576a7
Opcode Fuzzy Hash: 9e0d62a2bfb566eaa87413978eb1b68f191acc88a451a34d929c75cb4bc6284b
Instruction Fuzzy Hash: 54019A353006008FDB25AA34E948A3B37A7FBC8324F149628E5964B790CB75EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01289986 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1ecafa266b2069d74b55f14b5dca9907db35d46f604fbab438d7857c9e98ea
Instruction ID: 69b8a545798c077c3f1f708a9c1c73eb7af0e331132e0bb7fa875e4032336917
Opcode Fuzzy Hash: 3b1ecafa266b2069d74b55f14b5dca9907db35d46f604fbab438d7857c9e98ea
Instruction Fuzzy Hash: 5801D330A1500AAFDF15DA98ED85EAEB7B9FF80308F108522E914A7295D770D995CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05E40188 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4375baef3bd7fa0f534f632a8e458368158fd68c3650e3538cdc54c09d44c8c
Instruction ID: f7bffa039a5c267fa531f223355f47ff4354c4755313963fc96f9871217638f2
Opcode Fuzzy Hash: a4375baef3bd7fa0f534f632a8e458368158fd68c3650e3538cdc54c09d44c8c
Instruction Fuzzy Hash: 7EF0AF303101105BD7149A19D894B66B7DAFBC8614B208079E609CB365CA35DC018790

Uniqueness

Uniqueness Score: -1.00%

Function 01282200 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccaeaac115ae7671c673b3121bf94da711fa8113e298f36b937932589e101f03
Instruction ID: a765885ffeeba0de9e480e6c2d6f85ba173625d186d16aa8a7774274d8b98e97
Opcode Fuzzy Hash: ccaeaac115ae7671c673b3121bf94da711fa8113e298f36b937932589e101f03
Instruction Fuzzy Hash: 34F0C272A102499BDB15AB70C4696EFBBB6DF84310F05482AD042AF280DE705A0BC7C2

Uniqueness

Uniqueness Score: -1.00%

Function 01281939 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b441961d0abc84453715d1177f7384ab22786d0ccb088194b9c16f82e7f708
Instruction ID: 799d76130af3ac9fc9f39cbc7a503c347c6cc8065596e7cb2257492e5e1d3f1b
Opcode Fuzzy Hash: 29b441961d0abc84453715d1177f7384ab22786d0ccb088194b9c16f82e7f708
Instruction Fuzzy Hash: D9F0C872D1034A9FDB15DB64C4655EFBBB59F84314F54443AD002AB280EE74690786D2

Uniqueness

Uniqueness Score: -1.00%

Function 01282B28 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7845db9fb5a15398c5ece11752355c5c24fc4dbad1976be453708dabd7056761
Instruction ID: 59804fd60847f381e7d873ed13d7d40da61274b1040fe829158d25b7460221b2
Opcode Fuzzy Hash: 7845db9fb5a15398c5ece11752355c5c24fc4dbad1976be453708dabd7056761
Instruction Fuzzy Hash: D0F0A432E21509DBDB25DB64C455AEFFBF6AF84310F05882AC102A7250EEB4590AC681

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B680 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f434adcda4f48f24668477cc25f88b82c84bb5abbe68f7a746c2371f1b87853b
Instruction ID: 557d2e6e48841bcdc13a3d96834bd22b3d94cdd27dc356b501895804f3e74867
Opcode Fuzzy Hash: f434adcda4f48f24668477cc25f88b82c84bb5abbe68f7a746c2371f1b87853b
Instruction Fuzzy Hash: 4E018F343056159FC3099F24E519A1ABBA2FF8C725F108169F94A8B390CF35DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B690 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9173e44a7acc644251821a8ae49a54e44e90834b7f88faebb34017874d388f48
Instruction ID: cf1027a4c0f21df450bfdb781e80ebb3b2ce542082645104d6b49be7bdd8a79c
Opcode Fuzzy Hash: 9173e44a7acc644251821a8ae49a54e44e90834b7f88faebb34017874d388f48
Instruction Fuzzy Hash: FD018C353016149FC308AB29E41991ABBA3EFCC725B108169F94A8B390DF75EC42CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 01287D0B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4986d4c97ce76b4cbb16922c272c489743dd435f5087a1e84f4c194c92d96ecb
Instruction ID: 2bf410b19b704c994880be7b8766cdbca85114d3c49e664ac6f137ab1f52e06f
Opcode Fuzzy Hash: 4986d4c97ce76b4cbb16922c272c489743dd435f5087a1e84f4c194c92d96ecb
Instruction Fuzzy Hash: 28016239F11048CFDB18EFA8E499BACBB71FB54315F208166E506EB394C7319902CB41

Uniqueness

Uniqueness Score: -1.00%

Function 05E4806F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b16130f14655bed8dce596d07d14b81ffb22e2bde7d012bdb583be5f33824a6
Instruction ID: 9f9873534433cae0b18ea34eea1d7784d192121a227575dd8bbf81518d0099c8
Opcode Fuzzy Hash: 3b16130f14655bed8dce596d07d14b81ffb22e2bde7d012bdb583be5f33824a6
Instruction Fuzzy Hash: 2BF024367101086BDB289A19E8449BAF7AAFB84220F04402AFE0AD7360DE309C06CA90

Uniqueness

Uniqueness Score: -1.00%

Function 01281D48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6dca7a508bf6d14328bbe5c9451ae7c21c90d101dc39a8a04a4e54b617c229e
Instruction ID: 507cc5faff3d5c83353e663a8a852cbaefa2c5d680ca21b8e169d3a45b757c35
Opcode Fuzzy Hash: c6dca7a508bf6d14328bbe5c9451ae7c21c90d101dc39a8a04a4e54b617c229e
Instruction Fuzzy Hash: 4CF0C23292024A97CF15EA70C455AEEFFA65F44710F04852AD002A7280DEB1660BC7C1

Uniqueness

Uniqueness Score: -1.00%

Function 01285BB8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a413828fe568d748bc02b1d0ba8f6fa99553f6d8ed26a4bc56a8432ee0efd3c8
Instruction ID: 2ea2ffacf66dddcf3e027212672d348abd92dd6d7304d49cbc5281aa16431ec4
Opcode Fuzzy Hash: a413828fe568d748bc02b1d0ba8f6fa99553f6d8ed26a4bc56a8432ee0efd3c8
Instruction Fuzzy Hash: D401DC3161E3C9CFC3139B689454089BFB1AF93311B2941EAE091CB2A7D2289C46C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0128E298 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934c8a2092340ae31f43ce97d367b003b149e3baf654ed39ff34f0506d99bbe1
Instruction ID: 1ffbce957e3e8169b38ba5a6925951db94c99a920003d630cb1c0c9770a809b7
Opcode Fuzzy Hash: 934c8a2092340ae31f43ce97d367b003b149e3baf654ed39ff34f0506d99bbe1
Instruction Fuzzy Hash: 8BF05932B092156FE3145A599810B6BFBA9EBC8310F004029EA099B3D8CAB1AC40C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B408 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b70e191308600912af314ca280cac3bade35e31e263544fe87f6574cc0eef9
Instruction ID: 3980f3ac041788cba9f24da59766f13c92aa8044121d3a8b49ae1b88180c6227
Opcode Fuzzy Hash: e1b70e191308600912af314ca280cac3bade35e31e263544fe87f6574cc0eef9
Instruction Fuzzy Hash: 89F06D39311204AFC7149F16D858E3A7BAAEF89720F048069F9968B371CB31EC02DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4063F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbd4f8a97664fb5c49b8d39303979e622d037ba0e92ae4472dcd0117f069431
Instruction ID: bcedaef6dbaef055c6dad3aeff01abf76ea6b96992d51c5dfc8b173f3d31ede4
Opcode Fuzzy Hash: 4dbd4f8a97664fb5c49b8d39303979e622d037ba0e92ae4472dcd0117f069431
Instruction Fuzzy Hash: 22F0F6329082189FCB0ACB5AA45C2CC7FB7EB81614F0490F9D187DB691EF700A45CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0121D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381297194.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_121d000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8dceb389aec3cb1edf55689adf2542f202deadba608683dfd4d61fce4ad44c6
Instruction ID: 1b7e033d2fb96d1943d0acc1bf2de95e59e62a202fc34dd0ecfe4dc48f3b86d6
Opcode Fuzzy Hash: b8dceb389aec3cb1edf55689adf2542f202deadba608683dfd4d61fce4ad44c6
Instruction Fuzzy Hash: 9EF0C271404344EEE7118A1AC8C8B62FFD8EF92364F18C45AEE484E28AC2799840CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 012881A9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04392e72b005c479878140a38e274cfd325d4aa7230e45fb8e8c2d83a48fe0f
Instruction ID: 12ffc586f1529e3ad0aa467327a8d2bfe3586c1ab5869f2b576dd0794e7f4bcb
Opcode Fuzzy Hash: d04392e72b005c479878140a38e274cfd325d4aa7230e45fb8e8c2d83a48fe0f
Instruction Fuzzy Hash: 2FF0C270110702AFC354EF68E440989BBEAFF963307548769C0944F6A9DB75A94EC7E0

Uniqueness

Uniqueness Score: -1.00%

Function 05E4DE68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a745d241253406c793e971127e2f86d460c707ac873059c95501f090b7d9b3
Instruction ID: 33ed26dbbf9fffda9aaed5a6b9da501b46560b74c0a9da170bf1b51cba5ad680
Opcode Fuzzy Hash: a7a745d241253406c793e971127e2f86d460c707ac873059c95501f090b7d9b3
Instruction Fuzzy Hash: 99F02731B043158FDB2466357D0DB663396AF81141F14A479E5458B3C0EE71D800CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01281948 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c14248229d8b0983155b6ad636a0d2e01e7ad60ae9ae0767a25f954ae41e04e
Instruction ID: 93ec551c2906354066289049adebcae4c4b2d8045a7610045e8c44424327ec4f
Opcode Fuzzy Hash: 1c14248229d8b0983155b6ad636a0d2e01e7ad60ae9ae0767a25f954ae41e04e
Instruction Fuzzy Hash: 26F08232E202099BDF15EB64C5599EFBBBA9F84300F55852AD412B7280DEB4690B86D2

Uniqueness

Uniqueness Score: -1.00%

Function 012895A2 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5c34da4db8f3373422eab6007f43df4b272f8047e23f4b93139217a408c463
Instruction ID: 1d2580a86b5392b5b4af845e45637183e38afb088a712492ecf7e875027a52ba
Opcode Fuzzy Hash: ef5c34da4db8f3373422eab6007f43df4b272f8047e23f4b93139217a408c463
Instruction Fuzzy Hash: 15F0BE312252019BCB28EF68B49687EBBA9FED0228304143EE10B875A5CBA44C49C770

Uniqueness

Uniqueness Score: -1.00%

Function 01285B6D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d3c1a6d1ecaee8bea232ab836aac55b26b34b23fb3800b2ff59a753e33fb15
Instruction ID: 1da180c6785d4c2bae836fc86fe2356c3e0183275b70c8864f932bc1f7a56c21
Opcode Fuzzy Hash: 45d3c1a6d1ecaee8bea232ab836aac55b26b34b23fb3800b2ff59a753e33fb15
Instruction Fuzzy Hash: AEF0C23161D3C5DFC7139B68D458499BFB1AF57310B1941EAD481CB297C6389C42C765

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B418 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8685b653004af2cbff1a92a390f2896b9b2cabca61754c2f29584c0bdda453af
Instruction ID: a79d05f0578fe0fe0b941d74280fecc2312119069d5c5a5a1ec1dd2c2c93e3ed
Opcode Fuzzy Hash: 8685b653004af2cbff1a92a390f2896b9b2cabca61754c2f29584c0bdda453af
Instruction Fuzzy Hash: 5AF05E363146049FC314DF1AD858D3A7BAAEFC8721B144069F9868B770CA31EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4F3A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759b2ef599e18397e25817cac3a03f0c1451262abb3669b0cf8bf88cda290b70
Instruction ID: 4e5f7ee85a6dbebb7a140344531d7febecb87bb3b38753224d58946eca62b510
Opcode Fuzzy Hash: 759b2ef599e18397e25817cac3a03f0c1451262abb3669b0cf8bf88cda290b70
Instruction Fuzzy Hash: 41F06DB540A3C4EFC7029B20A8557467F31AB12608F58849FE4808B262C7365416EB55

Uniqueness

Uniqueness Score: -1.00%

Function 05E474C7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f08bd5a59ab762966391458a579de16475188bc575eacb6e1022c4ed1ba8de2
Instruction ID: 65f7e22dc16d5d07c706e6d6900aed0254450728e3c5c5342bd626df8245a1a4
Opcode Fuzzy Hash: 8f08bd5a59ab762966391458a579de16475188bc575eacb6e1022c4ed1ba8de2
Instruction Fuzzy Hash: D5F027326042058BC7008A1AF989D4ABF9EDFD0325F108939F04A87225DE74D80AC7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0128D150 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f582271f42c960ff3c9ba5f2c7521da8e113ca8a3777dfe635bf800a1773a232
Instruction ID: c58dc50471f9a9a769a9586bbdc9784a859dda23e9436d0562a56ec3512d0c5b
Opcode Fuzzy Hash: f582271f42c960ff3c9ba5f2c7521da8e113ca8a3777dfe635bf800a1773a232
Instruction Fuzzy Hash: 7FE0927497F10CEB8754FEE4A90343A73B89E01251B004596E80BC31C4EAB29A0CC392

Uniqueness

Uniqueness Score: -1.00%

Function 01284F96 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1433f4ca0bee412cca7ad6525826a1aed5c3c8fd1319da80cae8582c0b0172ae
Instruction ID: b3ed68952e895f8e31ca1f7b9d4298d0cd7dbf79b4430d2e9fa270c9c1bf90db
Opcode Fuzzy Hash: 1433f4ca0bee412cca7ad6525826a1aed5c3c8fd1319da80cae8582c0b0172ae
Instruction Fuzzy Hash: E6F0E9312006115BC214EF54E940A9EBBDBFFD4320F008A28D1494B65DCF74D90DC790

Uniqueness

Uniqueness Score: -1.00%

Function 012895A8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f2f44d7289125f61e284794129cf2f1ce6faa67f89bd9baab354a52a94f4f8
Instruction ID: 9368d6a406af2ed56e30e6ed44de187be675f26a717186d619da5547085f5703
Opcode Fuzzy Hash: 46f2f44d7289125f61e284794129cf2f1ce6faa67f89bd9baab354a52a94f4f8
Instruction Fuzzy Hash: 24E0D831329200ABC928BA69B88683F7BDEFAD02793441539E10B83595DFA49C08C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 01289622 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6fb6b0f9c2033ca5631dbe0197c6830b0669f9f2b0e93dca4213ae71eaf6f8
Instruction ID: faf972685c7776e70e4e946c17a08e615d6851ec3d05606a0d7dc387d37a9845
Opcode Fuzzy Hash: 6d6fb6b0f9c2033ca5631dbe0197c6830b0669f9f2b0e93dca4213ae71eaf6f8
Instruction Fuzzy Hash: C2E0D8313251019BCD28BA68B48647D7795FAD012D3001535D10786499DFA89D498360

Uniqueness

Uniqueness Score: -1.00%

Function 05E40650 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93770e22987c8219f7e24515c4c6cf5d8534bf02b819db6d374d8d2b58644c94
Instruction ID: a9a328295ea6b175c51f00911dde8c5f7571ce5b47061a919f6582540fb5c10f
Opcode Fuzzy Hash: 93770e22987c8219f7e24515c4c6cf5d8534bf02b819db6d374d8d2b58644c94
Instruction Fuzzy Hash: BBF037319082189FDB09CB5AD04C6DD7FF6EB84214F048099D04797250DB701A81CB84

Uniqueness

Uniqueness Score: -1.00%

Function 01283DD5 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43b7cc8ec3bdb72eb8ccd6f8219469245ec0d15245cc2d83265d0d857c058e1
Instruction ID: 6897018b99b699d3d8a1c71044c80c56d8e5f9c4ea7f376e19db2389f1bb1295
Opcode Fuzzy Hash: c43b7cc8ec3bdb72eb8ccd6f8219469245ec0d15245cc2d83265d0d857c058e1
Instruction Fuzzy Hash: 3DF01C70D2521EDFCB08FFA9D4954ACBBF5FF24A40B100525E412AB3A8DBB19802CF14

Uniqueness

Uniqueness Score: -1.00%

Function 05E474D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9afda8e265b852ca552ac16f5c04d8c79f413f4a85ee6f6990d515a7b5a7a2
Instruction ID: 60bc4eff2e399a341aa0cb491ab3edeee8c37412b7305512e111bb82235def5a
Opcode Fuzzy Hash: 2f9afda8e265b852ca552ac16f5c04d8c79f413f4a85ee6f6990d515a7b5a7a2
Instruction Fuzzy Hash: 74E012312042095BC7149A1BF884C4BFF9EDFC0364710C93AB14A87225DE74ED49C690

Uniqueness

Uniqueness Score: -1.00%

Function 05E48F3B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e556cb062196406d786487cbcba34be0957d0df4ffb50d786f0123dc1527a7d4
Instruction ID: 046a33d79fa48c632dba3e86f8ad9c244dd20fecc20e41adbff53a32cf3efce4
Opcode Fuzzy Hash: e556cb062196406d786487cbcba34be0957d0df4ffb50d786f0123dc1527a7d4
Instruction Fuzzy Hash: 97E0CD313085694FDB25D61AF9027E637D7DF85A14F106679E0C7D7B05D610CC024BC0

Uniqueness

Uniqueness Score: -1.00%

Function 01283538 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dee748f1d5a3af55b84ea5165e676b4203709e99c8346e22d72c555f49a0f50
Instruction ID: 32a13d7512e7073a8ac02d3aaf90b5e74f847ee41be281efce3753f849641ca1
Opcode Fuzzy Hash: 2dee748f1d5a3af55b84ea5165e676b4203709e99c8346e22d72c555f49a0f50
Instruction Fuzzy Hash: 91E08C3103E780EFC3316F68B41E0AC3F70BE06B1530518D1E082C94A6EBACAD418B62

Uniqueness

Uniqueness Score: -1.00%

Function 01287211 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaec567f03b508418c54d968d67af7a874b09f195ba77922860f721c1b955118
Instruction ID: 637e7bce11585a74e7ad896a8ae9748474d7b76bff109d3aa94f8b4105667028
Opcode Fuzzy Hash: eaec567f03b508418c54d968d67af7a874b09f195ba77922860f721c1b955118
Instruction Fuzzy Hash: 5BE0C27007E741DBC3223A6470260B4FFB0A96330432A04C6F0C68E4DED2A2AD41C792

Uniqueness

Uniqueness Score: -1.00%

Function 05E42820 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0961c745f8a2e69afc76bd1fd84b0d1847138a9a5610353cf20b9cd0bdd56045
Instruction ID: aa7975147b3e0b29201bb7475bfcced0dbe2794e1f602def48056adccf9b80e0
Opcode Fuzzy Hash: 0961c745f8a2e69afc76bd1fd84b0d1847138a9a5610353cf20b9cd0bdd56045
Instruction Fuzzy Hash: 23D02B357403189BDF2066706805B69339DAF09755F1428AAF7455F2C0E5B1E8C1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0128D980 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b81f10d387e574a06944a75e952cbd7ce8f60f4a7c65da0109aa3f7d57a16c
Instruction ID: 3c6eb39be31476bc0ca185f07335ad3f267ad97ed9d1df1cfd0437ce9b93dc4e
Opcode Fuzzy Hash: 27b81f10d387e574a06944a75e952cbd7ce8f60f4a7c65da0109aa3f7d57a16c
Instruction Fuzzy Hash: DEE01270A0020DEFDB08DFB5EA56AAD7BFAEB85215F5045ACD5089B244DE315F04D780

Uniqueness

Uniqueness Score: -1.00%

Function 0128D938 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a25c194e685dd3dad9c48583f617788cb681dbd729ca88fc2953b6a159cec87
Instruction ID: ad16d2fe8132b2126dd9e786da303c5f1a03dbda1b3a9ea0b3763031d59155f5
Opcode Fuzzy Hash: 9a25c194e685dd3dad9c48583f617788cb681dbd729ca88fc2953b6a159cec87
Instruction Fuzzy Hash: 9AE0C230A0020CEFCB04DFE4E501A5D7BF9EB44210F1040A8D409D3304DA315F00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01285DD9 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a064f67560ea0d0b5d0ab4c5424ac2e1d73d8a7efe2dafed921232b3425a36ec
Instruction ID: dac1671d2d1d36a4f8489ff86bc6abad183977abea051b057db91e7edf0d5b8c
Opcode Fuzzy Hash: a064f67560ea0d0b5d0ab4c5424ac2e1d73d8a7efe2dafed921232b3425a36ec
Instruction Fuzzy Hash: 61D0A51173E1555BCB037B5478040FD7BB3FFD12227040197C0518519ED934480643D5

Uniqueness

Uniqueness Score: -1.00%

Function 01280879 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe73609dd760a7bb11efbe759113c80ee083c21e174e2ea1717589973bb9df49
Instruction ID: 6da8187a9ee2bdb6300cf2d8829451787a800b4ae381675cc3004ca5080b40a1
Opcode Fuzzy Hash: fe73609dd760a7bb11efbe759113c80ee083c21e174e2ea1717589973bb9df49
Instruction Fuzzy Hash: E1D0A7311797D41FC3031770981D1AD3F68AF4630430509F7D085CF177E65548858785

Uniqueness

Uniqueness Score: -1.00%

Function 01284F88 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67003e525af5383c173de614ef87eea230c13124cb401ba9e9df94c35272098e
Instruction ID: d31f407645a099adc6f2460d3109fb41df07d873dffd32c1086064a8cbd29fce
Opcode Fuzzy Hash: 67003e525af5383c173de614ef87eea230c13124cb401ba9e9df94c35272098e
Instruction Fuzzy Hash: B9D0523261E3C20FD7431B2868A46807F609B13230B4A08DAC0808E0ABE18C08878322

Uniqueness

Uniqueness Score: -1.00%

Function 05E46E83 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642d396d2c3b5f384b113948b5950559729e3a65761e2dadfe4c891a53465e51
Instruction ID: d315a6c401aaba49cba9661bec9dd92aca4017abfbcea2eabba866158f7af7d3
Opcode Fuzzy Hash: 642d396d2c3b5f384b113948b5950559729e3a65761e2dadfe4c891a53465e51
Instruction Fuzzy Hash: E3D0A9313086128B8B14867EF905A6723DA9BC42083008025A089C3318EE60EE0A8780

Uniqueness

Uniqueness Score: -1.00%

Function 01281212 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659cb9a45559162edc18aaa420653f3615f9447c8f101cc4ce3e0df046711554
Instruction ID: d14d4c552832b22046e0caa3109a2613f4ddb2e4288c64950b53073c1bec8acb
Opcode Fuzzy Hash: 659cb9a45559162edc18aaa420653f3615f9447c8f101cc4ce3e0df046711554
Instruction Fuzzy Hash: D4D0A731916574CFFB295F10D8542983764EF12762B4A04ADCA9B630C2C3149E07C612

Uniqueness

Uniqueness Score: -1.00%

Function 012808B0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72bb73193bafde496a6cb4dd6363be46519c5be7889dd7ceb86bc9301e8f0af
Instruction ID: e49210d67629f3dc02c92cf3807d36c25a240f1813a9d56ded73e56ec1316d13
Opcode Fuzzy Hash: b72bb73193bafde496a6cb4dd6363be46519c5be7889dd7ceb86bc9301e8f0af
Instruction Fuzzy Hash: 2ED01230158BC84FC3530B7454292D87FA4ED4722438608DAD1C48A427D1955C82C756

Uniqueness

Uniqueness Score: -1.00%

Function 012894E8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d5d5066b9127a2fec4a7b11813561d01754a8a21a28c4aba938165af6853a9
Instruction ID: 196bf3895680659618376ae8359c76925ee5f7a98ee07314da6b268d9d4a48d3
Opcode Fuzzy Hash: b4d5d5066b9127a2fec4a7b11813561d01754a8a21a28c4aba938165af6853a9
Instruction Fuzzy Hash: FCD05E3981C38A9BCB23DF28FC14598BF24E9822507540796D254474AEC3645A1ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B3E1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3647b209004dfc0f1cb5592e4734cd396a2072a3826523a1a9f06d64b056b0cf
Instruction ID: 4535ee82adb0b38d8cff8d2c1e0b90a17ee06320a0f3c59cd7c2ed7f525a5d7e
Opcode Fuzzy Hash: 3647b209004dfc0f1cb5592e4734cd396a2072a3826523a1a9f06d64b056b0cf
Instruction Fuzzy Hash: 3CD0C9BA094248AFCB44DF19E88AE827FB8EF16720F518595F5458B133CB26D824DE44

Uniqueness

Uniqueness Score: -1.00%

Function 05E4D2F8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36feffcd635e1a67f1e7459851427b9d17c3e95f031d03fd1d2e893dc0c4a5b0
Instruction ID: 9e50a48aa59ce53205ed5951381e478ad17b6a3b1840736e735296fd0ab68827
Opcode Fuzzy Hash: 36feffcd635e1a67f1e7459851427b9d17c3e95f031d03fd1d2e893dc0c4a5b0
Instruction Fuzzy Hash: 73D052B9090248ABC704CF1CEA81F823BA4AF01610F908295F9800B222C322A824CE84

Uniqueness

Uniqueness Score: -1.00%

Function 01283548 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87498909ccf708abc94b3ed6ba5ecb1b263e5dc997cbb21d176ea8efdd64e4ac
Instruction ID: 35ea67e8047bea1b972e64002a7df5faf863692615213cb79126e047f8b21bf7
Opcode Fuzzy Hash: 87498909ccf708abc94b3ed6ba5ecb1b263e5dc997cbb21d176ea8efdd64e4ac
Instruction Fuzzy Hash: 35C0123203E008EFC634BF6CB00F02C3B78BA18B023402440F20B80488ABBCA8008B22

Uniqueness

Uniqueness Score: -1.00%

Function 01285DF0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb214c70af09661ab11d689c598307485c05f4719d51559906025b5799bcc96
Instruction ID: f0d828b5e89ac02733a08947cbba4a96f022cbe910d574ba71392a9e5468cfa9
Opcode Fuzzy Hash: deb214c70af09661ab11d689c598307485c05f4719d51559906025b5799bcc96
Instruction Fuzzy Hash: B6C0121292F2C09DCB03B66478020E87F716C021A530800D3D091894DAD164080A83A5

Uniqueness

Uniqueness Score: -1.00%

Function 01288439 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03b401928da60a5be71c52452c6c725be3b1f146c7b7d6519518f22a8fa71db
Instruction ID: c164428cb931948b8687635aa39cfc69fc911b52a1a51bd357746b51772ff28c
Opcode Fuzzy Hash: d03b401928da60a5be71c52452c6c725be3b1f146c7b7d6519518f22a8fa71db
Instruction Fuzzy Hash: 52D0121122F3808FD3430A740C512923AF4AF02110B4E019B9881D65D7D74C8944C332

Uniqueness

Uniqueness Score: -1.00%

Function 01289738 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55e0accdedb012009800f2e696fb60bb4d7748fe0aba7268f86a717ad6a9c05
Instruction ID: 8afb1df80294db231d38c6198be56eec6e20c8e24a1c6ae96ba17807f1dcdbfb
Opcode Fuzzy Hash: f55e0accdedb012009800f2e696fb60bb4d7748fe0aba7268f86a717ad6a9c05
Instruction Fuzzy Hash: 45C08036B040199BCF304B90FC09BDDF774FB48225F104052E5196114083325511CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01287220 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7cc10e140468b8e62ef5e1cb20dc4546e752c960d182250dbd815c2d72b9754
Instruction ID: 72b1e0ff4ba3a555e4b9f4be18a59e3bef2d2c467c5f1ac98737b5450116ae22
Opcode Fuzzy Hash: d7cc10e140468b8e62ef5e1cb20dc4546e752c960d182250dbd815c2d72b9754
Instruction Fuzzy Hash: E0C02B3083F009C30014BA94B00B474F3B871703007358281F00F061CC5AE0E940CA82

Uniqueness

Uniqueness Score: -1.00%

Function 01280888 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779687e797a21f1a3afe8c7b5268da4bf4714dbe0ffcb5fa2d634e831f72c544
Instruction ID: 0567cde251283a6161bbd99cf7a4edacb34c36acd07634ec459731ba2b50f7ad
Opcode Fuzzy Hash: 779687e797a21f1a3afe8c7b5268da4bf4714dbe0ffcb5fa2d634e831f72c544
Instruction Fuzzy Hash: 85C02B301053641FC3022730A80C46F77EC4B4400030005B2D40ACF129ED9158004B80

Uniqueness

Uniqueness Score: -1.00%

Function 012808D0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937ebca3d02ddcb91365072de89a86a3361fd5856704a9a3cc4792928614c91a
Instruction ID: a19a5c0b147aa3c2e550bdef430722dab3c9a82ab1dae1c48ec11d1b769a3780
Opcode Fuzzy Hash: 937ebca3d02ddcb91365072de89a86a3361fd5856704a9a3cc4792928614c91a
Instruction Fuzzy Hash: 1BC04C2450A7905FC35647244C70DD93A75EE8261839B48C6D0C4EF572D5988D848665

Uniqueness

Uniqueness Score: -1.00%

Function 01283250 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0d8da222d7a1e42d6e273f4e9b50ed6b5a28549ad7fe004e7c8d1547a4fbb4
Instruction ID: cf58089fe9f478910655adedf262ba4e4eb926e24978a48079b48bb315d27f1d
Opcode Fuzzy Hash: 0d0d8da222d7a1e42d6e273f4e9b50ed6b5a28549ad7fe004e7c8d1547a4fbb4
Instruction Fuzzy Hash: E3C0027449D7C26FD703573584260887F75AE4321839A89DAE0D08A462C21E1859C762

Uniqueness

Uniqueness Score: -1.00%

Function 012897EA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55b250d765371bea6e54ea2e868657a332886572316c14444bc2b287d94f409
Instruction ID: 0b573420a1d065464e47d2d3752a3722bc39caebee50d032542aa3912dc6d68e
Opcode Fuzzy Hash: c55b250d765371bea6e54ea2e868657a332886572316c14444bc2b287d94f409
Instruction Fuzzy Hash: FCC08CB183A10BCE8B00EA90C0810BA7A62BBA02003204106C00212288C5300E018B22

Uniqueness

Uniqueness Score: -1.00%

Function 05E4B3F0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Uniqueness

Uniqueness Score: -1.00%

Function 05E4F3C8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c84333ed4c093792dbff95c12dd5ce96631f1eeb1315c8f2059a959a651e90
Instruction ID: 7a73dd92ff537b6b27472e67513cb80708eabc501f19774b82021a7462cc71fc
Opcode Fuzzy Hash: 77c84333ed4c093792dbff95c12dd5ce96631f1eeb1315c8f2059a959a651e90
Instruction Fuzzy Hash: 59B0123200020CEBC7009F94F90CC55BF6DEB58B00740C025F64906511CB33F822EBE8

Uniqueness

Uniqueness Score: -1.00%

Function 012808C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfcba20100fd9d9a818fb322cafb8daf00076f32af3f7051472ca16619c8bf7e
Instruction ID: 21183f5331e423d67c5dfe338ef26feb0789876fcf38d201314052a69cf2cb46
Opcode Fuzzy Hash: dfcba20100fd9d9a818fb322cafb8daf00076f32af3f7051472ca16619c8bf7e
Instruction Fuzzy Hash: 2C900235044A0C9B65602BA5740D5DDB79C95486157809051E61D425069AE6A4504696

Uniqueness

Uniqueness Score: -1.00%

Function 012875F2 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd60ed6eaee5dd445139d640c9257c1485e4687eb93bd2c8b01459a82fbbe31
Instruction ID: 8726b6045b12fc0cffab75641378faf6739adbd7419df546d4e8a6012263484a
Opcode Fuzzy Hash: 2dd60ed6eaee5dd445139d640c9257c1485e4687eb93bd2c8b01459a82fbbe31
Instruction Fuzzy Hash: EDA02430437101DFC3307FD0700F05C7570D70C1103700C00C40350540D1710510C730

Uniqueness

Uniqueness Score: -1.00%

Function 01284772 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2381491527.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1280000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0638faedb1f2fa4ea9e53ea2b0c380ce7e64db9ad8742baddd6206cc2945cd6a
Instruction ID: 8ad8f552c64b7ed854364763f5a6540b5e5e2debc20c067c91dd3c425682c310
Opcode Fuzzy Hash: 0638faedb1f2fa4ea9e53ea2b0c380ce7e64db9ad8742baddd6206cc2945cd6a
Instruction Fuzzy Hash: 22A02238820223ABA3303B30300C02830C30388280308C832CC838220CCEB088008208

Uniqueness

Uniqueness Score: -1.00%

Function 05E48F2B Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea3d800038b8ad2e2d091f72e0c486ed277868c231b6d89b3d7313504c197ac
Instruction ID: a028535dbb9dac81c642bfcc08c4ddc0e671a63b5315fda19d79cf80387fa14e
Opcode Fuzzy Hash: 5ea3d800038b8ad2e2d091f72e0c486ed277868c231b6d89b3d7313504c197ac
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E41D58 Relevance: 2.8, Strings: 2, Instructions: 334COMMON

Download Yara Rule

Strings

,aq, xrefs: 05E41E4E
(aq, xrefs: 05E420FC

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$,aq
API String ID: 0-1929014441
Opcode ID: 778b51a0b5bb1789e1561ae046a6f103a3714f3e2b3dd3c5a8e906ed125bc4a0
Instruction ID: 91fe451e57cc1765e2f398c07936ae07d7cabe8df031946bedf2a5a3c3971368
Opcode Fuzzy Hash: 778b51a0b5bb1789e1561ae046a6f103a3714f3e2b3dd3c5a8e906ed125bc4a0
Instruction Fuzzy Hash: 97D13A34A00205CFDB14CF69D584AAABBF2BF88314F15D4A9E9469B365D731EC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E47AB0 Relevance: 7.9, Strings: 6, Instructions: 406COMMON

Download Yara Rule

Strings

4']q, xrefs: 05E47B34
4']q, xrefs: 05E47B64
4']q, xrefs: 05E47B82
paq, xrefs: 05E47C07
4']q, xrefs: 05E47BFA
(aq, xrefs: 05E47C7A

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (aq$4']q$4']q$4']q$4']q$paq
API String ID: 0-463314800
Opcode ID: b5618e4d955ebf7ed411a4ca18b0c09e7c9fef9d246ebf1c1b89ffad855da7db
Instruction ID: 50c2ea03590f2a635be31176e444760311b21498193769ca59d5912389b56c58
Opcode Fuzzy Hash: b5618e4d955ebf7ed411a4ca18b0c09e7c9fef9d246ebf1c1b89ffad855da7db
Instruction Fuzzy Hash: CAD16E32A00214DFCB19CF64D944E99BBB7FF88310B054498E6496B276D731ED56DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4E3E9 Relevance: 5.2, Strings: 4, Instructions: 169COMMON

Download Yara Rule

Strings

(_]q, xrefs: 05E4EA9D
(_]q, xrefs: 05E4EA93
(_]q, xrefs: 05E4EAE3
(_]q, xrefs: 05E4EB19

Memory Dump Source

Source File: 00000000.00000002.2385384045.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e40000_Wzphku.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q
API String ID: 0-2651352888
Opcode ID: d7f1dd92b23f490a8143440066f3f665d2e1b79238842f2f1c9c2528944a9915
Instruction ID: 28973df328dfe4378f0c6425cfb16d927d92c1462f108b89750500ac5a4ed088
Opcode Fuzzy Hash: d7f1dd92b23f490a8143440066f3f665d2e1b79238842f2f1c9c2528944a9915
Instruction Fuzzy Hash: 7351CD75B002058FDB04EF78D49596E7BB6FF89304B5445A9E486EB3A1EB31EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wzphku.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wzphku.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
Wzphku.exe

Function 05F60638 Relevance: 3.3, Strings: 2, Instructions: 818
COMMON

Function 05E44328 Relevance: 3.1, Strings: 2, Instructions: 557
COMMON

Function 0128ABD8 Relevance: 5.1, Strings: 4, Instructions: 138
COMMON

Function 05E467F8 Relevance: 4.2, Strings: 3, Instructions: 481
COMMON

Function 05E484A8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Function 05E4CA80 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Function 012879B3 Relevance: 3.9, Strings: 3, Instructions: 179
COMMON

Function 05E45EA8 Relevance: 2.8, Strings: 2, Instructions: 347
COMMON

Function 05E40318 Relevance: 2.7, Strings: 2, Instructions: 209
COMMON

Function 05E42628 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON